* [PATCH 6.12 0000/1376] 6.12.110-rc1 review
@ 2026-09-12 6:40 Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0001/1376] net: skbuff: dont skb_tx_error() the source skb in skb_zerocopy() Greg Kroah-Hartman
` (998 more replies)
0 siblings, 999 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
This is the start of the stable review cycle for the 6.12.110 release.
There are 1376 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Mon, 14 Sep 2026 06:54:17 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.110-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 6.12.110-rc1
Tony W Wang-oc <TonyWWang-oc@zhaoxin.com>
ACPI: processor: Add cpuidle driver check in acpi_processor_register_idle_driver()
Nathan Chancellor <nathan@kernel.org>
integrity: Eliminate weak definition of arch_get_secureboot()
Hao Ge <gehao@kylinos.cn>
slab: reset slab->obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL
Alexander Popov <alex.popov@linux.com>
x86/Kconfig: Reenable PTDUMP on i386
Dan Carpenter <dan.carpenter@linaro.org>
pinctrl: mediatek: common-v1: Fix error checking in mtk_eint_init()
Tomas Glozar <tglozar@redhat.com>
tools/build: Use SYSTEM_BPFTOOL for system bpftool
Eric Dumazet <edumazet@google.com>
net_sched: add back BH safety to tcf_lock
Eric Dumazet <edumazet@google.com>
net_sched: act_tunnel_key: use RCU in tunnel_key_dump()
Eric Dumazet <edumazet@google.com>
net_sched: act_vlan: use RCU in tcf_vlan_dump()
Eric Dumazet <edumazet@google.com>
net_sched: act_skbedit: use RCU in tcf_skbedit_dump()
Eric Dumazet <edumazet@google.com>
net_sched: act_ctinfo: use RCU in tcf_ctinfo_dump()
Eric Dumazet <edumazet@google.com>
net_sched: act_ct: use RCU in tcf_ct_dump()
Zheng Qixing <zhengqixing@huawei.com>
md: fix sync_action incorrect display during resync
Zheng Qixing <zhengqixing@huawei.com>
md: add helper rdev_needs_recovery()
Catalin Marinas <catalin.marinas@arm.com>
kselftest/arm64: mte: Use the correct naming for tag check modes in check_hugetlb_options.c
Catalin Marinas <catalin.marinas@arm.com>
kselftest/arm64: mte: Skip the hugetlb tests if MTE not supported on such mappings
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: fq: clamp quantum and initial_quantum in change path
Arnd Bergmann <arnd@arndb.de>
Bluetooth: btmtk: hide unused btmtk_mt6639_devs[] array
e.kubanski <e.kubanski@partner.samsung.com>
xsk: Fix offset calculation in unaligned mode
Gao Xiang <xiang@kernel.org>
erofs: fix managed cache race for unaligned extents
Chen Ridong <chenridong@huawei.com>
cpuset: fix warning when disabling remote partition
Nick Chan <towinchenmi@gmail.com>
nvme-apple: Reset q->sq_tail during queue init
Nick Chan <towinchenmi@gmail.com>
nvme-apple: Prevent shared tags across queues on Apple A11
Thomas Weißschuh <thomas.weissschuh@linutronix.de>
powerpc/vdso: Remove unused clockmode asm offsets
Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
phy: qcom: qmp-combo: Add missing PLL (VCO) configuration on SM8750
James Clark <james.clark@linaro.org>
perf test: Don't signal all processes on system when interrupting tests
Yuyang Huang <yuyanghuang@google.com>
bpf: fix BPF_PROG_QUERY OOB write and cgroup backward compat
Yuyang Huang <yuyanghuang@google.com>
selftests/bpf: add verification for BPF_PROG_QUERY attr size boundaries
Yang Xiuwei <yangxiuwei@kylinos.cn>
scsi: sd: Fix error handling in sd_probe() after large pool creation failure
Pankaj Raghav <p.raghav@samsung.com>
block: reject bs > ps block devices when THP is disabled
Yongpeng Yang <yangyongpeng@xiaomi.com>
fscrypt: fix left shift underflow when inode->i_blkbits > PAGE_SHIFT
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
ACPI: processor: Update cpuidle driver check in __acpi_processor_start()
Kuniyuki Iwashima <kuniyu@google.com>
slub: Don't call lockdep_unregister_key() for immature kmem_cache.
Xiao Ni <xni@redhat.com>
md: keep recovery_cp in mdp_superblock_s
Chen-Yu Tsai <wenst@chromium.org>
pinctrl: mediatek: common-v1: Fix EINT breakage on older controllers
Hao Chang <ot_chhao.chang@mediatek.com>
pinctrl: mediatek: Fix new design debounce issue
Chen-Yu Tsai <wenst@chromium.org>
pinctrl: mediatek: eint: Drop base from mtk_eint_chip_write_mask()
Mario Limonciello <mario.limonciello@amd.com>
cpufreq/amd-pstate: Fix prefcore rankings
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
platform/x86: lg-laptop: Check ACPI_COMPANION() against NULL
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: sch_htb: limit htb_classify inner-class filter hops
Jiayuan Chen <jiayuan.chen@linux.dev>
tcp: fix corruption of urgent data on multi-segment retransmit
Deepanshu Kartikey <kartikey406@gmail.com>
usb: atm: usbatm: fix invalid ci_range initialization
bui duc phuc <phucduc.bui@gmail.com>
net: fec: only stop PTP if it was initialized
Eric Dumazet <edumazet@google.com>
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
Maxime Chevallier <maxime.chevallier@bootlin.com>
net: stmmac: selftests: Account for the UC filter list for filtering tests
Maxime Chevallier <maxime.chevallier@bootlin.com>
net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering
Maxime Chevallier <maxime.chevallier@bootlin.com>
net: stmmac: dwmac4: Account for the primary MAC address for UC filtering
Maxime Chevallier <maxime.chevallier@bootlin.com>
net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering
Maxime Chevallier <maxime.chevallier@bootlin.com>
net: stmmac: selftests: Check multiple MMC counters
Muhammad Usama Anjum <usama.anjum@arm.com>
selftests/arm64: Treat KSM merge_across_nodes as optional
Muhammad Usama Anjum <usama.anjum@arm.com>
selftests/arm64: Print missing MTE TAP headers
Yang Shi <yang@os.amperecomputing.com>
selftests: arm64: add hugetlb mte tests
Takashi Iwai <tiwai@suse.de>
ALSA: control: Don't add invalid kcontrols to LED layer
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()
Marino Dzalto <marino.dzalto@gmail.com>
netfilter: xt_HL: add pr_fmt and checkentry validation
Michal Koutný <mkoutny@suse.com>
netfilter: xt_cgroup: Make it independent from net_cls
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nf_tables: move hardware offload step after building the chain blob
Alice Mikityanska <alice@isovalent.com>
virtio-net: Ensure that TCP packets don't overflow gso_segs
Maxime Chevallier <maxime.chevallier@bootlin.com>
net: stmmac: selftests: Pass the IP proto mask in the TC selftest
Jiawen Wu <jiawenwu@trustnetic.com>
net: wangxun: use BIT_ULL() to prevent shift overflow on 32-bit archs
Yifei Chu <Chuyf26@linux.alibaba.com>
net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure
bui duc phuc <phucduc.bui@gmail.com>
net: ethernet: sun4i-emac: Fix IRQ error handling
Haotian Zhang <vulab@iscas.ac.cn>
samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify
Haotian Zhang <vulab@iscas.ac.cn>
samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-modify
Aleksandr Nogikh <nogikh@google.com>
libceph: validate banner payload length
Xiubo Li <xiubo.li@clyso.com>
ceph: revalidate ki_pos for O_APPEND writes after cap acquisition
HyeongJun An <sammiee5311@gmail.com>
ASoC: dapm: Fix off-by-one check on the second enum channel
John Johansen <john.johansen@canonical.com>
apparmor: policy_int make sure list heads are initialized before fail path
Thorsten Blum <thorsten.blum@linux.dev>
apparmor: Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init
Ruoyu Wang <ruoyuw560@gmail.com>
tpm: st33zp24: Validate locality read result
Ruoyu Wang <ruoyuw560@gmail.com>
tpm: st33zp24: Return zero on status read failure
Victor Nogueira <victor@mojatatu.com>
net/sched: sch_teql: restore skb->dev on the slave failure path
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: sfq: clamp quantum to avoid signed overflow soft lockup
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: hhf: clamp quantum before hhf_change() to avoid overflow
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: fq_pie: clamp default quantum to avoid signed overflow
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: sch_codel: clamp default mtu to avoid disabling CoDel
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: fq_codel: clamp default quantum and mtu
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: fq: add overflow bounds to quantum and initial quantum
Mina Almasry <almasrymina@google.com>
net: core: check skb_frags_readable before uncloning in skb_copy_ubufs
Eric Dumazet <edumazet@google.com>
net/sched: act_skbmod: fix length calculations and avoid invalid header warnings
Eric Dumazet <edumazet@google.com>
net_sched: act_skbmod: use RCU in tcf_skbmod_dump()
Liam R. Howlett (Oracle) <liam@infradead.org>
maple_tree: fix argument name in header
Liam R. Howlett (Oracle) <liam@infradead.org>
maple_tree: catch race in mas_alloc_cyclic()
Muhammad Usama Anjum <usama.anjum@arm.com>
selftests/mm: skip COW tmpfile cases when fallocate() is unsupported
Mark Brown <broonie@kernel.org>
selftests/mm: report unique test names for each cow test
Hao Ge <gehao@kylinos.cn>
selftests/mm/cow: modify the incorrect checking parameters
Frank Sorenson <sorenson@redhat.com>
cifs: fix clearing stats for fastest execution of each smb2 command
Allison Henderson <achender@kernel.org>
net/rds: use wq_has_sleeper() in rds_cong_map_updated()
Naveen Mamindlapalli <naveenm@marvell.com>
octeontx2-af: Fix TL3/TL2 link config ENA clearing
Xiang Mei <xmei5@asu.edu>
net: qualcomm: rmnet: restore skb->dev on deaggregated frames
Anshumali Gaur <agaur@marvell.com>
octeontx2-af: fix NULL deref in NIX TM tree debugfs read path
Cen Zhang (Microsoft) <blbllhy@gmail.com>
gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free
Hyunwoo Kim <imv4bel@gmail.com>
Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop
Chris Lu <chris.lu@mediatek.com>
Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path
Chris Lu <chris.lu@mediatek.com>
Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX
Ismail Tarim <ismailtarim7@gmail.com>
Bluetooth: btmtk: Do not discard the subsystem reset timeout
Ismail Tarim <ismailtarim7@gmail.com>
Bluetooth: btmtk: Do not report success when subsys reset fails
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bluetooth: btmtk: Fix short read errors in btmtk_usb_reg_read()
Javier Tia <floss@jetm.me>
Bluetooth: btmtk: Add MT6639 (MT7927) Bluetooth support
Pauli Virtanen <pav@iki.fi>
Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan
Pavel Shpakovskiy <pashpakovskii@salutedevices.com>
Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference
Pauli Virtanen <pav@iki.fi>
Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN
Wei-Lin Chang <weilin.chang@arm.com>
arm64: ptdump: Make note_page_flush() range aware
Anshuman Khandual <anshuman.khandual@arm.com>
mm/ptdump: split note_page() into level specific callbacks
Anshuman Khandual <anshuman.khandual@arm.com>
mm: rename GENERIC_PTDUMP and PTDUMP_CORE
Anshuman Khandual <anshuman.khandual@arm.com>
mm: make DEBUG_WX depdendent on GENERIC_PTDUMP
Shrikanth Hegde <sshegde@linux.ibm.com>
powerpc: Add preempt lazy support
Heiko Carstens <hca@linux.ibm.com>
s390: Add ARCH_HAS_PREEMPT_LAZY support
Heiko Carstens <hca@linux.ibm.com>
s390: Add missing _TIF defines
Yicong Yang <yangyicong@hisilicon.com>
arm64: Enable ARCH_HAS_NONLEAF_PMD_YOUNG
Geert Uytterhoeven <geert+renesas@glider.be>
erofs: Fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS default logic
Dan Carpenter <error27@gmail.com>
scsi: qla2xxx: Fix an loop timeout test
Rong Zhang <i@rong.moe>
net: page_pool: Remove zone/policy GFP flags when allocating XArray entries
Guenter Roeck <linux@roeck-us.net>
bnxt_en: Fix call to hardware monitoring event handler
Cosmo Chou <chou.cosmo@gmail.com>
rtc: pcf85363: Add error checking to regmap calls in probe()
Junrui Luo <moonafterrain@outlook.com>
NFSv4/pnfs: key the data server cache on the NFS version
Jeff Layton <jlayton@kernel.org>
nfs: move the nfs4_data_server_cache into struct nfs_net
Junrui Luo <moonafterrain@outlook.com>
NFSv4.2: fix LAYOUTSTATS send buffer exhaustion
Mahanta Jambigi <mjambigi@linux.ibm.com>
net/smc: free pending qentry in smc_llc_flow_stop() before memset
Mahanta Jambigi <mjambigi@linux.ibm.com>
net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition
Jamal Hadi Salim <jhs@mojatatu.com>
net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue
Eric Dumazet <edumazet@google.com>
inetpeer: randomize RB-tree node comparison using SipHash
Pengpeng Hou <pengpeng@iscas.ac.cn>
net: qlcnic: validate unified ROM sections before loading
Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
net: add missing ref_tracker_dir_exit() to net_passive_dec()
Ruoyu Wang <ruoyuw560@gmail.com>
net: ipa: balance runtime PM reference on remove error
Marek Czernohous <marek@czernohous.de>
forcedeth: stop the tx_timeout register dump past the requested window
Fan Ye <fy15309206903@gmail.com>
net: thunderbolt: Count delivered packets in rx_packets and rx_bytes
Victor Nogueira <victor@mojatatu.com>
net/sched: add get_fill_size callbacks for actions missing them
Ruoyu Wang <ruoyuw560@gmail.com>
net: bridge: Reject descending VLAN tunnel ranges
Cen Zhang (Microsoft) <blbllhy@gmail.com>
xsk: fix NULL pointer dereference in __xsk_rcv()
Maciej Fijalkowski <maciej.fijalkowski@intel.com>
xsk: avoid double checking against rx queue being full
Maciej Fijalkowski <maciej.fijalkowski@intel.com>
xsk: Get rid of xdp_buff_xsk::orig_addr
Serhat Kumral <serhatkumral1@gmail.com>
RDMA/ucma: Allow path records to exactly fit the output buffer
Haotian Zhang <vulab@iscas.ac.cn>
ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup
Cássio Gabriel <cassiogabrielcontato@gmail.com>
ALSA: core: Add scoped cleanup helper for card references
Geert Uytterhoeven <geert+renesas@glider.be>
clk: visconti: Make sure clk_init_data is fully initialized
Geert Uytterhoeven <geert+renesas@glider.be>
clk: ti: Make sure clk_init_data is fully initialized
Bradley Morgan <include@grrlz.net>
prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator
Linkai Gong <gonglinkai@kylinos.cn>
rtc: gamecube: check return value of devm_rtc_register_device()
Ruoyu Wang <ruoyuw560@gmail.com>
i2c: ocores: Disable clock on failed resume
Biju Das <biju.das.jz@bp.renesas.com>
irqchip/renesas-rzg2l: Fix loss of interrupt
Pengpeng Hou <pengpeng@iscas.ac.cn>
rtc: zynqmp: Return optional clock lookup errors
Christopher Lusk <clusk@northecho.dev>
smb: client: fix request buffer leak in smb2_new_read_req()
Yi Ding <yi.s.ding@gmail.com>
rtc: pcf8563: fix clock provider leak on unbind
Li RongQing <lirongqing@baidu.com>
vdpa/mlx5: fix wrong list iterated in add_direct_chain error path
Li RongQing <lirongqing@baidu.com>
virtio_pci: fix wrong queue index for admin vq in intx path
Linfeng Sun <linfeng.sun.dev@gamil.com>
vdpa_sim: fix cleanup after worker creation failure
Michael S. Tsirkin <mst@redhat.com>
virtio_balloon: disable indirect descriptors
Jian-Ming Liao <Jm_Liao@asmedia.com.tw>
i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode
Adrian Hunter <adrian.hunter@intel.com>
i3c: mipi-i3c-hci: Refactor PIO register initialization
Adrian Hunter <adrian.hunter@intel.com>
i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc()
Adrian Hunter <adrian.hunter@intel.com>
i3c: mipi-i3c-hci: Quieten initialization messages
Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs()
Ruoyu Wang <ruoyuw560@gmail.com>
bonding: initialize err for empty target lists
Nikolay Kulikov <nikolayof23@gmail.com>
mlxbf-bootctl: fix the build error with FIELD_PREP()
Guangshuo Li <lgs201920130244@gmail.com>
platform/x86: hp-bioscfg: fix password encoding bounds check
Nguyen Dinh Phi <phind.uet@gmail.com>
vsock: use sock_error() to consume sk_err after a failed connect
Nguyen Dinh Phi <phind.uet@gmail.com>
vsock: don't check the listener's sk_err in vsock_accept()
Laurence Rowe <laurencerowe@gmail.com>
vsock: avoid timeout for non-blocking accept() with empty backlog
HyeongJun An <sammiee5311@gmail.com>
platform/x86: dell-wmi-sysman: Fix instance ID bounds
Mahanta Jambigi <mjambigi@linux.ibm.com>
net/smc: hash socket only after full initialisation in smc_sk_init()
Karl Mehltretter <kmehltretter@gmail.com>
8139cp: fix Rx and Tx not being disabled in cp_suspend
Baul Lee <baul.lee@xbow.com>
vxlan: mdb: Fix use-after-free in vxlan_mdb_flush()
Xu Rao <raoxu@uniontech.com>
ALSA: hda: Fix connection list comparison in proc output
Baokun Li <libaokun@linux.alibaba.com>
fuse: check for NULL root inode in fuse_fill_super_submount
Zhang Tianci <zhangtianci.1997@bytedance.com>
fuse: check attributes staleness on fuse_iget()
Joanne Koong <joannelkoong@gmail.com>
fuse: convert readdir to use folios
Joanne Koong <joannelkoong@gmail.com>
fuse: support folios in struct fuse_args_pages and fuse_copy_pages()
Weiming Shi <bestswngs@gmail.com>
fs/ntfs3: validate ef->size covers the record's name and value
Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()
Baokun Li <libaokun@linux.alibaba.com>
cuse: wait for pending RCU callbacks on module exit
Nikolay Aleksandrov <razor@blackwall.org>
net: bridge: vlan: fix inverted default vlan notification
Maximilian Immanuel Brandtner <maxbr@linux.ibm.com>
tls: fix RX desync on overlapping skbs
Ruoyu Wang <ruoyuw560@gmail.com>
net: dsa: mv88e6xxx: Fix PCS link check on CMODE read error
Xiang Mei <xmei5@asu.edu>
vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes
Joas Antonio dos Santos <joasantonio108@gmail.com>
ipvs: fix integer overflow in ftp helper port/address parsing
Chao Yu <chao@kernel.org>
f2fs: fix to avoid pinfile fragment on fragment:{block, segment} mode
Chao Yu <chao@kernel.org>
f2fs: cleanup w/ f2fs_need_rand_{blk, seg, seg_blk}
liujinbao1 <liujinbao1@xiaomi.com>
f2fs:Fix incomplete search range in f2fs_get_victim when f2fs_need_rand_seg is enabled
Chao Yu <chao@kernel.org>
f2fs: fix to parse temperature correctly in f2fs_get_segment_temp()
Xin Xie <xiexinet@gmail.com>
net: hsr: free learned nodes on device setup failure
Qingfang Deng <qingfang.deng@linux.dev>
pppox: drain queued packets on channel handoff
Vladimir Oltean <vladimir.oltean@nxp.com>
net: dsa: b53: fix error propagation from b53_fdb_dump()
Junseo Lim <zirajs7@gmail.com>
net: kcm: Hold RCU read lock while running BPF parser
Prabu Thayalan <prabu.ponrajthayalan@amd.com>
ionic: fix completion descriptor access with 2x desc size
Dan Carpenter <error27@gmail.com>
drm/xe: tests: fix error message in xe_migrate_sanity_test()
Karl Mehltretter <kmehltretter@gmail.com>
octeontx2-af: initialize lmac_bmap in rvu_mcs_set_lmac_bmap()
Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
clk: ti: mux: resolve parent clocks by DT index, not by name
Ethan Carter Edwards <ethan@ethancedwards.com>
clk: ti: use kcalloc() instead of kzalloc()
Onur Özkan <work@onurozkan.dev>
clk: devres: fix cleanup in devm_clk_get_optional_enabled_with_rate()
Michael Nemanov <michael.nemanov@vastdata.com>
nfs: fix ENXIO on O_CREAT open of existing symlink over NFSv3
Zhansong Gao <zhsgao@hotmail.com>
NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease()
ZhangGuoDong <zhangguodong@kylinos.cn>
pnfs/blocklayout: Fix device leaks on parse failure
Ruoyu Wang <ruoyuw560@gmail.com>
NFSv4: remove callback IDR entry on client allocation failure
Arnaud Bonnet <abo@medichon.fr>
nfs: refactor pNFS functions using clear_and_wake_up_bit
Arnaud Bonnet <abo@medichon.fr>
nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper
Ze Tan <tanze@kylinos.cn>
smb/server: fix session leak in ksmbd_session_register()
Hang Nan <2122295973@qq.com>
ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: disconnect on SMB3 decryption failure
Junseo Lim <zirajs7@gmail.com>
bpf: Reject negative optlen in cgroup getsockopt hook
Andreas Schwab <schwab@linux-m68k.org>
m68k: nfcon: Do not call console_is_registered() in nfcon_device()
Junseo Lim <zirajs7@gmail.com>
bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks
Ojaswin Mujoo <ojaswin@linux.ibm.com>
erofs: fix unused pcluster_pools for higher page sizes
Gao Xiang <xiang@kernel.org>
erofs: support unaligned encoded data
Gao Xiang <xiang@kernel.org>
erofs: convert z_erofs_bind_cache() to folios
Junseo Lim <zirajs7@gmail.com>
lwt_bpf: Restore reserved headroom after xmit program
ZhangGuoDong <zhangguodong@kylinos.cn>
smb/server: preserve error status in smb2_handle_negotiate()
ZhangGuoDong <zhangguodong@kylinos.cn>
smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger()
ZhangGuoDong <zhangguodong@kylinos.cn>
smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request()
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: free preauth sessions on connection teardown
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: do not advertise unimplemented CA support
Yunseong Kim <yunseong.kim@est.tech>
ksmbd: validate ipc response length before dereferencing its fields
Enzo Matsumiya <ematsumiya@suse.de>
smb: server: fix leak of ksmbd_ipc_login_request_ext() returned buffer
Guangshuo Li <lgs201920130244@gmail.com>
ksmbd: Do not skip lock checks for single-byte ranges
Marius Cristea <marius.cristea@microchip.com>
hwmon: (emc1403) Drop hysteresis for low limit temperature
Guenter Roeck <linux@roeck-us.net>
hwmon: (emc1403) Rely on subsystem locking
Szymon Wilczek <swilczek.lx@gmail.com>
hwmon: (coretemp) Fix core_data leak on CPUs without PTS
Hongyan Xu <getshell@seu.edu.cn>
block: mtip32xx: synchronize ioctls with device removal
Yao Sang <sangyao@kylinos.cn>
ublk: reject non-power-of-2 zone sizes in SET_PARAMS
Niklas Cassel <cassel@kernel.org>
null_blk: serialize configfs attribute updates with device setup
Zizhi Wo <wozizhi@huawei.com>
null_blk: serialize configfs attribute stores with the lock
Zizhi Wo <wozizhi@huawei.com>
null_blk: reject per-device queue resize for shared tag set
Zizhi Wo <wozizhi@huawei.com>
null_blk: free zones array on device power-off
Zizhi Wo <wozizhi@huawei.com>
null_blk: free global tag_set on init error path
Zizhi Wo <wozizhi@huawei.com>
null_blk: register configfs subsystem after creating default devices
Zizhi Wo <wozizhi@huawei.com>
null_blk: use DEFINE_MUTEX for the file-scope mutex
Huisong Li <lihuisong@huawei.com>
mailbox: pcc: Fix command timeout due to missed interrupt
Sudeep Holla <sudeep.holla@arm.com>
Revert "mailbox/pcc: support mailbox management of the shared buffer"
Adam Young <admiyo@os.amperecomputing.com>
mailbox/pcc: support mailbox management of the shared buffer
Sudeep Holla <sudeep.holla@arm.com>
mailbox: pcc: Always map the shared memory communication address
Linmao Li <lilinmao@kylinos.cn>
mailbox: rockchip: disable pclk on probe failure and unbind
Jia Yang <jia.yang@oss.qualcomm.com>
mailbox: qcom-cpucp: handle NULL data in send_data callback
Jia Yang <jia.yang@oss.qualcomm.com>
mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler
Arnaldo Carvalho de Melo <acme@redhat.com>
perf dso: Guard against cache underflow on short reads in dso_cache__memcpy()
Arnaldo Carvalho de Melo <acme@redhat.com>
perf dso: Use stored fd error instead of stale errno in file_read() and file_size()
Arnaldo Carvalho de Melo <acme@redhat.com>
perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path()
Tao Cui <cuitao@kylinos.cn>
sched_ext/scx_flatcg: Fix cvtime true-up on slice expiry
Karl Mehltretter <kmehltretter@gmail.com>
crypto: lskcipher - propagate errors from unaligned crypt
Zhushuai Yin <yinzhushuai@huawei.com>
crypto: hisilicon/sec2 - fix CCM algorithm long packet failure
Israel Téllez García <i.tellez@btesa.com>
bpf: Fix pending_pos walk on 32-bit ring position wrap
Hongyan Xu <getshell@seu.edu.cn>
ACPI: scan: fix bus ID cleanup on device_add() failures
Vincent Donnefort <vdonnefort@google.com>
ring-buffer: Remove trace_buffer::cpus
Pu Lehui <pulehui@huawei.com>
riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args
Xianglin Lin <1021538027@qq.com>
HID: multitouch: reclassify HTIX5288 to WIN_8_FORCE_MULTI_INPUT_NSMU
Pengpeng Hou <pengpeng@iscas.ac.cn>
ASoC: SOF: validate topology volume range before allocation
Steven Rostedt <rostedt@goodmis.org>
tracing: Have trace_event_update_all() only handle module that is loading
Masami Hiramatsu (Google) <mhiramat@kernel.org>
tracing: Remove "__attribute__()" from the type field of event format
Aleksandr Nogikh <nogikh@google.com>
ALSA: core: Fix use-after-free in snd_card_do_free()
Zhan Xusheng <zhanxusheng1024@gmail.com>
fs/ntfs3: reject out-of-range evcn in mi_enum_attr()
Zhan Xusheng <zhanxusheng1024@gmail.com>
fs/ntfs3: fix integer overflow in MFT cluster validation
Jijie Shao <shaojijie@huawei.com>
net: page_pool: fix UAF in __page_pool_release_netmem_dma on xa_cmpxchg race
Byungchul Park <byungchul@sk.com>
page_pool: rename __page_pool_release_page_dma() to __page_pool_release_netmem_dma()
Bart Van Assche <bvanassche@acm.org>
scsi: ufs: core: Set task state before io_schedule_timeout()
Avri Altman <avri.altman@wdc.com>
scsi: ufs: core: Remove redundant host_lock calls around UTMRLDBR
Chandrakanth Patil <chandrakanth.patil@broadcom.com>
scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers
Eduard Zingerman <eddyz87@gmail.com>
selftests/bpf: Fix for veristat file/prog filters processing
Phillip Lougher <phillip@squashfs.org.uk>
Squashfs: check block offset is not negative
Krystian Kaniewski <krystianmkaniewski@gmail.com>
ocfs2: fix circular locking dependency in ocfs2_init_acl()
Yuan Chen <chenyuan@kylinos.cn>
bpftool: Fix double close in map dump
Bijan Tabatabai <btabatabai@wisc.edu>
x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported
Rui Qi <qirui.001@bytedance.com>
selftests/cgroup: Preserve CPU hotplug write errors
Waiman Long <longman@redhat.com>
selftest/cgroup: Clean up and restructure test_cpuset_prs.sh
Waiman Long <longman@redhat.com>
selftest/cgroup: Update test_cpuset_prs.sh to use | as effective CPUs and state separator
Waiman Long <longman@redhat.com>
cgroup/cpuset: Remove remote_partition_check() & make update_cpumasks_hier() handle remote partition
everestkc <everestkc@everestkc.com.np>
cgroup/cpuset: Fix spelling errors in file kernel/cgroup/cpuset.c
John Keeping <jkeeping@inmusicbrands.com>
ALSA: seq: midi: Serialize input teardown with event_input
Takashi Iwai <tiwai@suse.de>
ALSA: seq: midi: Optimize event_input locking with RCU
Yuho Choi <dbgh9129@gmail.com>
clocksource/drivers/armada: Unwind timer clock on init failure
Guangshuo Li <lgs201920130244@gmail.com>
clocksource/drivers/clps711x: Do not unmap clocksource MMIO
Peter Oberparleiter <oberpar@linux.ibm.com>
s390/debug: Fix deadlock during unregister
Yuho Choi <dbgh9129@gmail.com>
xenbus: Unregister reboot notifier on init failure
Henrik Grimler <henrik.grimler@axis.com>
power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address
Henrik Grimler <henrik.grimler@axis.com>
power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address
Henrik Grimler <henrik.grimler@axis.com>
power: supply: bq27xxx: bq27520g4: fix REG_TTES address
Matti Vaittinen <mazziesaccount@gmail.com>
power: supply: bd99954: Drop bad register fields
Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
PCI/ASPM: Disable/restore ASPM on every function for multi-function devices
Bjorn Helgaas <bhelgaas@google.com>
PCI/ASPM: Cache L0s/L1 Supported so advertised link states can be overridden
Felix Gu <ustc.gu@gmail.com>
spi: img-spfi: don't disable runtime PM on DMA deferred probe
Vineet Gupta <vineet.gupta@linux.dev>
selftests/bpf: vmtest.sh: Preserve command quoting when running in the VM
David Matlack <dmatlack@google.com>
selftests: harness: Mark test fixture objects __maybe_unused
Thomas Weißschuh <thomas.weissschuh@linutronix.de>
selftests: harness: Restore order of test functions
Daniel Borkmann <daniel@iogearbox.net>
bpf, s390: Clear fetch destination on faulting arena atomic
Mohammad Abu-Khader <mohammad.abukhader@hotmail.com>
kunit: tool: fix _list_tests filtering wrong variable when list has TAP prefix
Karl Mehltretter <kmehltretter@gmail.com>
super: fix dying superblock warning messages
Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
PCI/ASPM: Use pcie_capability_clear_and_set_word() for ASPM disable/restore
Takashi Sakamoto <o-takashi@sakamocchi.jp>
firewire: core: fix memory leak in error path of build_tree()
Takashi Sakamoto <o-takashi@sakamocchi.jp>
firewire: core: validate parent port count before allocating nodes in build_tree()
Takashi Sakamoto <o-takashi@sakamocchi.jp>
firewire: core: consolidate port counting in build_tree()
Takashi Sakamoto <o-takashi@sakamocchi.jp>
firewire: core: add KUnit tests for failure of tree building
Takashi Sakamoto <o-takashi@sakamocchi.jp>
firewire: core: add KUnit tests for successful tree building
Takashi Sakamoto <o-takashi@sakamocchi.jp>
firewire: core: add KUnit test skeleton for node tree
Ran Hongyun <ranhongyun1@huawei.com>
UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC
Rosen Penev <rosenp@gmail.com>
ASoC: xilinx: formatter_pcm: fix stream_data leak on open error
Yuho Choi <dbgh9129@gmail.com>
mtd: ubi: Release device reference on busy detach
Yuho Choi <dbgh9129@gmail.com>
ubi: Fix rollback for explicit UBI device numbers
Zhihao Cheng <chengzhihao1@huawei.com>
UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs
Zhihao Cheng <chengzhihao1@huawei.com>
UBI: Preserve torture flag when rescheduling failed erasures
LiangCheng Wang <zaq14760@gmail.com>
ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready
bui duc phuc <phucduc.bui@gmail.com>
ASoC: pxa: Use devm_clk_get_optional() for extclk clock
Petr Oros <poros@redhat.com>
ice: clear the default forwarding VSI rule when releasing a VSI
Zhu Yanjun <yanjun.zhu@linux.dev>
RDMA/cma: Fix WARNING in res_to_rt
Fan Wu <fanwu01@zju.edu.cn>
RDMA/cxgb4: Free debugfs on registration failure
Guangshuo Li <lgs201920130244@gmail.com>
dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal
HyeongJun An <sammiee5311@gmail.com>
ALSA: seq: Don't leak the extension cell pointer in the bounce payload
Yun Zhou <yun.zhou@windriver.com>
nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing
Linmao Li <lilinmao@kylinos.cn>
nfc: digital: Do not dump a NULL response in command completion
Yinhao Hu <dddddd@hust.edu.cn>
nfc: pn533: hold a reference to the request skb during send_frame
Doruk Tan Ozturk <doruk@0sec.ai>
nfc: llcp: bound SNL TLV parsing to the skb and add length checks
Zhenghang Xiao <kipreyyy@gmail.com>
nfc: nci: fix double completion race in nci_data_exchange_complete
Breno Leitao <leitao@debian.org>
nfc: llcp: read llcp_sock->local under the socket lock in getsockopt
Breno Leitao <leitao@debian.org>
nfc: llcp: avoid userspace overflow on invalid optlen
Chao Shi <coshi036@gmail.com>
nvme: reject passthrough of driver-managed Set Features
Yang Xiuwei <yangxiuwei@kylinos.cn>
nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()
Guixin Liu <kanie@linux.alibaba.com>
nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()
Sven Peter <sven@kernel.org>
nvme-apple: Drop the PRP null check chicken bit
Nick Chan <towinchenmi@gmail.com>
nvme: apple: Add Apple A11 support
Sven Peter <sven@kernel.org>
nvme-apple: Never set the opcode in the NVMMU TCB
Sven Peter <sven@kernel.org>
nvme-apple: Don't set a DMA direction for commands without a data transfer
Sven Peter <sven@kernel.org>
nvme-apple: Destroy the admin queue on removal
Guixin Liu <kanie@linux.alibaba.com>
nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()
Alistair Francis <alistair.francis@wdc.com>
nvme: Add the DHCHAP maximum HD IDs
Guixin Liu <kanie@linux.alibaba.com>
nvme: introduce change ptpl and iekey definition
Guixin Liu <kanie@linux.alibaba.com>
nvme: add reservation command's defines
Ilya Leoshkevich <iii@linux.ibm.com>
s390/irqflags: Add out-of-line definitions of arch_local_irq_*() for KMSAN
Coiby Xu <coxu@redhat.com>
s390: Drop unnecessary CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT
Coiby Xu <coxu@redhat.com>
integrity: Make arch_ima_get_secureboot integrity-wide
Thorsten Blum <thorsten.blum@linux.dev>
powerpc: Use str_enabled_disabled() helper function
Christophe Leroy <christophe.leroy@csgroup.eu>
powerpc/vdso: Add a page for non-time data
Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>
ASoC: qcom: q6apm: keep the graph start count in sync with the DSP
Babanpreet Singh <bbnpreetsingh@gmail.com>
spi: sprd-adi: Fix probe succeeding without registering the controller
Esteban Urrutia <esteuwu@proton.me>
phy: qcom: qmp-combo: Drop qmp_v4_calibrate_dp_phy
Abel Vesa <abelvesa@kernel.org>
phy: qualcomm: qmp-combo: Add DP offsets and settings for Glymur platforms
Wesley Cheng <wesley.cheng@oss.qualcomm.com>
phy: qualcomm: qmp-combo: Update QMP PHY with Glymur settings
Wesley Cheng <wesley.cheng@oss.qualcomm.com>
phy: qualcomm: Update the QMP clamp register for V6
Faisal Hassan <faisal.hassan@oss.qualcomm.com>
phy: qcom-qmp-combo: Use regulator_bulk_data with init_load_uA for regulator setup
Wesley Cheng <quic_wcheng@quicinc.com>
phy: qcom: qmp-combo: Add new PHY sequences for SM8750
Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
phy: qualcomm: qmp-combo: add support for SAR2130P
Esteban Urrutia <esteuwu@proton.me>
phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs
Vasant Hegde <vasant.hegde@amd.com>
iommu/amd: Fix incorrect device ID in invalid PASID error message
Michael Walle <mwalle@kernel.org>
powerpc/configs: enable CONFIG_RAS to fix EDAC support
Runyu Xiao <runyu.xiao@seu.edu.cn>
sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE
Weiming Shi <bestswngs@gmail.com>
SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6
Marco Elver <elver@google.com>
arm64: Disable KCSAN instrumentation in delay.o
Chuck Lever <chuck.lever@oracle.com>
xdrgen: Fix opaque and string encoders for unbounded members
Chuck Lever <chuck.lever@oracle.com>
xdrgen: Do not declare union XDR functions in the definitions header
Chuck Lever <chuck.lever@oracle.com>
xdrgen: Address some checkpatch whitespace complaints
Chuck Lever <chuck.lever@oracle.com>
xdrgen: Implement big-endian enums
Chuck Lever <chuck.lever@oracle.com>
xdrgen: Rename "enum yada" types as just "yada"
Karl Mehltretter <kmehltretter@gmail.com>
m68k: Fix backtraces for non-running tasks
Lu Baolu <baolu.lu@linux.intel.com>
iommu/vt-d: Tear down scalable-mode context on probe failure
Lu Baolu <baolu.lu@linux.intel.com>
iommu/vt-d: Clear Present bit before tearing down copied context entry
Desnes Nunes <desnesn@redhat.com>
iommu/vt-d: Fix UCTP context table slot when copying root entries
Danila Chernetsov <listdansp@mail.ru>
fbdev: kyro: Validate overlay viewport coordinates
Myeonghun Pak <mhun512@gmail.com>
fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device()
Ian Rogers <irogers@google.com>
perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads
Ian Rogers <irogers@google.com>
perf python: Check counts_values size in set_values
Gautam Menghani <gautam@linux.ibm.com>
perf python: Add support for 'struct perf_counts_values' to return counter data
Ian Rogers <irogers@google.com>
perf python: Remove python 2 scripting support
Ian Rogers <irogers@google.com>
perf test: Fix skiplist leak in cmd_test
Ian Rogers <irogers@google.com>
perf test: Support dynamic test suites with setup callback and private data
Ian Rogers <irogers@google.com>
perf test: Send list output to stdout rather than stderr
Ian Rogers <irogers@google.com>
perf test: Rename functions and variables for better clarity
Ian Rogers <irogers@google.com>
perf test: Sort tests placing exclusive tests last
Ian Rogers <irogers@google.com>
perf test: Add a signal handler to kill forked child processes
Ian Rogers <irogers@google.com>
perf test: Run parallel tests in two passes
Ian Rogers <irogers@google.com>
perf test: Add a signal handler around running a test
Ian Rogers <irogers@google.com>
perf test: Display number of active running tests
Arnaldo Carvalho de Melo <acme@redhat.com>
perf test: Introduce workloads__for_each()
Ian Rogers <irogers@google.com>
perf synthetic-events: Fix uninitialized pthread_join
Ian Rogers <irogers@google.com>
perf stat: Fix evsel_list leak in cmd_stat
Rosen Penev <rosenp@gmail.com>
ARM: dts: helios4: add SATA regulator supplies
Rosen Penev <rosenp@gmail.com>
ARM: dts: helios4: add vcc-supply to GPIO expander
Rosen Penev <rosenp@gmail.com>
ARM: dts: helios4: add vcc-supply to EEPROM
Tomáš Macholda <tomas.macholda@nic.cz>
arm64: dts: turris-mox: fix usb3 phys
Guodong Xu <guodong@riscstar.com>
riscv: cpufeature: Clarify ISA spec version for canonical order
Victor Nogueira <victor@mojatatu.com>
net/sched: cls_api: fix teardown of an adopted proto on insert-race loss
Nikhil Gautam <nikhilgtr@gmail.com>
iio: light: gp2ap002: re-enable irq if runtime suspend fails
Nikhil Gautam <nikhilgtr@gmail.com>
iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
Pu Lehui <pulehui@huawei.com>
bpf, cgroup: Fix storage null-ptr-deref after replacing prog
Yonghong Song <yonghong.song@linux.dev>
bpf: Implement mprog API on top of existing cgroup progs
Yonghong Song <yonghong.song@linux.dev>
cgroup: Add bpf prog revisions to struct cgroup_bpf
Ali Ahmet Memis <ali@iusegentoo.com>
Bluetooth: MSFT: validate evt_prefix_len against the response length
Guangshuo Li <lgs201920130244@gmail.com>
Bluetooth: btmtksdio: fix usage_count leak when autosuspend_delay is negative
Sean Wang <sean.wang@mediatek.com>
Bluetooth: btmtk: add MT7902 SDIO support
Sean Wang <sean.wang@mediatek.com>
Bluetooth: btmtk: add MT7902 MCU support
Sean Wang <sean.wang@mediatek.com>
mmc: sdio: add MediaTek MT7902 SDIO device ID
Linmao Li <lilinmao@kylinos.cn>
Bluetooth: MGMT: free the mesh send cancel command when it is cancelled
Linmao Li <lilinmao@kylinos.cn>
Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths
Linmao Li <lilinmao@kylinos.cn>
Bluetooth: hci_conn: fix the SCO setup context lifetime
Zijun Hu <zijun.hu@oss.qualcomm.com>
Bluetooth: btintel: Fix diagnostics event detection
HyeongJun An <sammiee5311@gmail.com>
Bluetooth: virtio_bt: avoid OOB read of build info string
Yichong Chen <chenyichong@uniontech.com>
btrfs: retry verity reads for not-uptodate Merkle folios
Yang Xiuwei <yangxiuwei@kylinos.cn>
scsi: sd: Fix sd_done() sense handling condition
Yang Xiuwei <yangxiuwei@kylinos.cn>
scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails
Swarna Prabhu <sw.prabhu6@gmail.com>
scsi: sd: Enable sector size > PAGE_SIZE in SCSI sd driver
Bart Van Assche <bvanassche@acm.org>
scsi: sd: Move the sd_config_discard() function definition
Bart Van Assche <bvanassche@acm.org>
scsi: sd: Move the sd_remove() function definition
Uwe Kleine-König <u.kleine-koenig@baylibre.com>
scsi: sd: Convert to SCSI bus methods
Uwe Kleine-König <u.kleine-koenig@baylibre.com>
scsi: core: sysfs: Make use of bus callbacks
Uwe Kleine-König <u.kleine-koenig@baylibre.com>
scsi: core: Pass a struct scsi_driver to scsi_{,un}register_driver()
Luis Chamberlain <mcgrof@kernel.org>
block/bdev: lift block size restrictions to 64k
Tanushree Shah <tshah@linux.ibm.com>
perf trace-event: Fix integer truncation in do_read() and skip()
Zijun Hu <zijun.hu@oss.qualcomm.com>
Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices
Zijun Hu <zijun.hu@oss.qualcomm.com>
Bluetooth: btusb: Record matched usb_device_id into btusb_data
Johan Hovold <johan@kernel.org>
Bluetooth: btusb: refactor endpoint lookup
Zijun Hu <zijun.hu@oss.qualcomm.com>
Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855()
Zijun Hu <zijun.hu@oss.qualcomm.com>
Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event
Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
sched/fair: Check CPU capacity before comparing group types during load balance
Adrian Hunter <adrian.hunter@intel.com>
perf/x86/intel/pt: Fix stop/start with no update
Adrian Hunter <adrian.hunter@intel.com>
perf/x86/intel/pt: Use bitwise access for PERF_HES_STOPPED
Adrian Hunter <adrian.hunter@intel.com>
perf/x86/intel/pt: Factor out pt_config_enable()
Adrian Hunter <adrian.hunter@intel.com>
perf/x86/intel/pt: Add support for pause / resume
Yuho Choi <dbgh9129@gmail.com>
ACPI: video: Release PCI device reference after lookup
Kamal Wadhwa <kamal.wadhwa@oss.qualcomm.com>
regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling
Yeoreum Yun <yeoreum.yun@arm.com>
coresight: etm4x: fix leaked trace id
Yeoreum Yun <yeoreum.yun@arm.com>
coresight: etm4x: fix underflow for usage of (nrseqstate - 1)
James Clark <james.clark@linaro.org>
coresight: Change syncfreq to be a u8
Yeoreum Yun <yeoreum.yun@arm.com>
coresight: etm4x: fix wrong check of etm4x_sspcicrn_present()
Bruce Johnston <bjohnsto@redhat.com>
md/raid1: don't set array_frozen in raid1_takeover()
Yu Kuai <yukuai@fygo.io>
md: avoid stale clone I/O accounting timestamps
Yu Kuai <yukuai@fygo.io>
md/raid5: round bitmap stripes with sector division
Loic Poulain <loic.poulain@oss.qualcomm.com>
phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend
Loic Poulain <loic.poulain@oss.qualcomm.com>
phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend
Loic Poulain <loic.poulain@oss.qualcomm.com>
phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend
Mohd Ayaan Anwar <mohd.anwar@oss.qualcomm.com>
phy: qcom: sgmii-eth: vote for both voltage rails with correct current loads
Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
phy: qcom-sgmii-eth: relax order of .power_on() vs .set_mode*()
Linkai Gong <gonglinkai@kylinos.cn>
soc: fsl: qe: check platform_driver_register() in qe_ic_of_init()
Yichong Chen <chenyichong@uniontech.com>
hugetlbfs: release subpool on fill_super failure
Simon Glass <sjg@chromium.org>
pinctrl: rockchip: Reset the pin count when recalculating SoC data
Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
firmware_loader: do not queue completed sysfs fallback requests
Manish Rangankar <mrangankar@marvell.com>
scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path
Timur Kristóf <timur.kristof@gmail.com>
drm/amdgpu/gfx6: Use PFP on the compute queues too
Timur Kristóf <timur.kristof@gmail.com>
drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets
Tanushree Shah <tshah@linux.ibm.com>
perf trace-event: Fix buffer overflow in read_string()
Gerald Loacker <gerald.loacker@wolfvision.net>
phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table
Felix Gu <ustc.gu@gmail.com>
phy: sunplus: fix error handling in sp_uphy_init()
Meghana Malladi <m-malladi@ti.com>
arm64: dts: ti: k3-am64: Fix MDIO clock reference for ICSSG0 node
Jan Kara <jack@suse.cz>
ext4: fix spurious message about orphan cleanup on RO fs
Timur Kristóf <timur.kristof@gmail.com>
drm/amdgpu/gfx6: Fixup emit_cntxcntl()
Pengpeng Hou <pengpeng@iscas.ac.cn>
mfd: iqs62x: Reject zero-length firmware records
Pengpeng Hou <pengpeng@iscas.ac.cn>
mfd: rave-sp: validate received frame payload lengths
Vladimir Murzin <vladimir.murzin@arm.com>
arm64: hibernate: Restore DAIF state on error
Ada Couprie Diaz <ada.coupriediaz@arm.com>
arm64: hibernate: mask DAIF before restoring hibernated kernel
Felix Fietkau <nbd@nbd.name>
wifi: mac80211: skip default WMM setup for AP_VLAN links
Leon Romanovsky <leon@kernel.org>
RDMA/erdma: restrict the driver to little-endian systems
Petr Pavlu <petr.pavlu@suse.com>
module/dups: Fix use-after-free in kmod_dup_req lifetime handling
Petr Pavlu <petr.pavlu@suse.com>
module/dups: Inform duplicate requests about the result directly
Naveen Kumar Chaudhary <naveen.osdev@gmail.com>
module: use strscpy() to copy module names in stats and dup tracking
Marco Crivellari <marco.crivellari@suse.com>
module: replace use of system_wq with system_dfl_wq
Shuangpeng Bai <shuangpeng.kernel@gmail.com>
RDMA/siw: Fix use-after-free in siw_accept()
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
IB/isert: post the full-feature receive buffers after session registration
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
IB/isert: delay the final Login Response until the session is registered
Karl Mehltretter <kmehltretter@gmail.com>
cpufreq: imx6q: fix out-of-bounds write when probed more than once
Karl Mehltretter <kmehltretter@gmail.com>
cpufreq: imx6q: fix devres accumulation across driver rebind
Jernej Skrabec <jernej.skrabec@gmail.com>
drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz
Jernej Skrabec <jernej.skrabec@gmail.com>
drm/sun4i: dw-hdmi: Drop TCON TOP port reference
Jernej Skrabec <jernej.skrabec@gmail.com>
drm/sun4i: tcon: Drop remote endpoint reference
Jernej Skrabec <jernej.skrabec@gmail.com>
drm/sun4i: crtc: Propagate layer initialization error
Jernej Skrabec <jernej.skrabec@gmail.com>
drm/sun4i: hdmi: Don't leak sync polarity bits into packet control
Jernej Skrabec <jernej.skrabec@gmail.com>
drm/sun4i: tcon: Drop TCON TOP device reference
Jernej Skrabec <jernej.skrabec@gmail.com>
drm/sun4i: tcon: Set output mux for DSI and LVDS
Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
of: property: add of_graph_get_next_port_endpoint()
Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
of: property: add of_graph_get_next_port()
Jernej Skrabec <jernej.skrabec@gmail.com>
drm/sun4i: vi scaler: Fix coefficient selection
Alexey Charkov <alchark@flipper.net>
clk: rockchip: rk3576: fix source muxes for SPI0..SPI4
Cen Zhang <zzzccc427@gmail.com>
ocfs2: synchronize heartbeat callbacks with o2net teardown
Xie Yuanbin <xieyuanbin1@huawei.com>
ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults
Linus Walleij <linusw@kernel.org>
ARM: 9481/2: breakpoint: CFI breakpoints only on demand
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ
Cheng Xu <chengyou@linux.alibaba.com>
RDMA/erdma: Hold QP references for AE and CM processing
Cheng Xu <chengyou@linux.alibaba.com>
RDMA/erdma: Hold CQ references when processing EQ events
Robertus Diawan Chris <robertusdchris@gmail.com>
modpost: prevent leak when early return no suffix .o in read_symbols()
Sergei Litvin <litvindev@gmail.com>
scripts/tags.sh: Prevent binary files appearing in cscope.files
Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
arm64: dts: qcom: sm7225-fairphone-fp4: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
arm64: dts: qcom: qcs8550-aim300: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
Sayali Patil <sayalip@linux.ibm.com>
selftests/mm: fix ternary operator precedence in ksm_tests
Sayali Patil <sayalip@linux.ibm.com>
selftests/mm: fix ksm NUMA merge test for systems with memoryless NUMA nodes
Mike Rapoport (Microsoft) <rppt@kernel.org>
selftests/mm: ksm_tests: use kselftest framework
Li Wang <liwang@redhat.com>
ksm_tests: skip hugepage test when Transparent Hugepages are disabled
Donet Tom <donettom@linux.ibm.com>
selftests/mm: add new test cases to the migration test
Pu Lehui <pulehui@huawei.com>
bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed
Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()
Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources()
Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
remoteproc: Move resource table data structure to its own header
Imran Shaik <imran.shaik@oss.qualcomm.com>
arm64: dts: qcom: agatti: Add missing CX power domain to DISPCC
Andreas Kemnade <andreas@kemnade.info>
drm/omap: dsi: Do not copy isr table
Inochi Amaoto <inochiama@gmail.com>
riscv: dts: sophgo: cv180x: Allow the DMA multiplexer to set channel number for DMA controller
Yichong Chen <chenyichong@uniontech.com>
fat: release buffer head after rebuilding parent
Guangshuo Li <lgs201920130244@gmail.com>
rapidio: clear mport->net when rio_add_net() fails
Calvin Owens <calvin@wbinvd.org>
pps-gpio: remove dead capture_clear code
Michael Byczkowski <by@by-online.de>
pps: pps-gpio: split IRQ handler into hardirq timestamper + threaded handler
Bastien Curutchet <bastien.curutchet@bootlin.com>
pps: clients: gpio: Bypass edge's direction check when not needed
Calvin Owens <calvin@wbinvd.org>
pps: don't try to wait for negative timeouts in PPS_FETCH
Bradley Morgan <include@grrlz.net>
lib/string: fix memchr_inv() for large ranges
Cen Zhang <zzzccc427@gmail.com>
ocfs2/cluster: keep heartbeat local node stable
Al Viro <viro@zeniv.linux.org.uk>
o2hb_region_dev_store(): avoid goto around fdget()/fdput()
Caleb Sander Mateos <csander@purestorage.com>
ublk: check for ublk_unmap_io() returning 0
Tao Cui <cuitao@kylinos.cn>
block/kyber-iosched: flush per-cpu latency buckets over possible CPUs
Tao Cui <cuitao@kylinos.cn>
block/blk-iocost: collect per-cpu latency stats over possible CPUs
Tao Cui <cuitao@kylinos.cn>
block/blk-stat: drain per-cpu callback stats over possible CPUs
Zheng Qixing <zhengqixing@huawei.com>
blk-cgroup: skip dying blkg in blkcg_activate_policy()
Breno Leitao <leitao@debian.org>
phonet: pep: do not write beyond optlen in getsockopt
Zxyan Zhu <zxyan0222@gmail.com>
net: stmmac: Skip PHY attach if custom PCS is in use
Sang-Heon Jeon <ekffu200098@gmail.com>
iio: light: tsl2583: return zero in write_raw() on success
Sang-Heon Jeon <ekffu200098@gmail.com>
iio: light: isl29028: return zero in write_raw() on success
Yuanshen Cao <alex.caoys@gmail.com>
iio: light: tsl2772: fix ALS calibscale readback
Arnaldo Carvalho de Melo <acme@redhat.com>
perf intel-bts: Fix off-by-one in auxtrace_info minimum size check
Arnaldo Carvalho de Melo <acme@redhat.com>
perf intel-pt: Fix off-by-one in auxtrace_info minimum size check
Arnaldo Carvalho de Melo <acme@redhat.com>
perf auxtrace: Fix queue grow overflow and old array leak
Arnaldo Carvalho de Melo <acme@redhat.com>
perf thread-stack: Fix heap buffer overflow on branch stack wrap copy
Jiancheng Huang <jchuang@seu.edu.cn>
HID: lg4ff: validate report length before fixed offsets
Chao Huang <huangchao@kylinos.cn>
HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure
Ai Chao <aichao@kylinos.cn>
HID: i2c-hid: Fix "(null)" output when reading report descriptor fails
Yousef Alhouseen <alhouseenyousef@gmail.com>
HID: synchronize input before cleaning up a failed probe
谢致邦 (XIE Zhibang) <Yeking@Red54.com>
HID: i2c-hid: Refactor _DSM helper and add i2c-hid-acpi-prp0001 driver
Karl Mehltretter <kmehltretter@gmail.com>
tty: clear cdev pointer after cdev_add() failure
Karl Mehltretter <kmehltretter@gmail.com>
serial: amba-pl011: unprepare console clock on unregister
Thomas Bogendoerfer <tsbogend@alpha.franken.de>
MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL
Saket Kumar Bhaskar <skb99@linux.ibm.com>
powerpc/irq: Fix missing r2 clobber in PCREL inline assembly
Gou Hao <gouhao@uniontech.com>
powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass
Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
firmware: coreboot: Validate table bounds
Titouan Ameline de Cadeville <titouan.ameline@gmail.com>
firmware: google: Add bounds checks in coreboot_table_populate()
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: disconnect on CSA to channel 0
Zhao Li <enderaoelyther@gmail.com>
wifi: mac80211: skip unused probe response countdown offsets
Slawomir Stepien <sst@poczta.fm>
wifi: zd1211rw: reject secondary interfaces to prevent conflicts
Zhao Li <enderaoelyther@gmail.com>
wifi: mac80211: send TWT teardown to peer after setup TX failure
Davidlohr Bueso <dave@stgolabs.net>
perf/cxlpmu: Fix 64-bit write to 32-bit HDM filter register
Pranjal Shrivastava <praan@google.com>
iommu/arm-smmu-v3: Convert to use atomic poll timeout
Linghui Wu <linghui.wu@oss.qualcomm.com>
wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump
shengwei.lu <shengwei.lu@mediatek.com>
wifi: mt76: mt7925: Fix EHT Beamformee SS subfields to meet 802.11be minimum
Javier Tia <floss@jetm.me>
wifi: mt76: mt7925: advertise EHT 320MHz capabilities for 6GHz band
Felix Fietkau <nbd@nbd.name>
wifi: mt76: mt7915: report RX chain signal for all RX paths
Felix Fietkau <nbd@nbd.name>
wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1
StanleyYP Wang <StanleyYP.Wang@mediatek.com>
wifi: mt76: mt7996: fix reg addr remap when addr is 0
Felix Fietkau <nbd@nbd.name>
wifi: mt76: mt7915: release hif2 reference on probe IRQ failure
Felix Fietkau <nbd@nbd.name>
wifi: mt76: mt7915: fix ext PHY use-after-free on register error path
Felix Fietkau <nbd@nbd.name>
wifi: mt76: mt7915: fix double hif2 init on the non-WED path
Felix Fietkau <nbd@nbd.name>
wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement
Yonghong Song <yonghong.song@linux.dev>
bpf, x86: Fix trampoline stack size for 128-bit arguments
Arnaldo Carvalho de Melo <acme@redhat.com>
perf machine: Check snprintf truncation for guest kallsyms path
Arnaldo Carvalho de Melo <acme@redhat.com>
perf machine: Free scandir entries in guest kernel map creation
Arnaldo Carvalho de Melo <acme@redhat.com>
perf machine: Reset errno before strtol in guest kernel map creation
Arnaldo Carvalho de Melo <acme@redhat.com>
perf machine: Don't abort guest map creation on first inaccessible dir
Arnaldo Carvalho de Melo <acme@redhat.com>
perf machine: Check snprintf truncation in machines__findnew()
Arnaldo Carvalho de Melo <acme@redhat.com>
perf machine: Use snprintf() for guestmount path construction
Arnaldo Carvalho de Melo <acme@redhat.com>
perf machine: Guard against NULL strlist in machines__findnew()
Arnaldo Carvalho de Melo <acme@redhat.com>
perf machine: Fix NULL parent dereference in fork event processing
Joy Zou <joy.zou@oss.nxp.com>
regulator: core: use system_freezable_wq for init complete work
Jeff Johnson <jeff.johnson@oss.qualcomm.com>
wifi: ath11k: fix leak in ath11k_service_ready_ext_event()
Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
drm/msm/dsi: Drop dev_pm_opp_set_rate(0)
Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0)
Leo Yan <leo.yan@arm.com>
perf: arm_spe: Make wakeup range check overflow safe
Can Peng <pengcan@kylinos.cn>
ACPI: processor: Unregister cpufreq notifier on init failure
Huisong Li <lihuisong@huawei.com>
ACPI: processor: idle: Optimize ACPI idle driver registration
Felix Fietkau <nbd@nbd.name>
wifi: mt76: only consume the WO drop bit on WED v2 devices
Felix Fietkau <nbd@nbd.name>
wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields
Felix Fietkau <nbd@nbd.name>
wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV
Felix Fietkau <nbd@nbd.name>
wifi: mt76: mt7915: unwind state on add_interface failure
Felix Fietkau <nbd@nbd.name>
wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config
Rex Lu <rex.lu@mediatek.com>
wifi: mt76: check txfree done event on the WED hw path
Felix Fietkau <nbd@nbd.name>
wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie
Felix Fietkau <nbd@nbd.name>
wifi: mt76: fix stranded frames in mt76_txq_schedule_pending
Felix Fietkau <nbd@nbd.name>
wifi: mt76: mt7915: write RX header translation bit to the correct register
Felix Fietkau <nbd@nbd.name>
wifi: mt76: mt7996: don't report a zero TX bitrate
Felix Fietkau <nbd@nbd.name>
wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss
Felix Fietkau <nbd@nbd.name>
wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear
Felix Fietkau <nbd@nbd.name>
wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset
Felix Fietkau <nbd@nbd.name>
wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[]
Michael-CY Lee <michael-cy.lee@mediatek.com>
wifi: mt76: fix non-AQL packet accounting for MLO stations
Shayne Chen <shayne.chen@mediatek.com>
wifi: mt76: mt7996: fix capability of EHT-MCS 15 in MRU
Eason Lai <Eason.Lai@mediatek.com>
wifi: mt76: mt792x: Fix memory leak in SDIO TX path
Jared.Huang <jared.huang@mediatek.com>
wifi: mt76: mt7925: fix msg len mismatch between driver and firmware
Eason Lai <Eason.Lai@mediatek.com>
wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete
Sean Wang <sean.wang@mediatek.com>
wifi: mt76: add init_wiphy callback
Zhi-Jun You <hujy652@gmail.com>
wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986
Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
wifi: mt76: mt7921: validate CLC firmware records
Devin Wittmayer <lucid_duck@justthetip.ca>
wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length
Yichong Chen <chenyichong@uniontech.com>
fanotify: report full event length for FIONREAD
Muhammad Usama Anjum <usama.anjum@arm.com>
misc: sgi-gru: remove interrupt-context page-table walks
Abdun Nihaal <nihaal@cse.iitm.ac.in>
misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe()
Jinjie Ruan <ruanjinjie@huawei.com>
powerpc/crash: Fix possible memory leak in update_crash_elfcorehdr()
Naveen Kumar Chaudhary <naveen.osdev@gmail.com>
locking/lockdep: Fix NULL pointer dereference in __lock_set_class()
Martin Wilck <mwilck@suse.com>
md/raid1: create serial pool adding rdev to array with serialize_policy=1
Yu Kuai <yukuai@fnnas.com>
md: merge mddev serialize_policy into mddev_flags
Yu Kuai <yukuai@fnnas.com>
md: merge mddev faillast_dev into mddev_flags
Yu Kuai <yukuai@fnnas.com>
md: merge mddev has_superblock into mddev_flags
Adrian Hunter <adrian.hunter@intel.com>
i3c: master: Fix device_register() error path
Jakub Kicinski <kuba@kernel.org>
i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices
Aneesh Kumar K.V (Arm) <aneesh.kumar@kernel.org>
swiotlb: Preserve allocation virtual address for dynamic pools
Aneesh Kumar K.V (Arm) <aneesh.kumar@kernel.org>
iommu/dma: Check atomic pool allocation result directly
Chen Cheng <chencheng@fnnas.com>
md: scope memalloc_noio to allocation critical sections
Abd-Alrhman Masalkhi <abd.masalkhi@gmail.com>
md: skip redundant raid_disks update when value is unchanged
Chen Cheng <chencheng@fnnas.com>
md: remove unused mddev argument from export_rdev
Chen Cheng <chencheng@fnnas.com>
md/bitmap: resume array on backlog_store() error path
Vladimir Zapolskiy <vz@kernel.org>
clk: qcom: Return expected ENOMEM error on dynamic allocation failure
Imran Shaik <imran.shaik@oss.qualcomm.com>
clk: qcom: gpucc-qcm2290: Park RCG's clk source at XO during disable
Stanislav Kinsburskii <skinsburskii@linux.microsoft.com>
lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone
Pu Lehui <pulehui@huawei.com>
bpf: Fix potential UAF when reading bpf link info
Pu Lehui <pulehui@huawei.com>
bpf: Fix potential UAF in bpf_netns_link_update_prog
Hongyan Xu <getshell@seu.edu.cn>
power: supply: sc2731_charger: cancel work on remove
Hongyan Xu <getshell@seu.edu.cn>
power: supply: isp1704_charger: cancel work on remove
Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
arm64: dts: qcom: sm8650: Fix the PCIe iommu-map entries
Neil Armstrong <neil.armstrong@linaro.org>
arm64: dts: qcom: sm8650: add OPP table support to PCIe
Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
arm64: dts: qcom: sm8550: Fix the PCIe iommu-map entries
Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
arm64: dts: qcom: sm8450: Fix the PCIe iommu-map entries
Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
arm64: dts: qcom: sm8350: Fix the PCIe iommu-map entries
Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
arm64: dts: qcom: sm8250: Fix the PCIe iommu-map entries
Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
arm64: dts: qcom: sm8150: Fix the PCIe iommu-map entries
Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
arm64: dts: qcom: sdm845: Fix the PCIe iommu-map entries
Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
arm64: dts: qcom: sc8180x: Fix the PCIe iommu-map entries
Dawid Wróbel <me@dawidwrobel.com>
arm64: dts: qcom: sm8250-xiaomi-elish: correct the board ID
Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
firmware: qcom: scm: Fix tzmem state on probe retry
Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published
Yuvaraj Ranganathan <yuvaraj.ranganathan@oss.qualcomm.com>
firmware: qcom: scm: instrument SMC call path with tracepoints
Yuvaraj Ranganathan <yuvaraj.ranganathan@oss.qualcomm.com>
firmware: qcom: scm: add trace events for the SMC call interface
Unnathi Chalicheemala <unnathi.chalicheemala@oss.qualcomm.com>
firmware: qcom_scm: Support multiple waitq contexts
Unnathi Chalicheemala <unnathi.chalicheemala@oss.qualcomm.com>
firmware: qcom_scm: Add API to get waitqueue IRQ info
Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
arm64: dts: qcom: sc8280xp-crd: Fix the pin index for misc_3p3_reg_en
Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
clk: qcom: gcc-qcm2290: don't park QUP RCGs upon registration
Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
arm64: dts: qcom: qcs404: Fix DTBS Check errors in usb controller nodes
Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
arm64: dts: qcom: sdm632-motorola-ocean: Fix LED default trigger property
Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
arm64: dts: qcom: msm8998: Don't pull-up I2C pins by default in sleep
Itai Handler <itai.handler@gmail.com>
rcu: Mark accesses to ->rcu_urgent_qs and ->rcu_need_heavy_qs
Jeff Johnson <jeff.johnson@oss.qualcomm.com>
wifi: ath11k: fix stride mismatch in mac_phy_caps_parse()
Jeff Johnson <jeff.johnson@oss.qualcomm.com>
wifi: ath12k: fix stride mismatch in mac_phy_caps_parse()
Alexei Starovoitov <ast@kernel.org>
slab: Reuse first bit for OBJEXTS_ALLOC_FAIL
Alexei Starovoitov <ast@kernel.org>
slab: Make slub local_(try)lock more precise for LOCKDEP
Vlastimil Babka <vbabka@suse.cz>
slab: simplify init_kmem_cache_nodes() error handling
Cheng-Han Wu <hank20010209@gmail.com>
selftests/zram: fix kernel_gte() for POSIX sh
Abd-Alrhman Masalkhi <abd.masalkhi@gmail.com>
md: recheck spare changes before starting sync
Thomas Weißschuh <thomas.weissschuh@linutronix.de>
tools/nolibc/powerpc: mark ctr and xer as clobbered by system call
Chen Cheng <chencheng@fnnas.com>
md/raid5: protect lockless recovery_offset accesses during reshape
Yu Kuai <yukuai3@huawei.com>
md: add a new recovery_flag MD_RECOVERY_LAZY_RECOVER
Li Nan <linan122@huawei.com>
md: rename recovery_cp to resync_offset
Zheng Qixing <zhengqixing@huawei.com>
md: allow removing faulty rdev during resync
Li Nan <linan122@huawei.com>
md: ensure resync is prioritized over recovery
Sajal Gupta <sajal2005gupta@gmail.com>
md/raid5-ppl: fix use-after-free in ppl_do_flush()
Chen Cheng <chencheng@fnnas.com>
md/raid5: protect bitmap batch counters aka seq_flush/seq_write consistency
Yuho Choi <dbgh9129@gmail.com>
bus: mhi: host: Fix controller cleanup on EDL sysfs failure
Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET
Abdun Nihaal <nihaal@cse.iitm.ac.in>
wifi: rtlwifi: pci: fix error path in rtl_pci_probe()
Hongyan Xu <getshell@seu.edu.cn>
platform/chrome: cros_ec_debugfs: Unregister panic notifier
Hongyan Xu <getshell@seu.edu.cn>
platform/chrome: cros_ec_debugfs: Clean up console log on probe failure
Ali Tariq <alitariq45892@gmail.com>
PCI: starfive: Fix unchecked pm_runtime_get_sync() in probe
Ali Tariq <alitariq45892@gmail.com>
PCI: starfive: Fix Runtime PM handling and teardown ordering
Jeff Johnson <jeff.johnson@oss.qualcomm.com>
wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()
Fan Wu <fanwu01@zju.edu.cn>
spi: davinci: switch to managed controller allocation
Guixin Liu <kanie@linux.alibaba.com>
nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
IB/isert: reject login PDUs declaring more data than was received
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
IB/isert: reject PDUs declaring more data than was received
Leon Romanovsky <leon@kernel.org>
RDMA/cxgb4: free STAG index when TPT entry write fails
Leon Romanovsky <leon@kernel.org>
RDMA/mlx5: Send cong param changes to the resolved port mdev
Leon Romanovsky <leon@kernel.org>
RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs
David Strahan <David.Strahan@microchip.com>
scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches.
Ryusuke Konishi <konishi.ryusuke@gmail.com>
nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch
David Lee <david.lee@trailofbits.com>
nilfs2: prevent out-of-bounds read in super root block parsing
Joshua Crofts <joshua.crofts1@gmail.com>
nilfs2: fix infinite loop in nilfs_clean_segments()
Alexey Charkov <alchark@flipper.net>
clk: rockchip: Fix the fractional part denominator on RK3588/RK3576 PLLs
Akari Tsuyukusa <akkun11.open@gmail.com>
clk: mediatek: mt8135: Fix inverted gate control for devapc_ck
longlong yan <yanlonglong@kylinos.cn>
clk/x86: pmc_atom: add kasprintf return value check
Myeonghun Pak <mhun512@gmail.com>
clk: palmas: Manage external-control prepare with devm
Guangshuo Li <lgs201920130244@gmail.com>
clk: tegra: tegra124-emc: put EMC node on register failure
Ondrej Jirman <megi@xff.cz>
arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix
Zhao Li <enderaoelyther@gmail.com>
wifi: mac80211: fix per-STA profile length in cross-link CSA parsing
Yonatan Nachum <ynachum@amazon.com>
RDMA/efa: Fix PBL chunk length computation
Nicolin Chen <nicolinc@nvidia.com>
iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs
Nicolin Chen <nicolinc@nvidia.com>
iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs
Nicolin Chen <nicolinc@nvidia.com>
iommu/tegra241-cmdqv: Use request_threaded_irq
Weiming Shi <bestswngs@gmail.com>
fs/ntfs3: reject restart table growth beyond U16_MAX entries
Ivy Lopez <skunkolee@gmail.com>
staging: rtl8723bs: use kfree_sensitive() for key material
Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
remoteproc: Prevent crash handling to race with rproc_del()
Jingyi Wang <jingyi.wang@oss.qualcomm.com>
remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work()
Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
remoteproc: Allow shutdown of crashed processors
Peng Fan <peng.fan@nxp.com>
remoteproc: core: Drop redundant initialization of 'ret' in rproc_shutdown()
Babanpreet Singh <bbnpreetsingh@gmail.com>
w1: ds2482: Fix signedness bug in ds2482_w1_triplet()
Fan Wu <fanwu01@zju.edu.cn>
spi: oc-tiny: switch to managed controller allocation
Yichong Chen <chenyichong@uniontech.com>
isofs: release zisofs block pointer buffer head
Sumeet Pawnikar <sumeet4linux@gmail.com>
powercap: intel_rapl_tpmi: Handle PMU registration failure during probe
Maher Sanalla <msanalla@nvidia.com>
RDMA/mlx5: Fix integer overflow of user QP buffer size
Can Peng <pengcan@kylinos.cn>
crypto: keembay - publish OF module alias for OCS AES/SM4
Linmao Li <lilinmao@kylinos.cn>
crypto: keembay - Initialize completion before requesting IRQ
Li Qiang <liqiang01@kylinos.cn>
scsi: ufs: debugfs: Reserve space for a string terminator
Babanpreet Singh <bbnpreetsingh@gmail.com>
power: supply: sbs-battery: Use a per-device serial number buffer
James Clark <james.clark@linaro.org>
tools/build: Allow versioning of all LLVM tools defined in Makefile.include
Tomas Glozar <tglozar@redhat.com>
tools/build: Add bpftool-skeletons feature test
Justin Yeh <justin.yeh@mediatek.com>
pinctrl: mediatek: free EINT resources on unbind
Nícolas F. R. A. Prado <nfraprado@collabora.com>
pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms
Hao Chang <ot_chhao.chang@mediatek.com>
pinctrl: mediatek: Fix the invalid conditions
Hao Chang <ot_chhao.chang@mediatek.com>
pinctrl: mediatek: Add EINT support for multiple addresses
Alison Schofield <alison.schofield@intel.com>
cxl/region: Fix use-after-free in find_pos_and_ways() error path
Feng Yang <yangfeng@kylinos.cn>
selftests/bpf: Fix memory leak on subtest_states reallocation
Feng Yang <yangfeng@kylinos.cn>
selftests/bpf: Fix incorrect error checking for pthread_create
Karl Mehltretter <kmehltretter@gmail.com>
ARM: lpc32xx: only run SoC init on LPC32xx hardware
Fabio Estevam <festevam@gmail.com>
arm64: dts: rockchip: Fix Gru WLAN sideband interrupt
Osama Abdelkader <osama.abdelkader@gmail.com>
drm/panthor: return PTR_ERR() from devm_drm_dev_alloc()
Weiming Wu <weiming3@asu.edu>
fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init
Florian Westphal <fw@strlen.de>
netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet
Can Peng <pengcan@kylinos.cn>
drm/tve200: add OF module alias for autoloading
Cosmo Chou <chou.cosmo@gmail.com>
leds: pca9532: Fix phantom device registration on missing hardware
Malaya Kumar Rout <malayarout91@gmail.com>
PM: hibernate: Fix memory leak in snapshot_write_next() error path
Leon Romanovsky <leon@kernel.org>
RDMA/erdma: complete object teardown when the destroy command fails
Boshi Yu <boshiyu@linux.alibaba.com>
RDMA/erdma: Support non-sleeping erdma_post_cmd_wait()
Boshi Yu <boshiyu@linux.alibaba.com>
RDMA/erdma: Fix incorrect response returned from query_qp
Boshi Yu <boshiyu@linux.alibaba.com>
RDMA/erdma: Add the query_qp command to the cmdq
Boshi Yu <boshiyu@linux.alibaba.com>
RDMA/erdma: Refactor the code of the modify_qp interface
Boshi Yu <boshiyu@linux.alibaba.com>
RDMA/erdma: Add erdma_modify_qp_rocev2() interface
Boshi Yu <boshiyu@linux.alibaba.com>
RDMA/erdma: Add address handle implementation
Boshi Yu <boshiyu@linux.alibaba.com>
RDMA/erdma: Add the erdma_query_pkey() interface
Boshi Yu <boshiyu@linux.alibaba.com>
RDMA/erdma: Add GID table management interfaces
Boshi Yu <boshiyu@linux.alibaba.com>
RDMA/erdma: Probe the erdma RoCEv2 device
Sanghyun Park <sanghyun.park.cnu@gmail.com>
xfrm: Fix skb double-free in xfrm_dev_direct_output()
Leo Yan <leo.yan@arm.com>
perf cs-etm: Avoid truncating AUX buffer sizes to int
Leo Yan <leo.yan@arm.com>
perf cs-etm: Flush thread stacks after decoder reset
Sudeep Holla <sudeep.holla@kernel.org>
firmware: arm_scmi: Unrequest devices if driver registration fails
Sudeep Holla <sudeep.holla@kernel.org>
firmware: arm_scmi: Roll back partial protocol table registration
Marco Scardovi <scardracs@disroot.org>
cpufreq/amd-pstate: Toggle auto_sel in active mode on shared memory systems
Lifeng Zheng <zhenglifeng1@huawei.com>
ACPI: CPPC: Modify cppc_get_auto_sel_caps() to cppc_get_auto_sel()
Lifeng Zheng <zhenglifeng1@huawei.com>
ACPI: CPPC: Refactor register value get and set ABIs
Lifeng Zheng <zhenglifeng1@huawei.com>
ACPI: CPPC: Add cppc_set_reg_val()
Lifeng Zheng <zhenglifeng1@huawei.com>
ACPI: CPPC: Rename cppc_get_perf() to cppc_get_reg_val()
Lifeng Zheng <zhenglifeng1@huawei.com>
ACPI: CPPC: Optimize cppc_get_perf()
Lifeng Zheng <zhenglifeng1@huawei.com>
ACPI: CPPC: Add IS_OPTIONAL_CPC_REG macro to judge if a cpc_reg is optional
Mario Limonciello <mario.limonciello@amd.com>
cpufreq/amd-pstate: Store the boost numerator as highest perf again
Andre Przywara <andre.przywara@arm.com>
ARM: dts: allwinner: a10: Fix PMU interrupt
Xiang Mei <xmei5@asu.edu>
ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()
Guanghui Yang <3497809730@qq.com>
ext4: fix buffer_head leak in ext4_init_orphan_info
Selvin Xavier <selvin.xavier@broadcom.com>
RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap
Jeff Johnson <jeff.johnson@oss.qualcomm.com>
wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx()
Jeff Johnson <jeff.johnson@oss.qualcomm.com>
wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx()
Jeff Johnson <jeff.johnson@oss.qualcomm.com>
wifi: ath11k: Correctly copy the hint BSSID in WMI scan request
Jeff Johnson <jeff.johnson@oss.qualcomm.com>
wifi: ath12k: Correctly copy the hint BSSID in WMI scan request
Jeff Johnson <jeff.johnson@oss.qualcomm.com>
wifi: ath6kl: avoid buffer overreads in WMI event handlers
Baokun Li <libaokun@linux.alibaba.com>
ext4: drain in-flight DIO before buffered write fallback
Gerald Yang <gerald.yang@canonical.com>
ext4: clear stale xarray tags on folios skipped during writeback
Pengpeng Hou <pengpeng@iscas.ac.cn>
thermal: intel: int3400: clean up ODVP on probe failures
Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
iommu/qcom: Fix inverted fault report check in qcom_iommu_fault()
Haoxiang Li <haoxiang_li2024@163.com>
iommu/qcom: Remove sysfs device on probe failure path
Sudeep Holla <sudeep.holla@kernel.org>
firmware: arm_scmi: Fix requested device removal race
Patrisious Haddad <phaddad@nvidia.com>
RDMA/core: Fix potential use after free in ib_dealloc_pd_user()
Patrisious Haddad <phaddad@nvidia.com>
RDMA/core: Fix potential use after free in ib_free_cq()
Mark Zhang <markzhang@nvidia.com>
RDMA/core: Add driver APIs pre_destroy_cq() and post_destroy_cq()
Patrisious Haddad <phaddad@nvidia.com>
RDMA/core: Fix potential use after free in counter_release()
Patrisious Haddad <phaddad@nvidia.com>
RDMA/core: Fix potential use after free in ib_destroy_srq_user()
Patrisious Haddad <phaddad@nvidia.com>
RDMA/core: Fix potential use after free in ib_destroy_cq_user()
Patrisious Haddad <phaddad@nvidia.com>
RDMA/core: Fix use after free in ib_query_qp()
Patrisious Haddad <phaddad@nvidia.com>
RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations
Jason Gunthorpe <jgg@ziepe.ca>
RDMA/nldev: Fix locking when accessing mr->pd
Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
RDMA/restrack: Fix typos in the comments
Myeonghun Pak <mhun512@gmail.com>
RDMA/erdma: Fix CEQ tasklet use-after-free on removal
Takuma Fujiwara <t-fujiwara1@ti.com>
PCI: j721e: Fix incorrect max_lanes for J7200
Leon Romanovsky <leon@kernel.org>
RDMA/srpt: Pass the mapped task attribute to target_init_cmd()
Kumar Kartikeya Dwivedi <memxor@gmail.com>
bpf: Preserve unique-field state across nested structs
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
ACPI: battery: Adjust charging status validation check
Pu Lehui <pulehui@huawei.com>
riscv, bpf: Fix memory leak in bpf_jit_free
Ricardo B. Marlière <rbm@suse.com>
libbpf: Search /lib64 and /lib in resolve_full_path()
Yun Zhou <yun.zhou@windriver.com>
ext4: skip extra isize expansion during mount to prevent deadlock
Xiang Mei <xmei5@asu.edu>
ext4: fix out-of-bounds read in ext4_read_inline_dir()
Yun Zhou <yun.zhou@windriver.com>
ext4: fix circular lock dependency in ext4_ext_migrate
Chen Pei <cp0613@linux.alibaba.com>
ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root
Pengpeng Hou <pengpeng@iscas.ac.cn>
ACPI: processor: validate MADT IOAPIC entry bounds
Zhu Ling <zhuling2709@phytium.com.cn>
ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer
Pengpeng Hou <pengpeng@iscas.ac.cn>
RDMA/nldev: validate dynamic counter attribute length
Kemeng Shi <shikemeng@huaweicloud.com>
irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc()
Viktor Malik <vmalik@redhat.com>
selftests/bpf: Silence array bounds warning in global_map_resize
Frank Li <Frank.Li@nxp.com>
arm64: dts: imx8-ss-audio: Fix LPCG clock indices for ASRC0
Marco Elver <elver@google.com>
kcsan: avoid unintended access checking in NMIs
TanZheng <tanzheng@kylinos.cn>
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
Ibrahim Hashimov <security@auditcode.ai>
RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[]
Danila Chernetsov <listdansp@mail.ru>
RDMA/hfi1: Propagate sdma_txinit_ahg() errors
Jun Yan <jerrysteve1101@gmail.com>
arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe
Jun Yan <jerrysteve1101@gmail.com>
arm64: dts: amlogic: meson-axg: Add missing nand_rb0 pin to nand_all_pins
Can Peng <pengcan@kylinos.cn>
phy: starfive: Fix runtime PM cleanup in JH7110 DPHY RX probe
Can Peng <pengcan@kylinos.cn>
phy: starfive: Fix runtime PM cleanup in JH7110 DPHY TX probe
Linmao Li <lilinmao@kylinos.cn>
ASoC: meson: Keep link pointers valid on realloc failure
Koichiro Den <den@valinux.co.jp>
dmaengine: dw-edma: Clear stale requests on termination
Koichiro Den <den@valinux.co.jp>
dmaengine: dw-edma: Serialize channel state checks
Koichiro Den <den@valinux.co.jp>
dmaengine: dw-edma: Serialize abort state updates
Koichiro Den <den@valinux.co.jp>
dmaengine: dw-edma: Terminate all descriptors without callbacks
Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>
bpf: Reject arena frees below the arena base
Puranam V G Tejaswi <puranam.tejaswi@oss.qualcomm.com>
drm/msm/a6xx: Fix RBBM_CLOCK_CNTL3_TP0 value in a730_hwcg
Yuho Choi <dbgh9129@gmail.com>
driver core: soc: Unregister bus on early device registration failure
Alban Bedel <alban.bedel@lht.dlh.de>
software node: Fix software_node_get_reference_args() with index -1
Ian Rogers <irogers@google.com>
perf ui hists: Fix uninitialized stack memory free on pstack allocation failure
zhouminqiang <zhouminqiang2@huawei.com>
mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()
Ruoyu Wang <ruoyuw560@gmail.com>
mtd: mtdswap: Avoid freeing registered blktrans device twice
Pengpeng Hou <pengpeng@iscas.ac.cn>
soc: ti: knav_qmss: Remove debugfs file on teardown
Md Shofiqul Islam <shofiqtest@gmail.com>
soc: ti: knav_qmss_queue: Implement resource cleanup in remove()
Xiang Mei <xmei5@asu.edu>
vfio/pci: clear vdev->msi_perm after freeing it on init failure
Myeonghun Pak <mhun512@gmail.com>
char: xilinx_hwicap: unregister class on init errors
Pei Xiao <xiaopei01@kylinos.cn>
ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove
Linmao Li <lilinmao@kylinos.cn>
ppdev: prevent overflow when setting port timeout
Breno Leitao <leitao@debian.org>
cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64)
Pengpeng Hou <pengpeng@iscas.ac.cn>
misc: ad525x_dpot: use driver core groups for sysfs files
Gleb Markov <markov.gi@npc-ksb.ru>
misc: rtsx: add missing write register handling
Gui-Dong Han <hanguidong02@gmail.com>
misc: bcm-vk: Use acquire/release for msgq_inited
Pavel Zhigulin <Pavel.Zhigulin@kaspersky.com>
speakup: keyhelp: guard letter_offsets possible out-of-range indexing
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status()
Yuho Choi <dbgh9129@gmail.com>
uio: Fix stale info pointer in failed registration path
David Lee <david.lee@trailofbits.com>
UDF symlink pathComponent header OOB read
Karl Mehltretter <kmehltretter@gmail.com>
tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64
Xu Yang <xu.yang_2@nxp.com>
usb: gadget: f_uac1_legacy: remove broken string configfs attributes
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
ACPI: processor: idle: Expand _LPI package sanity checks
Thorsten Blum <thorsten.blum@linux.dev>
crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping
Pu Lehui <pulehui@huawei.com>
bpf: Sync tail_call_reachable with callee state on entry
Shivam Rawat <shivrawa@qti.qualcomm.com>
drm/msm/a6xx: Fix stale rpmh votes after suspend
Mikko Perttunen <mperttunen@nvidia.com>
gpu: host1x: Avoid stack over-read in debug output helpers
Mikko Perttunen <mperttunen@nvidia.com>
gpu: host1x: Fix offset calculation in trace_write_gather
Avraham Stern <avraham.stern@intel.com>
wifi: iwlwifi: mei: pass correct argument to function
Emmanuel Grumbach <emmanuel.grumbach@intel.com>
wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments
Avraham Stern <avraham.stern@intel.com>
wifi: iwlwifi: mei: check SAP message length before reading it
Emmanuel Grumbach <emmanuel.grumbach@intel.com>
wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser
Emmanuel Grumbach <emmanuel.grumbach@intel.com>
wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs
Ian Rogers <irogers@google.com>
perf jevents: Add more components to the metric sorting order
Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
arm64: dts: qcom: sm8250: correct frequencies in the Iris OPP table
Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
arm64: dts: qcom: sm8250: sort out Iris power domains
Pengyu Luo <mitltlatltl@gmail.com>
arm64: dts: qcom: sc8280xp-x13s: Fix the drive-strength of mclk pin
Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
arm64: dts: qcom: msm8996-xiaomi-gemini: Fix up ti,drv2604 enable GPIO
Maoyi Xie <maoyixie.tju@gmail.com>
drm/bridge: tc358767: clamp the reported AUX read size to the request
Uday Khare <udaykhare77@gmail.com>
remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev
Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply()
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
cpufreq: intel_pstate: Fix setting minimum P-state at init time
Gleb Markov <markov.gi@npc-ksb.ru>
drm/amd/display: Remove unused-but-set variable hubp from
Ruoyu Wang <ruoyuw560@gmail.com>
media: ipu6: Do not free aux device pdata after init
Eugen Hristev <ehristev@kernel.org>
media: bcm2835-unicam: Fix asc leaked in error/remove path
Biren Pandya <birenpandya@gmail.com>
media: i2c: rdacm21: Fix missing media_entity_cleanup()
Qingshuang Fu <fuqingshuang@kylinos.cn>
irqchip/renesas-irqc: Fix generic interrupt chip leak on remove
Yuho Choi <dbgh9129@gmail.com>
PCI: xgene: Drop unnecessary OF node reference
Marc Zyngier <maz@kernel.org>
PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN
Dan Carpenter <error27@gmail.com>
cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate()
John Groves <John@Groves.net>
dax: read holder_ops once in dax_holder_notify_failure()
Bryam Vargas <hexlabsecurity@proton.me>
libnvdimm/labels: Bound the on-media label size before the shift
Sudeep Holla <sudeep.holla@kernel.org>
firmware: arm_scmi: Unwind P2A receiver mailbox setup failure
Sudeep Holla <sudeep.holla@kernel.org>
firmware: arm_scmi: Unwind TX receiver mailbox setup failure
Sudeep Holla <sudeep.holla@kernel.org>
firmware: arm_scmi: Drop handle on protocol bind failures
Sudeep Holla <sudeep.holla@kernel.org>
firmware: arm_scmi: Protect device request lookup with RCU
Sudeep Holla <sudeep.holla@kernel.org>
firmware: arm_scmi: Use channel ID for transport teardown
Sudeep Holla <sudeep.holla@kernel.org>
firmware: arm_scmi: Reject out of range DT protocol IDs
Sudeep Holla <sudeep.holla@kernel.org>
firmware: arm_scmi: Avoid IDR updates while cleaning channels
Sudeep Holla <sudeep.holla@kernel.org>
firmware: arm_scmi: Free transport channel on IDR failure
Sudeep Holla <sudeep.holla@kernel.org>
firmware: arm_scmi: Clean up channels on setup failure
Sudeep Holla <sudeep.holla@kernel.org>
firmware: arm_scmi: Quiesce notifications before teardown
Sudeep Holla <sudeep.holla@kernel.org>
firmware: arm_scmi: Unregister device notifier before IDR teardown
Sudeep Holla <sudeep.holla@kernel.org>
firmware: arm_scmi: Publish channel state before callbacks
David Stevens <stevensd@google.com>
x86/entry/fred: Encode frame pointer on entry
Baochen Qiang <baochen.qiang@oss.qualcomm.com>
wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate
Kyle Zeng <kylebot@openai.com>
hfsplus: validate thread record before delete key rebuild
HE WEI（ギカク） <skyexpoc@gmail.com>
fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
Nirbhay Sharma <nirbhay.lkd@gmail.com>
fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list
Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr()
Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
fs/ntfs3: Add more checks in mi_enum_attr (part 2)
Dave Jiang <dave.jiang@intel.com>
cxl/pci: Honor -EPROBE_DEFER from component register setup
Dave Jiang <dave.jiang@intel.com>
cxl/mbox: Break poison list loop on an empty payload
Guzebing <Guzebing1612@gmail.com>
cxl/memdev: Fix firmware upload exact-fit handling
Vishnu Santhosh <vishnu.santhosh@oss.qualcomm.com>
rpmsg: glink: fix deadlock in endpoint destroy during driver detach
Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
rpmsg: glink: remove duplicate code for rpmsg device remove
Hans Verkuil <hverkuil+cisco@kernel.org>
media: v4l2-async: Unregister sub-device if asc_list is empty
Samuel Moelius <sam.moelius@trailofbits.com>
iommufd/selftest: Avoid selftest dirty bitmap size wrap
Xiang Mei <xmei5@asu.edu>
isofs: fix out-of-bounds page array access on empty zisofs block
James Calligeros <jcalligeros99@gmail.com>
ASoC: apple: mca: increase SERDES reset delay
Leon Romanovsky <leon@kernel.org>
RDMA/hfi1: Initialize debugfs after probe completes
Leon Romanovsky <leon@kernel.org>
RDMA/hfi1: Stop flushing the global IB workqueue
Leon Romanovsky <leon@kernel.org>
RDMA/hfi1: Create workqueues before device initialization
Leon Romanovsky <leon@kernel.org>
RDMA/hfi1: Remove redundant PCI device ID validation
Leon Romanovsky <leon@kernel.org>
RDMA/hfi1: Free RX data on late probe failure
Leon Romanovsky <leon@kernel.org>
RDMA/hfi1: Preserve unit 0 on allocation failure
Sean Rhodes <sean@starlabs.systems>
misc: rtsx_usb: avoid USB I/O in runtime autosuspend
Pengpeng Hou <pengpeng@iscas.ac.cn>
pmdomain: bcm: bcm2835: handle genpd provider registration errors
Evgenii Burenchev <evg28bur@yandex.ru>
ALSA: hpi: Check transport errors during HPI6000 adapter initialization
Xiang Mei <xmei5@asu.edu>
xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
Yuho Choi <dbgh9129@gmail.com>
hwrng: ks-sa - Fix runtime PM cleanup on registration failure
Atish Patra <atishp@meta.com>
crypto: ccp - Fix memory leak in SEV INIT_EX path
Allison Henderson <achender@kernel.org>
RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state
Leon Romanovsky <leon@kernel.org>
RDMA/ipoib: Drain RCU callbacks during module teardown
Leon Romanovsky <leon@kernel.org>
RDMA/mlx5: Drain RCU callbacks during module teardown
Leon Romanovsky <leon@kernel.org>
RDMA/core: Wait for RCU callbacks before unloading ib_core
Mert Seftali <mertsftl@gmail.com>
iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE
Brian Masney <bmasney@redhat.com>
clk: qcom: camcc-sc8280xp: unregister CAMCC_GDSC_CLK
Pengpeng Hou <pengpeng@iscas.ac.cn>
bus: qcom-ebi2: use managed resources for clocks and children
Pengpeng Hou <pengpeng@iscas.ac.cn>
soc: qcom: rpmh-rsc: manage PM notifiers with devres
Yu Peng <pengyu@kylinos.cn>
perf metricgroup: Fix metric expression copy leaks
Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
drm/panel: samsung-s6d16d0: Power off on prepare failure
Biju Das <biju.das.jz@bp.renesas.com>
usb: renesas_usbhs: Fix power-off ordering on unbind
Fei Shao <fshao@chromium.org>
usb: mtu3: allow system suspend during active gadget connection
Linmao Li <lilinmao@kylinos.cn>
platform/surface: acpi-notify: Check ACPI companion before use
Linmao Li <lilinmao@kylinos.cn>
platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL
Gary Guo <gary@garyguo.net>
usb: fix UAF when probe runs concurrent to dyn ID removal
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
USB: make to_usb_driver() use container_of_const()
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
USB: make single lock for all usb dynamic id lists
Ruoyu Wang <ruoyuw560@gmail.com>
usb: gadget: aspeed_udc: check endpoint DMA allocation
Maoyi Xie <maoyixie.tju@gmail.com>
usb: ljca: bound bank_num in ljca_enumerate_gpio()
Michael Bommarito <michael.bommarito@gmail.com>
usb: gadget: configfs: fix out-of-bounds read of qw_sign
Nuno Sá <nuno.sa@analog.com>
usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths
Guangshuo Li <lgs201920130244@gmail.com>
serial: qcom-geni: do not advance stale DMA completions
Yuho Choi <dbgh9129@gmail.com>
serial: ma35d1: Fix OF node reference leaks in console init
Liang Luo <luoliang@kylinos.cn>
selftests/sched_ext: Fix bpf_link leak on early return in prog_run
Wolfram Sang <wsa+renesas@sang-engineering.com>
hwspinlock: propagate errno when registering single lock
Felix Gu <gu_0233@qq.com>
remoteproc: qcom_q6v5_adsp: Fix reference leak for device node
Armin Wolf <W_Armin@gmx.de>
platform/x86: lg-laptop: Fix LED resource handling
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
platform/x86: lg-laptop: Convert ACPI driver to a platform one
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
platform/x86: lg-laptop: Drop debug-only ACPI notify handler
Armin Wolf <W_Armin@gmx.de>
platform/x86: dell-wmi-base: Fix resource leak on module load failure
Armin Wolf <W_Armin@gmx.de>
platform/x86: dell-privacy: Fix race condition
Lorenzo Pieralisi <lpieralisi@kernel.org>
ACPI: RISC-V: Fix riscv_acpi_add_prt_dep() loop handling
Lorenzo Pieralisi <lpieralisi@kernel.org>
ACPI: RISC-V: Check acpi_get_handle() status in riscv_acpi_add_prt_dep()
Lorenzo Pieralisi <lpieralisi@kernel.org>
ACPI: RISC-V: Fix riscv_acpi_irq_get_dep() loop termination
John Ogness <john.ogness@linutronix.de>
printk: Fix possible console use-after-free
Andrew Murray <amurray@thegoodpenguin.co.uk>
printk: Introduce console_flush_one_record
Jinchao Wang <wangjinchao600@gmail.com>
panic/printk: replace other_cpu_in_panic() with panic_on_other_cpu()
Jinchao Wang <wangjinchao600@gmail.com>
panic/printk: replace this_cpu_in_panic() with panic_on_this_cpu()
Jinchao Wang <wangjinchao600@gmail.com>
panic: introduce helper functions for panic state
Donghyeok Choe <d7271.choe@samsung.com>
printk/panic: Add option to allow non-panic CPUs to write to the ring buffer.
Cosmo Chou <chou.cosmo@gmail.com>
leds: pca9532: Fix inverted GPIO output polarity
Wei Wang <wei.w.wang@hotmail.com>
iommu/amd: Fix false positive in SB IOAPIC IVRS validation
Fu Hao <fuhao@open-hieco.net>
iommu/amd: Add support for Hygon family 18h model 4h IOAPIC
Wei Wang <wei.w.wang@hotmail.com>
iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors
Vladimir Zapolskiy <vz@kernel.org>
iommu/msm: Return -ENOMEM on memory allocation failure in probe
Akari Tsuyukusa <akkun11.open@gmail.com>
iommu/mediatek-v1: Fix off-by-one in MT2701_LARB_NR_MAX
Yuho Choi <dbgh9129@gmail.com>
bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation
Sanghyun Park <sanghyun.park.cnu@gmail.com>
bpf: Fix use-after-free on mm_struct in bpf_find_vma()
Breno Leitao <leitao@debian.org>
efi: fix stale reference to efi_recover_from_page_fault()
Daniel Borkmann <daniel@iogearbox.net>
bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux
Tanushree Shah <tshah@linux.ibm.com>
perf dso: Fix kallsyms DSO detection with fallback logic
Sandipan Das <sandipan.das@amd.com>
perf vendor events amd: Reintroduce deprecated Zen 5 core events
Aleksandr Nogikh <nogikh@google.com>
udf: Mark LVID buffer as uptodate before marking it dirty
Hongyan Xu <getshell@seu.edu.cn>
usb: gadget: r8a66597: avoid double free of ep0_req in probe error path
Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
usb: typec: ucsi: unregister debugfs entries on teardown
Dan Carpenter <error27@gmail.com>
thermal/drivers/rcar: Fix error checking in probe()
Tanushree Shah <tshah@linux.ibm.com>
perf data convert json: Fix trace_seq memory leak in process_sample_event()
Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
arm64: dts: qcom: sc8180x-lenovo-flex-5g: Describe the display power net
Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
arm64: dts: qcom: sc8180x-lenovo-flex-5g: Rename regulator nodes
Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
arm64: dts: qcom: sc8180x-primus: Describe the display power net
Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
arm64: dts: qcom: sc8180x-primus: Rename regulator nodes
Herman van Hazendonk <github.com@herrie.org>
clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister()
Herman van Hazendonk <github.com@herrie.org>
clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains
Herman van Hazendonk <github.com@herrie.org>
clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status
David Woodhouse <dwmw@amazon.co.uk>
timekeeping: Account for monotonicity adjustment in ntp_error
Thomas Weißschuh <thomas.weissschuh@linutronix.de>
y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32
Yuho Choi <dbgh9129@gmail.com>
clocksource: Unregister subsystem on device registration failure
Jiangshan Yi <yijiangshan@kylinos.cn>
selftests: timers: leap-a-day: Fix -w option and update usage comment
Kemeng Shi <shikemeng@huaweicloud.com>
irqchip/gic-v3-its: Fix its node leak in gic_acpi_parse_madt_its()
Kemeng Shi <shikemeng@huaweicloud.com>
irqchip/gic-v3-its: Fix memleak in its_probe_one()
Wang Yan <wangyan01@kylinos.cn>
selftests/lsm: Fix memory leak in attr_lsm_count
Feng Yang <yangfeng@kylinos.cn>
selftests/bpf: Fix memory leak in msg_alloc_iov
Malaya Kumar Rout <malayarout91@gmail.com>
selftests/bpf: Fix memory leak in msg_alloc_iov error path
Evgenii Burenchev <evg28bur@yandex.ru>
ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer()
Dawei Feng <dawei.feng@seu.edu.cn>
staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()
Ayush Mukkanwar <ayushmukkanwar@gmail.com>
staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown
Ayush Mukkanwar <ayushmukkanwar@gmail.com>
staging: octeon: replace pr_warn with dev_warn in fill and rx paths
Ayush Mukkanwar <ayushmukkanwar@gmail.com>
staging: octeon: ethernet-mem: replace pr_warn with dev_warn in free functions
Yuvraj Singh Chauhan <ysinghcin@gmail.com>
staging: octeon: fix free_irq dev_id mismatch in cvm_oct_rx_shutdown
Ayush Mukkanwar <ayushmukkanwar@gmail.com>
staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown
Dan Carpenter <error27@gmail.com>
staging: fbtft: Use sysfs_emit_at() to print to sysfs file
Bryam Vargas <hexlabsecurity@proton.me>
greybus: audio: bound the topology section sizes against the fetched size
Rong Zhang <i@rong.moe>
staging: sm750fb: Add missing Kconfig dependency
Ahmet Sezgin Duran <ahmet@sezginduran.net>
staging: sm750fb: gate dualview dataflow using g_dualview
Alexander A. Klimov <grandmaster@al2klimov.de>
staging: greybus: audio: correct sscanf() return value check
Cen Zhang <zzzccc427@gmail.com>
wifi: mac80211_hwsim: avoid NULL skb in stop queue drain
Ruoyu Wang <ruoyuw560@gmail.com>
bus: qcom-ebi2: Fix clock leak on probe failure
Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
bus: qcom-ebi2: Simplify with scoped for each OF child loop
Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
arm64: dts: qcom: hamoa: Fix clocks for HSPHYs
Luca Weiss <luca.weiss@fairphone.com>
arm64: dts: qcom: sm7225-fairphone-fp4: Fix address in fb node name
Waiman Long <longman@redhat.com>
cgroup/cpuset: Make nr_deadline_tasks an atomic_t
Haowen Tu <tuhaowen@uniontech.com>
PM: sleep: Fix off-by-one in wakelocks number limit check
Yuho Choi <dbgh9129@gmail.com>
bus: ti-sysc: Fix /chosen node reference leak
Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
nvmet-rdma: fix response resource leak on queue teardown
Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
nvmet-rdma: factor out response resource cleanup
Gui-Dong Han <hanguidong02@gmail.com>
nvme-apple: Use acquire/release for queue enabled state
Myeonghun Pak <mhun512@gmail.com>
crypto: keembay - Fix AEAD unregister count in error path
Pengpeng Hou <pengpeng@iscas.ac.cn>
crypto: rk3288 - fail ahash requests on HASH idle timeout
Pengpeng Hou <pengpeng@iscas.ac.cn>
crypto: sa2ul - stop probe if context pool creation fails
Lothar Rubusch <l.rubusch@gmail.com>
crypto: atmel-sha204a - fix heap info leak on I2C transfer failure
Thorsten Blum <thorsten.blum@linux.dev>
crypto: atmel-ecc - reject hardware ECDH without a public key
Thorsten Blum <thorsten.blum@linux.dev>
crypto: atmel-ecc - clean up and improve ECDH comments
Thorsten Blum <thorsten.blum@linux.dev>
crypto: atmel-ecc - replace min_t with min
Giovanni Cabiddu <giovanni.cabiddu@intel.com>
crypto: qat - clear AES key schedule from stack
Giovanni Cabiddu <giovanni.cabiddu@intel.com>
crypto: qat - cancel work on re-enable SR-IOV timeout
Manos Pitsidianakis <manos@pitsidianak.is>
hwrng: core - fix rng list on registration error
Sandipan Das <sandipan.das@amd.com>
perf vendor events amd: Update Zen 5 core events
Sandipan Das <sandipan.das@amd.com>
perf/x86/amd/uncore: Add group validation
Leo Yan <leo.yan@arm.com>
perf cs-etm: Fix thread leaks on trace queue init failure
James Clark <james.clark@linaro.org>
perf cs-etm: Queue context packets for frontend
Pengpeng Hou <pengpeng@iscas.ac.cn>
wifi: rtw89: fix HE extended capability length check
Tzung-Bi Shih <tzungbi@kernel.org>
platform/chrome: sensorhub: Fix memory overread in ring handler
Hisam Mehboob <hisamshar@gmail.com>
selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check
Hanlin Song <pgeorge8929@gmail.com>
csky: Fix a4/a5 restoration in syscall trace path
Sanjay Chitroda <sanjayembeddedse@gmail.com>
iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure
Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
soundwire: qcom: Fix port exhaustion check in stream_alloc_ports
Vladimir Zapolskiy <vz@kernel.org>
dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe
Suraj Gupta <suraj.gupta2@amd.com>
dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers
Vladimir Zapolskiy <vz@kernel.org>
dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure
Gregory Price <gourry@gourry.net>
mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug
Gregory Price <gourry@gourry.net>
mm: name the anonymous MMOP enum as enum mmop
Israel Batista <linux@israelbatista.dev.br>
mm: change type of state in struct memory_block
Israel Batista <linux@israelbatista.dev.br>
mm: convert memory block states (MEM_*) macros to enum
Gregory Price <gourry@gourry.net>
mm: add build-time option for hotplug memory default online type
Sechang Lim <rhkrqnwk98@gmail.com>
bpf,lsm: Drop bpf_prog_free from sleepable_lsm_hooks
Guillaume Maudoux <layus.on@gmail.com>
selftests/bpf: Mask socket type flags in mptcpify prog
Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>
selftests/bpf: Systematically add SO_REUSEADDR in start_server_addr
Leon Hwang <leon.hwang@linux.dev>
bpf: Copy per-CPU map value padding in copy_map_value_long()
Yichong Chen <chenyichong@uniontech.com>
tools/bpf/bpftool: Reset vmlinux BTF after struct_ops commands
Yichong Chen <chenyichong@uniontech.com>
tools/bpf/bpftool: Reset vmlinux BTF after map commands
Asad Kamal <asad.kamal@amd.com>
drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup
Asad Kamal <asad.kamal@amd.com>
drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup
Uday Khare <udaykhare77@gmail.com>
regulator: tps6594: Fix device node reference leaks in multiphase loop
Michael Walle <mwalle@kernel.org>
regulator: tps6594-regulator: refactor variant descriptions
Michael Walle <mwalle@kernel.org>
regulator: tps6594-regulator: remove hardcoded buck config
Michael Walle <mwalle@kernel.org>
regulator: tps6594-regulator: remove interrupt_count
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
regulator: tps6594-regulator: Constify struct tps6594_regulator_irq_type
Ian Rogers <irogers@google.com>
perf tests: Fix flakiness in branch stack sampling tests
Ian Rogers <irogers@google.com>
perf test: Fixes for check branch stack sampling
James Clark <james.clark@linaro.org>
perf test: Extend branch stack sampling test for Arm64 BRBE
James Clark <james.clark@linaro.org>
perf test: Add syscall and address tests to brstack test
James Clark <james.clark@linaro.org>
perf test: Refactor brstack test
Ian Rogers <irogers@google.com>
perf tests: Harden branch stack sampling test
James Clark <james.clark@linaro.org>
perf test brstack: Speed up running test by using tr -s instead of xargs
Ian Rogers <irogers@google.com>
perf tests: Fix flakiness in BPF counters test on hybrid systems
Namhyung Kim <namhyung@kernel.org>
perf test: Fix perf stat --bpf-counters on hybrid machines
Tengda Wu <wutengda@huaweicloud.com>
perf test: Use sqrtloop workload to test bperf event
Ian Rogers <irogers@google.com>
perf tests: Skip metrics validation if system-wide recording lacks permission
Namhyung Kim <namhyung@kernel.org>
perf test: Do not skip when some metrics tests succeeded
Ian Rogers <irogers@google.com>
perf test all metrics: Fully ignore Default metric failures
Ian Rogers <irogers@google.com>
perf test metrics: Update all metrics for possibly failing default metrics
Ian Rogers <irogers@google.com>
perf tests metrics: Permission related fixes
Ian Rogers <irogers@google.com>
perf test stat_all_metrics: Ensure missing events fail test
Namhyung Kim <namhyung@kernel.org>
perf test: Update all metrics test like metricgroups test
Sean Young <sean@mess.org>
media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define
Sean Young <sean@mess.org>
media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define
Jinjie Ruan <ruanjinjie@huawei.com>
riscv: kexec_file: Fix crashk_low_res not exclude bug
Song Shuai <songshuaishuai@tinylab.org>
riscv: kexec_file: Split the loading of kernel and others
Daniel McCarthy <daniel@dragonzap.com>
pinctrl: bcm2835: Don't remove an unregistered GPIO chip
Zide Chen <zide.chen@intel.com>
perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails
Chen, Yu C <yu.c.chen@intel.com>
sched/fair: Fix overflow in update_tg_cfs_runnable()
Wei Yang <richard.weiyang@gmail.com>
mm/mm_init: fix incorrect node_spanned_pages
Henrik Grimler <henrik.grimler@axis.com>
drm/lima: call drm_mm_init() with a valid allocation range
Brian Masney <bmasney@redhat.com>
clk: imx: scu: drop redundant init.ops variable assignment
Frieder Schrempf <frieder.schrempf@kontron.de>
arm64: dts: imx93-kontron: set memory node to 0x80000000/1GiB
Weigang He <geoffreyhe2@gmail.com>
ARM: imx: fix device_node refcount leaks in imx7_src_init()
Weigang He <geoffreyhe2@gmail.com>
ARM: imx: fix device_node refcount leak in imx_src_init()
Min zhang <zhangmin2026@yeah.net>
clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller
Shengjiu Wang <shengjiu.wang@nxp.com>
ASoC: fsl_audmix: rework runtime PM handling in probe
Runyu Xiao <runyu.xiao@seu.edu.cn>
ASoC: rt700-sdw: always drain jack work on remove
Joey Lu <a0987203069@gmail.com>
clk: nuvoton: ma35d1: fix ma35d1_clk_pll_determine_rate logic
Brian Masney <bmasney@redhat.com>
clk: nuvoton: ma35d1-pll: convert from round_rate() to determine_rate()
Joey Lu <a0987203069@gmail.com>
clk: nuvoton: ma35d1: fix PLL_CTL1_FRAC bit field width and fractional calc
Joey Lu <a0987203069@gmail.com>
clk: nuvoton: ma35d1: fix ignored div_u64 return values in PLL freq calculation
Alexander A. Klimov <grandmaster@al2klimov.de>
clk: moxart: remove unused variables, fix refcount leak
Myeonghun Pak <mhun512@gmail.com>
clk: versaclock7: Fix APLL clock leak on probe failure
Wei Hou <wei.hou@scaleflux.com>
cxl/pci: Remove incorrect mbox.valid check in cxl_pci_type3_init_mailbox()
Richard Cheng <icheng@nvidia.com>
cxl/mbox: Clamp mailbox output allocation to the payload size
Dave Jiang <dave.jiang@intel.com>
cxl: Refactor user ioctl command path from mds to mailbox
Gui-Dong Han <hanguidong02@gmail.com>
media: cec-pin: Fix event FIFO ordering
Weigang He <geoffreyhe2@gmail.com>
soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap()
Michael Bommarito <michael.bommarito@gmail.com>
HID: roccat: bound device-supplied profile index
Christos Maragkos <whitetowersoftware@gmail.com>
HID: nintendo: Fix imu_timestamp_us double increment per report
Philipp Weber <kernel@phwe.de>
HID: core: quiesce input in hid_hw_stop() to prevent use-after-free
Maoyi Xie <maoyixie.tju@gmail.com>
platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count
Jens Remus <jremus@linux.ibm.com>
x86/cfi: Use symmetric SYM_START and SYM_END in __CFI_TYPE()
Wanwu Li <liwanwu@kylinos.cn>
sched_ext/scx_flatcg: Fix cvtime_delta race and add hweight scaling to bypass charging
Konstantin Andreev <andreev@swemel.ru>
smack: restrict smackfs/{direct,mapped} values to 0-255
Konstantin Andreev <andreev@swemel.ru>
smack: deduplicate smackfs/{direct,mapped} file_operations
Dmitry Antipov <dmantipov@yandex.ru>
smack: simplify write handlers of sysfs entries
Konstantin Andreev <andreev@swemel.ru>
smack: fix incorrect task context in smack_msg_queue_msgrcv
Maxime Ripard <mripard@kernel.org>
drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure
Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format
Maíra Canal <mcanal@igalia.com>
drm/v3d: Clear queue->active_job when v3d_fence_create() fails
Maíra Canal <mcanal@igalia.com>
drm/v3d: Replace a global spinlock with a per-queue spinlock
Paul Kocialkowski <paulk@sys-base.io>
drm: lcdif: Wait for vblank before disabling DMA
Yicong Hui <yiconghui@gmail.com>
drm: Remove unused header in drm_dumb_buffers.c
Casey Schaufler <casey@schaufler-ca.com>
Smack: Fix error in capability bypass
SJ Park <sj@kernel.org>
mm/damon/core: skip aging from repeated aggressive merging
Sven Eckelmann <sven@narfation.org>
batman-adv: fix TX priority extraction for BATADV_FORW_MCAST
Martin Blumenstingl <martin.blumenstingl@googlemail.com>
clk: meson: align gxbb_32k_clk_sel number of parents with actual count
Arnaldo Carvalho de Melo <acme@redhat.com>
perf sched: Fix register_pid() overflow, strcpy, and BUG_ON
Sven Eckelmann <sven@narfation.org>
batman-adv: bla: avoid CRC corruption due to parallel claim add
Sven Eckelmann <sven@narfation.org>
batman-adv: dat: atomically update mac addresses
Sean Shen <grayhat@foxmail.com>
ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE
Junyi Liu <moss80199@gmail.com>
ksmbd: fix durable reconnect error path file lifetime
Akif <akif.sait111@gmail.com>
ksmbd: fix use-after-free in smb2_open during durable reconnect
Zilin Guan <zilin@seu.edu.cn>
of: unittest: Fix memory leak in unittest_data_add()
SJ Park <sj@kernel.org>
mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of()
SJ Park <sj@kernel.org>
mm/damon/core-kunit: handle region split failure in filter_out()
SJ Park <sj@kernel.org>
mm/damon/vaddr-kunit: check region count in three_regions test
SJ Park <sj@kernel.org>
mm/damon/paddr: drop last same folio access check reuse optimization
SJ Park <sj@kernel.org>
mm/damon/ops-common: use nr_accesses moving sum for quota score
SJ Park <sj@kernel.org>
mm/damon/vaddr: drop last same folio access check optimization
Kazuki Hanai <hnkz.64@gmail.com>
nvmet-auth: Synchronize timeout work during SQ teardown
Dragos Tatulea <dtatulea@nvidia.com>
net/mlx5e: xsk: Fix unlocked writing to ICOSQ
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: zero pipe read compound padding
Arthur Gautier <baloo@superbaloo.net>
xhci: fix lost bounce buffers on TDs spanning several ring segments
David Howells <dhowells@redhat.com>
afs: Fix leak of ungot volume
Zhenhao Wan <whi4ed0g@gmail.com>
drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE
Zhenhao Wan <whi4ed0g@gmail.com>
drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE
Zhenhao Wan <whi4ed0g@gmail.com>
drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op
Faith Ekstrand <faith.ekstrand@collabora.com>
drm/nouveau: Use write-combined maps for coherent
Marek Czernohous <marek@czernohous.de>
drm/nouveau: unsubscribe the channel-kill event before the fence context
Sunday Clement <Sunday.Clement@amd.com>
drm/amdkfd: Reject zero-sized AQL queue allocations after size halving
Vladimir Marioukhine <Vladimir.Marioukhine@amd.com>
drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore
Sunil Khatri <sunil.khatri@amd.com>
drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT
Kanala Ramalingeswara Reddy <Kanala.RamalingeswaraReddy@amd.com>
drm/amdgpu: Skip accessing psp rum time db for APUs
Guangshuo Li <lgs201920130244@gmail.com>
drm/amdgpu: fix autosuspend cleanup during removal
Yang Wang <kevinyang.wang@amd.com>
drm/amdgpu: check thunderbolt before switcheroo registration
Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used
Kavan Smith <kavansmith82@gmail.com>
drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value
Tao Yu <tao1.yu@intel.com>
drm/gud: validate TV mode names before creating enum property
Deepanshu Kartikey <kartikey406@gmail.com>
drm/gud: NUL-terminate TV mode names read from the device
David (Ming Qiang) Wu <David.Wu3@amd.com>
drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check
Harry Wentland <harry.wentland@amd.com>
drm/amd/display: validate plane degamma LUT size for private color prop
Harry Wentland <harry.wentland@amd.com>
drm/amd/display: avoid divide-by-zero in __is_lut_linear()
Thomas Zimmermann <tzimmermann@suse.de>
drm/hibmc: Use drm_atomic_helper_check_plane_state()
Thomas Zimmermann <tzimmermann@suse.de>
drm/hibmc: Fix list of formats on the primary plane
Amit Barzilai <amit.barzilai22@gmail.com>
drm/ssd130x: fix column and row end address in partial updates in ssd133x
Wentao Liang <vulab@iscas.ac.cn>
drm/sun4i: fix refcount leak in sun4i_backend_init_sat()
Amit Barzilai <amit.barzilai22@gmail.com>
drm/ssd130x: fix column and row end address in partial updates for ssd132x
Deepanshu Kartikey <kartikey406@gmail.com>
drm/i915: Guard against NULL driver_data in i915_pci_probe()
Danilo Krummrich <dakr@kernel.org>
drm: fix race between partial drm_dev_register() failure and ioctl
Johan Hovold <johan@kernel.org>
drm/panel-edp: fix i2c adapter leak on probe failure
Johan Hovold <johan@kernel.org>
drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure
Osama Abdelkader <osama.abdelkader@gmail.com>
drm/panthor: fix firmware control interface bounds checks
Chao Yu <chao@kernel.org>
f2fs: fix to zero post-EOF data when extending file size
Chen Changcheng <chenchangcheng@kylinos.cn>
f2fs: fix valid block count leak on data block allocation failure
Chao Yu <chao@kernel.org>
f2fs: fix to off-by-one issue in f2fs_zero_post_eof_page()
Zhan Xusheng <zhanxusheng1024@gmail.com>
f2fs: fix i_size when pinned fallocate partially fails
Daeho Jeong <daehojeong@google.com>
f2fs: fix to migrate all curseg types during free_segment_range
Wenjie Qi <qwjhust@gmail.com>
f2fs: avoid NULL checkpoint thread access in sysfs
Wenjie Qi <qwjhust@gmail.com>
f2fs: return writeback error from collapse range
Zhan Xusheng <zhanxusheng1024@gmail.com>
f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set()
Hao-Qun Huang <alvinhuang0603@gmail.com>
f2fs: reject overlapping move range after len expansion
Wenjie Qi <qwjhust@gmail.com>
f2fs: return symlink writeback errors
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Drop vport reference under lock in report ID acquisition
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Avoid double completion in async IOCB timeout
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Quiesce response IRQ before freeing request queue
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb()
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Don't query firmware state while chip is down
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Fix FCE trace enable parsing in debugfs
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Fix cs84xx use-after-free on host teardown
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Serialize flash version read in reset handler
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config()
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Initialize NVMe abort_work once at submission
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Bound i2c->length in I2C bsg handlers
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers
Jackson Lee <jackson.lee@chipsnmedia.com>
media: chips-media: wave5: Guard bit depth check with initial_info_obtained
Ruoyu Wang <ruoyuw560@gmail.com>
media: zoran: Avoid freeing a registered video_device twice
Arash Golgol <arash.golgol@gmail.com>
media: vimc: fix pixel format lookup in enum_framesizes
Uday Khare <udaykhare77@gmail.com>
media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure
Mohammed EL Kadiri <med08elkadiri@gmail.com>
media: venus: fix payload size calculation in parse_raw_formats()
Mohammed EL Kadiri <med08elkadiri@gmail.com>
media: venus: fix payload size returned by parse_caps() and parse_alloc_mode()
Biren Pandya <birenpandya@gmail.com>
media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link
Ming Qian <ming.qian@oss.nxp.com>
media: v4l2-ctrls: Allow unknown HDR10 white point and luminance
Xu Rao <raoxu@uniontech.com>
media: v4l2-async: avoid deleting unlinked ASC entry on link error
Ilya Krutskih <devsec@tpz.ru>
media: tda18250: fix possible integer overflow
Guangshuo Li <lgs201920130244@gmail.com>
media: saa7164: fix cleanup on resource allocation failure
Lei Huang <huanglei@kylinos.cn>
media: s2255: check firmware size before reading trailing marker
HyeongJun An <sammiee5311@gmail.com>
media: s2255: bound JPEG frame size before copying into the buffer
Valery Borovsky <vebohr@gmail.com>
media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure
Valery Borovsky <vebohr@gmail.com>
media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak
Myeonghun Pak <mhun512@gmail.com>
media: rc: sunxi-cir: Unregister rc device on probe failure
Guoniu Zhou <guoniu.zhou@oss.nxp.com>
media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks
Guoniu Zhou <guoniu.zhou@oss.nxp.com>
media: nxp: imx8-isi: Correct color map between V4L2 and ISI
Guoniu Zhou <guoniu.zhou@oss.nxp.com>
media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing
Johan Hovold <johan@kernel.org>
media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup
Guangshuo Li <lgs201920130244@gmail.com>
media: platform: mtk-mdp3: Fix SCP device refcounting
Christian Hewitt <christianshewitt@gmail.com>
media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common
Cong Nguyen <congnt264@gmail.com>
media: intel/ipu6: fix async notifier cleanup leak on parse error
Biren Pandya <birenpandya@gmail.com>
media: i2c: ov7740: fix use-after-destroy in remove
Biren Pandya <birenpandya@gmail.com>
media: i2c: ov02a10: fix endpoint parsing use-after-free
Narasimharao Vadlamudi <ahmisaranrao@gmail.com>
media: i2c: imx415: Return test pattern write errors
Martin Hecht <mhecht73@gmail.com>
media: i2c: alvium: Fix: Correct name of register in alvium_set_ctrl_auto_exposure
Shuangpeng Bai <shuangpeng.kernel@gmail.com>
media: go7007: defer the ALSA v4l2 put until card release
Jiangong.Han <jiangong.han@windriver.com>
media: em28xx: fix use-after-free of dev_next->devlist on disconnect
Diego Fernando Mancera Gomez <diegomancera.dev@gmail.com>
media: em28xx: defer audio-only extension registration
Fan Wu <fanwu01@zju.edu.cn>
media: cx23885: cancel NetUP CI work before teardown
Bryam Vargas <hexlabsecurity@proton.me>
media: cx231xx: reject geometry changes while the VBI queue is busy
Ruoyu Wang <ruoyuw560@gmail.com>
media: cobalt: Avoid freeing ALSA private data twice
Dawei Feng <dawei.feng@seu.edu.cn>
media: cedrus: fix memory leak in cedrus_init_ctrls()
Ruoyu Wang <ruoyuw560@gmail.com>
media: cec: Serialize exclusive follower delivery
Yi Ding <yi.s.ding@gmail.com>
media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash
Hans Verkuil <hverkuil+cisco@kernel.org>
media: cec: extron-da-hd-4k-plus: add sanity check
Biren Pandya <birenpandya@gmail.com>
media: cec: disable delayed work before freeing an interrupted transmit
Jonas Karlman <jonas@kwiboo.se>
media: cec: core: Fix kmemleak due to missed rc_free_device() call
Ming Qian <ming.qian@oss.nxp.com>
media: amphion: Remove obsolete frame_count check in venc_start_session
Valery Borovsky <vebohr@gmail.com>
media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref
Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
LoongArch: Avoid preempt count underflow without probe
Wentao Guan <guanwentao@uniontech.com>
LoongArch: Do not save/restore percpu base register in rethook trampoline
Nathan Chancellor <nathan@kernel.org>
LoongArch: Do not select HAVE_RUST when KASAN is enabled
Bibo Mao <maobibo@loongson.cn>
LoongArch: Fix acpi_package_ids[] array overflow
Zeng Chi <zengchi@kylinos.cn>
LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY
Chaithanya Lagisetty <nagachaithanya9911@gmail.com>
LoongArch: KVM: Free init resources if kvm_init() fails
Tao Cui <cuitao@kylinos.cn>
LoongArch: KVM: Fix TOCTOU race on pv_features
Christian Borntraeger <borntraeger@linux.ibm.com>
KVM: s390: Restore sigset on error path
Christian Borntraeger <borntraeger@linux.ibm.com>
KVM: s390: pv: Fix rc/rrc offset for PVM_DUMP
Christian Borntraeger <borntraeger@linux.ibm.com>
KVM: s390: Zero initialize irq in reinject_machine_check
Christian Borntraeger <borntraeger@linux.ibm.com>
KVM: s390: Take srcu when importing watchpoint data
Christian Borntraeger <borntraeger@linux.ibm.com>
KVM: s390: Free guest debug data on vcpu destroy
Christian Borntraeger <borntraeger@linux.ibm.com>
KVM: s390: Fix old_data leak in guest debug error path
Christian Borntraeger <borntraeger@linux.ibm.com>
KVM: s390: Fix memory leak in guest debug handling
Christian Borntraeger <borntraeger@linux.ibm.com>
KVM: s390: Fix length check __import_wp_info()
Sean Christopherson <seanjc@google.com>
KVM: x86: Ensure runtime reads of disabled_quirks are resolved once
Sean Christopherson <seanjc@google.com>
KVM: x86: Serialize writes to disabled_quirks using kvm->lock
Carlos López <clopez@suse.de>
KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock
Sean Christopherson <seanjc@google.com>
KVM: x86/mmu: Fold kvm_mmu_zap_memslot() into kvm_arch_flush_shadow_memslot()
Yosry Ahmed <yosry@kernel.org>
KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU
Yosry Ahmed <yosry@kernel.org>
KVM: nVMX: Service local TLB flushes on failed nested VM-Enter
Sean Christopherson <seanjc@google.com>
KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit
Sean Christopherson <seanjc@google.com>
KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02
Yosry Ahmed <yosry@kernel.org>
KVM: nVMX: Always flush vpid02 on first use
Nikhil Gautam <nikhilgtr@gmail.com>
iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask
Nikhil Gautam <nikhilgtr@gmail.com>
iio: light: opt4001: Reject integration times with a non-zero seconds part
Nikhil Gautam <nikhilgtr@gmail.com>
iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem()
Nikhil Gautam <nikhilgtr@gmail.com>
iio: light: opt4001: Fix power down clearing bits of the wrong register
Sanjay Chitroda <sanjayembeddedse@gmail.com>
iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register()
Cong Nguyen <congnt264@gmail.com>
iio: srf04: fix pm_runtime handling on probe error path
Can Peng <pengcan@kylinos.cn>
iio: pressure: mpl115: Fix runtime PM cleanup
Rupesh Majhi <zoone.rupert@gmail.com>
iio: pressure: dps310: fix NULL pointer dereference on ACPI probe
Vidhu Sarwal <vidhu.linux@gmail.com>
iio: light: ltrf216a: fix runtime PM reference leak in error path
Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
iio: light: gp2ap002: Disable regulators on resume failure
Giorgi Tchankvetadze <giorgi@tchankvetadze.com>
iio: light: cm32181: return zero after writing calibscale
Cong Nguyen <congnt264@gmail.com>
iio: gyro: mpu3050: fix sign of raw angular velocity readings
Erick Henrique <erick.henrique.rodrigues@usp.br>
iio: dac: m62332: Fix regulator reference count imbalance
Linmao Li <lilinmao@kylinos.cn>
iio: chemical: sgp30: Handle IAQ thread creation failure
Fan Wu <fanwu01@zju.edu.cn>
iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF
Moksh Panicker <mokshpanicker.7@gmail.com>
iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable
Lars-Peter Clausen <lars@metafoo.de>
iio: buffer: Tie IIO dma fence lock lifetime to the fence
Lars-Peter Clausen <lars@metafoo.de>
iio: buffer: Make IIO DMA fence release RCU-safe
Lars-Peter Clausen <lars@metafoo.de>
iio: buffer: Fix potential use-after-free in anonymous buffer release
Cong Nguyen <congnt264@gmail.com>
iio: adc: pac1921: fix wrong channel used in trigger handler read
Joshua Crofts <joshua.crofts1@gmail.com>
iio: adc: max34408: add missing 'select REGMAP_I2C' to Kconfig
WenTao Liang <vulab@iscas.ac.cn>
ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get
Binbin Zhou <zhoubinbin@loongson.cn>
ASoC: loongson: Fix error handling in ACPI property parsing
Haoxiang Li <haoxiang_li2024@163.com>
AsoC: intel: sst: fix PCI device reference leak on probe failure
Haoxiang Li <haoxiang_li2024@163.com>
ASoC: hdac_hda: Fix hlink refcount leak on component registration failure
Haoxiang Li <haoxiang_li2024@163.com>
ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure
Runyu Xiao <runyu.xiao@seu.edu.cn>
ASoC: cs35l34: drain threaded IRQ before runtime suspend
Runyu Xiao <runyu.xiao@seu.edu.cn>
ASoC: cs35l33: drain threaded IRQ before runtime suspend
Linkai Gong <gonglinkai@kylinos.cn>
i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure
Stephan Gerhold <stephan.gerhold@linaro.org>
clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks
Stephan Gerhold <stephan.gerhold@linaro.org>
clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk
Stephan Gerhold <stephan@gerhold.net>
clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk
Stephan Gerhold <stephan@gerhold.net>
clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src
Stephan Gerhold <stephan@gerhold.net>
clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src
Heiko Stuebner <heiko.stuebner@cherry.de>
clk: rockchip: rk3588: Don't change PLL rates when setting dclk_vop2_src
Stephan Gerhold <stephan.gerhold@linaro.org>
clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk
Stephan Gerhold <stephan.gerhold@linaro.org>
clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk
Sven Eckelmann <sven@narfation.org>
batman-adv: bla: prevent CRC corruptions after claim flush
Sven Eckelmann <sven@narfation.org>
batman-adv: bla: fix freeing of claims on meshif deletion
Sven Eckelmann <sven@narfation.org>
batman-adv: dat: avoid unaligned fault in IP extraction
Sven Eckelmann <sven@narfation.org>
batman-adv: mcast: linearize skbuff for packet generation
Sven Eckelmann <sven@narfation.org>
batman-adv: mcast: ensure unshared skb for multicast packets
Zhiling Zou <zhilinz@nebusec.ai>
batman-adv: fix stale receive device on merged fragments
Pengpeng Hou <pengpeng@iscas.ac.cn>
mtd: rawnand: validate ONFI extended parameter page sections
Xu Rao <raoxu@uniontech.com>
mtd: mtdoops: free page bitmap when the backing MTD is removed
Pengpeng Hou <pengpeng@iscas.ac.cn>
mtd: afs: validate v2 image info bounds
Anthony Krowiak <akrowiak@linux.ibm.com>
s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object
Anthony Krowiak <akrowiak@linux.ibm.com>
s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap
Anthony Krowiak <akrowiak@linux.ibm.com>
s390/vfio-ap: Fix NULL deref in status_show() during queue probe
Anthony Krowiak <akrowiak@linux.ibm.com>
s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed
Anthony Krowiak <akrowiak@linux.ibm.com>
s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL
Anthony Krowiak <akrowiak@linux.ibm.com>
s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove
Anthony Krowiak <akrowiak@linux.ibm.com>
s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove
Anthony Krowiak <akrowiak@linux.ibm.com>
s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm()
Sourabh Jain <sourabhjain@linux.ibm.com>
powerpc/crash: stop watchdogs before booting kdump kernel
Sourabh Jain <sourabhjain@linux.ibm.com>
powerpc/pseries: Move H_WATCHDOG definitions to a common header
Sourabh Jain <sourabhjain@linux.ibm.com>
powerpc/pseries: Handle and log pseries-wdt registration failures
Muchun Song <muchun.song@linux.dev>
powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population
Jinjie Ruan <ruanjinjie@huawei.com>
powerpc/kexec_file: Prevent kexec range truncation
Jinjie Ruan <ruanjinjie@huawei.com>
powerpc/kexec_file: Fix null-ptr-def in extra size calculation
Helge Deller <deller@gmx.de>
parisc: Fix alignment of asm statements in head.S
Pei Xiao <xiaopei01@kylinos.cn>
parisc: eisa: Fix infinite loop when parsing invalid IRQ value
Bryam Vargas <hexlabsecurity@proton.me>
nvdimm/btt: reject an arena whose nfree is below the lane count
Wupeng Ma <mawupeng1@huawei.com>
mm/hugetlb: fix missing migratable flag on same-node hugetlb migration
caina <caina@uniontech.com>
Revert "irqchip/mbigen: Fix mbigen node address layout"
Shivam Kumar <kumar.shivam43666@gmail.com>
nvmet-tcp: reject unsolicited H2CData PDUs
Shivam Kumar <kumar.shivam43666@gmail.com>
nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
nvme-tcp: check the data direction of a C2HData PDU
Niklas Cassel <cassel@kernel.org>
nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails
Xu Rao <raoxu@uniontech.com>
nvme-fabrics: fix DHCHAP secret leak on parse failure
Takashi Iwai <tiwai@suse.de>
ALSA: pcm: Fix race between non-atomic ops and trigger-start
Runyu Xiao <runyu.xiao@seu.edu.cn>
ALSA: harmony: initialize locks before requesting IRQ
HyeongJun An <sammiee5311@gmail.com>
ALSA: rawmidi: Return the error from snd_rawmidi_input_params()
Karl Mehltretter <kmehltretter@gmail.com>
arm64: mm: Fix the lockless page-table walk in show_pte()
Ahmad Byagowi <ahmadexp@gmail.com>
i2c: mux: Fix channel node leak on adapter add failure
Vasileios Almpanis <vasilisalmpanis@gmail.com>
i2c: core: fix debugfs UAF on adapter removal
Sizhe Liu <liusizhe5@huawei.com>
perf hisi-ptt: Fix PTT trace TLP header parsing
Viktor Malik <vmalik@redhat.com>
perf trace: Refactor augmented_raw_syscalls using bpf_for
Viktor Malik <vmalik@redhat.com>
perf trace: Factor out BPF loop body
Dapeng Mi <dapeng1.mi@linux.intel.com>
perf/x86/intel: Fix kernel address leakages in LBR stack
Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers
Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
rtc: rzn1: Fix weekday underflow when alarm crosses month boundary
Shakeel Butt <shakeel.butt@linux.dev>
memcg: make the v1 soft limit knob inert
Pengpeng Hou <pengpeng@iscas.ac.cn>
Input: aiptek - validate raw macro indices before updating state
Sechang Lim <rhkrqnwk98@gmail.com>
tcp: clear sock_ops cb flags before force-closing a child socket
Eric Dumazet <edumazet@google.com>
mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave()
Masami Hiramatsu (Google) <mhiramat@kernel.org>
kprobes: Protect kprobe_blacklist with RCU
Ju Nan <junan76@163.com>
irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout
Bradley Morgan <brads@mainlining.org>
ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()
Hajo Noerenberg <hajo-linux-ide@noerenberg.de>
ata: ahci: work around lost interrupts on Marvell 88SE61xx
Max Kellermann <max.kellermann@ionos.com>
ceph: lock mutex in ceph_mds_check_access()
Damien Le Moal <dlemoal@kernel.org>
block: flag zoned disks with GENHD_FL_NO_PART
Linkai Gong <gonglinkai@kylinos.cn>
cpuidle: dt_idle_genpd: kfree() the original name allocation
Koichiro Den <den@valinux.co.jp>
dmaengine: dw-edma: Initialize IRQ data before requesting IRQs
Koichiro Den <den@valinux.co.jp>
dmaengine: dw-edma: Complete descriptors before pausing
Koichiro Den <den@valinux.co.jp>
dmaengine: dw-edma: Fix HDMA channel status register access
Martin Kaiser <martin@kaiser.cx>
dmaengine: fsl-edma: tracing: no ptr dereference during log output
Aneesh Kumar K.V (Arm) <aneesh.kumar@kernel.org>
dma-direct: return struct page from dma_direct_alloc_from_pool()
Mikulas Patocka <mpatocka@redhat.com>
dm: fix resume-vs-remove race
Mikulas Patocka <mpatocka@redhat.com>
dm: fix race when loading and unloading a table
Ibrahim Hashimov <security@auditcode.ai>
HID: wacom: validate report length in wacom_intuos_pro2_bt_irq
Wei Jie Law <98lawweijie@gmail.com>
HID: rmi: fix OOB access with undersized RMI reports
Shen Yongchao <grayhat@foxmail.com>
HID: bpf: serialize device reference release in struct_ops destroy path
Steven Rostedt <rostedt@goodmis.org>
ftrace: Synchronize the initialization of ftrace_ops
Yao Kai <yaokai34@huawei.com>
futex: Prevent rcuwait use-after-free during requeue PI
SJ Park <sj@kernel.org>
mm/damon/core-kunit: check region count before testing in split_at()
SJ Park <sj@kernel.org>
mm/damon/sysfs: kobject_del() target (normal), context and kdamond dirs
SJ Park <sj@kernel.org>
mm/damon/sysfs: kobject_del() region and target (error) dirs
SJ Park <sj@kernel.org>
mm/damon/sysfs-schemes: kobject_del() scheme region dirs
SJ Park <sj@kernel.org>
mm/damon/sysfs-schemes: kobject_del() scheme quota goal dirs
SJ Park <sj@kernel.org>
mm/damon/sysfs-schemes: kobject_del() scheme filter dirs
SJ Park <sj@kernel.org>
mm/damon/sysfs-schemes: kobject_del() scheme dirs
Runyu Xiao <runyu.xiao@seu.edu.cn>
scsi: pm8001: Use rollback index when freeing MSI-X vectors
Sujal Tuladhar <sujaltuladhar1231@gmail.com>
scsi: target: iscsi: Reserve a terminator byte for the login payload
Honghui Jiang <jiang_hh2019@163.com>
spi: Fix DMA mapping ownership on partial map failure
Can Peng <pengcan@kylinos.cn>
spi: bcmbca-hsspi: disable clocks on resume failure
Can Peng <pengcan@kylinos.cn>
spi: bcm63xx: disable clock on resume failure
Can Peng <pengcan@kylinos.cn>
spi: bcm63xx-hsspi: disable clocks on resume failure
Kanishka De Silva <kpskanna1915@gmail.com>
ublk: clear VM_MAYWRITE on read-only ublk char device mmap
Can Peng <pengcan@kylinos.cn>
thermal/drivers/qoriq: Disable clock on resume failure
Can Peng <pengcan@kylinos.cn>
thermal/drivers/imx: Disable clock on runtime resume failure
Muhammad Bilal <meatuni001@gmail.com>
staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()
Muhammad Bilal <meatuni001@gmail.com>
staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()
Jeffin Philip <jeffinphilip14@gmail.com>
usb: gadget: fix null pointer dereference in usb_put_function_instance()
Lovekesh Solanki <lovekeshsolanki00@gmail.com>
USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()
Jeffin Philip <jeffinphilip14@gmail.com>
usb: gadget: f_midi: initialize work in f_midi_alloc()
Ivy Lopez <skunkolee@gmail.com>
usb: gadget: f_midi2: fix use-after-free in string attribute show path
Aleksandr Nogikh <nogikh@google.com>
usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs
Jameson Thies <jthies@google.com>
usb: typec: ucsi: displayport: Fix OOB altmode array index
Fan Wu <fanwu01@zju.edu.cn>
usb: typec: qcom-pmic: cancel reset_work on stop
Fan Wu <fanwu01@zju.edu.cn>
usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails
Fan Wu <fanwu01@zju.edu.cn>
usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns()
Liu Qi <liuqi@longcheer.com>
usb-storage: ene_ub6250: fix race between scan work and probe
Shuangpeng Bai <shuangpeng.kernel@gmail.com>
media: usbtv: keep device alive while ALSA card exists
Stephan Gerhold <stephan@gerhold.net>
clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset
HyeongJun An <sammiee5311@gmail.com>
ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()
Griffin Kroah-Hartman <griffin@kroah.com>
usb: image: mdc800: change kmalloc() to kzalloc()
Hari Mishal <harimishal1@gmail.com>
drm/amd/display: fix division by zero in get_estimated_bw()
Koichiro Den <den@valinux.co.jp>
net: ntb_netdev: Fix TX busy and drop handling
Sun Jian <sun.jian.kdev@gmail.com>
fsnotify: inotify: pass mark connector to fsnotify_recalc_mask()
FUJITA Tomonori <fujita.tomonori@gmail.com>
objtool/rust: add one more `noreturn` Rust function
Jinjie Ruan <ruanjinjie@huawei.com>
entry: Fix seccomp bypass after ptrace with TSYNC
Eric Dumazet <edumazet@google.com>
tcp: fix potential race in tcp_v6_syn_recv_sock()
Youngjae Kwon <yjkwon0026@snu.ac.kr>
fsnotify: Fix stale object mask after concurrent mark updates
Guillaume Morin <guillaume@morinfr.org>
hugetlb: only adjust reservation during unmapping if mapcount is 0
Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
wifi: mt76: mt7996: validate default EEPROM firmware size
Dev Jain <dev.jain@arm.com>
mm/page_vma_mapped: use huge_ptep_get() for hugetlb
David Howells <dhowells@redhat.com>
netfs: Fix netfs_read_folio() to wait on writeback
Jason Xing <kernelxing@tencent.com>
xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()
Günther Noack <gnoack@google.com>
landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation
Yuqi Xu <xuyuqiabc@gmail.com>
openvswitch: Fix CT limit teardown use-after-free
Ilya Maximets <i.maximets@ovn.org>
net: openvswitch: fix kernel-doc warnings in internal headers
Norbert Szetei <norbert@doyensec.com>
net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
-------------
Diffstat:
.../ABI/testing/configfs-usb-gadget-uac1_legacy | 3 -
Documentation/admin-guide/cgroup-v1/memory.rst | 49 +-
Documentation/admin-guide/kernel-parameters.txt | 12 +-
Documentation/admin-guide/mm/memory-hotplug.rst | 4 +-
Documentation/admin-guide/pm/amd-pstate.rst | 4 +-
Documentation/hwmon/emc1403.rst | 8 +-
Documentation/trace/hisi-ptt.rst | 28 +-
Documentation/usb/gadget-testing.rst | 3 -
.../media/v4l/ext-ctrls-colorimetry.rst | 12 +-
MAINTAINERS | 1 +
Makefile | 4 +-
arch/Kconfig | 3 +
arch/arm/boot/dts/allwinner/sun4i-a10.dtsi | 2 +-
arch/arm/boot/dts/marvell/armada-388-helios4.dts | 13 +
arch/arm/kernel/hw_breakpoint.c | 11 +-
arch/arm/mach-imx/src.c | 3 +
arch/arm/mach-lpc32xx/common.c | 5 +-
arch/arm/mach-lpc32xx/common.h | 2 +
arch/arm/mach-lpc32xx/phy3250.c | 2 +
arch/arm/mach-lpc32xx/pm.c | 5 +-
arch/arm/mm/fault.c | 16 +-
arch/arm64/Kconfig | 3 +-
.../boot/dts/allwinner/sun50i-a64-pinephone.dtsi | 4 +-
arch/arm64/boot/dts/amlogic/meson-axg-s400.dts | 4 +
arch/arm64/boot/dts/amlogic/meson-axg.dtsi | 3 +-
arch/arm64/boot/dts/freescale/imx8-ss-audio.dtsi | 8 +-
.../boot/dts/freescale/imx93-kontron-osm-s.dtsi | 4 +-
.../boot/dts/marvell/armada-3720-turris-mox.dts | 3 +-
arch/arm64/boot/dts/qcom/msm8996-xiaomi-gemini.dts | 2 +-
.../boot/dts/qcom/msm8998-sony-xperia-yoshino.dtsi | 4 -
arch/arm64/boot/dts/qcom/msm8998-xiaomi-sagit.dts | 5 -
arch/arm64/boot/dts/qcom/msm8998.dtsi | 24 +-
arch/arm64/boot/dts/qcom/qcm2290.dtsi | 1 +
arch/arm64/boot/dts/qcom/qcs404.dtsi | 16 +-
arch/arm64/boot/dts/qcom/qcs8550-aim300.dtsi | 4 +-
.../arm64/boot/dts/qcom/sc8180x-lenovo-flex-5g.dts | 57 +-
arch/arm64/boot/dts/qcom/sc8180x-primus.dts | 56 +-
arch/arm64/boot/dts/qcom/sc8180x.dtsi | 16 +-
arch/arm64/boot/dts/qcom/sc8280xp-crd.dts | 4 +-
.../dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts | 2 +-
arch/arm64/boot/dts/qcom/sdm632-motorola-ocean.dts | 2 +-
arch/arm64/boot/dts/qcom/sdm845.dtsi | 64 +-
arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts | 6 +-
arch/arm64/boot/dts/qcom/sm8150.dtsi | 8 +-
.../boot/dts/qcom/sm8250-xiaomi-elish-common.dtsi | 2 +-
arch/arm64/boot/dts/qcom/sm8250.dtsi | 48 +-
arch/arm64/boot/dts/qcom/sm8350.dtsi | 8 +-
arch/arm64/boot/dts/qcom/sm8450.dtsi | 8 +-
arch/arm64/boot/dts/qcom/sm8550.dtsi | 8 +-
arch/arm64/boot/dts/qcom/sm8650.dtsi | 97 +-
arch/arm64/boot/dts/qcom/x1e80100.dtsi | 4 +-
.../boot/dts/rockchip/rk3399-gru-chromebook.dtsi | 3 +-
arch/arm64/boot/dts/ti/k3-am64-main.dtsi | 2 +-
arch/arm64/include/asm/pgtable.h | 8 +-
arch/arm64/include/asm/ptdump.h | 22 +-
arch/arm64/kernel/hibernate.c | 16 +-
arch/arm64/kvm/Kconfig | 4 +-
arch/arm64/lib/Makefile | 4 +
arch/arm64/mm/Makefile | 2 +-
arch/arm64/mm/fault.c | 12 +-
arch/arm64/mm/ptdump.c | 60 +-
arch/csky/kernel/entry.S | 6 +-
arch/loongarch/Kconfig | 2 +-
arch/loongarch/configs/loongson3_defconfig | 5 +-
arch/loongarch/include/asm/kvm_host.h | 1 +
arch/loongarch/kernel/acpi.c | 3 +-
arch/loongarch/kernel/kprobes.c | 3 +
arch/loongarch/kernel/rethook_trampoline.S | 2 -
arch/loongarch/kvm/main.c | 6 +-
arch/loongarch/kvm/mmu.c | 10 +
arch/loongarch/kvm/vcpu.c | 6 +-
arch/loongarch/kvm/vm.c | 1 +
arch/m68k/emu/nfcon.c | 2 +-
arch/m68k/kernel/traps.c | 4 +-
arch/mips/kernel/ptrace.c | 6 +-
arch/parisc/kernel/head.S | 1 +
arch/powerpc/Kconfig | 4 +-
arch/powerpc/configs/85xx-hw.config | 1 +
arch/powerpc/include/asm/papr-watchdog.h | 64 ++
arch/powerpc/include/asm/thread_info.h | 9 +-
arch/powerpc/include/asm/vdso_datapage.h | 24 +-
arch/powerpc/kernel/asm-offsets.c | 2 -
arch/powerpc/kernel/ima_arch.c | 5 -
arch/powerpc/kernel/interrupt.c | 4 +-
arch/powerpc/kernel/irq.c | 16 +-
arch/powerpc/kernel/secure_boot.c | 11 +-
arch/powerpc/kernel/smp.c | 3 +
arch/powerpc/kernel/vdso.c | 16 +-
arch/powerpc/kernel/vdso/cacheflush.S | 2 +-
arch/powerpc/kernel/vdso/datapage.S | 4 +-
arch/powerpc/kernel/vdso/getrandom.S | 3 +-
arch/powerpc/kernel/vdso/gettimeofday.S | 5 +-
arch/powerpc/kernel/vdso/vdso32.lds.S | 2 +-
arch/powerpc/kernel/vdso/vdso64.lds.S | 2 +-
arch/powerpc/kexec/crash.c | 2 +-
arch/powerpc/kexec/file_load_64.c | 2 +-
arch/powerpc/kexec/ranges.c | 12 +-
arch/powerpc/mm/Makefile | 2 +-
arch/powerpc/mm/book3s64/radix_pgtable.c | 7 +-
arch/powerpc/mm/ptdump/ptdump.c | 46 +-
arch/powerpc/platforms/pseries/setup.c | 28 +-
arch/riscv/Kconfig | 2 +-
arch/riscv/boot/dts/sophgo/cv18xx.dtsi | 2 +-
arch/riscv/include/asm/kexec.h | 5 +
arch/riscv/kernel/Makefile | 2 +-
arch/riscv/kernel/cpufeature.c | 3 +-
arch/riscv/kernel/elf_kexec.c | 485 ---------
arch/riscv/kernel/kexec_elf.c | 144 +++
arch/riscv/kernel/machine_kexec_file.c | 368 +++++++
arch/riscv/mm/Makefile | 2 +-
arch/riscv/mm/ptdump.c | 46 +-
arch/riscv/net/bpf_jit_comp64.c | 5 +-
arch/riscv/net/bpf_jit_core.c | 1 +
arch/s390/Kconfig | 5 +-
arch/s390/include/asm/irqflags.h | 20 +-
arch/s390/include/asm/thread_info.h | 21 +-
arch/s390/kernel/Makefile | 2 +-
arch/s390/kernel/debug.c | 10 +-
arch/s390/kernel/ima_arch.c | 14 -
arch/s390/kernel/ipl.c | 6 +
arch/s390/kernel/irqflags.c | 28 +
arch/s390/kvm/guestdbg.c | 9 +-
arch/s390/kvm/interrupt.c | 2 +-
arch/s390/kvm/kvm-s390.c | 15 +-
arch/s390/mm/Makefile | 2 +-
arch/s390/mm/dump_pagetables.c | 46 +-
arch/s390/net/bpf_jit_comp.c | 11 +
arch/x86/Kconfig | 2 +-
arch/x86/Kconfig.debug | 2 +-
arch/x86/entry/entry_64_fred.S | 2 +
arch/x86/events/amd/uncore.c | 31 +
arch/x86/events/intel/lbr.c | 12 +-
arch/x86/events/intel/pt.c | 137 ++-
arch/x86/events/intel/pt.h | 4 +
arch/x86/events/intel/uncore.c | 2 -
arch/x86/include/asm/efi.h | 4 +-
arch/x86/include/asm/linkage.h | 2 +-
arch/x86/include/asm/pkeys.h | 3 +
arch/x86/kvm/hyperv.c | 25 +-
arch/x86/kvm/mmu/mmu.c | 35 +-
arch/x86/kvm/vmx/nested.c | 75 +-
arch/x86/kvm/x86.c | 5 +-
arch/x86/kvm/x86.h | 2 +-
arch/x86/mm/Makefile | 2 +-
arch/x86/mm/dump_pagetables.c | 39 +-
arch/x86/net/bpf_jit_comp.c | 7 +-
arch/x86/platform/efi/efi.c | 2 +-
block/bdev.c | 3 +-
block/blk-cgroup.c | 2 +
block/blk-iocost.c | 2 +-
block/blk-stat.c | 2 +-
block/genhd.c | 7 +
block/kyber-iosched.c | 2 +-
crypto/lskcipher.c | 1 -
drivers/accessibility/speakup/keyhelp.c | 17 +-
drivers/accessibility/speakup/kobjects.c | 6 +-
drivers/acpi/battery.c | 44 +-
drivers/acpi/cppc_acpi.c | 228 ++---
drivers/acpi/ec.c | 40 +-
drivers/acpi/pci_root.c | 3 +-
drivers/acpi/processor_core.c | 31 +-
drivers/acpi/processor_driver.c | 18 +-
drivers/acpi/processor_idle.c | 103 +-
drivers/acpi/riscv/irq.c | 33 +-
drivers/acpi/scan.c | 13 +-
drivers/acpi/video_detect.c | 4 +-
drivers/ata/ahci.c | 49 +
drivers/base/cacheinfo.c | 9 +-
drivers/base/firmware_loader/fallback.c | 10 +
drivers/base/memory.c | 8 +-
drivers/base/soc.c | 15 +-
drivers/base/swnode.c | 2 +-
drivers/block/mtip32xx/mtip32xx.c | 7 +
drivers/block/mtip32xx/mtip32xx.h | 2 +
drivers/block/null_blk/main.c | 78 +-
drivers/block/ublk_drv.c | 16 +-
drivers/bluetooth/btintel.c | 2 +-
drivers/bluetooth/btmtk.c | 104 +-
drivers/bluetooth/btmtk.h | 8 +-
drivers/bluetooth/btmtksdio.c | 84 +-
drivers/bluetooth/btqca.c | 3 +-
drivers/bluetooth/btusb.c | 68 +-
drivers/bluetooth/virtio_bt.c | 8 +-
drivers/bus/mhi/ep/main.c | 15 +-
drivers/bus/mhi/host/init.c | 4 +-
drivers/bus/mhi/host/main.c | 6 +
drivers/bus/qcom-ebi2.c | 51 +-
drivers/bus/ti-sysc.c | 12 +-
drivers/char/hw_random/core.c | 4 +-
drivers/char/hw_random/ks-sa-rng.c | 9 +-
drivers/char/ppdev.c | 10 +-
drivers/char/tpm/st33zp24/st33zp24.c | 8 +-
drivers/char/xilinx_hwicap/xilinx_hwicap.c | 5 +-
drivers/clk/clk-devres.c | 12 +-
drivers/clk/clk-moxart.c | 14 -
drivers/clk/clk-palmas.c | 14 +-
drivers/clk/clk-versaclock7.c | 2 +-
drivers/clk/hisilicon/reset.c | 2 +-
drivers/clk/imx/clk-scu.c | 1 -
drivers/clk/mediatek/clk-mt8135.c | 5 +-
drivers/clk/meson/gxbb.c | 2 +-
drivers/clk/nuvoton/clk-ma35d1-pll.c | 52 +-
drivers/clk/qcom/camcc-sc8280xp.c | 19 -
drivers/clk/qcom/common.c | 4 +-
drivers/clk/qcom/gcc-mdm9607.c | 182 +---
drivers/clk/qcom/gcc-msm8916.c | 5 +-
drivers/clk/qcom/gcc-msm8939.c | 5 +-
drivers/clk/qcom/gcc-qcm2290.c | 12 +-
drivers/clk/qcom/gdsc.c | 25 +-
drivers/clk/qcom/gpucc-qcm2290.c | 2 +-
drivers/clk/rockchip/clk-pll.c | 9 +-
drivers/clk/rockchip/clk-rk3576.c | 11 +-
drivers/clk/rockchip/clk-rk3588.c | 2 +-
drivers/clk/tegra/clk-tegra124-emc.c | 1 +
drivers/clk/ti/adpll.c | 4 +-
drivers/clk/ti/divider.c | 2 +-
drivers/clk/ti/mux.c | 22 +-
drivers/clk/visconti/clkc.c | 2 +-
drivers/clk/x86/clk-pmc-atom.c | 3 +
drivers/clocksource/clps711x-timer.c | 2 +-
drivers/clocksource/timer-armada-370-xp.c | 18 +-
drivers/cpufreq/amd-pstate.c | 33 +-
drivers/cpufreq/imx6q-cpufreq.c | 6 +-
drivers/cpufreq/intel_pstate.c | 19 +-
drivers/cpufreq/spear-cpufreq.c | 4 +-
drivers/cpuidle/dt_idle_genpd.c | 3 +-
drivers/crypto/atmel-ecc.c | 45 +-
drivers/crypto/atmel-sha204a.c | 6 +-
drivers/crypto/ccp/sev-dev.c | 17 +-
drivers/crypto/gemini/sl3516-ce-cipher.c | 8 -
drivers/crypto/hisilicon/sec2/sec_crypto.c | 12 +-
.../crypto/intel/keembay/keembay-ocs-aes-core.c | 9 +-
drivers/crypto/intel/qat/qat_common/adf_aer.c | 2 +
drivers/crypto/intel/qat/qat_common/qat_algs.c | 1 +
drivers/crypto/rockchip/rk3288_crypto_ahash.c | 7 +-
drivers/crypto/sa2ul.c | 6 +-
drivers/cxl/core/core.h | 6 +-
drivers/cxl/core/mbox.c | 95 +-
drivers/cxl/core/memdev.c | 24 +-
drivers/cxl/core/region.c | 7 +-
drivers/cxl/cxlmem.h | 40 -
drivers/cxl/pci.c | 13 +-
drivers/dax/super.c | 12 +-
drivers/dma/dw-edma/dw-edma-core.c | 127 ++-
drivers/dma/dw-edma/dw-hdma-v0-core.c | 2 +-
drivers/dma/fsl-edma-trace.h | 4 +-
drivers/dma/hisi_dma.c | 2 +-
drivers/dma/mediatek/mtk-uart-apdma.c | 2 +-
drivers/dma/qcom/bam_dma.c | 1 +
drivers/dma/xilinx/xilinx_dma.c | 12 +-
drivers/firewire/.kunitconfig | 1 +
drivers/firewire/Kconfig | 15 +
drivers/firewire/core-topology.c | 62 +-
drivers/firewire/node-tree-test.c | 607 +++++++++++
drivers/firmware/arm_scmi/bus.c | 67 +-
drivers/firmware/arm_scmi/driver.c | 72 +-
drivers/firmware/arm_scmi/notify.c | 21 +
drivers/firmware/arm_scmi/notify.h | 1 +
drivers/firmware/arm_scmi/transports/mailbox.c | 26 +-
drivers/firmware/arm_scmi/transports/smc.c | 15 +-
drivers/firmware/google/coreboot_table.c | 26 +-
drivers/firmware/qcom/Makefile | 1 +
drivers/firmware/qcom/qcom_scm-smc.c | 12 +-
drivers/firmware/qcom/qcom_scm.c | 140 ++-
drivers/firmware/qcom/qcom_scm.h | 3 +-
drivers/firmware/qcom/qcom_scm_trace.h | 143 +++
drivers/firmware/qcom/qcom_tzmem.c | 13 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 7 +
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 14 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 1 +
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 6 +
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 2 +-
drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 74 +-
drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 10 +-
drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 10 +-
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 3 +-
.../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 10 +
.../drm/amd/display/amdgpu_dm/amdgpu_dm_color.c | 13 +
.../gpu/drm/amd/display/dc/hubp/dcn10/dcn10_hubp.c | 3 +-
.../display/dc/link/protocols/link_dp_dpia_bw.c | 5 +
.../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 24 +
.../gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 35 +-
.../gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 2 +-
drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 3 +-
drivers/gpu/drm/bridge/tc358767.c | 2 +-
drivers/gpu/drm/drm_atomic_uapi.c | 2 +
drivers/gpu/drm/drm_drv.c | 34 +-
drivers/gpu/drm/drm_dumb_buffers.c | 1 -
drivers/gpu/drm/gud/gud_connector.c | 12 +-
drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c | 54 +-
drivers/gpu/drm/i915/i915_pci.c | 3 +
drivers/gpu/drm/lima/lima_device.c | 12 +-
drivers/gpu/drm/msm/adreno/a6xx_catalog.c | 2 +-
drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 5 +-
drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c | 4 +
drivers/gpu/drm/msm/dsi/dsi_host.c | 14 +-
drivers/gpu/drm/mxsfb/lcdif_kms.c | 15 +-
drivers/gpu/drm/nouveau/nouveau_chan.c | 9 +-
drivers/gpu/drm/nouveau/nouveau_sgdma.c | 4 +-
drivers/gpu/drm/nouveau/nouveau_uvmm.c | 6 +-
drivers/gpu/drm/omapdrm/dss/dsi.c | 7 +-
drivers/gpu/drm/omapdrm/dss/dsi.h | 2 -
drivers/gpu/drm/panel/panel-edp.c | 19 +-
drivers/gpu/drm/panel/panel-samsung-s6d16d0.c | 10 +-
drivers/gpu/drm/panthor/panthor_drv.c | 2 +-
drivers/gpu/drm/panthor/panthor_fw.c | 19 +-
drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 2 +
drivers/gpu/drm/solomon/ssd130x.c | 9 +-
drivers/gpu/drm/sun4i/sun4i_backend.c | 2 +-
drivers/gpu/drm/sun4i/sun4i_crtc.c | 2 +-
drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c | 2 +-
drivers/gpu/drm/sun4i/sun4i_tcon.c | 22 +-
drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c | 2 +
drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c | 2 +-
drivers/gpu/drm/sun4i/sun8i_vi_scaler.c | 18 +-
drivers/gpu/drm/tve200/tve200_drv.c | 1 +
drivers/gpu/drm/v3d/v3d_drv.h | 8 +-
drivers/gpu/drm/v3d/v3d_fence.c | 11 +-
drivers/gpu/drm/v3d/v3d_gem.c | 3 +-
drivers/gpu/drm/v3d/v3d_irq.c | 6 +-
drivers/gpu/drm/v3d/v3d_sched.c | 67 +-
drivers/gpu/drm/xe/tests/xe_migrate.c | 3 +-
drivers/gpu/host1x/debug.c | 4 +-
drivers/gpu/host1x/hw/channel_hw.c | 5 +-
drivers/hid/bpf/hid_bpf_struct_ops.c | 17 +-
drivers/hid/hid-core.c | 9 +
drivers/hid/hid-lg4ff.c | 8 +
drivers/hid/hid-multitouch.c | 2 +-
drivers/hid/hid-nintendo.c | 1 -
drivers/hid/hid-rmi.c | 46 +-
drivers/hid/hid-roccat-kone.c | 8 +-
drivers/hid/i2c-hid/Makefile | 2 +-
drivers/hid/i2c-hid/i2c-hid-acpi-prp0001.c | 104 ++
drivers/hid/i2c-hid/i2c-hid-acpi.c | 54 +-
drivers/hid/i2c-hid/i2c-hid-acpi.h | 33 +
drivers/hid/i2c-hid/i2c-hid-core.c | 2 +-
drivers/hid/i2c-hid/i2c-hid-of-goodix.c | 4 +-
drivers/hid/wacom_wac.c | 13 +
drivers/hwmon/coretemp.c | 1 +
drivers/hwmon/emc1403.c | 73 +-
drivers/hwspinlock/hwspinlock_core.c | 2 +-
drivers/hwtracing/coresight/coresight-etm4x-cfg.c | 2 +-
drivers/hwtracing/coresight/coresight-etm4x-core.c | 15 +-
.../hwtracing/coresight/coresight-etm4x-sysfs.c | 6 +-
drivers/hwtracing/coresight/coresight-etm4x.h | 9 +-
drivers/i2c/busses/i2c-ocores.c | 6 +-
drivers/i2c/i2c-core-base.c | 6 +
drivers/i2c/i2c-mux.c | 1 +
drivers/i2c/muxes/i2c-demux-pinctrl.c | 1 +
drivers/i3c/master.c | 2 +
drivers/i3c/master/dw-i3c-master.c | 10 +-
drivers/i3c/master/mipi-i3c-hci/core.c | 18 +-
drivers/i3c/master/mipi-i3c-hci/dma.c | 4 +-
drivers/i3c/master/mipi-i3c-hci/ext_caps.c | 55 +-
drivers/i3c/master/mipi-i3c-hci/pio.c | 54 +-
drivers/iio/accel/dmard09.c | 7 +
drivers/iio/adc/Kconfig | 1 +
drivers/iio/adc/pac1921.c | 2 +-
drivers/iio/chemical/atlas-sensor.c | 19 +-
drivers/iio/chemical/sgp30.c | 3 +
drivers/iio/dac/m62332.c | 17 +-
drivers/iio/gyro/mpu3050-core.c | 2 +-
drivers/iio/industrialio-buffer.c | 38 +-
drivers/iio/light/cm32181.c | 2 +-
drivers/iio/light/gp2ap002.c | 24 +-
drivers/iio/light/isl29028.c | 2 +-
drivers/iio/light/ltrf216a.c | 3 +-
drivers/iio/light/opt4001.c | 37 +-
drivers/iio/light/tsl2583.c | 2 +-
drivers/iio/light/tsl2772.c | 2 +-
drivers/iio/orientation/hid-sensor-rotation.c | 20 +-
drivers/iio/pressure/dps310.c | 3 +-
drivers/iio/pressure/mpl115.c | 11 +-
drivers/iio/proximity/srf04.c | 1 +
drivers/iio/temperature/hid-sensor-temperature.c | 3 +-
drivers/infiniband/core/cma.c | 6 +-
drivers/infiniband/core/counters.c | 5 +-
drivers/infiniband/core/cq.c | 14 +-
drivers/infiniband/core/device.c | 3 +
drivers/infiniband/core/nldev.c | 20 +-
drivers/infiniband/core/restrack.c | 174 +++-
drivers/infiniband/core/restrack.h | 4 +
drivers/infiniband/core/ucma.c | 2 +-
drivers/infiniband/core/uverbs_cmd.c | 10 +-
drivers/infiniband/core/verbs.c | 32 +-
drivers/infiniband/hw/bnxt_re/ib_verbs.c | 6 +-
drivers/infiniband/hw/cxgb4/device.c | 2 +-
drivers/infiniband/hw/cxgb4/mem.c | 4 +-
drivers/infiniband/hw/efa/efa_verbs.c | 15 +-
drivers/infiniband/hw/erdma/Kconfig | 4 +-
drivers/infiniband/hw/erdma/erdma.h | 12 +-
drivers/infiniband/hw/erdma/erdma_cm.c | 77 +-
drivers/infiniband/hw/erdma/erdma_cmdq.c | 26 +-
drivers/infiniband/hw/erdma/erdma_cq.c | 45 +
drivers/infiniband/hw/erdma/erdma_eq.c | 16 +-
drivers/infiniband/hw/erdma/erdma_hw.h | 98 +-
drivers/infiniband/hw/erdma/erdma_main.c | 51 +-
drivers/infiniband/hw/erdma/erdma_qp.c | 230 +++--
drivers/infiniband/hw/erdma/erdma_verbs.c | 572 +++++++++--
drivers/infiniband/hw/erdma/erdma_verbs.h | 206 +++-
drivers/infiniband/hw/hfi1/chip.c | 4 +-
drivers/infiniband/hw/hfi1/hfi.h | 2 -
drivers/infiniband/hw/hfi1/init.c | 44 +-
drivers/infiniband/hw/hfi1/user_sdma.c | 13 +-
drivers/infiniband/hw/mlx5/cong.c | 8 +-
drivers/infiniband/hw/mlx5/main.c | 2 +
drivers/infiniband/hw/mlx5/qp.c | 25 +-
drivers/infiniband/sw/rxe/rxe_req.c | 15 +
drivers/infiniband/sw/rxe/rxe_resp.c | 9 +-
drivers/infiniband/sw/siw/siw_cm.c | 2 +-
drivers/infiniband/ulp/ipoib/ipoib_main.c | 2 +
drivers/infiniband/ulp/isert/ib_isert.c | 85 +-
drivers/infiniband/ulp/isert/ib_isert.h | 1 +
drivers/infiniband/ulp/srp/ib_srp.c | 45 +-
drivers/infiniband/ulp/srpt/ib_srpt.c | 9 +-
drivers/input/tablet/aiptek.c | 13 +-
drivers/iommu/amd/init.c | 42 +-
drivers/iommu/amd/ppr.c | 2 +-
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 5 +-
drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 43 +-
drivers/iommu/arm/arm-smmu/qcom_iommu.c | 6 +-
drivers/iommu/dma-iommu.c | 13 +-
drivers/iommu/intel/iommu.c | 17 +-
drivers/iommu/iommufd/selftest.c | 5 +-
drivers/iommu/msm_iommu.c | 2 +-
drivers/iommu/mtk_iommu_v1.c | 2 +-
drivers/ipack/devices/ipoctal.c | 56 +-
drivers/irqchip/irq-gic-v3-its.c | 23 +-
drivers/irqchip/irq-mbigen.c | 20 +-
drivers/irqchip/irq-renesas-irqc.c | 1 +
drivers/irqchip/irq-renesas-rzg2l.c | 4 +-
drivers/irqchip/irq-stm32mp-exti.c | 4 +-
drivers/leds/leds-pca9532.c | 18 +-
drivers/mailbox/pcc.c | 70 +-
drivers/mailbox/qcom-cpucp-mbox.c | 25 +-
drivers/mailbox/rockchip-mailbox.c | 17 +-
drivers/md/dm-raid.c | 42 +-
drivers/md/dm.c | 14 +-
drivers/md/md-bitmap.c | 17 +-
drivers/md/md-cluster.c | 16 +-
drivers/md/md.c | 334 +++++--
drivers/md/md.h | 15 +-
drivers/md/raid0.c | 10 +-
drivers/md/raid1-10.c | 2 +-
drivers/md/raid1.c | 20 +-
drivers/md/raid10.c | 20 +-
drivers/md/raid5-ppl.c | 10 +-
drivers/md/raid5.c | 138 +--
drivers/media/cec/core/cec-adap.c | 10 +-
drivers/media/cec/core/cec-core.c | 2 -
drivers/media/cec/core/cec-pin.c | 8 +-
drivers/media/cec/platform/meson/ao-cec-g12a.c | 1 +
.../extron-da-hd-4k-plus/extron-da-hd-4k-plus.c | 3 +-
drivers/media/dvb-frontends/rtl2832_sdr.c | 23 +-
drivers/media/i2c/alvium-csi2.c | 2 +-
drivers/media/i2c/imx415.c | 2 +-
drivers/media/i2c/ov02a10.c | 12 +-
drivers/media/i2c/ov7740.c | 4 +-
drivers/media/i2c/rdacm21.c | 5 +-
drivers/media/i2c/video-i2c.c | 8 +-
drivers/media/pci/cobalt/cobalt-alsa-main.c | 1 -
drivers/media/pci/cx23885/cimax2.c | 1 +
drivers/media/pci/intel/ipu6/ipu6-isys.c | 1 +
drivers/media/pci/intel/ipu6/ipu6.c | 10 +-
drivers/media/pci/saa7164/saa7164-core.c | 8 +-
drivers/media/pci/zoran/zoran_card.c | 2 +-
drivers/media/platform/amphion/venc.c | 2 -
drivers/media/platform/broadcom/bcm2835-unicam.c | 2 +
.../platform/chips-media/wave5/wave5-vpu-dec.c | 3 +-
.../media/platform/mediatek/mdp3/mtk-mdp3-core.c | 6 +-
.../platform/nxp/imx8-isi/imx8-isi-crossbar.c | 6 +-
.../media/platform/nxp/imx8-isi/imx8-isi-video.c | 2 +-
drivers/media/platform/qcom/venus/hfi_parser.c | 9 +-
drivers/media/rc/sunxi-cir.c | 9 +-
drivers/media/test-drivers/vimc/vimc-capture.c | 4 +-
drivers/media/tuners/tda18250.c | 4 +-
drivers/media/usb/airspy/airspy.c | 19 +-
drivers/media/usb/cx231xx/cx231xx-video.c | 4 +-
drivers/media/usb/em28xx/em28xx-cards.c | 3 +-
drivers/media/usb/em28xx/em28xx-core.c | 2 +
drivers/media/usb/go7007/snd-go7007.c | 10 +-
drivers/media/usb/s2255/s2255drv.c | 11 +
drivers/media/usb/usbtv/usbtv-audio.c | 11 +
drivers/media/v4l2-core/v4l2-async.c | 16 +-
drivers/media/v4l2-core/v4l2-ctrls-core.c | 49 +-
drivers/media/v4l2-core/v4l2-fwnode.c | 2 +
drivers/mfd/iqs62x.c | 2 +-
drivers/mfd/rave-sp.c | 64 +-
drivers/misc/ad525x_dpot-i2c.c | 1 +
drivers/misc/ad525x_dpot-spi.c | 1 +
drivers/misc/ad525x_dpot.c | 177 ++--
drivers/misc/ad525x_dpot.h | 3 +
drivers/misc/bcm-vk/bcm_vk_msg.c | 6 +-
drivers/misc/cardreader/rtsx_pcr.c | 2 +
drivers/misc/cardreader/rtsx_usb.c | 23 +-
drivers/misc/sgi-gru/grufault.c | 101 +-
drivers/misc/sgi-gru/gruprocfs.c | 1 -
drivers/misc/sgi-gru/grutables.h | 1 -
drivers/misc/vmw_vmci/vmci_event.c | 4 +-
drivers/mtd/mtdoops.c | 3 +
drivers/mtd/mtdpart.c | 3 +-
drivers/mtd/mtdswap.c | 1 +
drivers/mtd/nand/raw/nand_onfi.c | 27 +-
drivers/mtd/parsers/afs.c | 7 +
drivers/mtd/ubi/attach.c | 4 +-
drivers/mtd/ubi/build.c | 11 +-
drivers/mtd/ubi/fastmap.c | 6 +-
drivers/mtd/ubi/io.c | 11 +-
drivers/mtd/ubi/ubi.h | 4 +-
drivers/mtd/ubi/wl.c | 15 +-
drivers/net/bonding/bond_netlink.c | 2 +-
drivers/net/dsa/b53/b53_common.c | 2 +-
drivers/net/dsa/mv88e6xxx/pcs-6352.c | 5 +-
drivers/net/ethernet/allwinner/sun4i-emac.c | 4 +-
drivers/net/ethernet/broadcom/bnxt/bnxt_hwmon.c | 2 +-
drivers/net/ethernet/freescale/fec_main.c | 6 +-
drivers/net/ethernet/intel/ice/ice_lib.c | 3 +
.../net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c | 2 +-
.../ethernet/marvell/octeontx2/af/rvu_debugfs.c | 6 +
.../net/ethernet/marvell/octeontx2/af/rvu_nix.c | 11 +-
drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c | 2 +-
drivers/net/ethernet/nvidia/forcedeth.c | 2 +-
drivers/net/ethernet/pensando/ionic/ionic_txrx.c | 27 +-
drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c | 467 +++++----
.../net/ethernet/qualcomm/rmnet/rmnet_map_data.c | 1 +
drivers/net/ethernet/realtek/8139cp.c | 2 +-
.../net/ethernet/stmicro/stmmac/dwmac1000_core.c | 2 +-
drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 2 +-
.../net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 2 +-
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 4 +
.../net/ethernet/stmicro/stmmac/stmmac_selftests.c | 41 +-
drivers/net/ethernet/wangxun/libwx/wx_type.h | 2 +-
drivers/net/ethernet/wangxun/txgbe/txgbe_type.h | 2 +-
drivers/net/gtp.c | 2 +
drivers/net/ipa/ipa_main.c | 6 +-
drivers/net/ntb_netdev.c | 27 +-
drivers/net/ppp/pppox.c | 17 +
drivers/net/slip/slip.c | 8 -
drivers/net/thunderbolt/main.c | 6 +-
drivers/net/vxlan/vxlan_mdb.c | 9 +-
drivers/net/vxlan/vxlan_vnifilter.c | 6 +-
drivers/net/wireless/ath/ath10k/snoc.c | 9 +-
drivers/net/wireless/ath/ath11k/dp_rx.c | 32 +-
drivers/net/wireless/ath/ath11k/wmi.c | 40 +-
drivers/net/wireless/ath/ath12k/wmi.c | 20 +-
drivers/net/wireless/ath/ath6kl/wmi.c | 17 +-
drivers/net/wireless/intel/iwlwifi/fw/dump.c | 2 +-
drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 8 +-
drivers/net/wireless/intel/iwlwifi/mei/main.c | 8 +-
drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 2 +-
drivers/net/wireless/mediatek/mt76/dma.c | 16 +-
drivers/net/wireless/mediatek/mt76/dma.h | 2 +-
drivers/net/wireless/mediatek/mt76/mac80211.c | 7 +
drivers/net/wireless/mediatek/mt76/mt76.h | 3 +
drivers/net/wireless/mediatek/mt76/mt76_connac.h | 5 +
drivers/net/wireless/mediatek/mt76/mt76x02_mac.c | 2 +-
drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c | 2 +-
drivers/net/wireless/mediatek/mt76/mt7915/init.c | 9 +-
drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 6 +-
drivers/net/wireless/mediatek/mt76/mt7915/main.c | 24 +-
drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 10 +-
drivers/net/wireless/mediatek/mt76/mt7915/mcu.h | 6 +-
drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h | 18 +
drivers/net/wireless/mediatek/mt76/mt7915/pci.c | 9 +-
drivers/net/wireless/mediatek/mt76/mt7915/soc.c | 2 +-
.../net/wireless/mediatek/mt76/mt7915/testmode.c | 5 +-
drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 28 +-
drivers/net/wireless/mediatek/mt76/mt7925/main.c | 66 +-
drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 2 +-
drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c | 6 +
drivers/net/wireless/mediatek/mt76/mt7996/init.c | 16 +-
drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 7 +
drivers/net/wireless/mediatek/mt76/mt7996/main.c | 2 -
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 16 +-
drivers/net/wireless/mediatek/mt76/mt7996/mcu.h | 2 +-
drivers/net/wireless/mediatek/mt76/mt7996/mmio.c | 12 +-
drivers/net/wireless/mediatek/mt76/sdio.c | 11 +-
drivers/net/wireless/mediatek/mt76/tx.c | 8 +-
drivers/net/wireless/realtek/rtlwifi/pci.c | 6 +-
drivers/net/wireless/realtek/rtw89/mac.c | 2 +-
drivers/net/wireless/virtual/mac80211_hwsim.c | 5 +-
drivers/net/wireless/zydas/zd1211rw/zd_usb.c | 8 +
drivers/nfc/pn533/pn533.c | 21 +-
drivers/nvdimm/btt.c | 8 +
drivers/nvdimm/label.c | 15 +-
drivers/nvme/host/apple.c | 227 +++--
drivers/nvme/host/fabrics.c | 2 +
drivers/nvme/host/fc.c | 32 +-
drivers/nvme/host/ioctl.c | 117 ++-
drivers/nvme/host/tcp.c | 7 +
drivers/nvme/target/auth.c | 6 +
drivers/nvme/target/core.c | 2 +-
drivers/nvme/target/fabrics-cmd-auth.c | 12 +-
drivers/nvme/target/nvmet.h | 2 +
drivers/nvme/target/rdma.c | 31 +-
drivers/nvme/target/tcp.c | 10 +
drivers/nvme/target/zns.c | 2 +-
drivers/of/property.c | 81 ++
drivers/of/unittest.c | 8 +-
drivers/parisc/eisa.c | 5 +
drivers/pci/controller/cadence/pci-j721e.c | 4 +-
drivers/pci/controller/pci-xgene.c | 11 +-
drivers/pci/controller/plda/pcie-starfive.c | 10 +-
drivers/pci/pcie/aspm.c | 31 +-
drivers/pci/probe.c | 7 +
drivers/perf/arm_spe_pmu.c | 2 +-
drivers/perf/cxl_pmu.c | 2 +-
drivers/phy/qualcomm/phy-qcom-qmp-combo.c | 1056 ++++++++++++++++++--
drivers/phy/qualcomm/phy-qcom-qmp-dp-phy-v8.h | 25 +
.../phy/qualcomm/phy-qcom-qmp-dp-qserdes-com-v8.h | 52 +
drivers/phy/qualcomm/phy-qcom-qmp-pcs-aon-v6.h | 12 +
drivers/phy/qualcomm/phy-qcom-qmp-pcs-aon-v8.h | 17 +
drivers/phy/qualcomm/phy-qcom-qmp-pcs-misc-v5.h | 12 +
drivers/phy/qualcomm/phy-qcom-qmp-pcs-misc-v8.h | 12 +
drivers/phy/qualcomm/phy-qcom-qmp-pcs-usb-v8.h | 38 +
drivers/phy/qualcomm/phy-qcom-qmp-pcs-v8.h | 32 +
drivers/phy/qualcomm/phy-qcom-qmp-qserdes-com-v8.h | 64 ++
.../phy/qualcomm/phy-qcom-qmp-qserdes-lalb-v8.h | 639 ++++++++++++
.../phy/qualcomm/phy-qcom-qmp-qserdes-txrx-v8.h | 68 ++
drivers/phy/qualcomm/phy-qcom-qmp-usb-legacy.c | 12 +-
drivers/phy/qualcomm/phy-qcom-qmp-usb.c | 12 +-
drivers/phy/qualcomm/phy-qcom-qmp-usb43-pcs-v8.h | 33 +
.../qualcomm/phy-qcom-qmp-usb43-qserdes-com-v8.h | 224 +++++
drivers/phy/qualcomm/phy-qcom-qmp.h | 7 +
drivers/phy/qualcomm/phy-qcom-sgmii-eth.c | 43 +-
drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c | 26 +-
drivers/phy/rockchip/phy-rockchip-inno-csidphy.c | 2 +-
drivers/phy/starfive/phy-jh7110-dphy-rx.c | 5 +-
drivers/phy/starfive/phy-jh7110-dphy-tx.c | 5 +-
drivers/phy/sunplus/phy-sunplus-usb2.c | 6 +-
drivers/pinctrl/bcm/pinctrl-bcm2835.c | 1 -
drivers/pinctrl/mediatek/mtk-eint.c | 340 ++++---
drivers/pinctrl/mediatek/mtk-eint.h | 28 +-
drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c | 40 +-
drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.h | 1 +
drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 14 +-
drivers/pinctrl/mediatek/pinctrl-paris.h | 7 +
drivers/pinctrl/pinctrl-rockchip.c | 10 +
drivers/platform/chrome/cros_ec_debugfs.c | 6 +-
drivers/platform/chrome/cros_ec_sensorhub_ring.c | 9 +-
drivers/platform/chrome/cros_ec_typec.c | 6 +
drivers/platform/mellanox/mlxbf-bootctl.c | 1 +
drivers/platform/mellanox/mlxbf-pmc.c | 10 +-
drivers/platform/surface/surface_acpi_notify.c | 6 +-
drivers/platform/x86/dell/dell-wmi-base.c | 17 +-
drivers/platform/x86/dell/dell-wmi-privacy.c | 4 +-
.../x86/dell/dell-wmi-sysman/dell-wmi-sysman.h | 2 +-
.../x86/hp/hp-bioscfg/passwdobj-attributes.c | 5 +
drivers/platform/x86/lg-laptop.c | 79 +-
drivers/pmdomain/bcm/bcm2835-power.c | 7 +-
drivers/power/supply/bd99954-charger.h | 23 +-
drivers/power/supply/bq27xxx_battery.c | 6 +-
drivers/power/supply/isp1704_charger.c | 1 +
drivers/power/supply/sbs-battery.c | 7 +-
drivers/power/supply/sc2731_charger.c | 2 +
drivers/powercap/intel_rapl_tpmi.c | 5 +-
drivers/pps/clients/pps-gpio.c | 62 +-
drivers/pps/pps.c | 10 +-
drivers/rapidio/rio-scan.c | 1 +
drivers/regulator/core.c | 6 +-
drivers/regulator/qcom-rpmh-regulator.c | 6 +-
drivers/regulator/tps6594-regulator.c | 271 ++---
drivers/remoteproc/qcom_common.c | 4 +-
drivers/remoteproc/qcom_q6v5_adsp.c | 1 +
drivers/remoteproc/remoteproc_core.c | 156 +--
drivers/remoteproc/remoteproc_sysfs.c | 1 -
drivers/rpmsg/qcom_glink_native.c | 44 +-
drivers/rtc/rtc-gamecube.c | 4 +-
drivers/rtc/rtc-pcf85363.c | 17 +-
drivers/rtc/rtc-pcf8563.c | 4 +-
drivers/rtc/rtc-rzn1.c | 10 +-
drivers/rtc/rtc-zynqmp.c | 7 +-
drivers/s390/crypto/vfio_ap_ops.c | 176 ++--
drivers/scsi/ch.c | 4 +-
drivers/scsi/mpt3sas/mpt3sas_base.c | 2 +
drivers/scsi/pm8001/pm8001_init.c | 4 +-
drivers/scsi/qla2xxx/qla_attr.c | 7 +-
drivers/scsi/qla2xxx/qla_bsg.c | 39 +-
drivers/scsi/qla2xxx/qla_dbg.c | 2 +-
drivers/scsi/qla2xxx/qla_dfs.c | 4 +-
drivers/scsi/qla2xxx/qla_edif.c | 3 +
drivers/scsi/qla2xxx/qla_gs.c | 4 +-
drivers/scsi/qla2xxx/qla_init.c | 61 +-
drivers/scsi/qla2xxx/qla_inline.h | 13 +
drivers/scsi/qla2xxx/qla_isr.c | 39 +-
drivers/scsi/qla2xxx/qla_mbx.c | 28 +-
drivers/scsi/qla2xxx/qla_nvme.c | 31 +-
drivers/scsi/qla2xxx/qla_nx2.c | 2 +-
drivers/scsi/qla2xxx/qla_os.c | 14 +-
drivers/scsi/scsi_sysfs.c | 77 +-
drivers/scsi/sd.c | 297 +++---
drivers/scsi/ses.c | 4 +-
drivers/scsi/smartpqi/smartpqi_init.c | 18 +
drivers/scsi/sr.c | 4 +-
drivers/scsi/st.c | 4 +-
drivers/soc/fsl/qe/qe_ic.c | 3 +-
drivers/soc/qcom/rpmh-rsc.c | 37 +-
drivers/soc/samsung/exynos-pmu.c | 4 +-
drivers/soc/ti/knav_qmss.h | 1 +
drivers/soc/ti/knav_qmss_queue.c | 14 +-
drivers/soundwire/qcom.c | 2 +-
drivers/spi/spi-bcm63xx-hsspi.c | 8 +-
drivers/spi/spi-bcm63xx.c | 6 +-
drivers/spi/spi-bcmbca-hsspi.c | 8 +-
drivers/spi/spi-davinci.c | 7 +-
drivers/spi/spi-img-spfi.c | 5 +-
drivers/spi/spi-oc-tiny.c | 24 +-
drivers/spi/spi-sprd-adi.c | 6 +
drivers/spi/spi.c | 34 +-
drivers/staging/fbtft/fbtft-sysfs.c | 2 +-
drivers/staging/greybus/audio_gb.c | 13 +
drivers/staging/greybus/audio_manager_sysfs.c | 2 +-
drivers/staging/media/meson/vdec/vdec.c | 4 +-
drivers/staging/media/sunxi/cedrus/cedrus.c | 4 +-
drivers/staging/octeon/ethernet-mem.c | 43 +-
drivers/staging/octeon/ethernet-mem.h | 8 +-
drivers/staging/octeon/ethernet-rx.c | 53 +-
drivers/staging/octeon/ethernet-rx.h | 13 +-
drivers/staging/octeon/ethernet-tx.c | 2 +
drivers/staging/octeon/ethernet.c | 43 +-
drivers/staging/octeon/octeon-ethernet.h | 14 +
drivers/staging/rtl8723bs/core/rtw_cmd.c | 8 +-
drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 7 +
drivers/staging/rtl8723bs/os_dep/sdio_intf.c | 4 +-
drivers/staging/sm750fb/Kconfig | 1 +
drivers/staging/sm750fb/sm750.c | 4 +-
drivers/target/iscsi/iscsi_target_login.c | 2 +-
drivers/thermal/imx_thermal.c | 9 +-
.../intel/int340x_thermal/int3400_thermal.c | 4 +-
drivers/thermal/qoriq_thermal.c | 13 +-
drivers/thermal/renesas/rcar_thermal.c | 15 +-
drivers/tty/hvc/Kconfig | 2 +-
drivers/tty/serial/amba-pl011.c | 10 +
drivers/tty/serial/ma35d1_serial.c | 12 +-
drivers/tty/serial/qcom_geni_serial.c | 10 +-
drivers/tty/tty_io.c | 4 +-
drivers/ufs/core/ufs-debugfs.c | 2 +-
drivers/ufs/core/ufshcd.c | 19 +-
drivers/uio/uio.c | 5 +
drivers/usb/atm/usbatm.c | 4 +-
drivers/usb/common/common.c | 3 +
drivers/usb/core/driver.c | 29 +-
drivers/usb/gadget/configfs.c | 4 +-
drivers/usb/gadget/function/f_fs.c | 8 +-
drivers/usb/gadget/function/f_mass_storage.c | 2 +-
drivers/usb/gadget/function/f_midi.c | 2 +-
drivers/usb/gadget/function/f_midi2.c | 17 +-
drivers/usb/gadget/function/f_uac1_legacy.c | 56 --
drivers/usb/gadget/function/u_uac1_legacy.h | 3 -
drivers/usb/gadget/functions.c | 2 +-
drivers/usb/gadget/legacy/inode.c | 3 +-
drivers/usb/gadget/udc/aspeed_udc.c | 50 +-
drivers/usb/gadget/udc/r8a66597-udc.c | 1 -
drivers/usb/host/xhci-ring.c | 32 +-
drivers/usb/image/mdc800.c | 4 +-
drivers/usb/misc/usb-ljca.c | 3 +
drivers/usb/mtu3/mtu3_core.c | 11 +-
drivers/usb/renesas_usbhs/common.c | 6 +-
drivers/usb/serial/bus.c | 4 +-
drivers/usb/serial/usb-serial.c | 4 +-
drivers/usb/storage/ene_ub6250.c | 2 +
.../usb/typec/tcpm/qcom/qcom_pmic_typec_pdphy.c | 2 +
drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c | 5 +
drivers/usb/typec/ucsi/debugfs.c | 1 +
drivers/usb/typec/ucsi/displayport.c | 2 +-
drivers/usb/typec/ucsi/ucsi.c | 2 +
drivers/vdpa/mlx5/core/mr.c | 2 +-
drivers/vdpa/vdpa_sim/vdpa_sim.c | 25 +-
drivers/vfio/pci/vfio_pci_config.c | 1 +
drivers/video/fbdev/kyro/fbdev.c | 24 +-
drivers/video/fbdev/tdfxfb.c | 2 +-
drivers/virtio/virtio_balloon.c | 6 +
drivers/virtio/virtio_pci_common.c | 2 +-
drivers/w1/masters/ds2482.c | 4 +
drivers/watchdog/pseries-wdt.c | 53 +-
drivers/xen/xenbus/xenbus_xs.c | 16 +-
fs/afs/callback.c | 1 +
fs/btrfs/verity.c | 16 +-
fs/ceph/file.c | 48 +
fs/ceph/mds_client.c | 4 +
fs/ceph/mds_client.h | 1 +
fs/crypto/inline_crypt.c | 3 +-
fs/erofs/Kconfig | 8 +-
fs/erofs/compress.h | 23 +-
fs/erofs/decompressor.c | 2 +-
fs/erofs/zdata.c | 162 ++-
fs/ext4/file.c | 7 +
fs/ext4/inline.c | 11 +-
fs/ext4/inode.c | 28 +-
fs/ext4/migrate.c | 3 +-
fs/ext4/namei.c | 2 +
fs/ext4/orphan.c | 10 +-
fs/f2fs/data.c | 5 +-
fs/f2fs/f2fs.h | 27 +-
fs/f2fs/file.c | 120 ++-
fs/f2fs/gc.c | 7 +-
fs/f2fs/namei.c | 11 +-
fs/f2fs/segment.c | 41 +-
fs/f2fs/segment.h | 4 -
fs/f2fs/super.c | 4 +-
fs/f2fs/sysfs.c | 7 +-
fs/f2fs/xattr.c | 2 +-
fs/fat/nfs.c | 4 +-
fs/fuse/cuse.c | 5 +
fs/fuse/dev.c | 40 +-
fs/fuse/dir.c | 11 +-
fs/fuse/fuse_i.h | 36 +-
fs/fuse/inode.c | 58 +-
fs/fuse/readdir.c | 36 +-
fs/hfsplus/catalog.c | 25 +-
fs/hfsplus/hfsplus_fs.h | 6 +
fs/hugetlbfs/inode.c | 3 +-
fs/isofs/compress.c | 7 +-
fs/netfs/buffered_read.c | 2 +
fs/nfs/blocklayout/dev.c | 21 +-
fs/nfs/client.c | 21 +-
fs/nfs/dir.c | 7 +
fs/nfs/filelayout/filelayoutdev.c | 3 +-
fs/nfs/flexfilelayout/flexfilelayoutdev.c | 3 +-
fs/nfs/inode.c | 4 +-
fs/nfs/internal.h | 1 +
fs/nfs/netns.h | 6 +-
fs/nfs/nfs4client.c | 1 +
fs/nfs/nfs4proc.c | 4 +-
fs/nfs/pnfs.c | 35 +-
fs/nfs/pnfs.h | 3 +-
fs/nfs/pnfs_nfs.c | 39 +-
fs/nilfs2/page.c | 17 +-
fs/nilfs2/segment.c | 4 +
fs/nilfs2/the_nilfs.c | 6 +
fs/notify/fanotify/fanotify_user.c | 17 +-
fs/notify/inotify/inotify_user.c | 15 +-
fs/ntfs3/attrib.c | 11 +-
fs/ntfs3/frecord.c | 79 +-
fs/ntfs3/fslog.c | 13 +-
fs/ntfs3/fsntfs.c | 8 +-
fs/ntfs3/ntfs_fs.h | 21 +-
fs/ntfs3/record.c | 125 ++-
fs/ntfs3/super.c | 13 +-
fs/ntfs3/xattr.c | 25 +-
fs/ocfs2/acl.c | 141 ++-
fs/ocfs2/acl.h | 19 +-
fs/ocfs2/cluster/heartbeat.c | 97 +-
fs/ocfs2/cluster/heartbeat.h | 5 +
fs/ocfs2/cluster/nodemanager.c | 23 +-
fs/ocfs2/cluster/nodemanager.h | 2 +
fs/ocfs2/cluster/tcp.c | 83 +-
fs/ocfs2/cluster/tcp.h | 1 +
fs/ocfs2/namei.c | 17 +-
fs/ocfs2/xattr.c | 86 +-
fs/ocfs2/xattr.h | 9 +-
fs/smb/client/cifs_debug.c | 2 +-
fs/smb/client/smb2pdu.c | 16 +-
fs/smb/server/auth.c | 1 +
fs/smb/server/connection.c | 19 +
fs/smb/server/connection.h | 1 +
fs/smb/server/mgmt/share_config.c | 7 +-
fs/smb/server/mgmt/user_config.c | 1 +
fs/smb/server/mgmt/user_session.c | 24 +-
fs/smb/server/mgmt/user_session.h | 1 +
fs/smb/server/server.c | 4 +-
fs/smb/server/smb2ops.c | 11 +-
fs/smb/server/smb2pdu.c | 57 +-
fs/smb/server/smbacl.c | 4 +-
fs/smb/server/transport_ipc.c | 12 +
fs/smb/server/transport_tcp.c | 6 +
fs/smb/server/vfs.c | 3 -
fs/smb/server/vfs_cache.c | 5 +-
fs/squashfs/cache.c | 2 +-
fs/super.c | 4 +-
fs/udf/super.c | 23 +-
fs/udf/symlink.c | 2 +
include/acpi/cppc_acpi.h | 6 +-
include/acpi/pcc.h | 5 -
include/acpi/processor.h | 2 +
include/cxl/mailbox.h | 41 +-
include/linux/blkdev.h | 13 +-
include/linux/bpf-cgroup-defs.h | 1 +
include/linux/bpf-cgroup.h | 5 +-
include/linux/bpf.h | 4 +-
include/linux/efi.h | 4 +-
include/linux/ima.h | 7 +-
include/linux/kprobes.h | 1 +
include/linux/maple_tree.h | 2 +-
include/linux/memcontrol.h | 10 +-
include/linux/memory.h | 27 +-
include/linux/memory_hotplug.h | 19 +-
include/linux/mmc/sdio_ids.h | 1 +
include/linux/nfs_xdr.h | 2 +-
include/linux/nvme.h | 81 ++
include/linux/of_graph.h | 49 +
include/linux/panic.h | 6 +
include/linux/pci.h | 2 +
include/linux/printk.h | 2 -
include/linux/ptdump.h | 9 +-
include/linux/remoteproc.h | 284 +-----
include/linux/rsc_table.h | 364 +++++++
include/linux/rtsx_usb.h | 3 +
include/linux/secure_boot.h | 23 +
include/linux/sunrpc/xdr.h | 21 +
include/linux/usb.h | 7 +-
include/linux/virtio_net.h | 4 +
include/media/rc-map.h | 2 -
include/net/bluetooth/hci_core.h | 2 +-
include/net/bluetooth/l2cap.h | 5 +
include/net/inet_connection_sock.h | 12 +-
include/net/inetpeer.h | 4 +
include/net/pkt_sched.h | 1 +
include/net/tc_act/tc_ct.h | 2 +-
include/net/tc_act/tc_ctinfo.h | 1 +
include/net/tc_act/tc_skbedit.h | 1 +
include/net/tc_act/tc_skbmod.h | 1 +
include/net/tc_act/tc_tunnel_key.h | 1 +
include/net/tc_act/tc_vlan.h | 1 +
include/net/tcp.h | 13 +-
include/net/xsk_buff_pool.h | 19 +-
include/rdma/ib_verbs.h | 14 +
include/scsi/scsi_driver.h | 7 +-
include/sound/core.h | 2 +
include/uapi/linux/bpf.h | 7 +
include/uapi/linux/landlock.h | 1 +
include/uapi/linux/raid/md_p.h | 2 +-
include/uapi/linux/time_types.h | 2 +-
kernel/bpf/arena.c | 2 +
kernel/bpf/bpf_lsm.c | 1 -
kernel/bpf/btf.c | 26 +-
kernel/bpf/cgroup.c | 220 +++-
kernel/bpf/net_namespace.c | 17 +-
kernel/bpf/ringbuf.c | 2 +-
kernel/bpf/syscall.c | 73 +-
kernel/bpf/task_iter.c | 36 +-
kernel/bpf/verifier.c | 24 +-
kernel/cgroup/cgroup.c | 5 +
kernel/cgroup/cpuset-internal.h | 2 +-
kernel/cgroup/cpuset.c | 305 +++---
kernel/dma/direct.c | 18 +-
kernel/dma/swiotlb.c | 31 +-
kernel/entry/common.c | 3 +
kernel/futex/requeue.c | 12 +-
kernel/kcsan/core.c | 12 +-
kernel/kprobes.c | 14 +-
kernel/locking/lockdep.c | 2 +
kernel/module/dups.c | 99 +-
kernel/module/stats.c | 2 +-
kernel/panic.c | 53 +
kernel/power/snapshot.c | 5 +-
kernel/power/wakelock.c | 2 +-
kernel/printk/internal.h | 2 +-
kernel/printk/nbcon.c | 10 +-
kernel/printk/printk.c | 218 ++--
kernel/printk/printk_ringbuffer.c | 13 +-
kernel/rcu/tree_plugin.h | 10 +-
kernel/sched/cpufreq_schedutil.c | 2 +-
kernel/sched/fair.c | 27 +-
kernel/sys.c | 2 +-
kernel/time/clocksource.c | 8 +-
kernel/time/timekeeping.c | 6 +
kernel/trace/ftrace.c | 13 +-
kernel/trace/ring_buffer.c | 2 -
kernel/trace/trace.c | 28 +-
kernel/trace/trace.h | 4 +-
kernel/trace/trace_events.c | 134 ++-
lib/dump_stack.c | 2 +-
lib/maple_tree.c | 43 +-
lib/string.c | 3 +-
lib/test_hmm.c | 2 +-
mm/Kconfig | 57 +-
mm/Kconfig.debug | 11 +-
mm/Makefile | 2 +-
mm/damon/core.c | 17 +-
mm/damon/ops-common.c | 5 +-
mm/damon/paddr.c | 20 +-
mm/damon/sysfs-schemes.c | 14 +-
mm/damon/sysfs.c | 19 +-
mm/damon/tests/core-kunit.h | 15 +-
mm/damon/tests/vaddr-kunit.h | 5 +
mm/damon/vaddr.c | 34 +-
mm/hugetlb.c | 22 +-
mm/memcontrol-v1.c | 43 +-
mm/memory_hotplug.c | 42 +-
mm/mempolicy.c | 2 +-
mm/mm_init.c | 19 +-
mm/page_vma_mapped.c | 8 +-
mm/ptdump.c | 40 +-
mm/slab.h | 1 +
mm/slub.c | 36 +-
net/batman-adv/bridge_loop_avoidance.c | 80 +-
net/batman-adv/distributed-arp-table.c | 66 +-
net/batman-adv/main.c | 4 +
net/batman-adv/multicast_forw.c | 7 +-
net/batman-adv/soft-interface.c | 7 +-
net/batman-adv/types.h | 2 +-
net/bluetooth/hci_conn.c | 20 +-
net/bluetooth/hci_sync.c | 12 +-
net/bluetooth/l2cap_sock.c | 36 +-
net/bluetooth/mgmt.c | 27 +-
net/bluetooth/msft.c | 5 +
net/bluetooth/rfcomm/core.c | 4 +
net/bridge/br_netlink_tunnel.c | 3 +-
net/bridge/br_vlan.c | 4 +-
net/ceph/messenger_v2.c | 5 +
net/core/dev.c | 1 +
net/core/filter.c | 4 -
net/core/lwt_bpf.c | 15 +-
net/core/net_namespace.c | 4 +
net/core/page_pool.c | 77 +-
net/core/skbuff.c | 11 +-
net/dccp/dccp.h | 4 +-
net/dccp/ipv4.c | 4 +-
net/dccp/ipv6.c | 7 +-
net/dccp/minisocks.c | 2 +-
net/hsr/hsr_device.c | 2 +
net/ipv4/inet_connection_sock.c | 9 +
net/ipv4/inetpeer.c | 38 +-
net/ipv4/syncookies.c | 2 +-
net/ipv4/tcp_fastopen.c | 2 +-
net/ipv4/tcp_ipv4.c | 8 +-
net/ipv4/tcp_minisocks.c | 2 +-
net/ipv4/tcp_output.c | 2 +-
net/ipv6/tcp_ipv6.c | 97 +-
net/ipv6/xfrm6_input.c | 2 +-
net/kcm/kcmsock.c | 3 +
net/mac80211/link.c | 3 +-
net/mac80211/mlme.c | 2 +-
net/mac80211/s1g.c | 2 +-
net/mac80211/spectmgmt.c | 11 +-
net/mac80211/tx.c | 3 +-
net/mptcp/subflow.c | 6 +-
net/netfilter/Kconfig | 2 +-
net/netfilter/ipvs/ip_vs_ftp.c | 10 +-
net/netfilter/nf_nat_sip.c | 5 +
net/netfilter/nf_tables_api.c | 14 +-
net/netfilter/xt_cgroup.c | 21 +-
net/netfilter/xt_hl.c | 27 +
net/nfc/digital_core.c | 2 +-
net/nfc/llcp_core.c | 29 +-
net/nfc/llcp_sock.c | 14 +-
net/nfc/nci/data.c | 10 +-
net/nfc/nci/rsp.c | 41 +-
net/openvswitch/conntrack.c | 121 ++-
net/openvswitch/conntrack.h | 6 +-
net/openvswitch/datapath.c | 10 +-
net/openvswitch/datapath.h | 26 +-
net/openvswitch/vport.h | 9 +
net/phonet/pep.c | 2 +-
net/rds/cong.c | 4 +-
net/sched/act_api.c | 5 +-
net/sched/act_bpf.c | 26 +
net/sched/act_ct.c | 76 +-
net/sched/act_ctinfo.c | 34 +-
net/sched/act_ife.c | 23 +
net/sched/act_pedit.c | 24 +
net/sched/act_police.c | 12 +
net/sched/act_sample.c | 9 +
net/sched/act_skbedit.c | 20 +-
net/sched/act_skbmod.c | 34 +-
net/sched/act_tunnel_key.c | 96 +-
net/sched/act_vlan.c | 16 +-
net/sched/cls_api.c | 18 +-
net/sched/sch_api.c | 7 +-
net/sched/sch_codel.c | 2 +-
net/sched/sch_fifo.c | 2 +-
net/sched/sch_fq.c | 18 +-
net/sched/sch_fq_codel.c | 6 +-
net/sched/sch_fq_pie.c | 3 +-
net/sched/sch_gred.c | 4 +-
net/sched/sch_hhf.c | 4 +
net/sched/sch_htb.c | 7 +-
net/sched/sch_plug.c | 2 +-
net/sched/sch_sfq.c | 3 +-
net/sched/sch_teql.c | 1 +
net/smc/af_smc.c | 8 +-
net/smc/smc_inet.c | 16 +
net/smc/smc_llc.c | 3 +
net/sunrpc/rpcb_clnt.c | 4 +
net/sunrpc/xprtsock.c | 20 +-
net/tls/tls_strp.c | 16 +-
net/vmw_vsock/af_vsock.c | 23 +-
net/xdp/xsk.c | 57 +-
net/xdp/xsk_buff_pool.c | 4 +-
net/xdp/xsk_queue.h | 16 +-
net/xfrm/xfrm_output.c | 4 +-
samples/ftrace/ftrace-direct-modify.c | 12 +-
samples/ftrace/ftrace-direct-multi-modify.c | 12 +-
scripts/mod/modpost.c | 6 +-
scripts/tags.sh | 2 +-
security/apparmor/lib.c | 20 +-
security/integrity/Makefile | 1 +
security/integrity/efi_secureboot.c | 56 ++
security/integrity/ima/ima_appraise.c | 4 +-
security/integrity/ima/ima_efi.c | 47 +-
security/integrity/ima/ima_main.c | 3 +-
security/integrity/integrity.h | 1 +
security/integrity/platform_certs/load_uefi.c | 2 +-
security/landlock/errata/abi-1.h | 23 +
security/landlock/fs.c | 40 +-
security/smack/smack.h | 5 +-
security/smack/smack_lsm.c | 67 +-
security/smack/smackfs.c | 222 ++--
sound/core/control.c | 6 +-
sound/core/control_led.c | 13 +-
sound/core/init.c | 4 +-
sound/core/pcm_native.c | 2 +
sound/core/rawmidi.c | 2 +-
sound/core/seq/seq_clientmgr.c | 16 +-
sound/core/seq/seq_midi.c | 61 +-
sound/parisc/harmony.c | 6 +-
sound/pci/asihpi/hpi6000.c | 5 +
sound/pci/hda/hda_proc.c | 2 +-
sound/pci/ice1712/ice1712.c | 7 +-
sound/pci/via82xx_modem.c | 26 +-
sound/soc/apple/mca.c | 6 +-
sound/soc/codecs/cs35l33.c | 14 +-
sound/soc/codecs/cs35l34.c | 14 +-
sound/soc/codecs/hdac_hda.c | 4 +-
sound/soc/codecs/rt700-sdw.c | 6 +-
sound/soc/fsl/fsl-asoc-card.c | 4 +-
sound/soc/fsl/fsl_audmix.c | 24 +-
sound/soc/fsl/mpc5200_psc_i2s.c | 1 +
sound/soc/intel/atom/sst/sst_pci.c | 4 +-
sound/soc/loongson/loongson_card.c | 6 +-
sound/soc/meson/meson-card-utils.c | 17 +-
sound/soc/pxa/pxa-ssp.c | 7 +-
sound/soc/qcom/qdsp6/q6apm.c | 12 +-
sound/soc/samsung/aries_wm8994.c | 1 +
sound/soc/soc-dapm.c | 2 +-
sound/soc/sof/topology.c | 18 +-
sound/soc/xilinx/xlnx_formatter_pcm.c | 14 +-
sound/usb/midi.c | 2 +
tools/bpf/bpftool/map.c | 16 +-
tools/bpf/bpftool/struct_ops.c | 4 +
tools/build/Makefile.feature | 3 +-
tools/build/feature/Makefile | 3 +
tools/include/nolibc/arch-powerpc.h | 2 +-
tools/include/uapi/linux/bpf.h | 7 +
tools/lib/bpf/libbpf.c | 3 +-
tools/net/sunrpc/xdrgen/README | 17 +
tools/net/sunrpc/xdrgen/generators/enum.py | 17 +-
tools/net/sunrpc/xdrgen/generators/union.py | 34 +-
tools/net/sunrpc/xdrgen/grammars/xdr.lark | 4 +-
.../xdrgen/templates/C/enum/declaration/close.j2 | 5 +-
.../sunrpc/xdrgen/templates/C/enum/decoder/enum.j2 | 2 +-
.../xdrgen/templates/C/enum/decoder/enum_be.j2 | 14 +
.../xdrgen/templates/C/enum/definition/close.j2 | 2 +
.../xdrgen/templates/C/enum/definition/close_be.j2 | 4 +
.../sunrpc/xdrgen/templates/C/enum/encoder/enum.j2 | 2 +-
.../xdrgen/templates/C/enum/encoder/enum_be.j2 | 14 +
.../C/pointer/encoder/variable_length_opaque.j2 | 2 +
.../C/pointer/encoder/variable_length_string.j2 | 2 +
.../C/struct/encoder/variable_length_opaque.j2 | 2 +
.../C/struct/encoder/variable_length_string.j2 | 2 +
.../templates/C/union/decoder/case_spec_be.j2 | 2 +
.../xdrgen/templates/C/union/definition/close.j2 | 5 -
.../templates/C/union/encoder/case_spec_be.j2 | 2 +
tools/net/sunrpc/xdrgen/xdr_ast.py | 7 +-
tools/objtool/check.c | 3 +-
tools/perf/builtin-sched.c | 40 +-
tools/perf/builtin-stat.c | 9 +-
.../arch/x86/amdzen5/floating-point.json | 160 ++-
.../pmu-events/arch/x86/amdzen5/load-store.json | 8 +-
tools/perf/pmu-events/jevents.py | 5 +-
tools/perf/pmu-events/metric.py | 6 +-
.../perf/scripts/python/Perf-Trace-Util/Context.c | 18 -
tools/perf/tests/builtin-test.c | 511 ++++++----
.../perf/tests/shell/lib/perf_metric_validation.py | 11 +-
tools/perf/tests/shell/stat_all_metrics.sh | 167 +++-
tools/perf/tests/shell/stat_bpf_counters.sh | 44 +-
tools/perf/tests/shell/stat_metrics_values.sh | 7 +
tools/perf/tests/shell/test_brstack.sh | 237 ++++-
tools/perf/tests/task-exit.c | 9 +-
tools/perf/tests/tests-scripts.c | 7 +-
tools/perf/tests/tests.h | 12 +
tools/perf/tests/workloads/Build | 2 +
tools/perf/tests/workloads/traploop.c | 31 +
tools/perf/ui/browsers/hists.c | 6 +-
tools/perf/util/auxtrace.c | 15 +-
.../util/bpf_skel/augmented_raw_syscalls.bpf.c | 155 +--
tools/perf/util/color.h | 1 +
tools/perf/util/cs-etm-decoder/cs-etm-decoder.c | 21 +-
tools/perf/util/cs-etm.c | 321 ++++--
tools/perf/util/cs-etm.h | 8 +-
tools/perf/util/data-convert-json.c | 1 +
tools/perf/util/dso.c | 23 +-
tools/perf/util/dso.h | 57 +-
.../util/hisi-ptt-decoder/hisi-ptt-pkt-decoder.c | 47 +-
.../util/hisi-ptt-decoder/hisi-ptt-pkt-decoder.h | 12 +
tools/perf/util/intel-bts.c | 2 +-
tools/perf/util/intel-pt.c | 2 +-
tools/perf/util/machine.c | 37 +-
tools/perf/util/metricgroup.c | 7 +-
tools/perf/util/python.c | 187 ++--
.../util/scripting-engines/trace-event-python.c | 63 +-
tools/perf/util/synthetic-events.c | 6 +-
tools/perf/util/thread-stack.c | 2 +-
tools/perf/util/trace-event-read.c | 33 +-
tools/sched_ext/scx_flatcg.bpf.c | 19 +-
tools/scripts/Makefile.include | 38 +-
tools/testing/kunit/kunit.py | 2 +-
tools/testing/kunit/kunit_tool_test.py | 12 +
.../selftests/arm64/mte/check_buffer_fill.c | 2 +
.../selftests/arm64/mte/check_child_memory.c | 2 +
.../selftests/arm64/mte/check_gcr_el1_cswitch.c | 1 +
.../selftests/arm64/mte/check_hugetlb_options.c | 298 ++++++
.../selftests/arm64/mte/check_ksm_options.c | 31 +-
.../selftests/arm64/mte/check_mmap_options.c | 2 +
.../selftests/arm64/mte/check_tags_inclusion.c | 2 +
tools/testing/selftests/arm64/mte/check_user_mem.c | 2 +
tools/testing/selftests/bpf/README.rst | 4 +-
tools/testing/selftests/bpf/network_helpers.c | 10 +-
tools/testing/selftests/bpf/network_helpers.h | 5 +
.../selftests/bpf/prog_tests/bpf_attr_size.c | 69 ++
.../selftests/bpf/prog_tests/global_map_resize.c | 8 +-
tools/testing/selftests/bpf/prog_tests/mptcp.c | 13 +-
.../testing/selftests/bpf/progs/bpf_tracing_net.h | 3 +
tools/testing/selftests/bpf/progs/mptcpify.c | 2 +-
tools/testing/selftests/bpf/test_progs.c | 11 +-
tools/testing/selftests/bpf/test_sockmap.c | 3 +-
tools/testing/selftests/bpf/veristat.c | 76 +-
tools/testing/selftests/bpf/vmtest.sh | 13 +-
tools/testing/selftests/cgroup/test_cpuset_prs.sh | 494 +++++----
tools/testing/selftests/kselftest_harness.h | 14 +-
tools/testing/selftests/lsm/common.c | 4 +-
tools/testing/selftests/mm/cow.c | 350 ++++---
tools/testing/selftests/mm/khugepaged.c | 5 +
tools/testing/selftests/mm/ksm_tests.c | 210 ++--
tools/testing/selftests/mm/migration.c | 107 ++
tools/testing/selftests/mm/soft-dirty.c | 9 +-
tools/testing/selftests/mm/thp_settings.c | 11 +
tools/testing/selftests/mm/thp_settings.h | 2 +
.../selftests/rseq/rseq-x86-thread-pointer.h | 4 +-
tools/testing/selftests/sched_ext/prog_run.c | 36 +-
tools/testing/selftests/timers/leap-a-day.c | 19 +-
tools/testing/selftests/zram/zram_lib.sh | 2 +-
1233 files changed, 21147 insertions(+), 8982 deletions(-)
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0001/1376] net: skbuff: dont skb_tx_error() the source skb in skb_zerocopy()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
@ 2026-09-12 6:40 ` Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0002/1376] net: openvswitch: fix kernel-doc warnings in internal headers Greg Kroah-Hartman
` (997 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ilya Maximets, Norbert Szetei,
Willem de Bruijn, Paolo Abeni, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Norbert Szetei <norbert@doyensec.com>
[ Upstream commit 8ece906150128d5ec2462aabcc978c568433eca4 ]
skb_zerocopy() copies frags from @from into @to. On an
skb_orphan_frags() failure it calls skb_tx_error(@from), a destructive
operation on the source skb the copy helper does not own. That completes
@from's zerocopy uarg and clears SKBFL_ALL_ZEROCOPY, including the
SKBFL_SHARED_FRAG page-ownership marker.
Both callers already report the failure on their own drop path.
nfnetlink_queue does it at nla_put_failure, and Open vSwitch does it in
the flow-miss drop arm of ovs_dp_process_packet(), so nothing is lost by
dropping it here.
On Open vSwitch's OVS_ACTION_ATTR_USERSPACE path the skb is not freed on
this error: do_execute_actions() ignores output_userspace()'s return
value and, unless the upcall was the last action, keeps forwarding the
same skb through the flow's remaining actions. The uarg is completed
while that skb is still in flight, telling the producer its buffers are
free, and SKBFL_SHARED_FRAG is cleared on an skb the rest of the stack
still handles. That flag is what makes esp_input() call skb_cow_data()
instead of decrypting in place, so a later local ESP delivery can
decrypt over frags the skb does not own privately.
Leave error reporting to the callers.
Fixes: 36d5fe6a0007 ("core, nfqueue, openvswitch: Orphan frags in skb_zerocopy and handle errors")
Cc: stable@vger.kernel.org
Suggested-by: Ilya Maximets <i.maximets@ovn.org>
Signed-off-by: Norbert Szetei <norbert@doyensec.com>
Reviewed-by: Ilya Maximets <i.maximets@ovn.org>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/6E3A780D-FB87-421F-9964-B1D457D7D106@doyensec.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
[ 7.2 and earlier do not have the put_page() call on the error path ]
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/skbuff.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index a3d329b2ccfd0..ca861bd6db148 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3847,10 +3847,9 @@ skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen)
skb_len_add(to, len + plen);
- if (unlikely(skb_orphan_frags(from, GFP_ATOMIC))) {
- skb_tx_error(from);
+ if (unlikely(skb_orphan_frags(from, GFP_ATOMIC)))
return -ENOMEM;
- }
+
skb_zerocopy_clone(to, from, GFP_ATOMIC);
for (i = 0; i < skb_shinfo(from)->nr_frags; i++) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0002/1376] net: openvswitch: fix kernel-doc warnings in internal headers
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0001/1376] net: skbuff: dont skb_tx_error() the source skb in skb_zerocopy() Greg Kroah-Hartman
@ 2026-09-12 6:40 ` Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0003/1376] openvswitch: Fix CT limit teardown use-after-free Greg Kroah-Hartman
` (996 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ilya Maximets, Eelco Chaudron,
Aaron Conole, Jakub Kicinski, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Maximets <i.maximets@ovn.org>
[ Upstream commit 6bb0dcb3d321c14be7ca33b71a149034d6a2cde8 ]
Some field descriptions were missing, some were not very accurate.
Not touching the uAPI header or .c files for now.
Formatting of those comments isn't great in general, but at least
they are not missing anything now.
Before:
$ ./scripts/kernel-doc -none -Wall net/openvswitch/*.h 2>&1 | wc -l
16
After:
$ ./scripts/kernel-doc -none -Wall net/openvswitch/*.h 2>&1 | wc -l
0
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
Acked-by: Eelco Chaudron <echaudro@redhat.com>
Reviewed-by: Aaron Conole <aconole@redhat.com>
Link: https://patch.msgid.link/20250320224431.252489-1-i.maximets@ovn.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/openvswitch/datapath.h | 20 ++++++++++++++------
net/openvswitch/vport.h | 9 +++++++++
2 files changed, 23 insertions(+), 6 deletions(-)
diff --git a/net/openvswitch/datapath.h b/net/openvswitch/datapath.h
index 8453da5507e11..67250d7df1ab2 100644
--- a/net/openvswitch/datapath.h
+++ b/net/openvswitch/datapath.h
@@ -29,8 +29,8 @@
* datapath.
* @n_hit: Number of received packets for which a matching flow was found in
* the flow table.
- * @n_miss: Number of received packets that had no matching flow in the flow
- * table. The sum of @n_hit and @n_miss is the number of packets that have
+ * @n_missed: Number of received packets that had no matching flow in the flow
+ * table. The sum of @n_hit and @n_missed is the number of packets that have
* been received by the datapath.
* @n_lost: Number of received packets that had no matching flow in the flow
* table that could not be sent to userspace (normally due to an overflow in
@@ -40,6 +40,7 @@
* up per packet.
* @n_cache_hit: The number of received packets that had their mask found using
* the mask cache.
+ * @syncp: Synchronization point for 64bit counters.
*/
struct dp_stats_percpu {
u64 n_hit;
@@ -74,8 +75,10 @@ struct dp_nlsk_pids {
* ovs_mutex and RCU.
* @stats_percpu: Per-CPU datapath statistics.
* @net: Reference to net namespace.
- * @max_headroom: the maximum headroom of all vports in this datapath; it will
+ * @user_features: Bitmap of enabled %OVS_DP_F_* features.
+ * @max_headroom: The maximum headroom of all vports in this datapath; it will
* be used by all the internal vports in this dp.
+ * @meter_tbl: Meter table.
* @upcall_portids: RCU protected 'struct dp_nlsk_pids'.
*
* Context: See the comment on locking at the top of datapath.c for additional
@@ -128,10 +131,13 @@ struct ovs_skb_cb {
#define OVS_CB(skb) ((struct ovs_skb_cb *)(skb)->cb)
/**
- * struct dp_upcall - metadata to include with a packet to send to userspace
+ * struct dp_upcall_info - metadata to include with a packet sent to userspace
* @cmd: One of %OVS_PACKET_CMD_*.
* @userdata: If nonnull, its variable-length value is passed to userspace as
* %OVS_PACKET_ATTR_USERDATA.
+ * @actions: If nonnull, its variable-length value is passed to userspace as
+ * %OVS_PACKET_ATTR_ACTIONS.
+ * @actions_len: The length of the @actions.
* @portid: Netlink portid to which packet should be sent. If @portid is 0
* then no packet is sent and the packet is accounted in the datapath's @n_lost
* counter.
@@ -152,6 +158,10 @@ struct dp_upcall_info {
* struct ovs_net - Per net-namespace data for ovs.
* @dps: List of datapaths to enable dumping them all out.
* Protected by genl_mutex.
+ * @dp_notify_work: A work notifier to handle port unregistering.
+ * @masks_rebalance: A work to periodically optimize flow table caches.
+ * @ct_limit_info: A hash table of conntrack zone connection limits.
+ * @xt_label: Whether connlables are configured for the network or not.
*/
struct ovs_net {
struct list_head dps;
@@ -160,8 +170,6 @@ struct ovs_net {
#if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
struct ovs_ct_limit_info *ct_limit_info;
#endif
-
- /* Module reference for configuring conntrack. */
bool xt_label;
};
diff --git a/net/openvswitch/vport.h b/net/openvswitch/vport.h
index 3e71ca8ad8a78..9f67b9dd49f98 100644
--- a/net/openvswitch/vport.h
+++ b/net/openvswitch/vport.h
@@ -97,6 +97,8 @@ struct vport {
* @desired_ifindex: New vport's ifindex.
* @dp: New vport's datapath.
* @port_no: New vport's port number.
+ * @upcall_portids: %OVS_VPORT_ATTR_UPCALL_PID attribute from Netlink message,
+ * %NULL if none was supplied.
*/
struct vport_parms {
const char *name;
@@ -125,6 +127,8 @@ struct vport_parms {
* have any configuration.
* @send: Send a packet on the device.
* zero for dropped packets or negative for error.
+ * @owner: Module that implements this vport type.
+ * @list: List entry in the global list of vport types.
*/
struct vport_ops {
enum ovs_vport_type type;
@@ -144,6 +148,7 @@ struct vport_ops {
/**
* struct vport_upcall_stats_percpu - per-cpu packet upcall statistics for
* a given vport.
+ * @syncp: Synchronization point for 64bit counters.
* @n_success: Number of packets that upcall to userspace succeed.
* @n_fail: Number of packets that upcall to userspace failed.
*/
@@ -164,6 +169,8 @@ void ovs_vport_free(struct vport *);
*
* @vport: vport to access
*
+ * Returns: A void pointer to a private data allocated in the @vport.
+ *
* If a nonzero size was passed in priv_size of vport_alloc() a private data
* area was allocated on creation. This allows that area to be accessed and
* used for any purpose needed by the vport implementer.
@@ -178,6 +185,8 @@ static inline void *vport_priv(const struct vport *vport)
*
* @priv: Start of private data area.
*
+ * Returns: A reference to a vport structure that contains @priv.
+ *
* It is sometimes useful to translate from a pointer to the private data
* area to the vport, such as in the case where the private data pointer is
* the result of a hash table lookup. @priv must point to the start of the
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0003/1376] openvswitch: Fix CT limit teardown use-after-free
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0001/1376] net: skbuff: dont skb_tx_error() the source skb in skb_zerocopy() Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0002/1376] net: openvswitch: fix kernel-doc warnings in internal headers Greg Kroah-Hartman
@ 2026-09-12 6:40 ` Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0004/1376] landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation Greg Kroah-Hartman
` (995 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vega, Nan Li, Yuqi Xu, Ren Wei,
Ilya Maximets, Jakub Kicinski, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuqi Xu <xuyuqiabc@gmail.com>
[ Upstream commit 403f96c32c9e24600093d7d0c61c17daeedca957 ]
Packet processing uses CT limit state under RCU, while netns teardown
frees that state under ovs_mutex. The CT limit pointer was neither removed
from readers nor protected by a grace period, allowing packet processing to
dereference the freed state.
An unprivileged user can trigger this bug from a user and network
namespace, causing a slab-use-after-free in ovs_ct_execute() when the
netns is torn down.
Publish the CT limit pointer through RCU, remove it before teardown, and
wait for readers before freeing its contents. Keep ovs_mutex around
individual CT limit updates, and use the RCU read-side lock while GET
traverses the RCU-protected limit lists.
Netns teardown detaches the RCU-protected CT limit state in the pernet
.pre_exit callback while holding ovs_mutex. The pernet core guarantees an
RCU grace period between the .pre_exit and .exit callbacks, so the .exit
callback completes the teardown without adding any extra synchronization.
The netlink command handlers do not need NULL checks because the userspace
netlink socket holds an active reference to its network namespace while a
request is processed. The per-netns exit path therefore cannot run
concurrently with SET, DEL, or GET for that socket's namespace.
Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Link: https://lore.kernel.org/all/cover.1784711445.git.xuyuqiabc@gmail.com
Co-developed-by: Nan Li <tonanli66@gmail.com>
Signed-off-by: Nan Li <tonanli66@gmail.com>
Signed-off-by: Yuqi Xu <xuyuqiabc@gmail.com>
Reviewed-by: Ren Wei <enjou1224z@gmail.com>
Reviewed-by: Ilya Maximets <i.maximets@ovn.org>
Link: https://patch.msgid.link/288fbd5459d92b9dd0dcc6faf625f04819161ff3.1787280296.git.xuyuqiabc@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ 7.0+ uses kmalloc_obj[s] while older versions use kmalloc[_array] ]
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/openvswitch/conntrack.c | 121 +++++++++++++++++++++++-------------
net/openvswitch/conntrack.h | 6 +-
net/openvswitch/datapath.c | 10 ++-
net/openvswitch/datapath.h | 8 ++-
4 files changed, 98 insertions(+), 47 deletions(-)
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index fb68aa17e479d..3f51f19686541 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -932,10 +932,14 @@ static int ovs_ct_check_limit(struct net *net,
const struct ovs_conntrack_info *info)
{
struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
- const struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
+ const struct ovs_ct_limit_info *ct_limit_info;
u32 per_zone_limit, connections;
u32 conncount_key;
+ ct_limit_info = rcu_dereference(ovs_net->ct_limit_info);
+ if (!ct_limit_info)
+ return 0;
+
conncount_key = info->zone.id;
per_zone_limit = ct_limit_get(ct_limit_info, info->zone.id);
@@ -1584,42 +1588,56 @@ static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info)
#if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
static int ovs_ct_limit_init(struct net *net, struct ovs_net *ovs_net)
{
+ struct ovs_ct_limit_info *info;
int i, err;
- ovs_net->ct_limit_info = kmalloc(sizeof(*ovs_net->ct_limit_info),
- GFP_KERNEL);
- if (!ovs_net->ct_limit_info)
+ info = kmalloc(sizeof(*info), GFP_KERNEL);
+ if (!info)
return -ENOMEM;
- ovs_net->ct_limit_info->default_limit = OVS_CT_LIMIT_DEFAULT;
- ovs_net->ct_limit_info->limits =
+ info->default_limit = OVS_CT_LIMIT_DEFAULT;
+ info->limits =
kmalloc_array(CT_LIMIT_HASH_BUCKETS, sizeof(struct hlist_head),
GFP_KERNEL);
- if (!ovs_net->ct_limit_info->limits) {
- kfree(ovs_net->ct_limit_info);
+ if (!info->limits) {
+ kfree(info);
return -ENOMEM;
}
for (i = 0; i < CT_LIMIT_HASH_BUCKETS; i++)
- INIT_HLIST_HEAD(&ovs_net->ct_limit_info->limits[i]);
+ INIT_HLIST_HEAD(&info->limits[i]);
- ovs_net->ct_limit_info->data = nf_conncount_init(net, sizeof(u32));
+ info->data = nf_conncount_init(net, sizeof(u32));
- if (IS_ERR(ovs_net->ct_limit_info->data)) {
- err = PTR_ERR(ovs_net->ct_limit_info->data);
- kfree(ovs_net->ct_limit_info->limits);
- kfree(ovs_net->ct_limit_info);
+ if (IS_ERR(info->data)) {
+ err = PTR_ERR(info->data);
+ kfree(info->limits);
+ kfree(info);
pr_err("openvswitch: failed to init nf_conncount %d\n", err);
return err;
}
+ rcu_assign_pointer(ovs_net->ct_limit_info, info);
return 0;
}
-static void ovs_ct_limit_exit(struct net *net, struct ovs_net *ovs_net)
+static void *ovs_ct_limit_exit_start(struct ovs_net *ovs_net)
+{
+ return rcu_replace_pointer(ovs_net->ct_limit_info, NULL,
+ lockdep_ovsl_is_held());
+}
+
+/* The CT limit state must be detached by ovs_ct_limit_exit_start() and an
+ * RCU grace period must elapse before this function runs. The pernet core
+ * guarantees the grace period between the .pre_exit and .exit callbacks.
+ */
+static void ovs_ct_limit_exit_finish(struct net *net, void *data)
{
- const struct ovs_ct_limit_info *info = ovs_net->ct_limit_info;
+ const struct ovs_ct_limit_info *info = data;
int i;
+ if (!info)
+ return;
+
nf_conncount_destroy(net, info->data);
for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) {
struct hlist_head *head = &info->limits[i];
@@ -1627,7 +1645,7 @@ static void ovs_ct_limit_exit(struct net *net, struct ovs_net *ovs_net)
struct hlist_node *next;
hlist_for_each_entry_safe(ct_limit, next, head, hlist_node)
- kfree_rcu(ct_limit, rcu);
+ kfree(ct_limit);
}
kfree(info->limits);
kfree(info);
@@ -1666,12 +1684,13 @@ static bool check_zone_id(int zone_id, u16 *pzone)
return false;
}
-static int ovs_ct_limit_set_zone_limit(struct nlattr *nla_zone_limit,
- struct ovs_ct_limit_info *info)
+static int ovs_ct_limit_set_zone_limit(struct ovs_net *ovs_net,
+ struct nlattr *nla_zone_limit)
{
struct ovs_zone_limit *zone_limit;
- int rem;
+ struct ovs_ct_limit_info *info;
u16 zone;
+ int rem;
rem = NLA_ALIGN(nla_len(nla_zone_limit));
zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit);
@@ -1680,6 +1699,7 @@ static int ovs_ct_limit_set_zone_limit(struct nlattr *nla_zone_limit,
if (unlikely(zone_limit->zone_id ==
OVS_ZONE_LIMIT_DEFAULT_ZONE)) {
ovs_lock();
+ info = ovsl_dereference(ovs_net->ct_limit_info);
info->default_limit = zone_limit->limit;
ovs_unlock();
} else if (unlikely(!check_zone_id(
@@ -1697,6 +1717,7 @@ static int ovs_ct_limit_set_zone_limit(struct nlattr *nla_zone_limit,
ct_limit->limit = zone_limit->limit;
ovs_lock();
+ info = ovsl_dereference(ovs_net->ct_limit_info);
ct_limit_set(info, ct_limit);
ovs_unlock();
}
@@ -1711,12 +1732,13 @@ static int ovs_ct_limit_set_zone_limit(struct nlattr *nla_zone_limit,
return 0;
}
-static int ovs_ct_limit_del_zone_limit(struct nlattr *nla_zone_limit,
- struct ovs_ct_limit_info *info)
+static int ovs_ct_limit_del_zone_limit(struct ovs_net *ovs_net,
+ struct nlattr *nla_zone_limit)
{
struct ovs_zone_limit *zone_limit;
- int rem;
+ struct ovs_ct_limit_info *info;
u16 zone;
+ int rem;
rem = NLA_ALIGN(nla_len(nla_zone_limit));
zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit);
@@ -1725,6 +1747,7 @@ static int ovs_ct_limit_del_zone_limit(struct nlattr *nla_zone_limit,
if (unlikely(zone_limit->zone_id ==
OVS_ZONE_LIMIT_DEFAULT_ZONE)) {
ovs_lock();
+ info = ovsl_dereference(ovs_net->ct_limit_info);
info->default_limit = OVS_CT_LIMIT_DEFAULT;
ovs_unlock();
} else if (unlikely(!check_zone_id(
@@ -1732,6 +1755,7 @@ static int ovs_ct_limit_del_zone_limit(struct nlattr *nla_zone_limit,
OVS_NLERR(true, "zone id is out of range");
} else {
ovs_lock();
+ info = ovsl_dereference(ovs_net->ct_limit_info);
ct_limit_del(info, zone);
ovs_unlock();
}
@@ -1775,6 +1799,7 @@ static int __ovs_ct_limit_get_zone_limit(struct net *net,
return nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit);
}
+/* Called with RCU read lock held. */
static int ovs_ct_limit_get_zone_limit(struct net *net,
struct nlattr *nla_zone_limit,
struct ovs_ct_limit_info *info,
@@ -1798,12 +1823,10 @@ static int ovs_ct_limit_get_zone_limit(struct net *net,
&zone))) {
OVS_NLERR(true, "zone id is out of range");
} else {
- rcu_read_lock();
limit = ct_limit_get(info, zone);
err = __ovs_ct_limit_get_zone_limit(
net, info->data, zone, limit, reply);
- rcu_read_unlock();
if (err)
return err;
}
@@ -1818,6 +1841,7 @@ static int ovs_ct_limit_get_zone_limit(struct net *net,
return 0;
}
+/* Called with RCU read lock held. */
static int ovs_ct_limit_get_all_zone_limit(struct net *net,
struct ovs_ct_limit_info *info,
struct sk_buff *reply)
@@ -1830,19 +1854,16 @@ static int ovs_ct_limit_get_all_zone_limit(struct net *net,
if (err)
return err;
- rcu_read_lock();
for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) {
head = &info->limits[i];
hlist_for_each_entry_rcu(ct_limit, head, hlist_node) {
err = __ovs_ct_limit_get_zone_limit(net, info->data,
ct_limit->zone, ct_limit->limit, reply);
if (err)
- goto exit_err;
+ return err;
}
}
-exit_err:
- rcu_read_unlock();
return err;
}
@@ -1852,7 +1873,6 @@ static int ovs_ct_limit_cmd_set(struct sk_buff *skb, struct genl_info *info)
struct sk_buff *reply;
struct ovs_header *ovs_reply_header;
struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id);
- struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
int err;
reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_SET,
@@ -1865,8 +1885,8 @@ static int ovs_ct_limit_cmd_set(struct sk_buff *skb, struct genl_info *info)
goto exit_err;
}
- err = ovs_ct_limit_set_zone_limit(a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT],
- ct_limit_info);
+ err = ovs_ct_limit_set_zone_limit(ovs_net,
+ a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]);
if (err)
goto exit_err;
@@ -1886,7 +1906,6 @@ static int ovs_ct_limit_cmd_del(struct sk_buff *skb, struct genl_info *info)
struct sk_buff *reply;
struct ovs_header *ovs_reply_header;
struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id);
- struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
int err;
reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_DEL,
@@ -1899,8 +1918,8 @@ static int ovs_ct_limit_cmd_del(struct sk_buff *skb, struct genl_info *info)
goto exit_err;
}
- err = ovs_ct_limit_del_zone_limit(a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT],
- ct_limit_info);
+ err = ovs_ct_limit_del_zone_limit(ovs_net,
+ a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]);
if (err)
goto exit_err;
@@ -1920,7 +1939,7 @@ static int ovs_ct_limit_cmd_get(struct sk_buff *skb, struct genl_info *info)
struct ovs_header *ovs_reply_header;
struct net *net = sock_net(skb->sk);
struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
- struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
+ struct ovs_ct_limit_info *ct_limit_info;
int err;
reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_GET,
@@ -1934,18 +1953,19 @@ static int ovs_ct_limit_cmd_get(struct sk_buff *skb, struct genl_info *info)
goto exit_err;
}
+ rcu_read_lock();
+ ct_limit_info = rcu_dereference(ovs_net->ct_limit_info);
if (a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) {
err = ovs_ct_limit_get_zone_limit(
net, a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], ct_limit_info,
reply);
- if (err)
- goto exit_err;
} else {
err = ovs_ct_limit_get_all_zone_limit(net, ct_limit_info,
reply);
- if (err)
- goto exit_err;
}
+ rcu_read_unlock();
+ if (err)
+ goto exit_err;
nla_nest_end(reply, nla_reply);
genlmsg_end(reply, ovs_reply_header);
@@ -2020,12 +2040,29 @@ int ovs_ct_init(struct net *net)
return err;
}
-void ovs_ct_exit(struct net *net)
+/* Must be called with ovs_mutex held. Detaches the RCU-protected
+ * ct_limit_info and stores it in ovs_net->ct_limit_exit_data for
+ * ovs_ct_exit_finish() to complete the teardown after an RCU grace period.
+ */
+void ovs_ct_exit_start(struct net *net __maybe_unused)
+{
+#if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
+ struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
+
+ ovs_net->ct_limit_exit_data = ovs_ct_limit_exit_start(ovs_net);
+#endif
+}
+
+/* Completes the CT limit teardown. The pernet core guarantees an RCU
+ * grace period between detaching the state in ovs_ct_exit_start() and
+ * this call, so no RCU readers remain.
+ */
+void ovs_ct_exit_finish(struct net *net)
{
struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
#if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
- ovs_ct_limit_exit(net, ovs_net);
+ ovs_ct_limit_exit_finish(net, ovs_net->ct_limit_exit_data);
#endif
if (ovs_net->xt_label)
diff --git a/net/openvswitch/conntrack.h b/net/openvswitch/conntrack.h
index 317e525c8a113..ab21d032fde3d 100644
--- a/net/openvswitch/conntrack.h
+++ b/net/openvswitch/conntrack.h
@@ -14,7 +14,8 @@ enum ovs_key_attr;
#if IS_ENABLED(CONFIG_NF_CONNTRACK)
int ovs_ct_init(struct net *);
-void ovs_ct_exit(struct net *);
+void ovs_ct_exit_start(struct net *net);
+void ovs_ct_exit_finish(struct net *net);
bool ovs_ct_verify(struct net *, enum ovs_key_attr attr);
int ovs_ct_copy_action(struct net *, const struct nlattr *,
const struct sw_flow_key *, struct sw_flow_actions **,
@@ -40,7 +41,8 @@ void ovs_ct_free_action(const struct nlattr *a);
static inline int ovs_ct_init(struct net *net) { return 0; }
-static inline void ovs_ct_exit(struct net *net) { }
+static inline void ovs_ct_exit_start(struct net *net) { }
+static inline void ovs_ct_exit_finish(struct net *net) { }
static inline bool ovs_ct_verify(struct net *net, int attr)
{
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index 7d15be7784747..1d11e72cf08db 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -2730,6 +2730,13 @@ static void __net_exit list_vports_from_net(struct net *net, struct net *dnet,
}
}
+static void __net_exit ovs_pre_exit_net(struct net *dnet)
+{
+ ovs_lock();
+ ovs_ct_exit_start(dnet);
+ ovs_unlock();
+}
+
static void __net_exit ovs_exit_net(struct net *dnet)
{
struct datapath *dp, *dp_next;
@@ -2740,7 +2747,7 @@ static void __net_exit ovs_exit_net(struct net *dnet)
ovs_lock();
- ovs_ct_exit(dnet);
+ ovs_ct_exit_finish(dnet);
list_for_each_entry_safe(dp, dp_next, &ovs_net->dps, list_node)
__dp_destroy(dp);
@@ -2764,6 +2771,7 @@ static void __net_exit ovs_exit_net(struct net *dnet)
static struct pernet_operations ovs_net_ops = {
.init = ovs_init_net,
+ .pre_exit = ovs_pre_exit_net,
.exit = ovs_exit_net,
.id = &ovs_net_id,
.size = sizeof(struct ovs_net),
diff --git a/net/openvswitch/datapath.h b/net/openvswitch/datapath.h
index 67250d7df1ab2..285c578dc30a3 100644
--- a/net/openvswitch/datapath.h
+++ b/net/openvswitch/datapath.h
@@ -160,7 +160,10 @@ struct dp_upcall_info {
* Protected by genl_mutex.
* @dp_notify_work: A work notifier to handle port unregistering.
* @masks_rebalance: A work to periodically optimize flow table caches.
- * @ct_limit_info: A hash table of conntrack zone connection limits.
+ * @ct_limit_info: Hash table of conntrack zone connection limits. Protected
+ * by RCU; updates and teardown are serialized by ovs_mutex. May be NULL during
+ * netns teardown.
+ * @ct_limit_exit_data: CT limit state detached at .pre_exit, freed at .exit.
* @xt_label: Whether connlables are configured for the network or not.
*/
struct ovs_net {
@@ -168,7 +171,8 @@ struct ovs_net {
struct work_struct dp_notify_work;
struct delayed_work masks_rebalance;
#if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
- struct ovs_ct_limit_info *ct_limit_info;
+ struct ovs_ct_limit_info __rcu *ct_limit_info;
+ struct ovs_ct_limit_info *ct_limit_exit_data;
#endif
bool xt_label;
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0004/1376] landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2026-09-12 6:40 ` [PATCH 6.12 0003/1376] openvswitch: Fix CT limit teardown use-after-free Greg Kroah-Hartman
@ 2026-09-12 6:40 ` Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0005/1376] xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() Greg Kroah-Hartman
` (994 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Brauner,
Mickaël Salaün, Günther Noack, Günther Noack,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Günther Noack <gnoack@google.com>
[ Upstream commit 672fa082d48b21e1fb62cdb184fee41513e53421 ]
Whiteout objects are used in the upper layer of an OverlayFS to
indicate that the file with this name does not exist in the unified
view, even if it is present in one of the lower layer file systems.
For the userspace implementations of OverlayFS (fuse-overlayfs),
whiteout objects can be created from userspace as well:
* mknod(2) with S_IFCHR and makedev(0, 0)
* renameat2(2) with RENAME_WHITEOUT,
creating the whiteout in the old place of the moved file.
This commit guards whiteout creation in both of these cases with
LANDLOCK_ACCESS_FS_MAKE_REG. Whiteout objects are *not* considered
character devices and are not bound to a driver.
LANDLOCK_ACCESS_FS_MAKE_REG describes the same permission class as a
whiteout object: creating one is the only S_IFCHR creation that the VFS
exempts from CAP_MKNOD, so it is as unprivileged as creating a regular
file, while LANDLOCK_ACCESS_FS_MAKE_CHAR and
LANDLOCK_ACCESS_FS_MAKE_BLOCK keep meaning the creation of devices that
expose a kernel interface [1].
For the mknod(2) case, introduce a Landlock erratum. The creation of
whiteout objects through mknod(2) was previously guarded using
LANDLOCK_ACCESS_FS_MAKE_CHAR, and it is now guarded using
LANDLOCK_ACCESS_FS_MAKE_REG.
For the renameat2(2) case, fix a bug: Before this commit, renameat2(2)
with RENAME_WHITEOUT would create a directory entry even when all
LANDLOCK_ACCESS_FS_MAKE_* rights were denied.
This does not affect normal renames within layered OverlayFS mounts:
When doing a regular rename() on a mounted fuse-overlayfs, it is the
fuse-overlayfs daemon that exercises renameat2() with RENAME_WHITEOUT,
and only the Landlock domain of that daemon is checked there.
Suggested-by: Christian Brauner <brauner@kernel.org>
Suggested-by: Mickaël Salaün <mic@digikod.net>
Cc: stable@vger.kernel.org
Fixes: cb2c7d1a1776 ("landlock: Support filesystem access-control")
Depends-on: 49c9e09d9610 ("landlock: Fix handling of disconnected directories")
Depends-on: fe72ce6710cb ("landlock: Add errata documentation section")
Signed-off-by: Günther Noack <gnoack@google.com>
Link: https://patch.msgid.link/20260720.chow9ohYie5b@digikod.net [1]
Link: https://patch.msgid.link/20260813093157.1436894-3-gnoack@google.com
[mic: Record why LANDLOCK_ACCESS_FS_MAKE_REG is the matching right, and
add link(2) to the user doc]
Signed-off-by: Mickaël Salaün <mic@digikod.net>
Signed-off-by: Günther Noack <gnoack3000@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/uapi/linux/landlock.h | 1 +
security/landlock/errata/abi-1.h | 23 ++++++++++++++++++
security/landlock/fs.c | 40 +++++++++++++++++++++++++-------
3 files changed, 55 insertions(+), 9 deletions(-)
diff --git a/include/uapi/linux/landlock.h b/include/uapi/linux/landlock.h
index c223572f82296..94cfad88082f3 100644
--- a/include/uapi/linux/landlock.h
+++ b/include/uapi/linux/landlock.h
@@ -177,6 +177,7 @@ struct landlock_net_port_attr {
* device.
* - %LANDLOCK_ACCESS_FS_MAKE_DIR: Create (or rename) a directory.
* - %LANDLOCK_ACCESS_FS_MAKE_REG: Create (or rename or link) a regular file.
+ * This also guards the creation of whiteout objects as used in OverlayFS.
* - %LANDLOCK_ACCESS_FS_MAKE_SOCK: Create (or rename or link) a UNIX domain
* socket.
* - %LANDLOCK_ACCESS_FS_MAKE_FIFO: Create (or rename or link) a named pipe.
diff --git a/security/landlock/errata/abi-1.h b/security/landlock/errata/abi-1.h
index e8a2bff2e5b6a..80930957e84d2 100644
--- a/security/landlock/errata/abi-1.h
+++ b/security/landlock/errata/abi-1.h
@@ -14,3 +14,26 @@
* actions.
*/
LANDLOCK_ERRATUM(3)
+
+/**
+ * DOC: erratum_4
+ *
+ * Erratum 4: Creation of whiteout objects
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ * This fix changes the access rights required for the creation of whiteout
+ * objects through :manpage:`mknod(2)`, :manpage:`renameat2(2)`, or
+ * :manpage:`link(2)`. Creating whiteout objects is now guarded by
+ * ``LANDLOCK_ACCESS_FS_MAKE_REG`` instead of ``LANDLOCK_ACCESS_FS_MAKE_CHAR``.
+ *
+ * Whiteout objects are used in OverlayFS to mark the absence of a file in an
+ * upper file system. Despite being created with ``S_IFCHR``, whiteout objects
+ * do not count as character devices.
+ *
+ * Impact:
+ *
+ * Sandboxed programs that create OverlayFS whiteouts (such as fuse-overlayfs)
+ * now require ``LANDLOCK_ACCESS_FS_MAKE_REG`` instead of
+ * ``LANDLOCK_ACCESS_FS_MAKE_CHAR``.
+ */
+LANDLOCK_ERRATUM(4)
diff --git a/security/landlock/fs.c b/security/landlock/fs.c
index bb4a9e82156a6..b96a4daa5b2a2 100644
--- a/security/landlock/fs.c
+++ b/security/landlock/fs.c
@@ -20,6 +20,7 @@
#include <linux/falloc.h>
#include <linux/fs.h>
#include <linux/init.h>
+#include <linux/kdev_t.h>
#include <linux/kernel.h>
#include <linux/limits.h>
#include <linux/list.h>
@@ -954,7 +955,7 @@ static int current_check_access_path(const struct path *const path,
return check_access_path(dom, path, access_request);
}
-static access_mask_t get_mode_access(const umode_t mode)
+static access_mask_t get_mode_access(const umode_t mode, const dev_t dev)
{
switch (mode & S_IFMT) {
case S_IFLNK:
@@ -962,6 +963,9 @@ static access_mask_t get_mode_access(const umode_t mode)
case S_IFDIR:
return LANDLOCK_ACCESS_FS_MAKE_DIR;
case S_IFCHR:
+ /* Whiteout objects are guarded with MAKE_REG. */
+ if (dev == WHITEOUT_DEV)
+ return LANDLOCK_ACCESS_FS_MAKE_REG;
return LANDLOCK_ACCESS_FS_MAKE_CHAR;
case S_IFBLK:
return LANDLOCK_ACCESS_FS_MAKE_BLOCK;
@@ -978,6 +982,13 @@ static access_mask_t get_mode_access(const umode_t mode)
}
}
+static access_mask_t get_dentry_access(const struct dentry *const dentry)
+{
+ const struct inode *const inode = d_backing_inode(dentry);
+
+ return get_mode_access(inode->i_mode, inode->i_rdev);
+}
+
static access_mask_t maybe_remove(const struct dentry *const dentry)
{
if (d_is_negative(dentry))
@@ -1067,6 +1078,7 @@ static bool collect_domain_accesses(
* @new_dentry: Destination file or directory.
* @removable: Sets to true if it is a rename operation.
* @exchange: Sets to true if it is a rename operation with RENAME_EXCHANGE.
+ * @whiteout: Sets to true if it is a rename operation with RENAME_WHITEOUT.
*
* Because of its unprivileged constraints, Landlock relies on file hierarchies
* (and not only inodes) to tie access rights to files. Being able to link or
@@ -1115,7 +1127,8 @@ static bool collect_domain_accesses(
static int current_check_refer_path(struct dentry *const old_dentry,
const struct path *const new_dir,
struct dentry *const new_dentry,
- const bool removable, const bool exchange)
+ const bool removable, const bool exchange,
+ const bool whiteout)
{
const struct landlock_ruleset *const dom = get_current_fs_domain();
bool allow_parent1, allow_parent2;
@@ -1134,18 +1147,25 @@ static int current_check_refer_path(struct dentry *const old_dentry,
if (exchange) {
if (unlikely(d_is_negative(new_dentry)))
return -ENOENT;
- access_request_parent1 =
- get_mode_access(d_backing_inode(new_dentry)->i_mode);
+ access_request_parent1 = get_dentry_access(new_dentry);
} else {
access_request_parent1 = 0;
}
- access_request_parent2 =
- get_mode_access(d_backing_inode(old_dentry)->i_mode);
+ access_request_parent2 = get_dentry_access(old_dentry);
if (removable) {
access_request_parent1 |= maybe_remove(old_dentry);
access_request_parent2 |= maybe_remove(new_dentry);
}
+ /*
+ * In case of renameat2(2) with RENAME_WHITEOUT, a whiteout object is
+ * created in the source location, so we require an additional access
+ * right there.
+ */
+ if (whiteout)
+ access_request_parent1 |=
+ get_mode_access(S_IFCHR | WHITEOUT_MODE, WHITEOUT_DEV);
+
/* The mount points are the same for old and new paths, cf. EXDEV. */
if (old_dentry->d_parent == new_dir->dentry) {
/*
@@ -1417,7 +1437,7 @@ static int hook_path_link(struct dentry *const old_dentry,
struct dentry *const new_dentry)
{
return current_check_refer_path(old_dentry, new_dir, new_dentry, false,
- false);
+ false, false);
}
static int hook_path_rename(const struct path *const old_dir,
@@ -1428,7 +1448,8 @@ static int hook_path_rename(const struct path *const old_dir,
{
/* old_dir refers to old_dentry->d_parent and new_dir->mnt */
return current_check_refer_path(old_dentry, new_dir, new_dentry, true,
- !!(flags & RENAME_EXCHANGE));
+ !!(flags & RENAME_EXCHANGE),
+ !!(flags & RENAME_WHITEOUT));
}
static int hook_path_mkdir(const struct path *const dir,
@@ -1445,7 +1466,8 @@ static int hook_path_mknod(const struct path *const dir,
if (!dom)
return 0;
- return check_access_path(dom, dir, get_mode_access(mode));
+ return check_access_path(dom, dir,
+ get_mode_access(mode, new_decode_dev(dev)));
}
static int hook_path_symlink(const struct path *const dir,
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0005/1376] xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2026-09-12 6:40 ` [PATCH 6.12 0004/1376] landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation Greg Kroah-Hartman
@ 2026-09-12 6:40 ` Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0006/1376] netfs: Fix netfs_read_folio() to wait on writeback Greg Kroah-Hartman
` (993 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maciej Fijalkowski, Jason Xing,
Stanislav Fomichev, Jakub Kicinski, Suraj Jitindar Singh,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Xing <kernelxing@tencent.com>
commit 22ba97ea9cc1f63a0d0244fae38057ed452b6ac7 upstream.
The TX metadata area resides in the UMEM buffer which is memory-mapped
and concurrently writable by userspace. In xsk_skb_metadata(),
csum_start and csum_offset are read from shared memory for bounds
validation, then read again for skb assignment. A malicious userspace
application can race to overwrite these values between the two reads,
bypassing the bounds check and causing out-of-bounds memory access
during checksum computation in the transmit path.
Fix this by reading csum_start and csum_offset into local variables
once, then using the local copies for both validation and assignment.
Note that other metadata fields (flags, launch_time) and the cached
csum fields may be mutually inconsistent due to concurrent userspace
writes, but this is benign: the only security-critical invariant is
that each field's validated value is the same one used, which local
caching guarantees.
Closes: https://lore.kernel.org/all/20260503200927.73EA1C2BCB4@smtp.kernel.org/
Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Signed-off-by: Jason Xing <kernelxing@tencent.com>
Acked-by: Stanislav Fomichev <sdf@fomichev.me>
Fixes: 48eb03dd2630 ("xsk: Add TX timestamp and TX checksum offload support")
Link: https://patch.msgid.link/20260530042630.80626-1-kerneljasonxing@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ 6.12: Apply fix in xsk_build_skb() since missing patch
30c3055f9c0d ("xsk: wrap generic metadata handling onto separate
function") added in v6.18 which moves handling to separate
function xsk_skb_metadata(). ]
Signed-off-by: Suraj Jitindar Singh <surajjs@amazon.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/xdp/xsk.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
index da7e11e3bfad2..76675ce70f03d 100644
--- a/net/xdp/xsk.c
+++ b/net/xdp/xsk.c
@@ -665,6 +665,7 @@ static struct sk_buff *xsk_build_skb(struct xdp_sock *xs,
struct xsk_tx_metadata *meta = NULL;
struct net_device *dev = xs->dev;
struct sk_buff *skb = xs->skb;
+ u16 csum_start, csum_offset;
bool first_frag = false;
int err;
@@ -733,15 +734,17 @@ static struct sk_buff *xsk_build_skb(struct xdp_sock *xs,
}
if (meta->flags & XDP_TXMD_FLAGS_CHECKSUM) {
- if (unlikely(meta->request.csum_start +
- meta->request.csum_offset +
+ csum_start = READ_ONCE(meta->request.csum_start);
+ csum_offset = READ_ONCE(meta->request.csum_offset);
+
+ if (unlikely(csum_start + csum_offset +
sizeof(__sum16) > len)) {
err = -EINVAL;
goto free_err;
}
- skb->csum_start = hr + meta->request.csum_start;
- skb->csum_offset = meta->request.csum_offset;
+ skb->csum_start = hr + csum_start;
+ skb->csum_offset = csum_offset;
skb->ip_summed = CHECKSUM_PARTIAL;
if (unlikely(xs->pool->tx_sw_csum)) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0006/1376] netfs: Fix netfs_read_folio() to wait on writeback
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2026-09-12 6:40 ` [PATCH 6.12 0005/1376] xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() Greg Kroah-Hartman
@ 2026-09-12 6:40 ` Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0007/1376] mm/page_vma_mapped: use huge_ptep_get() for hugetlb Greg Kroah-Hartman
` (992 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Howells, Paulo Alcantara,
Matthew Wilcox, netfs, linux-fsdevel, Christian Brauner,
Suraj Jitindar Singh, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
commit ded0c6f1606061148c202825f7e53d711f9f84cf upstream.
Fix netfs_read_folio() to wait for an ongoing writeback to complete so that
it can trust the dirty flag and whatever is attached to folio->private
(folio->private may get cleaned up by the collector before it clears the
writeback flag).
Fixes: ee4cdf7ba857 ("netfs: Speed up buffered reading")
Closes: https://sashiko.dev/#/patchset/20260414082004.3756080-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://patch.msgid.link/20260512123404.719402-23-dhowells@redhat.com
cc: Paulo Alcantara <pc@manguebit.org>
cc: Matthew Wilcox <willy@infradead.org>
cc: netfs@lists.linux.dev
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Suraj Jitindar Singh <surajjs@amazon.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/netfs/buffered_read.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/netfs/buffered_read.c b/fs/netfs/buffered_read.c
index d99284e35126c..fd41e38aedb75 100644
--- a/fs/netfs/buffered_read.c
+++ b/fs/netfs/buffered_read.c
@@ -565,6 +565,8 @@ int netfs_read_folio(struct file *file, struct folio *folio)
struct netfs_inode *ctx = netfs_inode(mapping->host);
int ret;
+ folio_wait_writeback(folio);
+
if (folio_test_dirty(folio)) {
trace_netfs_folio(folio, netfs_folio_trace_read_gaps);
return netfs_read_gaps(file, folio);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0007/1376] mm/page_vma_mapped: use huge_ptep_get() for hugetlb
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2026-09-12 6:40 ` [PATCH 6.12 0006/1376] netfs: Fix netfs_read_folio() to wait on writeback Greg Kroah-Hartman
@ 2026-09-12 6:40 ` Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0008/1376] wifi: mt76: mt7996: validate default EEPROM firmware size Greg Kroah-Hartman
` (991 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dev Jain, David Hildenbrand (Arm),
Muchun Song, Alistair Popple, Andi Kleen, Anshuman Khandual,
Byungchul Park, Catalin Marinas, Dave Hansen, Gregory Price,
Harry Yoo, Huang, Ying, Jann Horn, Josh Poimboeuf, Joshua Hahn,
Junichi Nick Nomura, Kiryl Shutsemau, Lance Yang,
Liam R. Howlett, Lorenzo Stoakes, Matthew Brost, Mel Gorman,
Naoya Horiguchi, Oscar Salvador, Pedro Falcato, Rakie Kim,
Ralph Campbell, Rik van Riel, Ryan Roberts, Vlastimil Babka,
Will Deacon, Zi Yan, Andrew Morton, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dev Jain <dev.jain@arm.com>
[ Upstream commit e87df0d5d6962bde50f55f6d02b779daa394f894 ]
check_pte() is the final validation step in page_vma_mapped_walk(). It
reads pvmw->pte with ptep_get() to decide whether the entry maps the PFN
range being walked. For hugetlb VMAs, that pointer refers to a hugetlb
entry.
On arches which provide their own huge_ptep_get() to dereference a huge
pte pointer, accessing via ptep_get() would cause pte_pfn(), pte_present()
etc to misbehave.
It is not clear whether this has a trivially visible effect to userspace.
Use huge_ptep_get() to dereference a huge pte pointer.
Link: https://lore.kernel.org/20260703114202.365553-6-dev.jain@arm.com
Fixes: ace71a19cec5 ("mm: introduce page_vma_mapped_walk()")
Signed-off-by: Dev Jain <dev.jain@arm.com>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Muchun Song <muchun.song@linux.dev>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: Byungchul Park <byungchul@sk.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Gregory Price <gourry@gourry.net>
Cc: Harry Yoo <harry@kernel.org>
Cc: "Huang, Ying" <ying.huang@linux.alibaba.com>
Cc: Jann Horn <jannh@google.com>
Cc: Josh Poimboeuf <jpoimboe@kernel.org>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Jun'ichi "Nick" Nomura <j-nomura@ce.jp.nec.com>
Cc: Kiryl Shutsemau <kas@kernel.org>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Mel Gorman <mel@csn.ul.ie>
Cc: Naoya Horiguchi <nao.horiguchi@gmail.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Ralph Campbell <rcampbell@nvidia.com>
Cc: Rik van Riel <riel@surriel.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Will Deacon <will@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/page_vma_mapped.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/mm/page_vma_mapped.c b/mm/page_vma_mapped.c
index 585a53f7b06f0..1cc8fd382cd13 100644
--- a/mm/page_vma_mapped.c
+++ b/mm/page_vma_mapped.c
@@ -97,7 +97,13 @@ static bool map_pte(struct page_vma_mapped_walk *pvmw, spinlock_t **ptlp)
static bool check_pte(struct page_vma_mapped_walk *pvmw, unsigned long pte_nr)
{
unsigned long pfn;
- pte_t ptent = ptep_get(pvmw->pte);
+ pte_t ptent;
+
+ if (is_vm_hugetlb_page(pvmw->vma))
+ ptent = huge_ptep_get(pvmw->vma->vm_mm, pvmw->address,
+ pvmw->pte);
+ else
+ ptent = ptep_get(pvmw->pte);
if (pvmw->flags & PVMW_MIGRATION) {
swp_entry_t entry;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0008/1376] wifi: mt76: mt7996: validate default EEPROM firmware size
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2026-09-12 6:40 ` [PATCH 6.12 0007/1376] mm/page_vma_mapped: use huge_ptep_get() for hugetlb Greg Kroah-Hartman
@ 2026-09-12 6:40 ` Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0009/1376] hugetlb: only adjust reservation during unmapping if mapcount is 0 Greg Kroah-Hartman
` (990 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Laxman Acharya Padhya, Felix Fietkau,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
[ Upstream commit 653c6e289b13cc6942f3e8f8e3c568e70fa42d1f ]
The default EEPROM firmware is parsed and copied as a full EEPROM
without checking its length. A truncated file can make the driver
read beyond the firmware buffer during variant validation or the
fallback copy.
Reject files shorter than MT7996_EEPROM_SIZE before parsing or
copying the firmware.
Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Cc: stable@vger.kernel.org
Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
Link: https://patch.msgid.link/20260713115412.67095-1-acharyalaxman8848@gmail.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c b/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c
index 4c4ab0d4065d2..a14d1d2849b64 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c
@@ -51,6 +51,12 @@ mt7996_eeprom_load_default(struct mt7996_dev *dev)
goto out;
}
+ if (fw->size < MT7996_EEPROM_SIZE) {
+ dev_err(dev->mt76.dev, "Invalid default bin size\n");
+ ret = -EINVAL;
+ goto out;
+ }
+
memcpy(eeprom, fw->data, MT7996_EEPROM_SIZE);
dev->flash_mode = true;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0009/1376] hugetlb: only adjust reservation during unmapping if mapcount is 0
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2026-09-12 6:40 ` [PATCH 6.12 0008/1376] wifi: mt76: mt7996: validate default EEPROM firmware size Greg Kroah-Hartman
@ 2026-09-12 6:40 ` Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0010/1376] fsnotify: Fix stale object mask after concurrent mark updates Greg Kroah-Hartman
` (989 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guillaume Morin, Breno Leitao,
Rik van Riel, Muchun Song, David Hildenbrand, Oscar Salvador,
Andrew Morton, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Morin <guillaume@morinfr.org>
[ Upstream commit 5120b1e048d48596ffaec1a8412012a91adba73b ]
Since df7a6d1f6405, __unmap_hugepage_range can adjust reservations. In
the case of folio mapped in both a parent and a child, if the parent
unmaps the range first, the reservation adjustment will result in an
underflow of the reserved count. Once the child unmaps the range, the
count is restored. Change __unmap_hugepage_range() to check the mapcount
before adjusting the reservation.
Link: https://lore.kernel.org/all/alEJkwn5VlTTH_ZX@bender.morinfr.org/
Link: https://lore.kernel.org/amkC_1Ya6OiUoiLZ@bender.morinfr.org
Fixes: df7a6d1f6405 ("mm/hugetlb: restore the reservation if needed")
Signed-off-by: Guillaume Morin <guillaume@morinfr.org>
Reviewed-by: Breno Leitao <leitao@debian.org>
Reviewed-by: Rik van Riel <riel@surriel.com>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: David Hildenbrand <david@kernel.org>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Guillaume Morin <guillaume@morinfr.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/hugetlb.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index e910ed0c43d0b..185faeaf5c08e 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -5523,6 +5523,7 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma,
bool adjust_reservation;
unsigned long last_addr_mask;
+ i_mmap_assert_write_locked(vma->vm_file->f_mapping);
WARN_ON(!is_vm_hugetlb_page(vma));
BUG_ON(start & ~huge_page_mask(h));
BUG_ON(end & ~huge_page_mask(h));
@@ -5613,7 +5614,10 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma,
/*
* Restore the reservation for anonymous page, otherwise the
- * backing page could be stolen by someone.
+ * backing page could be stolen by someone. Restore only on the
+ * last unmap, otherwise the owner could empty its resv map
+ * while the folio is still mapped by a child. Note that holding
+ * i_mmap_lock_write is needed to check the number of mappings.
* If there we are freeing a surplus, do not set the restore
* reservation bit.
*/
@@ -5621,7 +5625,7 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma,
spin_lock_irq(&hugetlb_lock);
if (!h->surplus_huge_pages && __vma_private_lock(vma) &&
- folio_test_anon(page_folio(page))) {
+ !folio_mapped(page_folio(page)) && folio_test_anon(page_folio(page))) {
folio_set_hugetlb_restore_reserve(page_folio(page));
/* Reservation to be adjusted after the spin lock */
adjust_reservation = true;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0010/1376] fsnotify: Fix stale object mask after concurrent mark updates
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2026-09-12 6:40 ` [PATCH 6.12 0009/1376] hugetlb: only adjust reservation during unmapping if mapcount is 0 Greg Kroah-Hartman
@ 2026-09-12 6:40 ` Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0011/1376] tcp: fix potential race in tcp_v6_syn_recv_sock() Greg Kroah-Hartman
` (988 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jan Kara, Amir Goldstein,
Youngjae Kwon, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Youngjae Kwon <yjkwon0026@snu.ac.kr>
[ Upstream commit e422777fdd4746de1109575c51e65038d4c5c1be ]
When a mark gets a new event bit, fanotify and inotify may avoid
recalculating the object mask if the cached aggregate already contains that
bit. This is racy with a recalculation triggered by a concurrent update to
another mark on the same connector.
The concurrent scan can read the mark before the new bit is added, while
the updater reads the old aggregate before that scan publishes its result.
The updater then skips recalculation and the scan publishes a mask without
the bit, leaving the object mask stale after both updates complete.
This can be reproduced with two fanotify groups watching the same inode:
one thread removes FAN_MODIFY from one existing mark while another thread
adds FAN_MODIFY to the other mark. After both fanotify_mark() calls return,
writes can fail to produce FAN_MODIFY for the group whose mark now contains
the bit. This was reproduced on an unmodified v6.12.95 kernel. The
equivalent inotify interleaving loses IN_MODIFY events.
For normal fanotify additions, recalculate whenever the raw mark mask
changes. The normal mask is not cleared asynchronously, so an unchanged
addition cannot introduce missing interest. Always recalculate ignore-mask
updates because FS_MODIFY handling may clear the ignore mask without taking
mark->lock, making snapshot comparisons unreliable.
Always recalculate after updating an existing inotify watch. Its replace
path temporarily sets mark->mask to zero, so a concurrent scan can observe
zero even when the old and final masks are equal. Assigning the replacement
mask directly would avoid the transient zero, but existing-watch updates
are infrequent, so unconditional recalculation is simpler.
Link: https://lore.kernel.org/all/CACwKKmCZdiZDoFuYm6LZhQ=XvHPk0fNKH=X3LmoXMqakYqJaNw@mail.gmail.com/
Fixes: 63c882a05416 ("inotify: reimplement inotify using fsnotify")
Fixes: 912ee3946c5e ("fanotify: do not call fanotify_update_object_mask in fanotify_add_mark")
Cc: stable@vger.kernel.org # needs adjustments for <= 7.0
Suggested-by: Jan Kara <jack@suse.cz>
Suggested-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Youngjae Kwon <yjkwon0026@snu.ac.kr>
Link: https://patch.msgid.link/20260802015801.2426818-1-yjkwon0026@snu.ac.kr
Signed-off-by: Jan Kara <jack@suse.cz>
(cherry picked from commit e422777fdd4746de1109575c51e65038d4c5c1be)
[yjkwon0026: Resolve the inotify conflict by retaining the branch-native
inode->i_fsnotify_marks argument to fsnotify_recalc_mask(). This tree
lacks 4520b96b8136 ("fsnotify: inotify: pass mark connector to
fsnotify_recalc_mask()"). The surrounding conditional is deleted by
this patch, so that commit is not a prerequisite for this fix.]
Signed-off-by: Youngjae Kwon <yjkwon0026@snu.ac.kr>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/notify/fanotify/fanotify_user.c | 12 +++++++-----
fs/notify/inotify/inotify_user.c | 15 +--------------
2 files changed, 8 insertions(+), 19 deletions(-)
diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index b89ad128bf09c..93472a48ceb3c 100644
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -1141,16 +1141,18 @@ static bool fanotify_mark_update_flags(struct fsnotify_mark *fsn_mark,
static bool fanotify_mark_add_to_mask(struct fsnotify_mark *fsn_mark,
__u32 mask, unsigned int fan_flags)
{
+ __u32 old_mask;
bool recalc;
spin_lock(&fsn_mark->lock);
- if (!(fan_flags & FANOTIFY_MARK_IGNORE_BITS))
+ if (!(fan_flags & FANOTIFY_MARK_IGNORE_BITS)) {
+ old_mask = fsn_mark->mask;
fsn_mark->mask |= mask;
- else
+ recalc = old_mask != fsn_mark->mask;
+ } else {
fsn_mark->ignore_mask |= mask;
-
- recalc = fsnotify_calc_mask(fsn_mark) &
- ~fsnotify_conn_mask(fsn_mark->connector);
+ recalc = true;
+ }
recalc |= fanotify_mark_update_flags(fsn_mark, fan_flags);
spin_unlock(&fsn_mark->lock);
diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
index 0ea4e99dc449c..e5ccd5572beb6 100644
--- a/fs/notify/inotify/inotify_user.c
+++ b/fs/notify/inotify/inotify_user.c
@@ -539,7 +539,6 @@ static int inotify_update_existing_watch(struct fsnotify_group *group,
{
struct fsnotify_mark *fsn_mark;
struct inotify_inode_mark *i_mark;
- __u32 old_mask, new_mask;
int replace = !(arg & IN_MASK_ADD);
int create = (arg & IN_MASK_CREATE);
int ret;
@@ -555,27 +554,15 @@ static int inotify_update_existing_watch(struct fsnotify_group *group,
i_mark = container_of(fsn_mark, struct inotify_inode_mark, fsn_mark);
spin_lock(&fsn_mark->lock);
- old_mask = fsn_mark->mask;
if (replace) {
fsn_mark->mask = 0;
fsn_mark->flags &= ~INOTIFY_MARK_FLAGS;
}
fsn_mark->mask |= inotify_arg_to_mask(inode, arg);
fsn_mark->flags |= inotify_arg_to_flags(arg);
- new_mask = fsn_mark->mask;
spin_unlock(&fsn_mark->lock);
- if (old_mask != new_mask) {
- /* more bits in old than in new? */
- int dropped = (old_mask & ~new_mask);
- /* more bits in this fsn_mark than the inode's mask? */
- int do_inode = (new_mask & ~READ_ONCE(inode->i_fsnotify_mask));
-
- /* update the inode with this new fsn_mark */
- if (dropped || do_inode)
- fsnotify_recalc_mask(inode->i_fsnotify_marks);
-
- }
+ fsnotify_recalc_mask(inode->i_fsnotify_marks);
/* return the wd */
ret = i_mark->wd;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0011/1376] tcp: fix potential race in tcp_v6_syn_recv_sock()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2026-09-12 6:40 ` [PATCH 6.12 0010/1376] fsnotify: Fix stale object mask after concurrent mark updates Greg Kroah-Hartman
@ 2026-09-12 6:40 ` Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0012/1376] entry: Fix seccomp bypass after ptrace with TSYNC Greg Kroah-Hartman
` (987 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+937b5bbb6a815b3e5d0b,
Eric Dumazet, Kuniyuki Iwashima, Jakub Kicinski, Florian Fainelli,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 858d2a4f67ff69e645a43487ef7ea7f28f06deae ]
Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock()
is done too late.
After tcp_v4_syn_recv_sock(), the child socket is already visible
from TCP ehash table and other cpus might use it.
Since newinet->pinet6 is still pointing to the listener ipv6_pinfo
bad things can happen as syzbot found.
Move the problematic code in tcp_v6_mapped_child_init()
and call this new helper from tcp_v4_syn_recv_sock() before
the ehash insertion.
This allows the removal of one tcp_sync_mss(), since
tcp_v4_syn_recv_sock() will call it with the correct
context.
[florian:
- net/ipv6/tcp_ipv6.c:
- Set `newnp->ipv6_fl_list = NULL` instead of `newinet->ipv6_fl_list = NULL`,
as `ipv6_fl_list` is in `struct ipv6_pinfo`.
- net/dccp/:
- Updated `syn_recv_sock` implementations and call sites for DCCP, which was
removed in upstream kernels prior to this commit.]
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+937b5bbb6a815b3e5d0b@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/69949275.050a0220.2eeac1.0145.GAE@google.com/
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260217161205.2079883-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Assisted-by: Cursor:gemini-3.7-flash
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/inet_connection_sock.h | 4 +-
include/net/tcp.h | 4 +-
net/dccp/dccp.h | 4 +-
net/dccp/ipv4.c | 4 +-
net/dccp/ipv6.c | 7 ++-
net/dccp/minisocks.c | 2 +-
net/ipv4/syncookies.c | 2 +-
net/ipv4/tcp_fastopen.c | 2 +-
net/ipv4/tcp_ipv4.c | 8 ++-
net/ipv4/tcp_minisocks.c | 2 +-
net/ipv6/tcp_ipv6.c | 97 +++++++++++++-----------------
net/mptcp/subflow.c | 6 +-
net/smc/af_smc.c | 6 +-
13 files changed, 78 insertions(+), 70 deletions(-)
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index bcc138ff087bd..fe4f8261c4436 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -42,7 +42,9 @@ struct inet_connection_sock_af_ops {
struct request_sock *req,
struct dst_entry *dst,
struct request_sock *req_unhash,
- bool *own_req);
+ bool *own_req,
+ void (*opt_child_init)(struct sock *newsk,
+ const struct sock *sk));
u16 net_header_len;
u16 sockaddr_len;
int (*setsockopt)(struct sock *sk, int level, int optname,
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 1cc25e0b3bdea..64c300659a8ee 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -464,7 +464,9 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
struct request_sock *req,
struct dst_entry *dst,
struct request_sock *req_unhash,
- bool *own_req);
+ bool *own_req,
+ void (*opt_child_init)(struct sock *newsk,
+ const struct sock *sk));
int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb);
int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len);
int tcp_connect(struct sock *sk);
diff --git a/net/dccp/dccp.h b/net/dccp/dccp.h
index 1f748ed1279d3..e4e055493203a 100644
--- a/net/dccp/dccp.h
+++ b/net/dccp/dccp.h
@@ -267,7 +267,9 @@ struct sock *dccp_v4_request_recv_sock(const struct sock *sk, struct sk_buff *sk
struct request_sock *req,
struct dst_entry *dst,
struct request_sock *req_unhash,
- bool *own_req);
+ bool *own_req,
+ void (*opt_child_init)(struct sock *newsk,
+ const struct sock *sk));
struct sock *dccp_check_req(struct sock *sk, struct sk_buff *skb,
struct request_sock *req);
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index 5926159a6f204..b8f5e20368ec5 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -410,7 +410,9 @@ struct sock *dccp_v4_request_recv_sock(const struct sock *sk,
struct request_sock *req,
struct dst_entry *dst,
struct request_sock *req_unhash,
- bool *own_req)
+ bool *own_req,
+ void (*opt_child_init)(struct sock *newsk,
+ const struct sock *sk))
{
struct inet_request_sock *ireq;
struct inet_sock *newinet;
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index d6649246188d7..c1db853667479 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -419,7 +419,9 @@ static struct sock *dccp_v6_request_recv_sock(const struct sock *sk,
struct request_sock *req,
struct dst_entry *dst,
struct request_sock *req_unhash,
- bool *own_req)
+ bool *own_req,
+ void (*opt_child_init)(struct sock *newsk,
+ const struct sock *sk))
{
struct inet_request_sock *ireq = inet_rsk(req);
struct ipv6_pinfo *newnp;
@@ -434,7 +436,8 @@ static struct sock *dccp_v6_request_recv_sock(const struct sock *sk,
* v6 mapped
*/
newsk = dccp_v4_request_recv_sock(sk, skb, req, dst,
- req_unhash, own_req);
+ req_unhash, own_req,
+ opt_child_init);
if (newsk == NULL)
return NULL;
diff --git a/net/dccp/minisocks.c b/net/dccp/minisocks.c
index fecc8190064f8..49939eba87037 100644
--- a/net/dccp/minisocks.c
+++ b/net/dccp/minisocks.c
@@ -187,7 +187,7 @@ struct sock *dccp_check_req(struct sock *sk, struct sk_buff *skb,
goto drop;
child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL,
- req, &own_req);
+ req, &own_req, NULL);
if (child) {
child = inet_csk_complete_hashdance(sk, child, req, own_req);
goto out;
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index facf0fa7d6598..66d5272c5abb9 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -202,7 +202,7 @@ struct sock *tcp_get_cookie_sock(struct sock *sk, struct sk_buff *skb,
bool own_req;
child = icsk->icsk_af_ops->syn_recv_sock(sk, skb, req, dst,
- NULL, &own_req);
+ NULL, &own_req, NULL);
if (child) {
refcount_set(&req->rsk_refcnt, 1);
sock_rps_save_rxhash(child, skb);
diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
index 947109f01db6c..5378ef3b6ab53 100644
--- a/net/ipv4/tcp_fastopen.c
+++ b/net/ipv4/tcp_fastopen.c
@@ -247,7 +247,7 @@ static struct sock *tcp_fastopen_create_child(struct sock *sk,
bool own_req;
child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL,
- NULL, &own_req);
+ NULL, &own_req, NULL);
if (!child)
return NULL;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 40b73e97d5fbf..2b7c580e37281 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1742,7 +1742,9 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
struct request_sock *req,
struct dst_entry *dst,
struct request_sock *req_unhash,
- bool *own_req)
+ bool *own_req,
+ void (*opt_child_init)(struct sock *newsk,
+ const struct sock *sk))
{
struct inet_request_sock *ireq;
bool found_dup_sk = false;
@@ -1798,6 +1800,10 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
}
sk_setup_caps(newsk, dst);
+#if IS_ENABLED(CONFIG_IPV6)
+ if (opt_child_init)
+ opt_child_init(newsk, sk);
+#endif
tcp_ca_openreq_child(newsk, dst);
tcp_sync_mss(newsk, dst_mtu(dst));
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 7149ddb098409..f6657c571fb7a 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -859,7 +859,7 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
* socket is created, wait for troubles.
*/
child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL,
- req, &own_req);
+ req, &own_req, NULL);
if (!child)
goto listen_overflow;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 085fc97c5a5b3..84efaf846f07f 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1341,11 +1341,48 @@ static void tcp_v6_restore_cb(struct sk_buff *skb)
sizeof(struct inet6_skb_parm));
}
+/* Called from tcp_v4_syn_recv_sock() for v6_mapped children. */
+static void tcp_v6_mapped_child_init(struct sock *newsk, const struct sock *sk)
+{
+ struct inet_sock *newinet = inet_sk(newsk);
+ struct ipv6_pinfo *newnp;
+
+ newinet->pinet6 = newnp = tcp_inet6_sk(newsk);
+
+ memcpy(newnp, tcp_inet6_sk(sk), sizeof(struct ipv6_pinfo));
+
+ newnp->saddr = newsk->sk_v6_rcv_saddr;
+
+ inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
+ if (sk_is_mptcp(newsk))
+ mptcpv6_handle_mapped(newsk, true);
+ newsk->sk_backlog_rcv = tcp_v4_do_rcv;
+#if defined(CONFIG_TCP_MD5SIG) || defined(CONFIG_TCP_AO)
+ tcp_sk(newsk)->af_specific = &tcp_sock_ipv6_mapped_specific;
+#endif
+
+ newnp->ipv6_mc_list = NULL;
+ newnp->ipv6_ac_list = NULL;
+ newnp->ipv6_fl_list = NULL;
+ newnp->pktoptions = NULL;
+ newnp->opt = NULL;
+
+ /* tcp_v4_syn_recv_sock() has initialized newinet->mc_{index,ttl} */
+ newnp->mcast_oif = newinet->mc_index;
+ newnp->mcast_hops = newinet->mc_ttl;
+
+ newnp->rcv_flowinfo = 0;
+ if (inet6_test_bit(REPFLOW, sk))
+ newnp->flow_label = 0;
+}
+
static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
struct request_sock *req,
struct dst_entry *dst,
struct request_sock *req_unhash,
- bool *own_req)
+ bool *own_req,
+ void (*opt_child_init)(struct sock *newsk,
+ const struct sock *sk))
{
struct inet_request_sock *ireq;
struct ipv6_pinfo *newnp;
@@ -1361,60 +1398,10 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *
#endif
struct flowi6 fl6;
- if (skb->protocol == htons(ETH_P_IP)) {
- /*
- * v6 mapped
- */
-
- newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst,
- req_unhash, own_req);
-
- if (!newsk)
- return NULL;
-
- inet_sk(newsk)->pinet6 = tcp_inet6_sk(newsk);
-
- newnp = tcp_inet6_sk(newsk);
- newtp = tcp_sk(newsk);
-
- memcpy(newnp, np, sizeof(struct ipv6_pinfo));
-
- newnp->saddr = newsk->sk_v6_rcv_saddr;
-
- inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
- if (sk_is_mptcp(newsk))
- mptcpv6_handle_mapped(newsk, true);
- newsk->sk_backlog_rcv = tcp_v4_do_rcv;
-#if defined(CONFIG_TCP_MD5SIG) || defined(CONFIG_TCP_AO)
- newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
-#endif
-
- newnp->ipv6_mc_list = NULL;
- newnp->ipv6_ac_list = NULL;
- newnp->ipv6_fl_list = NULL;
- newnp->pktoptions = NULL;
- newnp->opt = NULL;
- newnp->mcast_oif = inet_iif(skb);
- newnp->mcast_hops = ip_hdr(skb)->ttl;
- newnp->rcv_flowinfo = 0;
- if (inet6_test_bit(REPFLOW, sk))
- newnp->flow_label = 0;
-
- /*
- * No need to charge this sock to the relevant IPv6 refcnt debug socks count
- * here, tcp_create_openreq_child now does this for us, see the comment in
- * that function for the gory details. -acme
- */
-
- /* It is tricky place. Until this moment IPv4 tcp
- worked with IPv6 icsk.icsk_af_ops.
- Sync it now.
- */
- tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
-
- return newsk;
- }
-
+ if (skb->protocol == htons(ETH_P_IP))
+ return tcp_v4_syn_recv_sock(sk, skb, req, dst,
+ req_unhash, own_req,
+ tcp_v6_mapped_child_init);
ireq = inet_rsk(req);
if (sk_acceptq_is_full(sk))
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index 26ea58691f793..4fc9a5a788761 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -812,7 +812,9 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
struct request_sock *req,
struct dst_entry *dst,
struct request_sock *req_unhash,
- bool *own_req)
+ bool *own_req,
+ void (*opt_child_init)(struct sock *newsk,
+ const struct sock *sk))
{
struct mptcp_subflow_context *listener = mptcp_subflow_ctx(sk);
struct mptcp_subflow_request_sock *subflow_req;
@@ -859,7 +861,7 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
create_child:
child = listener->icsk_af_ops->syn_recv_sock(sk, skb, req, dst,
- req_unhash, own_req);
+ req_unhash, own_req, opt_child_init);
if (child && *own_req) {
struct mptcp_subflow_context *ctx = mptcp_subflow_ctx(child);
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 7da93457e19ae..e5352d80a9e54 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -125,7 +125,9 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk,
struct request_sock *req,
struct dst_entry *dst,
struct request_sock *req_unhash,
- bool *own_req)
+ bool *own_req,
+ void (*opt_child_init)(struct sock *newsk,
+ const struct sock *sk))
{
struct smc_sock *smc;
struct sock *child;
@@ -150,7 +152,7 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk,
/* passthrough to original syn recv sock fct */
child = smc->ori_af_ops->syn_recv_sock(sk, skb, req, dst, req_unhash,
- own_req);
+ own_req, opt_child_init);
/* child must not inherit smc or its ops */
if (child) {
rcu_assign_sk_user_data(child, NULL);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0012/1376] entry: Fix seccomp bypass after ptrace with TSYNC
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2026-09-12 6:40 ` [PATCH 6.12 0011/1376] tcp: fix potential race in tcp_v6_syn_recv_sock() Greg Kroah-Hartman
@ 2026-09-12 6:40 ` Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0013/1376] objtool/rust: add one more `noreturn` Rust function Greg Kroah-Hartman
` (986 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jinjie Ruan, Thomas Gleixner,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <ruanjinjie@huawei.com>
commit 4a3591287fb7f808e209b4974ed337f609a2006b upstream.
Sashiko review pointed out the following issue.
If a thread is stopped in syscall_trace_enter() for ptrace, another
thread can install a seccomp filter with SECCOMP_FILTER_FLAG_TSYNC
(e.g., via seccomp_attach_filter()). This will successfully set
SYSCALL_WORK_SECCOMP on the stopped thread, but syscall_trace_enter()
evaluates a cached 'work' variable sampled on entry. Consequently,
the subsequent check for SYSCALL_WORK_SECCOMP misses the newly
assigned flag, and the filter is silently bypassed.
This race condition could allow an unprivileged process to execute
a prohibited system call (e.g., execve) that the newly installed filter
was intended to block, especially since the tracer might have modified
the system call number during the ptrace stop.
Fix this by re-reading the syscall_work flags after ptrace handling,
so that any new SYSCALL_WORK_SECCOMP flag set by another thread via
TSYNC during the ptrace stop is observed before the subsequent
seccomp check.
Fixes: 142781e108b1 ("entry: Provide generic syscall entry functionality")
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/20260629132914.1135C1F000E9@smtp.kernel.org/
Link: https://patch.msgid.link/20260713025712.416366-1-ruanjinjie@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/entry/common.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/kernel/entry/common.c b/kernel/entry/common.c
index 5b6934e23c21d..fc6552d065cc1 100644
--- a/kernel/entry/common.c
+++ b/kernel/entry/common.c
@@ -45,6 +45,9 @@ long syscall_trace_enter(struct pt_regs *regs, long syscall,
ret = ptrace_report_syscall_entry(regs);
if (ret || (work & SYSCALL_WORK_SYSCALL_EMU))
return -1L;
+
+ /* ptrace might have changed work flags */
+ work = READ_ONCE(current_thread_info()->syscall_work);
}
/* Do seccomp after ptrace, to catch any tracer changes. */
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0013/1376] objtool/rust: add one more `noreturn` Rust function
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2026-09-12 6:40 ` [PATCH 6.12 0012/1376] entry: Fix seccomp bypass after ptrace with TSYNC Greg Kroah-Hartman
@ 2026-09-12 6:40 ` Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0014/1376] fsnotify: inotify: pass mark connector to fsnotify_recalc_mask() Greg Kroah-Hartman
` (985 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, FUJITA Tomonori, Alice Ryhl,
Miguel Ojeda, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: FUJITA Tomonori <fujita.tomonori@gmail.com>
[ Upstream commit c18f35e4904920db4c51620ba634e4d175b24741 ]
Fix the following warning:
rust/kernel.o: warning: objtool: _RNvXNtNtCs1ewLyjEZ7Le_6kernel3str9parse_intaNtNtB2_7private12FromStrRadix14from_str_radix()
falls through to next function _RNvXNtNtCs1ewLyjEZ7Le_6kernel3str9parse_intaNtNtB2_7private12FromStrRadix16from_u64_negated()
The commit 51d9ee90ea90 ("rust: str: add radix prefixed integer
parsing functions") introduces u64::from_str_radix(), whose
implementation contains a panic path for out-of-range radix values.
The panic helper is core::num::from_ascii_radix_panic().
Note that radix is derived from strip_radix() here and is always
within the valid range, so kernel never panics.
Fixes: 51d9ee90ea90 ("rust: str: add radix prefixed integer parsing functions")
Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Tested-by: Alice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20251223113538.1016078-1-fujita.tomonori@gmail.com
[ Reworded typo. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/objtool/check.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index f6fe896d0d652..e19bf7621daa3 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -208,7 +208,8 @@ static bool is_rust_noreturn(const struct symbol *func)
* as well as changes to the source code itself between versions (since
* these come from the Rust standard library).
*/
- return str_ends_with(func->name, "_4core5sliceSp15copy_from_slice17len_mismatch_fail") ||
+ return str_ends_with(func->name, "_4core3num22from_ascii_radix_panic") ||
+ str_ends_with(func->name, "_4core5sliceSp15copy_from_slice17len_mismatch_fail") ||
str_ends_with(func->name, "_4core6option13expect_failed") ||
str_ends_with(func->name, "_4core6option13unwrap_failed") ||
str_ends_with(func->name, "_4core6result13unwrap_failed") ||
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0014/1376] fsnotify: inotify: pass mark connector to fsnotify_recalc_mask()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2026-09-12 6:40 ` [PATCH 6.12 0013/1376] objtool/rust: add one more `noreturn` Rust function Greg Kroah-Hartman
@ 2026-09-12 6:40 ` Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0015/1376] net: ntb_netdev: Fix TX busy and drop handling Greg Kroah-Hartman
` (984 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sun Jian, Jan Kara, Youngjae Kwon,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sun Jian <sun.jian.kdev@gmail.com>
[ Upstream commit 4520b96b8136ba2465a3f4dc5c3fb8bdf3d92e4e ]
fsnotify_recalc_mask() expects a plain struct fsnotify_mark_connector *,
but inode->i_fsnotify_marks is an __rcu pointer. Use fsn_mark->connector
instead to avoid sparse "different address spaces" warnings.
Signed-off-by: Sun Jian <sun.jian.kdev@gmail.com>
Link: https://patch.msgid.link/20260214051217.1381363-1-sun.jian.kdev@gmail.com
Signed-off-by: Jan Kara <jack@suse.cz>
(cherry picked from commit 4520b96b8136ba2465a3f4dc5c3fb8bdf3d92e4e)
Signed-off-by: Youngjae Kwon <yjkwon0026@snu.ac.kr>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/notify/inotify/inotify_user.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
index e5ccd5572beb6..024be6cee849f 100644
--- a/fs/notify/inotify/inotify_user.c
+++ b/fs/notify/inotify/inotify_user.c
@@ -562,7 +562,7 @@ static int inotify_update_existing_watch(struct fsnotify_group *group,
fsn_mark->flags |= inotify_arg_to_flags(arg);
spin_unlock(&fsn_mark->lock);
- fsnotify_recalc_mask(inode->i_fsnotify_marks);
+ fsnotify_recalc_mask(fsn_mark->connector);
/* return the wd */
ret = i_mark->wd;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0015/1376] net: ntb_netdev: Fix TX busy and drop handling
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2026-09-12 6:40 ` [PATCH 6.12 0014/1376] fsnotify: inotify: pass mark connector to fsnotify_recalc_mask() Greg Kroah-Hartman
@ 2026-09-12 6:40 ` Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0016/1376] drm/amd/display: fix division by zero in get_estimated_bw() Greg Kroah-Hartman
` (983 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Koichiro Den, Dave Jiang,
Jakub Kicinski, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <den@valinux.co.jp>
[ Upstream commit 8aaa47351db0f93a5c5297fbafdfa8bc75e8ae49 ]
Currently, ntb_netdev returns NETDEV_TX_BUSY for every enqueue error. It
also increments the drop and error counters while leaving the skb owned
by the qdisc, and may return BUSY with the subqueue still awake.
Retrying a permanent error cannot succeed either.
The unconditional BUSY return and premature accounting date back to the
initial driver. The error-path queue stop was later removed without
changing that return value. The current flow-control code includes a
resource check, but ntb_netdev does not honor its result before enqueue.
Honor the resource check before enqueue. For -EAGAIN and -EBUSY, stop
the subqueue, arm the existing reaper timer, and return BUSY without
touching the skb. For other errors, free the skb, increment tx_dropped,
and return NETDEV_TX_OK.
Fixes: 548c237c0a99 ("net: Add support for NTB virtual ethernet device")
Fixes: d723485cb4ca ("ntb_netdev: remove tx timeout")
Fixes: e74bfeedad08 ("NTB: Add flow control to the ntb_netdev")
Cc: stable@vger.kernel.org
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Link: https://patch.msgid.link/20260817053519.4135287-3-den@valinux.co.jp
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[den: adapt to the single-queue implementation, as 6.12.y lacks commit:
ee970634c777 ("net: ntb_netdev: Introduce per-queue context")]
Stable-dep-of: 873ce713fef5 ("NTB: ntb_transport: Fail TX enqueue when the QP link is down")
Stable-dep-of: a4f2387db6f1 ("NTB: ntb_transport: Reject oversized TX buffers")
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ntb_netdev.c | 27 +++++++++++++++++++--------
1 file changed, 19 insertions(+), 8 deletions(-)
diff --git a/drivers/net/ntb_netdev.c b/drivers/net/ntb_netdev.c
index ec5c6be874469..bf11812438aae 100644
--- a/drivers/net/ntb_netdev.c
+++ b/drivers/net/ntb_netdev.c
@@ -164,8 +164,10 @@ static int __ntb_netdev_maybe_stop_tx(struct net_device *netdev,
static int ntb_netdev_maybe_stop_tx(struct net_device *ndev,
struct ntb_transport_qp *qp, int size)
{
- if (netif_queue_stopped(ndev) ||
- (ntb_transport_tx_free_entry(qp) >= size))
+ if (netif_queue_stopped(ndev))
+ return -EBUSY;
+
+ if (ntb_transport_tx_free_entry(qp) >= size)
return 0;
return __ntb_netdev_maybe_stop_tx(ndev, qp, size);
@@ -208,21 +210,30 @@ static netdev_tx_t ntb_netdev_start_xmit(struct sk_buff *skb,
struct ntb_netdev *dev = netdev_priv(ndev);
int rc;
- ntb_netdev_maybe_stop_tx(ndev, dev->qp, tx_stop);
+ if (unlikely(ntb_netdev_maybe_stop_tx(ndev, dev->qp, tx_stop)))
+ return NETDEV_TX_BUSY;
rc = ntb_transport_tx_enqueue(dev->qp, skb, skb->data, skb->len);
- if (rc)
- goto err;
+ if (rc) {
+ if (rc == -EAGAIN || rc == -EBUSY) {
+ netif_stop_queue(ndev);
+ mod_timer(&dev->tx_timer,
+ jiffies + usecs_to_jiffies(tx_time));
+ return NETDEV_TX_BUSY;
+ }
+
+ goto drop;
+ }
/* check for next submit */
ntb_netdev_maybe_stop_tx(ndev, dev->qp, tx_stop);
return NETDEV_TX_OK;
-err:
+drop:
+ dev_kfree_skb_any(skb);
ndev->stats.tx_dropped++;
- ndev->stats.tx_errors++;
- return NETDEV_TX_BUSY;
+ return NETDEV_TX_OK;
}
static void ntb_netdev_tx_timer(struct timer_list *t)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0016/1376] drm/amd/display: fix division by zero in get_estimated_bw()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2026-09-12 6:40 ` [PATCH 6.12 0015/1376] net: ntb_netdev: Fix TX busy and drop handling Greg Kroah-Hartman
@ 2026-09-12 6:40 ` Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0017/1376] usb: image: mdc800: change kmalloc() to kzalloc() Greg Kroah-Hartman
` (982 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alex Hung, Hari Mishal, Alex Deucher
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hari Mishal <harimishal1@gmail.com>
commit f63de9054da858d57054474c32464106f8375e0d upstream.
get_estimated_bw() divides by link->dpia_bw_alloc_config.bw_granularity,
which is zeroed by reset_bw_alloc_struct() and only populated once
DP_TUNNELING_BW_ALLOC_CAP_CHANGED has been handled.
link_dp_dpia_handle_bw_alloc_status(), the DPCD interrupt handler,
calls get_estimated_bw() whenever DP_TUNNELING_ESTIMATED_BW_CHANGED
is set, independently of whether DP_TUNNELING_BW_ALLOC_CAP_CHANGED
has ever fired for that link. A connected USB4/DPIA tunneling device
that reports an estimated-bandwidth change before ever reporting a
capability change drives a division by zero in this IRQ path.
link_dpia_send_bw_alloc_request() already guards the same
bw_granularity division; add the identical guard here rather than
introducing a new pattern.
Fixes: 8e5cfe547bf3 ("drm/amd/display: upstream link_dp_dpia_bw.c")
Reviewed-by: Alex Hung <alex.hung@amd.com>
Assisted-by: gkh_clanker_t1000
Signed-off-by: Hari Mishal <harimishal1@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit f2a961457c33dc34223aad5c9e8971de34a4eed3)
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c
+++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c
@@ -102,6 +102,11 @@ static int get_estimated_bw(struct dc_li
{
uint8_t bw_estimated_bw = 0;
+ if (link->dpia_bw_alloc_config.bw_granularity == 0) {
+ DC_LOG_ERROR("%s: BW granularity is zero!\n", __func__);
+ return 0;
+ }
+
core_link_read_dpcd(
link,
ESTIMATED_BW,
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0017/1376] usb: image: mdc800: change kmalloc() to kzalloc()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2026-09-12 6:40 ` [PATCH 6.12 0016/1376] drm/amd/display: fix division by zero in get_estimated_bw() Greg Kroah-Hartman
@ 2026-09-12 6:40 ` Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0018/1376] ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() Greg Kroah-Hartman
` (981 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Griffin Kroah-Hartman
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Griffin Kroah-Hartman <griffin@kroah.com>
commit 2430eb81e44111b30eeb5273bbcf8b24ca517ef9 upstream.
Change the kmalloc() calls in usb_mdc800_init() for irq_urb_buffer and
download_urb_buffer to kzalloc(), avoiding potential stack leaks if a
shorter message is received in mdc800_usb_irq() and
mdc800_usb_download_notify()
Assisted-by: gkh_clanker_t1000
Cc: stable <stable@kernel.org>
Signed-off-by: Griffin Kroah-Hartman <griffin@kroah.com>
Link: https://patch.msgid.link/20260819-usb_misc_random-v1-1-43a0dcee3a32@kroah.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/image/mdc800.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/usb/image/mdc800.c
+++ b/drivers/usb/image/mdc800.c
@@ -1000,13 +1000,13 @@ static int __init usb_mdc800_init (void)
mdc800->downloaded = 0;
mdc800->written = 0;
- mdc800->irq_urb_buffer=kmalloc (8, GFP_KERNEL);
+ mdc800->irq_urb_buffer=kzalloc (8, GFP_KERNEL);
if (!mdc800->irq_urb_buffer)
goto cleanup_on_fail;
mdc800->write_urb_buffer=kmalloc (8, GFP_KERNEL);
if (!mdc800->write_urb_buffer)
goto cleanup_on_fail;
- mdc800->download_urb_buffer=kmalloc (64, GFP_KERNEL);
+ mdc800->download_urb_buffer=kzalloc (64, GFP_KERNEL);
if (!mdc800->download_urb_buffer)
goto cleanup_on_fail;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0018/1376] ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2026-09-12 6:40 ` [PATCH 6.12 0017/1376] usb: image: mdc800: change kmalloc() to kzalloc() Greg Kroah-Hartman
@ 2026-09-12 6:40 ` Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0019/1376] clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset Greg Kroah-Hartman
` (980 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, HyeongJun An, Takashi Iwai
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: HyeongJun An <sammiee5311@gmail.com>
commit e4637ce34607f1733a34a57294966d26b263e626 upstream.
The snd_usbmidi_us122l_output() picks a count of 2 on anything slower
than high speed and never relates it to ep->max_transfer. The URB
buffer holds exactly max_transfer bytes, so a device declaring a one
byte bulk endpoint takes two bytes from snd_rawmidi_transmit(), and the
memset that pads the rest computes 1 - 2 in int and wraps to SIZE_MAX.
Only 0x800e and 0x800f are pinned to nine bytes. The US-122MKII at
0x0644:0x8021 falls to the default and takes usb_maxpacket(), which the
USB core only clamps downward.
The akai and novation output ops in this file were given the same guard
recently. Do the same here.
Fixes: 030a07e44129 ("ALSA: Add USB US122L driver")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Link: https://patch.msgid.link/20260901090409.1478573-1-sammiee5311@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/midi.c | 2 ++
1 file changed, 2 insertions(+)
--- a/sound/usb/midi.c
+++ b/sound/usb/midi.c
@@ -974,6 +974,8 @@ static void snd_usbmidi_us122l_output(st
default:
count = 2;
}
+ if (ep->max_transfer < count)
+ return;
count = snd_rawmidi_transmit(ep->ports[0].substream,
urb->transfer_buffer,
count);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0019/1376] clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2026-09-12 6:40 ` [PATCH 6.12 0018/1376] ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() Greg Kroah-Hartman
@ 2026-09-12 6:40 ` Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0020/1376] media: usbtv: keep device alive while ALSA card exists Greg Kroah-Hartman
` (979 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Stephan Gerhold,
Bjorn Andersson
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <stephan@gerhold.net>
commit c99bc8e83848358bd4a0436e4bdae5b7919babb2 upstream.
To conform to the specifications of the USB PHY, the reset signal should be
asserted for at least 10us. Guarantee that by increasing the delay for the
USB2_HS_PHY_ONLY_BCR reset control similar to commit dcc6c9fb7128 ("clk:
qcom: gcc-msm8909: Increase delay for USB PHY reset").
Cc: stable@vger.kernel.org
Fixes: 48b7253264ea ("clk: qcom: Add MDM9607 GCC driver")
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
Link: https://lore.kernel.org/r/20260706-qcom-clk-mdm9607-fixes-v2-5-745565101869@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/qcom/gcc-mdm9607.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/clk/qcom/gcc-mdm9607.c
+++ b/drivers/clk/qcom/gcc-mdm9607.c
@@ -1567,7 +1567,7 @@ static const struct qcom_reset_map gcc_m
[USB_HS_HSIC_BCR] = { 0x3d05c },
[GCC_MSS_RESTART] = { 0x3e000 },
[USB_HS_BCR] = { 0x41000 },
- [USB2_HS_PHY_ONLY_BCR] = { 0x41034 },
+ [USB2_HS_PHY_ONLY_BCR] = { .reg = 0x41034, .udelay = 15 },
[QUSB2_PHY_BCR] = { 0x4103c },
};
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0020/1376] media: usbtv: keep device alive while ALSA card exists
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2026-09-12 6:40 ` [PATCH 6.12 0019/1376] clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset Greg Kroah-Hartman
@ 2026-09-12 6:40 ` Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0021/1376] usb-storage: ene_ub6250: fix race between scan work and probe Greg Kroah-Hartman
` (978 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Shuangpeng Bai, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
commit fc530fe168bb2b745a93f553ad21fc25fd9cba3d upstream.
The ALSA PCM callbacks store the driver state in pcm->private_data. An
open PCM file can outlive USB disconnect because usbtv_audio_free() uses
snd_card_free_when_closed(). The disconnect path can then drop the V4L2
device reference and free struct usbtv before ALSA releases the substream,
so a later close dereferences freed memory in snd_usbtv_pcm_close().
Take a V4L2 device reference for the ALSA card and drop it from the card
private_free callback. This keeps struct usbtv valid until ALSA has closed
the remaining files and freed the card.
Closes: https://lore.kernel.org/r/178144969601.60470.4852887710381872458@gmail.com
Fixes: 63ddf68de52e ("[media] usbtv: add audio support")
Cc: stable@vger.kernel.org
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/usbtv/usbtv-audio.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/drivers/media/usb/usbtv/usbtv-audio.c
+++ b/drivers/media/usb/usbtv/usbtv-audio.c
@@ -317,6 +317,13 @@ static const struct snd_pcm_ops snd_usbt
.pointer = snd_usbtv_pointer,
};
+static void usbtv_audio_card_free(struct snd_card *card)
+{
+ struct usbtv *usbtv = card->private_data;
+
+ v4l2_device_put(&usbtv->v4l2_dev);
+}
+
int usbtv_audio_init(struct usbtv *usbtv)
{
int rv;
@@ -331,6 +338,10 @@ int usbtv_audio_init(struct usbtv *usbtv
if (rv < 0)
return rv;
+ v4l2_device_get(&usbtv->v4l2_dev);
+ card->private_data = usbtv;
+ card->private_free = usbtv_audio_card_free;
+
strscpy(card->driver, usbtv->dev->driver->name, sizeof(card->driver));
strscpy(card->shortname, "usbtv", sizeof(card->shortname));
snprintf(card->longname, sizeof(card->longname),
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0021/1376] usb-storage: ene_ub6250: fix race between scan work and probe
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2026-09-12 6:40 ` [PATCH 6.12 0020/1376] media: usbtv: keep device alive while ALSA card exists Greg Kroah-Hartman
@ 2026-09-12 6:40 ` Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0022/1376] usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() Greg Kroah-Hartman
` (977 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+22ea20ef3afb6785b122, stable,
Liu Qi, Alan Stern
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liu Qi <liuqi@longcheer.com>
commit 445fc368c6bc73eff0aeb3818cf5f355facfbb16 upstream.
ene_ub6250_probe() calls usb_stor_probe2(), which starts the usb-storage
infrastructure and schedules the delayed scan work. The driver then
calls ene_get_card_type(), which sends an ENE command through
ene_send_scsi_cmd() and the usb-storage bulk transfer helpers.
Both the delayed scan work, through usb_stor_Bulk_max_lun(), and
ene_get_card_type() use us->current_urb. The scan work serializes this
access with us->dev_mutex, but the ENE card-type probe does not. If the
scan work runs while ene_get_card_type() is still using us->current_urb,
usb_submit_urb() warns that the URB is already active.
Serialize ene_get_card_type() with us->dev_mutex, matching the locking
used by the scan path.
Reported-by: syzbot+22ea20ef3afb6785b122@syzkaller.appspotmail.com
Cc: stable <stable@kernel.org>
Closes: https://syzkaller.appspot.com/bug?extid=22ea20ef3afb6785b122
Assisted-by: Qwen:Qwen3.6
Signed-off-by: Liu Qi <liuqi@longcheer.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://patch.msgid.link/20260821090416.1247127-1-liuqi@longcheer.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/ene_ub6250.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/storage/ene_ub6250.c
+++ b/drivers/usb/storage/ene_ub6250.c
@@ -2358,7 +2358,9 @@ static int ene_ub6250_probe(struct usb_i
return result;
/* probe card type */
+ mutex_lock(&us->dev_mutex);
result = ene_get_card_type(us, REG_CARD_STATUS, info->bbuf);
+ mutex_unlock(&us->dev_mutex);
if (result != USB_STOR_XFER_GOOD) {
usb_stor_disconnect(intf);
return USB_STOR_TRANSPORT_ERROR;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0022/1376] usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2026-09-12 6:40 ` [PATCH 6.12 0021/1376] usb-storage: ene_ub6250: fix race between scan work and probe Greg Kroah-Hartman
@ 2026-09-12 6:40 ` Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0023/1376] usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop Greg Kroah-Hartman
` (976 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Alan Stern, Andy Shevchenko
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
commit 9f6f095beec82a80daa666a3b2186a5b95841e9a upstream.
GCC (Debian 14.2.0-19) is not happy about the buffer size:
drivers/usb/gadget/function/f_mass_storage.c:2970:48: error: ‘%d’ directive output may be truncated writing between 1 and 9 bytes into a region of size 5 [-Werror=format-truncation=]
Bump the size to get it enough for all possible values.
Note, although cfg->nluns is limited to FSG_MAX_LUNS (16), the compiler
doesn't realize this and complains about the buffer size.
Also note, the existing comment is wrong as size 8 for the whole buffer
doesn't cover 100 mil numbers, hence drop it altogether.
Fixes: b27c08c953e9 ("usb: gadget: f_mass_storage: create lun creation helpers for use in fsg_common_init")
Cc: stable <stable@kernel.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20260817161239.1448582-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_mass_storage.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/gadget/function/f_mass_storage.c
+++ b/drivers/usb/gadget/function/f_mass_storage.c
@@ -2961,7 +2961,7 @@ EXPORT_SYMBOL_GPL(fsg_common_create_lun)
int fsg_common_create_luns(struct fsg_common *common, struct fsg_config *cfg)
{
- char buf[8]; /* enough for 100000000 different numbers, decimal */
+ char buf[14];
int i, rc;
fsg_common_remove_luns(common);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0023/1376] usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2026-09-12 6:40 ` [PATCH 6.12 0022/1376] usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() Greg Kroah-Hartman
@ 2026-09-12 6:40 ` Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0024/1376] usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails Greg Kroah-Hartman
` (975 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fan Wu, Heikki Krogerus, stable
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
commit 263f7d61a4201cde16849b2d016251806e7418be upstream.
cc_debounce_dwork is queued from the set_cc() and start_toggling()
callbacks, which run from TCPM's kthread worker. port_stop() returns
before tcpm_unregister_port() destroys that worker. Flushing the worker
during unregister may therefore run a callback which queues the delayed
work after port_stop() has returned.
The delayed work can then run after devres has freed pmic_typec_port.
Use disable_delayed_work_sync() in port_stop() to cancel a pending
instance and prevent the TCPM callbacks from queueing another one.
This issue was found by an in-house static analysis tool.
Fixes: a4422ff22142 ("usb: typec: qcom: Add Qualcomm PMIC Type-C driver")
Cc: stable <stable@kernel.org> # v6.10+
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://patch.msgid.link/20260820135307.153773-2-fanwu01@zju.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
+++ b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
@@ -693,6 +693,8 @@ static void qcom_pmic_typec_port_stop(st
for (i = 0; i < pmic_typec_port->nr_irqs; i++)
disable_irq(pmic_typec_port->irq_data[i].irq);
+
+ disable_delayed_work_sync(&pmic_typec_port->cc_debounce_dwork);
}
int qcom_pmic_typec_port_probe(struct platform_device *pdev,
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0024/1376] usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2026-09-12 6:40 ` [PATCH 6.12 0023/1376] usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop Greg Kroah-Hartman
@ 2026-09-12 6:40 ` Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0025/1376] usb: typec: qcom-pmic: cancel reset_work on stop Greg Kroah-Hartman
` (974 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryan ODonoghue, Fan Wu,
Heikki Krogerus, stable
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
commit c9273c83885835dbd1e8835d5665dfb8503d65e0 upstream.
cc_debounce_dwork can be queued before port_start() fails:
tcpm_register_port() runs first, and its state machine may invoke
set_cc() or start_toggling() from the TCPM worker. The error path then
calls tcpm_unregister_port(), whose worker flush may queue the delayed
work before devres frees pmic_typec_port.
Disable and drain the delayed work directly at port_start()'s error
exit. Do not use port_stop() for this path: its IRQs use IRQF_NO_AUTOEN
and are enabled only after a successful port_start().
This issue was found by an in-house static analysis tool.
Fixes: a4422ff22142 ("usb: typec: qcom: Add Qualcomm PMIC Type-C driver")
Cc: stable <stable@kernel.org> # v6.10+
Suggested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://patch.msgid.link/20260820135307.153773-3-fanwu01@zju.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
+++ b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
@@ -683,6 +683,9 @@ static int qcom_pmic_typec_port_start(st
enable_irq(pmic_typec_port->irq_data[i].irq);
done:
+ if (ret)
+ disable_delayed_work_sync(&pmic_typec_port->cc_debounce_dwork);
+
return ret;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0025/1376] usb: typec: qcom-pmic: cancel reset_work on stop
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2026-09-12 6:40 ` [PATCH 6.12 0024/1376] usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails Greg Kroah-Hartman
@ 2026-09-12 6:40 ` Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0026/1376] usb: typec: ucsi: displayport: Fix OOB altmode array index Greg Kroah-Hartman
` (973 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Fan Wu, Konrad Dybcio,
Bryan ODonoghue, Heikki Krogerus
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
commit 7b0df6efd143f8085bdb68778a013a46f1349913 upstream.
pdphy_stop() disables IRQs but leaves reset_work pending. If the IRQ
handler schedules it just before disable_irq(), the work runs after
remove() frees the struct via devm.
Call cancel_work_sync() after disabling IRQs to close the window.
This issue was found by an in-house static analysis tool.
Fixes: a4422ff22142 ("usb: typec: qcom: Add Qualcomm PMIC Type-C driver")
Cc: stable <stable@kernel.org>
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://patch.msgid.link/20260819161448.76597-1-fanwu01@zju.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_pdphy.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_pdphy.c
+++ b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_pdphy.c
@@ -544,6 +544,8 @@ static void qcom_pmic_typec_pdphy_stop(s
for (i = 0; i < pmic_typec_pdphy->nr_irqs; i++)
disable_irq(pmic_typec_pdphy->irq_data[i].irq);
+ cancel_work_sync(&pmic_typec_pdphy->reset_work);
+
qcom_pmic_typec_pdphy_reset_on(pmic_typec_pdphy);
regulator_disable(pmic_typec_pdphy->vdd_pdphy);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0026/1376] usb: typec: ucsi: displayport: Fix OOB altmode array index
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2026-09-12 6:40 ` [PATCH 6.12 0025/1376] usb: typec: qcom-pmic: cancel reset_work on stop Greg Kroah-Hartman
@ 2026-09-12 6:40 ` Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0027/1376] usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs Greg Kroah-Hartman
` (972 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jameson Thies, Benson Leung
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jameson Thies <jthies@google.com>
commit 04cec690b1fd9d1c4c314b91a10d8c68a3acfe18 upstream.
The UCSI displayport driver indexes the connector's port altmode array
with the GET_CURRENT_CAM response after checking it is not 0xff. The
port altmode array is UCSI_MAX_ALTMODES elements long. If the PPM
returns an invalid GET_CURRENT_CAM response above UCSI_MAX_ALTMODES and
not equal to 0xff, the kernel may crash with an array index OOB error.
Update the UCSI displayport driver to verify the current cam is less
than UCSI_MAX_ALTMODES before accessing the port altmode array.
Fixes: af8622f6a585 ("usb: typec: ucsi: Support for DisplayPort alt mode")
Cc: stable@vger.kernel.org
Signed-off-by: Jameson Thies <jthies@google.com>
Reviewed-by: Benson Leung <bleung@chromium.org>
Link: https://patch.msgid.link/20260825234545.2076049-1-jthies@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/ucsi/displayport.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/typec/ucsi/displayport.c
+++ b/drivers/usb/typec/ucsi/displayport.c
@@ -74,7 +74,7 @@ static int ucsi_displayport_enter(struct
cur = 0xff;
}
- if (cur != 0xff) {
+ if (cur < UCSI_MAX_ALTMODES) {
ret = dp->con->port_altmode[cur] == alt ? 0 : -EBUSY;
goto err_unlock;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0027/1376] usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2026-09-12 6:40 ` [PATCH 6.12 0026/1376] usb: typec: ucsi: displayport: Fix OOB altmode array index Greg Kroah-Hartman
@ 2026-09-12 6:40 ` Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0028/1376] usb: gadget: f_midi2: fix use-after-free in string attribute show path Greg Kroah-Hartman
` (971 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, syzbot+bbb6dad313f4aaa8da6b,
Aleksandr Nogikh, Takashi Iwai
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Nogikh <nogikh@google.com>
commit f0efaf1872949e96d213c8e910fd9517f7d7c406 upstream.
A null-pointer dereference occurs in f_midi2_free_ep_reqs() when attempting
to clean up an endpoint that was never initialized.
When configuring the MIDI 2.0 gadget via configfs and setting the block
direction to SNDRV_UMP_DIR_INPUT, the initialization of the midi1_ep_out
endpoint is explicitly skipped during the gadget bind phase
(f_midi2_bind()). As a result, the usb_ep->card field remains NULL.
Later, when the host sets the alternate setting, f_midi2_set_alt()
unconditionally stops both the IN and OUT endpoints by calling
f_midi2_stop_eps(), which in turn calls f_midi2_free_ep_reqs() for both
endpoints. When f_midi2_free_ep_reqs() is called for the uninitialized
midi1_ep_out, it attempts to dereference usb_ep->card to determine the
number of requests to free, leading to a crash.
Fix this by using usb_ep->num_reqs instead of usb_ep->card->info.num_reqs
in f_midi2_free_ep_reqs(). usb_ep->num_reqs is correctly set during
f_midi2_init_ep() and remains 0 if the endpoint was never initialized,
safely avoiding the loop. For consistency, apply the same change to
f_midi2_alloc_ep_reqs().
Oops: general protection fault, probably for non-canonical address
0xdffffc00000000ee: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000770-0x0000000000000777]
...
RIP: 0010:f_midi2_free_ep_reqs drivers/usb/gadget/function/f_midi2.c:1166
[inline]
RIP: 0010:f_midi2_stop_eps+0x28e/0x4d0
drivers/usb/gadget/function/f_midi2.c:1246
...
Call Trace:
<TASK>
f_midi2_set_alt+0x11c/0xf00 drivers/usb/gadget/function/f_midi2.c:1296
composite_setup+0x1ffd/0x3480 drivers/usb/gadget/composite.c:1933
configfs_composite_setup+0xbd/0x100 drivers/usb/gadget/configfs.c:1877
Fixes: 8b645922b223 ("usb: gadget: Add support for USB MIDI 2.0 function driver")
Cc: stable <stable@kernel.org>
Assisted-by: Gemini:gemini-3.5-flash Gemini:gemini-3.1-pro-preview syzbot
Reported-by: syzbot+bbb6dad313f4aaa8da6b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=bbb6dad313f4aaa8da6b
Link: https://syzkaller.appspot.com/ai_job?id=8ce30b1a-8cf7-4e38-bcf7-1f69e6f6313f
Signed-off-by: Aleksandr Nogikh <nogikh@google.com>
Reviewed-by: Takashi Iwai <tiwai@suse.de>
Closes: https://syzkaller.appspot.com/bug?extid=01a17afb30637396955e
Link: https://patch.msgid.link/cafe65f4-e1bb-46a3-901d-732814b861b2@mail.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_midi2.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/drivers/usb/gadget/function/f_midi2.c
+++ b/drivers/usb/gadget/function/f_midi2.c
@@ -1145,7 +1145,7 @@ static int f_midi2_alloc_ep_reqs(struct
if (!usb_ep->reqs)
return -EINVAL;
- for (i = 0; i < midi2->info.num_reqs; i++) {
+ for (i = 0; i < usb_ep->num_reqs; i++) {
if (usb_ep->reqs[i].req)
continue;
usb_ep->reqs[i].req = alloc_ep_req(usb_ep->usb_ep,
@@ -1160,10 +1160,9 @@ static int f_midi2_alloc_ep_reqs(struct
/* Free allocated requests */
static void f_midi2_free_ep_reqs(struct f_midi2_usb_ep *usb_ep)
{
- struct f_midi2 *midi2 = usb_ep->card;
int i;
- for (i = 0; i < midi2->info.num_reqs; i++) {
+ for (i = 0; i < usb_ep->num_reqs; i++) {
if (!usb_ep->reqs[i].req)
continue;
free_ep_req(usb_ep->usb_ep, usb_ep->reqs[i].req);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0028/1376] usb: gadget: f_midi2: fix use-after-free in string attribute show path
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2026-09-12 6:40 ` [PATCH 6.12 0027/1376] usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs Greg Kroah-Hartman
@ 2026-09-12 6:40 ` Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0029/1376] usb: gadget: f_midi: initialize work in f_midi_alloc() Greg Kroah-Hartman
` (970 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+2280f1cca5e6b0c353e4, stable,
Ivy Lopez, Takashi Iwai
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivy Lopez <skunkolee@gmail.com>
commit fed0aa7c6eaedc6c0d4e362fc91724aa47be4a7b upstream.
f_midi2_opts_str_show() takes the string lock internally, but its
callers dereference the opts->info.<field> pointer before calling it,
outside the lock. This races with f_midi2_opts_str_store(), which
frees the old string under opts->lock when the attribute is written
concurrently, the show path can read a pointer that gets freed
before the lock inside str_show() is even taken.
Change f_midi2_opts_str_show() to take a pointer to the string field,
matching the existing pattern in f_midi2_opts_str_store(), and
dereference it only after the lock is held. Update all three callers
(iface_name, block name, and the EP string option macro) accordingly.
Reported-by: syzbot+2280f1cca5e6b0c353e4@syzkaller.appspotmail.com
Cc: stable <stable@kernel.org>
Closes: https://syzkaller.appspot.com/bug?extid=2280f1cca5e6b0c353e4
Signed-off-by: Ivy Lopez <skunkolee@gmail.com>
Reviewed-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260816005434.34018-1-skunkolee@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_midi2.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--- a/drivers/usb/gadget/function/f_midi2.c
+++ b/drivers/usb/gadget/function/f_midi2.c
@@ -2180,13 +2180,13 @@ end:
/* generic show/store for string */
static ssize_t f_midi2_opts_str_show(struct f_midi2_opts *opts,
- const char *str, char *page)
+ const char **strp, char *page)
{
int result = 0;
mutex_lock(&opts->lock);
- if (str)
- result = scnprintf(page, PAGE_SIZE, "%s\n", str);
+ if (*strp)
+ result = scnprintf(page, PAGE_SIZE, "%s\n", *strp);
mutex_unlock(&opts->lock);
return result;
}
@@ -2280,7 +2280,7 @@ static ssize_t f_midi2_block_opts_name_s
{
struct f_midi2_block_opts *opts = to_f_midi2_block_opts(item);
- return f_midi2_opts_str_show(opts->ep->opts, opts->info.name, page);
+ return f_midi2_opts_str_show(opts->ep->opts, &opts->info.name, page);
}
static ssize_t f_midi2_block_opts_name_store(struct config_item *item,
@@ -2437,7 +2437,7 @@ static ssize_t f_midi2_ep_opts_##name##_
char *page) \
{ \
struct f_midi2_ep_opts *opts = to_f_midi2_ep_opts(item); \
- return f_midi2_opts_str_show(opts->opts, opts->info.name, page);\
+ return f_midi2_opts_str_show(opts->opts, &opts->info.name, page);\
} \
\
static ssize_t f_midi2_ep_opts_##name##_store(struct config_item *item, \
@@ -2592,7 +2592,7 @@ static ssize_t f_midi2_opts_iface_name_s
{
struct f_midi2_opts *opts = to_f_midi2_opts(item);
- return f_midi2_opts_str_show(opts, opts->info.iface_name, page);
+ return f_midi2_opts_str_show(opts, &opts->info.iface_name, page);
}
static ssize_t f_midi2_opts_iface_name_store(struct config_item *item,
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0029/1376] usb: gadget: f_midi: initialize work in f_midi_alloc()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2026-09-12 6:40 ` [PATCH 6.12 0028/1376] usb: gadget: f_midi2: fix use-after-free in string attribute show path Greg Kroah-Hartman
@ 2026-09-12 6:40 ` Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0030/1376] USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() Greg Kroah-Hartman
` (969 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+d5fa3d224505c8610702, stable,
Jeffin Philip, Takashi Iwai
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeffin Philip <jeffinphilip14@gmail.com>
commit 7e07d3e4c389217d7d7171d80edf2e23ac70f1ea upstream.
f_midi_alloc initializes free_ref to 1 and it can only be incremented
when a sound card is registered via f_midi_register_card().
f_midi_register_card() is only called in f_midi_bind() which actually
performs INIT_WORK. If f_midi_bind() is never run, work is not
initialized and the if condition in f_midi_free becomes true,
this results in a warning later in __flush_work as work->func = 0.
Fix this by moving INIT_WORK from f_midi_bind() to f_midi_alloc().
Reported-by: syzbot+d5fa3d224505c8610702@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d5fa3d224505c8610702
Fixes: 8653d71ce376 ("usb/gadget: f_midi: Replace tasklet with work")
Cc: stable <stable@kernel.org>
Signed-off-by: Jeffin Philip <jeffinphilip14@gmail.com>
Reviewed-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260815054006.102325-1-jeffinphilip14@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_midi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/gadget/function/f_midi.c
+++ b/drivers/usb/gadget/function/f_midi.c
@@ -878,7 +878,6 @@ static int f_midi_bind(struct usb_config
int status, n, jack = 1, i = 0, endpoint_descriptor_index = 0;
midi->gadget = cdev->gadget;
- INIT_WORK(&midi->work, f_midi_in_work);
status = f_midi_register_card(midi);
if (status < 0)
goto fail_register;
@@ -1371,6 +1370,7 @@ static struct usb_function *f_midi_alloc
status = -ENOMEM;
goto midi_free;
}
+ INIT_WORK(&midi->work, f_midi_in_work);
midi->out_ports = opts->out_ports;
midi->index = opts->index;
midi->buflen = opts->buflen;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0030/1376] USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2026-09-12 6:40 ` [PATCH 6.12 0029/1376] usb: gadget: f_midi: initialize work in f_midi_alloc() Greg Kroah-Hartman
@ 2026-09-12 6:40 ` Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0031/1376] usb: gadget: fix null pointer dereference in usb_put_function_instance() Greg Kroah-Hartman
` (968 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Eulgyu Kim, Jaeyoung Chung,
Lovekesh Solanki, Alan Stern
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lovekesh Solanki <lovekeshsolanki00@gmail.com>
commit dd0eed9e165b1a6292f49e622e3dd0b7d99b106d upstream.
gadget_dev_ioctl() reads dev->gadget before acquiring dev->lock, but
dev->state is checked after acquiring the lock. Therefore a concurrent
bind can change the device state between these operations, which can
leave ioctl with a stale NULL gadget pointer and causing a NULL pointer
dereference at gadget->ops->ioctl.
Read dev->gadget while holding dev->lock so that the gadget pointer
and device state are sampled consistently.
Cc: stable <stable@kernel.org>
Reported-by: Eulgyu Kim <eulgyukim@snu.ac.kr>
Link: https://lore.kernel.org/all/20260824113510.1141236-1-jjy600901@snu.ac.kr/
Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr>
Link: https://lore.kernel.org/all/20260824113510.1141236-1-jjy600901@snu.ac.kr/
Signed-off-by: Lovekesh Solanki <lovekeshsolanki00@gmail.com>
Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://patch.msgid.link/20260825171343.459630-1-lovekeshsolanki00@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/legacy/inode.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -1253,10 +1253,11 @@ out:
static long gadget_dev_ioctl (struct file *fd, unsigned code, unsigned long value)
{
struct dev_data *dev = fd->private_data;
- struct usb_gadget *gadget = dev->gadget;
+ struct usb_gadget *gadget;
long ret = -ENOTTY;
spin_lock_irq(&dev->lock);
+ gadget = dev->gadget;
if (dev->state == STATE_DEV_OPENED ||
dev->state == STATE_DEV_UNBOUND) {
/* Not bound to a UDC */
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0031/1376] usb: gadget: fix null pointer dereference in usb_put_function_instance()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2026-09-12 6:40 ` [PATCH 6.12 0030/1376] USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() Greg Kroah-Hartman
@ 2026-09-12 6:40 ` Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0032/1376] staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() Greg Kroah-Hartman
` (967 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+fd6ef980cf1c722be639, stable,
Jeffin Philip
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeffin Philip <jeffinphilip14@gmail.com>
commit 6e74ac5c596fd246e37eadfc354567179ccbe9aa upstream.
usb_put_function_instance() attempts to dereference fd inside fi struct
to get mod in uvc_alloc_inst() error path. However, fd is not allocated
until later in try_get_usb_function_instance() after allocating fi in
uvc_alloc_inst() and thus guranteed to be null in error path. Fix this
by adding a null check for fi->fd that returns if fd is null.
Reported-by: syzbot+fd6ef980cf1c722be639@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=fd6ef980cf1c722be639
Fixes: 0062f6e56f70 ("usb: gadget: add a forward pointer from usb_function to its "instance"")
Cc: stable <stable@kernel.org>
Signed-off-by: Jeffin Philip <jeffinphilip14@gmail.com>
Link: https://patch.msgid.link/20260816061712.15547-1-jeffinphilip14@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/functions.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/gadget/functions.c
+++ b/drivers/usb/gadget/functions.c
@@ -70,7 +70,7 @@ void usb_put_function_instance(struct us
{
struct module *mod;
- if (!fi)
+ if (!fi || !fi->fd)
return;
mod = fi->fd->mod;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0032/1376] staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2026-09-12 6:40 ` [PATCH 6.12 0031/1376] usb: gadget: fix null pointer dereference in usb_put_function_instance() Greg Kroah-Hartman
@ 2026-09-12 6:40 ` Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0033/1376] staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() Greg Kroah-Hartman
` (966 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Muhammad Bilal
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <meatuni001@gmail.com>
commit 99aa998dec83ba180822f70e6d48a514fc81c20d upstream.
rtw_get_wps_attr() walks WPS attributes inside a WPS IE taken from
a wireless management frame. For each candidate attribute it only
checks that the fixed 4-byte attribute header (2-byte ID + 2-byte
length) fits inside the IE:
if (attr_ptr + 4 > wps_ie + wps_ielen)
break;
u16 attr_id = get_unaligned_be16(attr_ptr);
u16 attr_data_len = get_unaligned_be16(attr_ptr + 2);
u16 attr_len = attr_data_len + 4;
attr_data_len (and therefore attr_len) is read directly from the
wire and is never checked against the remaining bytes in the IE
before being used as the size of:
memcpy(buf_attr, attr_ptr, attr_len);
Since attr_len is fully attacker controlled (0 to 65535+4), this is
both a heap OOB read of wps_ie, and, more seriously, a stack buffer
overflow at several call sites where buf_attr is a single-byte
stack variable, e.g. rtw_get_wps_attr_content()'s callers passing
WPS_ATTR_SELECTED_REGISTRAR into a stack "u8 sr"/"u8
selected_registrar" (drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c,
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c). A crafted WPS IE in a
beacon or probe response processed during scanning can therefore
smash the stack of the parsing thread.
rtw_get_wps_attr_content() itself has no independent length check
and simply trusts the attr_len it gets back from rtw_get_wps_attr(),
so fixing the bound here also fixes that caller.
The "attr_ptr + 4 > wps_ie + wps_ielen" header check above was added
by commit 1463ca3ec6601 ("staging: rtl8723bs: fix OOB reads in
rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()"), which
bounded the fixed header but never extended the check to cover the
variable-length attribute data that follows it. Add that missing
check before attr_len is used as a memcpy() length or accepted as a
match.
Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20260728125456.32359-2-meatuni001@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/staging/rtl8723bs/core/rtw_ieee80211.c
+++ b/drivers/staging/rtl8723bs/core/rtw_ieee80211.c
@@ -746,6 +746,10 @@ u8 *rtw_get_wps_attr(u8 *wps_ie, uint wp
u16 attr_data_len = get_unaligned_be16(attr_ptr + 2);
u16 attr_len = attr_data_len + 4;
+ /* Reject attributes whose claimed length runs past the IE */
+ if (attr_ptr + attr_len > wps_ie + wps_ielen)
+ break;
+
if (attr_id == target_attr_id) {
target_attr_ptr = attr_ptr;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0033/1376] staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2026-09-12 6:40 ` [PATCH 6.12 0032/1376] staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() Greg Kroah-Hartman
@ 2026-09-12 6:40 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0034/1376] thermal/drivers/imx: Disable clock on runtime resume failure Greg Kroah-Hartman
` (965 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Muhammad Bilal
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <meatuni001@gmail.com>
commit ff917923f4fb9c83717ba135ee47d7e4c1567bb7 upstream.
rtw_action_frame_parse() takes a frame_len parameter but never
actually checks it before indexing into the frame body:
const u8 *frame_body = frame + sizeof(struct ieee80211_hdr_3addr);
...
c = frame_body[0];
...
a = frame_body[1];
frame_body already points 24 bytes (sizeof(struct
ieee80211_hdr_3addr)) into frame, so reading frame_body[0] and
frame_body[1] requires frame_len >= 26. A management action frame
shorter than that (e.g. exactly 24 bytes, the minimum a malicious
peer can send) causes a 1-2 byte out-of-bounds read.
This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and
cfg80211_rtw_mgmt_tx() in ioctl_cfg80211.c, both of which pass
attacker/user-influenced frame buffers and lengths straight through.
Add the missing length check before frame_body is dereferenced.
Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20260728125456.32359-3-meatuni001@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/staging/rtl8723bs/core/rtw_ieee80211.c
+++ b/drivers/staging/rtl8723bs/core/rtw_ieee80211.c
@@ -1153,6 +1153,9 @@ int rtw_action_frame_parse(const u8 *fra
u8 c;
u8 a = ACT_PUBLIC_MAX;
+ if (frame_len < sizeof(struct ieee80211_hdr_3addr) + 2)
+ return false;
+
fc = le16_to_cpu(((struct ieee80211_hdr_3addr *)frame)->frame_control);
if ((fc & (IEEE80211_FCTL_FTYPE|IEEE80211_FCTL_STYPE))
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0034/1376] thermal/drivers/imx: Disable clock on runtime resume failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2026-09-12 6:40 ` [PATCH 6.12 0033/1376] staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0035/1376] thermal/drivers/qoriq: Disable clock on " Greg Kroah-Hartman
` (964 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Can Peng, Daniel Lezcano, Frank Li
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Can Peng <pengcan@kylinos.cn>
commit bcc6d886e5006a4656901d2d7fb6a215c96068a0 upstream.
imx_thermal_runtime_resume() enables the thermal clock before
powering up the sensor and enabling measurements.
If either regmap_write() fails, the function returns with the clock
still enabled. This leaves the clock enable count unbalanced after a
failed runtime resume.
Disable the clock on those failure paths before returning the error.
Fixes: 4cf2ddf16e17 ("thermal/drivers/imx: Implement runtime PM support")
Cc: stable@vger.kernel.org
Signed-off-by: Can Peng <pengcan@kylinos.cn>
Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260722084909.463437-1-pengcan@kylinos.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/thermal/imx_thermal.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/drivers/thermal/imx_thermal.c
+++ b/drivers/thermal/imx_thermal.c
@@ -832,12 +832,12 @@ static int imx_thermal_runtime_resume(st
ret = regmap_write(map, socdata->sensor_ctrl + REG_CLR,
socdata->power_down_mask);
if (ret)
- return ret;
+ goto disable_clk;
ret = regmap_write(map, socdata->sensor_ctrl + REG_SET,
socdata->measure_temp_mask);
if (ret)
- return ret;
+ goto disable_clk;
/*
* According to the temp sensor designers, it may require up to ~17us
@@ -846,6 +846,11 @@ static int imx_thermal_runtime_resume(st
usleep_range(20, 50);
return 0;
+
+disable_clk:
+ clk_disable_unprepare(data->thermal_clk);
+
+ return ret;
}
static const struct dev_pm_ops imx_thermal_pm_ops = {
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0035/1376] thermal/drivers/qoriq: Disable clock on resume failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0034/1376] thermal/drivers/imx: Disable clock on runtime resume failure Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0036/1376] ublk: clear VM_MAYWRITE on read-only ublk char device mmap Greg Kroah-Hartman
` (963 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Can Peng, Daniel Lezcano
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Can Peng <pengcan@kylinos.cn>
commit fcbf9964b67a6d6704c50ed28daa24c3b164f01c upstream.
qoriq_tmu_resume() enables the TMU clock before clearing the
power-down bit and enabling monitoring.
If either register update fails, the function returns with the clock
still enabled. This leaves the clock enable count unbalanced after a
failed resume.
Disable the clock on those failure paths before returning the error.
Fixes: 51904045d4aa ("thermal: qoriq: Add clock operations")
Cc: stable@vger.kernel.org
Signed-off-by: Can Peng <pengcan@kylinos.cn>
Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org>
Link: https://patch.msgid.link/20260722075625.452684-1-pengcan@kylinos.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/thermal/qoriq_thermal.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
--- a/drivers/thermal/qoriq_thermal.c
+++ b/drivers/thermal/qoriq_thermal.c
@@ -380,11 +380,20 @@ static int qoriq_tmu_resume(struct devic
if (data->ver > TMU_VER1) {
ret = regmap_clear_bits(data->regmap, REGS_TMR, TMR_CMD);
if (ret)
- return ret;
+ goto disable_clk;
}
/* Enable monitoring */
- return regmap_update_bits(data->regmap, REGS_TMR, TMR_ME, TMR_ME);
+ ret = regmap_update_bits(data->regmap, REGS_TMR, TMR_ME, TMR_ME);
+ if (ret)
+ goto disable_clk;
+
+ return 0;
+
+disable_clk:
+ clk_disable_unprepare(data->clk);
+
+ return ret;
}
static DEFINE_SIMPLE_DEV_PM_OPS(qoriq_tmu_pm_ops,
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0036/1376] ublk: clear VM_MAYWRITE on read-only ublk char device mmap
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0035/1376] thermal/drivers/qoriq: Disable clock on " Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0037/1376] spi: bcm63xx-hsspi: disable clocks on resume failure Greg Kroah-Hartman
` (962 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kanishka De Silva, Ming Lei,
Jens Axboe
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kanishka De Silva <kpskanna1915@gmail.com>
commit 6e2b571b0a54755b06e092501913e1dfefe75d6c upstream.
ublk_ch_mmap() rejects mmap requests with VM_WRITE set, but never
clears VM_MAYWRITE on the resulting read-only mapping. This allows
a userspace daemon to mmap the per-queue command buffer PROT_READ,
then upgrade it to PROT_WRITE via mprotect(), since VM_MAYWRITE was
never cleared.
The command buffer holds struct ublksrv_io_desc entries that are
kernel-written ABI; a writable mapping lets an unprivileged daemon
process corrupt fields such as addr, op_flags, nr_sectors, and
start_sector.
Same bug class as the drm/panthor and drm/vc4 VM_MAYWRITE fixes, and
the 2026-08-13 ptp/vmclock fix (a5edadbae57e).
Verified via mprotect() PoC: before the fix, a PROT_READ mapping can
be upgraded to PROT_READ|PROT_WRITE and a write into the command
buffer corrupts io_desc fields (confirmed under KASAN). After the
fix, mprotect() returns -EACCES.
Fixes: 3fee8d7599e1 ("ublk_drv: add io_uring based userspace block driver")
Cc: stable@vger.kernel.org
Signed-off-by: Kanishka De Silva <kpskanna1915@gmail.com>
Reviewed-by: Ming Lei <tom.leiming@gmail.com>
Link: https://patch.msgid.link/20260830070133.559-1-kpskanna1915@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/ublk_drv.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -1421,6 +1421,12 @@ static int ublk_ch_mmap(struct file *fil
if (vma->vm_flags & VM_WRITE)
return -EPERM;
+ /*
+ * The per-queue command buffer is kernel-written ABI; prevent
+ * the daemon from upgrading to writable via mprotect().
+ */
+ vm_flags_clear(vma, VM_MAYWRITE);
+
end = UBLKSRV_CMD_BUF_OFFSET + ub->dev_info.nr_hw_queues * max_sz;
if (phys_off < UBLKSRV_CMD_BUF_OFFSET || phys_off >= end)
return -EINVAL;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0037/1376] spi: bcm63xx-hsspi: disable clocks on resume failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0036/1376] ublk: clear VM_MAYWRITE on read-only ublk char device mmap Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0038/1376] spi: bcm63xx: disable clock " Greg Kroah-Hartman
` (961 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Can Peng, Kursad Oney, Mark Brown
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Can Peng <pengcan@kylinos.cn>
commit 3b0cee02664041aea7e4f787c66cb86c82eb4e97 upstream.
bcm63xx_hsspi_resume() enables the HSSPI clock, and optionally the PLL
clock, before restarting the SPI controller queue.
If spi_controller_resume() fails, the function currently reports success
and leaves those clocks enabled. Propagate the error and disable the
clocks before returning.
Fixes: 142168eba9dc ("spi: bcm63xx-hsspi: add bcm63xx HSSPI driver")
Cc: stable@vger.kernel.org
Signed-off-by: Can Peng <pengcan@kylinos.cn>
Reviewed-by: Kursad Oney <kursad.oney@broadcom.com>
Link: https://patch.msgid.link/20260804072017.860974-1-pengcan@kylinos.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-bcm63xx-hsspi.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-bcm63xx-hsspi.c
+++ b/drivers/spi/spi-bcm63xx-hsspi.c
@@ -921,7 +921,13 @@ static int bcm63xx_hsspi_resume(struct d
}
}
- spi_controller_resume(host);
+ ret = spi_controller_resume(host);
+ if (ret) {
+ if (bs->pll_clk)
+ clk_disable_unprepare(bs->pll_clk);
+ clk_disable_unprepare(bs->clk);
+ return ret;
+ }
return 0;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0038/1376] spi: bcm63xx: disable clock on resume failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0037/1376] spi: bcm63xx-hsspi: disable clocks on resume failure Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0039/1376] spi: bcmbca-hsspi: disable clocks " Greg Kroah-Hartman
` (960 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Can Peng, Mark Brown
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Can Peng <pengcan@kylinos.cn>
commit 2b62c2c134fa32d9d3a9e7323c8ac74518eeb4ac upstream.
bcm63xx_spi_resume() enables the controller clock before restarting the
SPI controller queue.
If spi_controller_resume() fails, the function currently reports success
and leaves the clock enabled. Propagate the error and disable the clock
before returning.
Fixes: b42dfed83d95 ("spi: add Broadcom BCM63xx SPI controller driver")
Cc: stable@vger.kernel.org
Signed-off-by: Can Peng <pengcan@kylinos.cn>
Link: https://patch.msgid.link/20260804071831.860784-1-pengcan@kylinos.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-bcm63xx.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-bcm63xx.c
+++ b/drivers/spi/spi-bcm63xx.c
@@ -661,7 +661,11 @@ static int bcm63xx_spi_resume(struct dev
if (ret)
return ret;
- spi_controller_resume(host);
+ ret = spi_controller_resume(host);
+ if (ret) {
+ clk_disable_unprepare(bs->clk);
+ return ret;
+ }
return 0;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0039/1376] spi: bcmbca-hsspi: disable clocks on resume failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0038/1376] spi: bcm63xx: disable clock " Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0040/1376] spi: Fix DMA mapping ownership on partial map failure Greg Kroah-Hartman
` (959 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Can Peng, Kursad Oney, Mark Brown
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Can Peng <pengcan@kylinos.cn>
commit d2f5a606710ad70c341dc609430a20a5645618d5 upstream.
bcmbca_hsspi_resume() enables the HSSPI clock, and optionally the PLL
clock, before restarting the SPI controller queue.
If spi_controller_resume() fails, the function currently reports success
and leaves those clocks enabled. Propagate the error and disable the
clocks before returning.
Fixes: a38a2233f23b ("spi: bcmbca-hsspi: Add driver for newer HSSPI controller")
Cc: stable@vger.kernel.org
Signed-off-by: Can Peng <pengcan@kylinos.cn>
Reviewed-by: Kursad Oney <kursad.oney@broadcom.com>
Link: https://patch.msgid.link/20260804071904.860842-1-pengcan@kylinos.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-bcmbca-hsspi.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-bcmbca-hsspi.c
+++ b/drivers/spi/spi-bcmbca-hsspi.c
@@ -612,7 +612,13 @@ static int bcmbca_hsspi_resume(struct de
}
}
- spi_controller_resume(host);
+ ret = spi_controller_resume(host);
+ if (ret) {
+ if (bs->pll_clk)
+ clk_disable_unprepare(bs->pll_clk);
+ clk_disable_unprepare(bs->clk);
+ return ret;
+ }
return 0;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0040/1376] spi: Fix DMA mapping ownership on partial map failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0039/1376] spi: bcmbca-hsspi: disable clocks " Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0041/1376] scsi: target: iscsi: Reserve a terminator byte for the login payload Greg Kroah-Hartman
` (958 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Honghui Jiang, Andy Shevchenko,
Mark Brown
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Honghui Jiang <jiang_hh2019@163.com>
commit 367cea239fc93094e5c16a72724800e0358f5c46 upstream.
If RX mapping fails after TX mapping succeeds, __spi_map_msg() unmaps
TX but leaves tx_sg_mapped set. If TX mapping fails on a later
transfer, mappings created for earlier transfers remain active.
In both cases, cur_{tx,rx}_dma_dev have not yet been updated because they
are assigned only after every transfer has been mapped. The subsequent
spi_unmap_msg() may therefore unmap the TX mapping again or release
earlier mappings using a NULL or stale device. Using a NULL device can
trigger an oops. An empty SG table does not prevent the NULL dereference
because dma_unmap_sg_attrs() accesses the device before checking the
entry count.
Publish both mapping devices before mapping starts and unwind all
failures through __spi_unmap_msg(). This clears the mapping flags and
releases each mapping once with the device that created it.
Publishing the devices before the loop also refreshes them when no
transfer needs mapping. No mapping flag is set in that case, so current
users do not use the pointers as mapping owners.
Fixes: e289df82344f ("spi: Rework per message DMA mapped flag to be per transfer")
Cc: stable@vger.kernel.org
Signed-off-by: Honghui Jiang <jiang_hh2019@163.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20260814031419.43378-2-jiang_hh2019@163.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi.c | 34 ++++++++++++++++++----------------
1 file changed, 18 insertions(+), 16 deletions(-)
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -1229,6 +1229,8 @@ void spi_unmap_buf(struct spi_controller
spi_unmap_buf_attrs(ctlr, dev, sgt, dir, 0);
}
+static int __spi_unmap_msg(struct spi_controller *ctlr, struct spi_message *msg);
+
static int __spi_map_msg(struct spi_controller *ctlr, struct spi_message *msg)
{
struct device *tx_dev, *rx_dev;
@@ -1252,7 +1254,13 @@ static int __spi_map_msg(struct spi_cont
else
rx_dev = ctlr->dev.parent;
- ret = -ENOMSG;
+ /*
+ * Store the devices before mapping so partial failures can be unwound
+ * with the device that created each mapping.
+ */
+ ctlr->cur_tx_dma_dev = tx_dev;
+ ctlr->cur_rx_dma_dev = rx_dev;
+
list_for_each_entry(xfer, &msg->transfers, transfer_list) {
/* The sync is done before each transfer. */
unsigned long attrs = DMA_ATTR_SKIP_CPU_SYNC;
@@ -1265,8 +1273,8 @@ static int __spi_map_msg(struct spi_cont
(void *)xfer->tx_buf,
xfer->len, DMA_TO_DEVICE,
attrs);
- if (ret != 0)
- return ret;
+ if (ret)
+ goto unwind;
xfer->tx_sg_mapped = true;
}
@@ -1275,25 +1283,19 @@ static int __spi_map_msg(struct spi_cont
ret = spi_map_buf_attrs(ctlr, rx_dev, &xfer->rx_sg,
xfer->rx_buf, xfer->len,
DMA_FROM_DEVICE, attrs);
- if (ret != 0) {
- spi_unmap_buf_attrs(ctlr, tx_dev,
- &xfer->tx_sg, DMA_TO_DEVICE,
- attrs);
-
- return ret;
- }
+ if (ret)
+ goto unwind;
xfer->rx_sg_mapped = true;
}
}
- /* No transfer has been mapped, bail out with success */
- if (ret)
- return 0;
-
- ctlr->cur_rx_dma_dev = rx_dev;
- ctlr->cur_tx_dma_dev = tx_dev;
return 0;
+
+unwind:
+ __spi_unmap_msg(ctlr, msg);
+
+ return ret;
}
static int __spi_unmap_msg(struct spi_controller *ctlr, struct spi_message *msg)
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0041/1376] scsi: target: iscsi: Reserve a terminator byte for the login payload
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0040/1376] spi: Fix DMA mapping ownership on partial map failure Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0042/1376] scsi: pm8001: Use rollback index when freeing MSI-X vectors Greg Kroah-Hartman
` (957 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sujal Tuladhar,
Martin K. Petersen (Oracle)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sujal Tuladhar <sujaltuladhar1231@gmail.com>
commit f4825922d2fb371e2b969697d792077f1b62b62c upstream.
iscsi_target_check_login_request() rejects a login PDU whose
DataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the test is '>' and
login->req_buf is allocated with exactly MAX_KEY_VALUE_PAIRS
bytes. Since iscsit_get_login_rx() receives payload_length + padding
bytes, where
padding = ((-payload_length) & 3);
any payload_length from 8189 to 8192 fills the whole 8192 byte
buffer. The write stays in bounds, but no byte is left for a NUL
terminator.
The buffer is subsequently consumed as a C string. In the CHAP path
chap_check_algorithm() calls kstrdup(a_str), and extract_param() calls
strstr(in_buf, pattern) followed by strlen_semi(), none of which take a
length. convert_null_to_semi() additionally rewrites every embedded NUL
to ';', so even a payload made of well formed NUL separated key=value
records is left without a terminator. These walk past the end of the
object into adjacent slab memory. It is reachable by an unauthenticated
initiator against a portal configured for CHAP; when authentication is
not required iscsi_login_zero_tsih_s2() rewrites AuthMethod to None and
the CHAP path is never entered.
Allocate one extra byte. kzalloc() zeroes it and nothing ever writes to
it, as every writer copies to offset 0 for at most MAX_KEY_VALUE_PAIRS
bytes, so the buffer is always terminated.
Fixes: e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1")
Assisted-by: Claude Opus5 (custom harness)
Cc: stable@vger.kernel.org
Signed-off-by: Sujal Tuladhar <sujaltuladhar1231@gmail.com>
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/target/iscsi/iscsi_target_login.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -48,7 +48,7 @@ static struct iscsi_login *iscsi_login_i
login->conn = conn;
login->first_request = 1;
- login->req_buf = kzalloc(MAX_KEY_VALUE_PAIRS, GFP_KERNEL);
+ login->req_buf = kzalloc(MAX_KEY_VALUE_PAIRS + 1, GFP_KERNEL);
if (!login->req_buf) {
pr_err("Unable to allocate memory for response buffer.\n");
goto out_login;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0042/1376] scsi: pm8001: Use rollback index when freeing MSI-X vectors
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0041/1376] scsi: target: iscsi: Reserve a terminator byte for the login payload Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0043/1376] mm/damon/sysfs-schemes: kobject_del() scheme dirs Greg Kroah-Hartman
` (956 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Jack Wang,
Martin K. Petersen (Oracle)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
commit 3f92a64545165bdbb36dee8fa35626b295463313 upstream.
pm8001_request_msix() unwinds previously registered handlers with
free_irq() when request_irq() fails. The rollback loop uses the failing
index i for every iteration instead of the already registered vector
index j.
That passes the wrong IRQ/dev_id pair to free_irq() and leaves the
earlier handlers installed. Use j for both pci_irq_vector() and the
matching irq_vector entry in the rollback loop.
Fixes: a76037ff3479 ("scsi: pm8001: switch to pci_irq_alloc_vectors")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Acked-by: Jack Wang <jinpu.wang@cloud.ionos.com>
Link: https://patch.msgid.link/20260824113618.2239100-1-runyu.xiao@seu.edu.cn
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/pm8001/pm8001_init.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/scsi/pm8001/pm8001_init.c
+++ b/drivers/scsi/pm8001/pm8001_init.c
@@ -1027,8 +1027,8 @@ static u32 pm8001_request_msix(struct pm
&(pm8001_ha->irq_vector[i]));
if (rc) {
for (j = 0; j < i; j++) {
- free_irq(pci_irq_vector(pm8001_ha->pdev, i),
- &(pm8001_ha->irq_vector[i]));
+ free_irq(pci_irq_vector(pm8001_ha->pdev, j),
+ &pm8001_ha->irq_vector[j]);
}
pci_free_irq_vectors(pm8001_ha->pdev);
break;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0043/1376] mm/damon/sysfs-schemes: kobject_del() scheme dirs
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0042/1376] scsi: pm8001: Use rollback index when freeing MSI-X vectors Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0044/1376] mm/damon/sysfs-schemes: kobject_del() scheme filter dirs Greg Kroah-Hartman
` (955 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, SJ Park, Andrew Morton
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
commit 05fb6ac98c49be870c5f9ccdfdf95f0107e564ae upstream.
On CONFIG_DEBUG_KOBJECT_RELEASE enabled kernel, lack of kobject_del()
could cause directories creation failures due to the name conflicts. Fix
those issues for scheme directories by adding kobject_del() calls.
Link: https://lore.kernel.org/20260628220121.97360-4-sj@kernel.org
Fixes: 7e84b1f8212a ("mm/damon/sysfs: support DAMON-based Operation Schemes")
Signed-off-by: SJ Park <sj@kernel.org>
Cc: <stable@vger.kernel.org> # 5.18.x
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/damon/sysfs-schemes.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/mm/damon/sysfs-schemes.c
+++ b/mm/damon/sysfs-schemes.c
@@ -1772,6 +1772,7 @@ void damon_sysfs_schemes_rm_dirs(struct
for (i = 0; i < schemes->nr; i++) {
damon_sysfs_scheme_rm_dirs(schemes_arr[i]);
+ kobject_del(&schemes_arr[i]->kobj);
kobject_put(&schemes_arr[i]->kobj);
}
schemes->nr = 0;
@@ -1813,13 +1814,15 @@ static int damon_sysfs_schemes_add_dirs(
goto out;
err = damon_sysfs_scheme_add_dirs(scheme);
if (err)
- goto out;
+ goto del_out;
schemes_arr[i] = scheme;
schemes->nr++;
}
return 0;
+del_out:
+ kobject_del(&scheme->kobj);
out:
damon_sysfs_schemes_rm_dirs(schemes);
kobject_put(&scheme->kobj);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0044/1376] mm/damon/sysfs-schemes: kobject_del() scheme filter dirs
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0043/1376] mm/damon/sysfs-schemes: kobject_del() scheme dirs Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0045/1376] mm/damon/sysfs-schemes: kobject_del() scheme quota goal dirs Greg Kroah-Hartman
` (954 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, SJ Park, Andrew Morton
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
commit 3c453bddacd4c04ecb38cf79dbfa41e7dfe0531b upstream.
On CONFIG_DEBUG_KOBJECT_RELEASE enabled kernel, lack of kobject_del()
could cause directories creation failures due to the name conflicts. Fix
those issues for scheme filter directories by adding kobject_del() calls.
Link: https://lore.kernel.org/20260628220121.97360-6-sj@kernel.org
Fixes: 472e2b70eda6 ("mm/damon/sysfs-schemes: connect filter directory and filters directory")
Signed-off-by: SJ Park <sj@kernel.org>
Cc: <stable@vger.kernel.org> # 6.3.x
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/damon/sysfs-schemes.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/mm/damon/sysfs-schemes.c
+++ b/mm/damon/sysfs-schemes.c
@@ -560,8 +560,10 @@ static void damon_sysfs_scheme_filters_r
struct damon_sysfs_scheme_filter **filters_arr = filters->filters_arr;
int i;
- for (i = 0; i < filters->nr; i++)
+ for (i = 0; i < filters->nr; i++) {
+ kobject_del(&filters_arr[i]->kobj);
kobject_put(&filters_arr[i]->kobj);
+ }
filters->nr = 0;
kfree(filters_arr);
filters->filters_arr = NULL;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0045/1376] mm/damon/sysfs-schemes: kobject_del() scheme quota goal dirs
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0044/1376] mm/damon/sysfs-schemes: kobject_del() scheme filter dirs Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0046/1376] mm/damon/sysfs-schemes: kobject_del() scheme region dirs Greg Kroah-Hartman
` (953 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, SJ Park, Andrew Morton
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
commit 0d4397ca921ceaf80fc3eca4c8194812ff79a979 upstream.
On CONFIG_DEBUG_KOBJECT_RELEASE enabled kernel, lack of kobject_del()
could cause directories creation failures due to the name conflicts. Fix
those issues for scheme quota goal directories by adding kobject_del()
calls.
Link: https://lore.kernel.org/20260628220121.97360-7-sj@kernel.org
Fixes: 7f262da0a30d ("mm/damon/sysfs-schemes: implement files for scheme quota goals setup")
Signed-off-by: SJ Park <sj@kernel.org>
Cc: <stable@vger.kernel.org> # 6.8.x
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/damon/sysfs-schemes.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/mm/damon/sysfs-schemes.c
+++ b/mm/damon/sysfs-schemes.c
@@ -971,8 +971,10 @@ static void damos_sysfs_quota_goals_rm_d
struct damos_sysfs_quota_goal **goals_arr = goals->goals_arr;
int i;
- for (i = 0; i < goals->nr; i++)
+ for (i = 0; i < goals->nr; i++) {
+ kobject_del(&goals_arr[i]->kobj);
kobject_put(&goals_arr[i]->kobj);
+ }
goals->nr = 0;
kfree(goals_arr);
goals->goals_arr = NULL;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0046/1376] mm/damon/sysfs-schemes: kobject_del() scheme region dirs
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0045/1376] mm/damon/sysfs-schemes: kobject_del() scheme quota goal dirs Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0047/1376] mm/damon/sysfs: kobject_del() region and target (error) dirs Greg Kroah-Hartman
` (952 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, SJ Park, Andrew Morton
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
commit f3ec3271210781c255e737498b84d5790e8176b4 upstream.
On CONFIG_DEBUG_KOBJECT_RELEASE enabled kernel, lack of kobject_del()
could cause directories creation failures due to the name conflicts. Fix
those issues for scheme region directories by adding kobject_del() calls.
This issue was discovered [1] by Sashiko, though its analysis was
partially incorrect.
Link: https://lore.kernel.org/20260628220121.97360-5-sj@kernel.org
Link: https://lore.kernel.org/20260517205828.6204-1-sj@kernel.org [1]
Fixes: 9277d0367ba1 ("mm/damon/sysfs-schemes: implement scheme region directory")
Signed-off-by: SJ Park <sj@kernel.org>
Cc: <stable@vger.kernel.org> # 6.2.x
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/damon/sysfs-schemes.c | 1 +
1 file changed, 1 insertion(+)
--- a/mm/damon/sysfs-schemes.c
+++ b/mm/damon/sysfs-schemes.c
@@ -197,6 +197,7 @@ static void damon_sysfs_scheme_regions_r
list_for_each_entry_safe(r, next, ®ions->regions_list, list) {
list_del(&r->list);
+ kobject_del(&r->kobj);
kobject_put(&r->kobj);
regions->nr_regions--;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0047/1376] mm/damon/sysfs: kobject_del() region and target (error) dirs
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0046/1376] mm/damon/sysfs-schemes: kobject_del() scheme region dirs Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0048/1376] mm/damon/sysfs: kobject_del() target (normal), context and kdamond dirs Greg Kroah-Hartman
` (951 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, SJ Park, Andrew Morton
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
commit 2603ef6f6ec3d3f7de2d6a07e7c9a683cebac419 upstream.
On CONFIG_DEBUG_KOBJECT_RELEASE enabled kernel, lack of kobject_del()
could cause directories creation failures due to the name conflicts. Fix
those issues for the normal creation path of region directories and the
error path of target directories, by adding kobject_del() calls.
Link: https://lore.kernel.org/20260628220121.97360-3-sj@kernel.org
Fixes: 2031b14ea757 ("mm/damon/sysfs: support the physical address space monitoring")
Signed-off-by: SJ Park <sj@kernel.org>
Cc: <stable@vger.kernel.org> # 5.18.x
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/damon/sysfs.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/mm/damon/sysfs.c
+++ b/mm/damon/sysfs.c
@@ -107,8 +107,10 @@ static void damon_sysfs_regions_rm_dirs(
struct damon_sysfs_region **regions_arr = regions->regions_arr;
int i;
- for (i = 0; i < regions->nr; i++)
+ for (i = 0; i < regions->nr; i++) {
+ kobject_del(®ions_arr[i]->kobj);
kobject_put(®ions_arr[i]->kobj);
+ }
regions->nr = 0;
kfree(regions_arr);
regions->regions_arr = NULL;
@@ -343,13 +345,15 @@ static int damon_sysfs_targets_add_dirs(
err = damon_sysfs_target_add_dirs(target);
if (err)
- goto out;
+ goto del_out;
targets_arr[i] = target;
targets->nr++;
}
return 0;
+del_out:
+ kobject_del(&target->kobj);
out:
damon_sysfs_targets_rm_dirs(targets);
kobject_put(&target->kobj);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0048/1376] mm/damon/sysfs: kobject_del() target (normal), context and kdamond dirs
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0047/1376] mm/damon/sysfs: kobject_del() region and target (error) dirs Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0049/1376] mm/damon/core-kunit: check region count before testing in split_at() Greg Kroah-Hartman
` (950 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, SJ Park, Andrew Morton
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
commit 263af33a72d1995ae6cdc22b08d527e2bda17259 upstream.
Patch series "mm/damon/sysfs: kobject_del() directories that users can
create/remove".
DAMON sysfs interface allows users to create and remove arbitrary number
of directories on sysfs, using a few files having 'nr_' prefix. For
example, 'nr_kdamonds'. When the user writes a number 'N' to the files,
directories having name starting from '0' to 'N - 1' are created in the
same directory. The pre-existing number-named directories are removed
before creating the new directories.
For the removal of the existing directories, DAMON sysfs interface use
only kobject_put(). Because DAMON sysfs interface is the only kernel
component that manages the directories, there is no problem in normal
situations. However, if CONFIG_DEBUG_KOBJECT_RELEASE is enabled, the
removal of dirs are delayed. Let's suppose a user writes a non-zero
number to the 'nr_*' files while there are pre-existing number-named
directories, on the config enabled kernel. DAMON sysfs interface
decreases the reference counts of the existing directories and immediately
creates new directories. Because the removal of the sysfs directories is
delayed, it shows some pre-existing directories of the same names when it
tries to create the new directories, and fails.
For example, the issue can be triggered like below:
# grep DEBUG_KOBJECT_RELEASE /boot/config-$(uname -r)
CONFIG_DEBUG_KOBJECT_RELEASE=y
# ls
nr_kdamonds
# echo 1 > nr_kdamonds
# echo 1 > nr_kdamonds
bash: echo: write error: File exists
# dmesg
[...]
[ 300.880458] kobject: kobject_add_internal failed for 0 with -EEXIST, don't try to register things with the same name in the same directory.
[...]
Some of the error handling paths of the directories also lack the
kobject_del() call. If the user uses nr_* file right after the errors,
similar issues can happen.
This doesn't cause catastrophic issues like kernel panics or memory
corruptions. Users can work around by removing all directories first
(write 0 to the nr_* files) and then create new directories after
confirming the old directories are gone. But, this is definitely a bug
that causes a bad user experience.
Fix the issues by calling kobject_del() before creating new directories.
This patch (of 11)
On CONFIG_DEBUG_KOBJECT_RELEASE enabled kernel, lack of kobject_del()
could cause directories creation failures due to the name conflicts. Fix
those issues for normal creation paths of target, context and kdamond
directories, and error paths of context and kdamond directories by adding
kobject_del() calls.
Note that this fix for target directories is not complete since it has a
similar issue in the damon_sysfs_targets_add_dirs() error path. Because
the normal path issue and the error path issue are introduced by different
commits, this commit is fixing only the normal path issue. A commit for
the error path will be added next.
Link: https://lore.kernel.org/20260628220121.97360-1-sj@kernel.org
Link: https://lore.kernel.org/20260628220121.97360-2-sj@kernel.org
Fixes: c951cd3b8901 ("mm/damon: implement a minimal stub for sysfs-based DAMON interface")
Signed-off-by: SJ Park <sj@kernel.org>
Cc: <stable@vger.kernel.org> # 5.18.x
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/damon/sysfs.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
--- a/mm/damon/sysfs.c
+++ b/mm/damon/sysfs.c
@@ -307,6 +307,7 @@ static void damon_sysfs_targets_rm_dirs(
for (i = 0; i < targets->nr; i++) {
damon_sysfs_target_rm_dirs(targets_arr[i]);
+ kobject_del(&targets_arr[i]->kobj);
kobject_put(&targets_arr[i]->kobj);
}
targets->nr = 0;
@@ -833,6 +834,7 @@ static void damon_sysfs_contexts_rm_dirs
for (i = 0; i < contexts->nr; i++) {
damon_sysfs_context_rm_dirs(contexts_arr[i]);
+ kobject_del(&contexts_arr[i]->kobj);
kobject_put(&contexts_arr[i]->kobj);
}
contexts->nr = 0;
@@ -871,13 +873,15 @@ static int damon_sysfs_contexts_add_dirs
err = damon_sysfs_context_add_dirs(context);
if (err)
- goto out;
+ goto del_out;
contexts_arr[i] = context;
contexts->nr++;
}
return 0;
+del_out:
+ kobject_del(&context->kobj);
out:
damon_sysfs_contexts_rm_dirs(contexts);
kobject_put(&context->kobj);
@@ -1692,6 +1696,7 @@ static void damon_sysfs_kdamonds_rm_dirs
for (i = 0; i < kdamonds->nr; i++) {
damon_sysfs_kdamond_rm_dirs(kdamonds_arr[i]);
+ kobject_del(&kdamonds_arr[i]->kobj);
kobject_put(&kdamonds_arr[i]->kobj);
}
kdamonds->nr = 0;
@@ -1747,13 +1752,15 @@ static int damon_sysfs_kdamonds_add_dirs
err = damon_sysfs_kdamond_add_dirs(kdamond);
if (err)
- goto out;
+ goto del_out;
kdamonds_arr[i] = kdamond;
kdamonds->nr++;
}
return 0;
+del_out:
+ kobject_del(&kdamond->kobj);
out:
damon_sysfs_kdamonds_rm_dirs(kdamonds);
kobject_put(&kdamond->kobj);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0049/1376] mm/damon/core-kunit: check region count before testing in split_at()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0048/1376] mm/damon/sysfs: kobject_del() target (normal), context and kdamond dirs Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0050/1376] futex: Prevent rcuwait use-after-free during requeue PI Greg Kroah-Hartman
` (949 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, SJ Park, Brendan Higgins,
Andrew Morton
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
commit 9b18ef3c3aa1ce24176e340061caf15fa2742564 upstream.
damon_test_split_at() test next region that is assumed to be created by
damon_split_region_at() invocation. But the split might fail. In this
case, the succeeding test may dereference invalid pointers returned by
damon_next_region().
The invalid pointer may not cause a really bad user impact, because of the
implementation detail. It would only read wrong contents in the belonging
damon_target struct. Depending on the future change of the offset from
the link header to the accessing field, this could also be really
dangerous, though. Still, the realistic user impact would be limited. It
would affect only test run setups.
Fix it by testing if the number of regions was also changed as expected
and exit early for the failure.
The issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260718001442.87129-3-sj@kernel.org
Link: https://lore.kernel.org/20260714142352.100478-1-sj@kernel.org [1]
Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests")
Signed-off-by: SJ Park <sj@kernel.org>
Cc: Brendan Higgins <brendan.higgins@linux.dev>
Cc: <stable@vger.kernel.org> # 5.15.x
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/damon/tests/core-kunit.h | 5 +++++
1 file changed, 5 insertions(+)
--- a/mm/damon/tests/core-kunit.h
+++ b/mm/damon/tests/core-kunit.h
@@ -166,6 +166,10 @@ static void damon_test_split_at(struct k
r->last_nr_accesses = 15;
damon_add_region(r, t);
damon_split_region_at(t, r, 25);
+ KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 2);
+ if (damon_nr_regions(t) != 2)
+ goto out;
+
KUNIT_EXPECT_EQ(test, r->ar.start, 0ul);
KUNIT_EXPECT_EQ(test, r->ar.end, 25ul);
@@ -177,6 +181,7 @@ static void damon_test_split_at(struct k
KUNIT_EXPECT_EQ(test, r->nr_accesses, r_new->nr_accesses);
KUNIT_EXPECT_EQ(test, r->last_nr_accesses, r_new->last_nr_accesses);
+out:
damon_free_target(t);
damon_destroy_ctx(c);
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0050/1376] futex: Prevent rcuwait use-after-free during requeue PI
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0049/1376] mm/damon/core-kunit: check region count before testing in split_at() Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0051/1376] ftrace: Synchronize the initialization of ftrace_ops Greg Kroah-Hartman
` (948 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yao Kai, Sebastian Andrzej Siewior,
Thomas Gleixner
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yao Kai <yaokai34@huawei.com>
commit a3b8d46fe401cba3a5c46dea610e6eb3dc15370e upstream.
On PREEMPT_RT, FUTEX_CMP_REQUEUE_PI can trigger a KASAN report
(slab-out-of-bounds) in futex_requeue_pi_complete() invocation of
rcuwait_wake_up().
The futex_q used by futex_wait_requeue_pi() is allocated on the waiter's
stack. An early wakeup can race with a PI requeue as follows:
waiter requeue task
------ ------------
futex_wait_requeue_pi()
futex_do_wait()
schedule()
futex_requeue
futex_proxy_trylock_atomic()
futex_requeue_pi_prepare()
Q_REQUEUE_PI_NONE -> Q_REQUEUE_PI_IN_PROGRESS
* timeout/ signal wakes waiter *
futex_requeue_pi_wakeup_sync()
Q_REQUEUE_PI_IN_PROGRESS -> Q_REQUEUE_PI_WAIT
requeue_pi_wake_futex
futex_requeue_pi_complete()
cmpxchg Q_REQUEUE_PI_WAIT -> Q_REQUEUE_PI_LOCKED
rcuwait_wait_event()
if (atomic_read(&q->requeue_state) != Q_REQUEUE_PI_WAIT)
break /* no schedule() */
/* q.pi_state->owner == current */
futex_private_hash_put()
/* return from syscall */
rcuwait_wake_up(&q->requeue_wait)
/* q is gone */
futex_requeue_pi_complete() publishes Q_REQUEUE_PI_LOCKED before
calling rcuwait_wake_up(). The waiter observes this state in
rcuwait_wait_event() before invoking schedule() in rcuwait_wait_event().
Here, the waiter is free leave the syscall before requeue task can
complete the wake.
To address this race skip rcuwait_wake_up() in the Q_REQUEUE_PI_LOCKED
case.
This state is only published by requeue_pi_wake_futex(), which saves
q->task before futex_requeue_pi_complete() and wakes the waiter via
wake_up_state().
This wake is intended to wake the waiter from its futex_do_wait() sleep.
If the waiter is still sleeping there, it can not get into the
Q_REQUEUE_PI_WAIT state (and require this removed wake).
Should the waiter be woken up from futex_do_wait() by other means (as in
this example) and sleep in futex_requeue_pi_wakeup_sync() then the
wake_up_state() from requeue_pi_wake_futex() will wake it, too.
Should the waiter task terminate before wake_up_state() had a chance to
wake the task then the task pointer does not become invalid because the
futex_hash_bucket::lock is held and the task pointer is RCU protected.
[bigeasy: Updated comment and commit message]
Fixes: 07d91ef510fb1 ("futex: Prevent requeue_pi() lock nesting issue on RT")
Signed-off-by: Yao Kai <yaokai34@huawei.com>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260901135453.3121948-3-bigeasy@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/futex/requeue.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
--- a/kernel/futex/requeue.c
+++ b/kernel/futex/requeue.c
@@ -149,8 +149,16 @@ static inline void futex_requeue_pi_comp
} while (!atomic_try_cmpxchg(&q->requeue_state, &old, new));
#ifdef CONFIG_PREEMPT_RT
- /* If the waiter interleaved with the requeue let it know */
- if (unlikely(old == Q_REQUEUE_PI_WAIT))
+ /*
+ * The waiter in futex_requeue_pi_wakeup_sync() can interleave with the
+ * wake below: It will assign Q_REQUEUE_PI_IN_PROGRESS and here it will
+ * be updated to Q_REQUEUE_PI_LOCKED (locked = 1). The rcuwait_wait_event()
+ * will already read Q_REQUEUE_PI_LOCKED and skip the schedule() invocation,
+ * leading to an access of futex_q::requeue_wait after the waiter returned.
+ * In this case only we skip the wake here and rely on following wake in
+ * requeue_pi_wake_futex() to perform the wake if needed.
+ */
+ if (unlikely(old == Q_REQUEUE_PI_WAIT) && new != Q_REQUEUE_PI_LOCKED)
rcuwait_wake_up(&q->requeue_wait);
#endif
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0051/1376] ftrace: Synchronize the initialization of ftrace_ops
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0050/1376] futex: Prevent rcuwait use-after-free during requeue PI Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0052/1376] HID: bpf: serialize device reference release in struct_ops destroy path Greg Kroah-Hartman
` (947 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, sashiko-bot, Steven Rostedt
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <rostedt@goodmis.org>
commit 4617721c502b2ddaa4e324e86da4997edf738fa5 upstream.
There's some internal state that ftrace_ops needs to have set, but since
it can be declared outside of the ftrace.c code, it calls
ftrace_ops_init() on the ops in every global function. The issue is that
if two tasks call it on the same ops at the same time it is possible to
have the initialization of one corrupt the initialization of the other
call.
Create a ops_mutex to use to synchronize every initialization of the
ftrace_ops. The mutex is taken within checking the ftrace_ops flag that
states it was initializied but the flag is checked again after the mutex
has been taken. Checking first outside the mutex allows it to shortcut
having to take the mutex. But then the check needs to be done again after
the mute is taken in case of races.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260902095501.6b59af20@gandalf.local.home
Fixes: f04f24fb7e48d ("ftrace, kprobes: Fix a deadlock on ftrace_regex_lock")
Reported-by: sashiko-bot@kernel.org
Close: https://lore.kernel.org/all/20260829025528.49A831F000E9@smtp.kernel.org/
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/ftrace.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -76,6 +76,8 @@
.func_hash = &opsname.local_hash, \
.local_hash.regex_lock = __MUTEX_INITIALIZER(opsname.local_hash.regex_lock), \
.subop_list = LIST_HEAD_INIT(opsname.subop_list),
+/* Used only to synchronize the initialization of ftrace_ops */
+static DEFINE_MUTEX(ops_mutex);
#else
#define INIT_OPS_HASH(opsname)
#endif
@@ -160,11 +162,18 @@ const struct ftrace_ops ftrace_nop_ops =
static inline void ftrace_ops_init(struct ftrace_ops *ops)
{
#ifdef CONFIG_DYNAMIC_FTRACE
- if (!(ops->flags & FTRACE_OPS_FL_INITIALIZED)) {
+ unsigned long flags = smp_load_acquire(&ops->flags);
+
+ if (!(flags & FTRACE_OPS_FL_INITIALIZED)) {
+ guard(mutex)(&ops_mutex);
+ /* Could have been initialized before lock taken */
+ if (unlikely(ops->flags & FTRACE_OPS_FL_INITIALIZED))
+ return;
mutex_init(&ops->local_hash.regex_lock);
INIT_LIST_HEAD(&ops->subop_list);
ops->func_hash = &ops->local_hash;
- ops->flags |= FTRACE_OPS_FL_INITIALIZED;
+ flags = ops->flags | FTRACE_OPS_FL_INITIALIZED;
+ smp_store_release(&ops->flags, flags);
}
#endif
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0052/1376] HID: bpf: serialize device reference release in struct_ops destroy path
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0051/1376] ftrace: Synchronize the initialization of ftrace_ops Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0053/1376] HID: rmi: fix OOB access with undersized RMI reports Greg Kroah-Hartman
` (946 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Shen Yongchao, Benjamin Tissoires
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shen Yongchao <grayhat@foxmail.com>
commit 9cdc7e6dc7a99ad7311ad5e7c145f2b9ce4e24b0 upstream.
__hid_bpf_ops_destroy_device() and hid_bpf_unreg() can race on the
same registration reference, double-putting struct hid_device and
freeing it while hid_destroy_device() still uses it. Serialize the
remove/NULL decision under hdev->bpf.prog_list_lock so exactly one
path releases each registration reference: unreg re-checks ops->hdev
under the lock and returns without putting when the destroy path
already cleared it; all put_device() calls happen after the lock is
dropped, which is safe because a concurrent unreg then observes
ops->hdev == NULL under the lock.
Background: each successful attach (hid_bpf_ops_reg) acquires one
device reference (hid_get_device()). Two paths can release it:
- device destruction: hid_destroy_device() -> hid_bpf_destroy_device()
-> __hid_bpf_ops_destroy_device(), which walks hdev->bpf.prog_list
under rcu_read_lock() and drops one reference per attached program;
- BPF link release: bpf map delete (no BPF_F_LINK) synchronously calls
st_ops->unreg() -> hid_bpf_unreg(), which drops the reference for
its own registration.
The coordination handshake (e->hdev = NULL on the destroy side vs
"if (!hdev) return" on the unreg side) is a TOCTOU check: the two
paths run under different lock domains (rcu_read_lock vs
prog_list_lock), so a concurrent unreg can read ops->hdev as
non-NULL, block on prog_list_lock, and then proceed while the
destroy traversal executes - both paths then drop the same
reference. The refcount reaches zero legitimately (each decrement
is individually valid), so no refcount_t saturation fires: the
device is simply freed while the transport is still inside
hid_destroy_device(), and subsequent teardown touches freed memory.
The fix serializes the remove/NULL decision under prog_list_lock on
both sides and moves the destroy-side puts outside the lock. With
the lock held, plain reads/writes of ops->hdev are sufficient; no
READ_ONCE/WRITE_ONCE are added, keeping the patch minimal.
Unlocked-read safety: the unlocked read of ops->hdev at the top of
hid_bpf_unreg() cannot touch a freed device, because the unreg path
itself still holds this registration's reference (released only by
its own hid_put_device() after the lock is dropped), and a destroy
traversal that already cleared ops->hdev makes the lock-internal
re-check return early without any put. At most one of the two
paths releases each registration reference.
Fixes: ebc0d8093e8c ("HID: bpf: implement HID-BPF through bpf_struct_ops")
Cc: stable@vger.kernel.org
Signed-off-by: Shen Yongchao <grayhat@foxmail.com>
Assisted-by: Hermes:kimi-k3
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/bpf/hid_bpf_struct_ops.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
--- a/drivers/hid/bpf/hid_bpf_struct_ops.c
+++ b/drivers/hid/bpf/hid_bpf_struct_ops.c
@@ -250,6 +250,11 @@ static void hid_bpf_unreg(void *kdata, s
mutex_lock(&hdev->bpf.prog_list_lock);
+ if (!ops->hdev) {
+ mutex_unlock(&hdev->bpf.prog_list_lock);
+ return;
+ }
+
list_del_rcu(&ops->list);
synchronize_srcu(&hdev->bpf.srcu);
ops->hdev = NULL;
@@ -310,13 +315,17 @@ static struct bpf_struct_ops bpf_hid_bpf
void __hid_bpf_ops_destroy_device(struct hid_device *hdev)
{
struct hid_bpf_ops *e;
+ int count = 0;
- rcu_read_lock();
- list_for_each_entry_rcu(e, &hdev->bpf.prog_list, list) {
- hid_put_device(hdev);
+ mutex_lock(&hdev->bpf.prog_list_lock);
+ list_for_each_entry(e, &hdev->bpf.prog_list, list) {
e->hdev = NULL;
+ count++;
}
- rcu_read_unlock();
+ mutex_unlock(&hdev->bpf.prog_list_lock);
+
+ while (count--)
+ hid_put_device(hdev);
}
static int __init hid_bpf_struct_ops_init(void)
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0053/1376] HID: rmi: fix OOB access with undersized RMI reports
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0052/1376] HID: bpf: serialize device reference release in struct_ops destroy path Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0054/1376] HID: wacom: validate report length in wacom_intuos_pro2_bt_irq Greg Kroah-Hartman
` (945 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wei Jie Law, Jiri Kosina
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Jie Law <98lawweijie@gmail.com>
commit 4956993bb3befdf791d71a4952d8d13bcfd44c7b upstream.
The hid-rmi driver sizes its writeReport/readReport buffer purely from
the report descriptor supplied by the device, with no minimum bound:
data->input_report_size = hid_report_len(input_report);
data->output_report_size = hid_report_len(output_report);
alloc_size = data->output_report_size + data->input_report_size;
data->writeReport = devm_kzalloc(&hdev->dev, alloc_size, GFP_KERNEL);
data->readReport = data->writeReport + data->output_report_size;
but then reads and writes fixed offsets into it. A device declaring a
1-byte output and a 1-byte input report makes hid_report_len() return 2
for each, so alloc_size is 4, while rmi_set_page() -- reached
unconditionally at probe time through rmi_input_configured() -- stores
writeReport[4] and rmi_hid_read_block() stores writeReport[0..5]. Since
readReport lives at writeReport + output_report_size, those stores also
corrupt the window the next reply is parsed out of.
The read path is worse: the copy length comes from readReport[1], which
the device fills in and can be up to 255, and the copy starts at
&readReport[2] with no regard for input_report_size, so it runs past the
end of the allocation into adjacent slab objects. This does not even
need a lying device -- rmi_f01_probe() issues a fixed 21-byte register
read, so any device declaring an input report smaller than 23 bytes
reads out of bounds even when it answers truthfully. Those bytes become
the register values the RMI core acts on: rmi_f01_probe() prints them to
the kernel log as the product id and exports them through the mode 0444
sysfs attribute of the same name, and rmi_driver_set_irq_bits() sends
them back to the device as the interrupt mask, so an undersized report
descriptor leaks heap contents both to unprivileged userspace and to the
device itself.
The write path has no bound either: rmi_hid_write_block() copies an
unbounded len to &writeReport[4], and the largest caller a device can
drive at probe time is rmi_driver_set_irq_bits(), whose length is
derived from the interrupt source counts the device declares in its Page
Description Table.
Finally, the read loop cannot terminate on a zero-length reply: such a
reply copies nothing and advances neither bytes_read nor bytes_needed,
and because a reply did arrive the one second wait_event_timeout() does
not fire either, so a device answering 0 forever keeps the loop running
inside the probe worker with page_mutex held. khungtaskd does not
notice, because every reply wakes the task.
Reject reports too small for what the driver builds -- 6 output bytes
for the write reports and 3 input bytes for the read handshake -- at
probe time, clamp the write and the read copy to the report sizes the
device declared, and treat a zero-length reply as an error. A device
refused this way is started as an ordinary HID device, like one that
does not carry the RMI report ids at all.
RMI_DEVICE must not be left set in device_flags on that path, because
rmi_input_configured() would then run the RMI setup and reach
rmi_set_page(), which writes the writeReport buffer the refusal just
skipped allocating. The bit can arrive set: rmi_probe() copies
id->driver_data into device_flags before the report checks, and a bind
through the new_id sysfs attribute can supply driver_data with
RMI_DEVICE (BIT(0)) set. Strip the bit where driver_data is copied, so
RMI_DEVICE keeps meaning exactly "this probe validated the reports"; the
three jumps to start that predate this patch are covered as well.
The error path also clears RMI_READ_DATA_PENDING on its way out, because
that flag is what the wait at the top of the loop tests: leaving it set
would make every later wait_event_timeout() return immediately on the
stale reply and kill the read path for the rest of the device's life.
Clamping does not regress working hardware: the read loop already
handles a reply carrying fewer bytes than requested, and a write longer
than the output report was overrunning the buffer already.
Verified on v6.12.69 and on v6.12.105 built with CONFIG_KASAN=y and
booted kasan_multi_shot, whose hid-rmi.c is identical to mainline here.
An emulated RMI4 device driven over /dev/uhid, and the same device again
over dummy_hcd plus raw-gadget, give identical results:
BUG: KASAN: slab-out-of-bounds in rmi_hid_read_block+0x409/0x750 [hid_rmi]
Read of size 21 at addr ffff88800bf33bba by task kworker/0:3/285
__asan_memcpy+0x23/0x60
rmi_hid_read_block+0x409/0x750 [hid_rmi]
rmi_f01_probe+0x5dd/0x1dc0 [rmi_core]
BUG: KASAN: slab-out-of-bounds in rmi_hid_write_block+0x1a9/0x350 [hid_rmi]
Write of size 35 at addr ffff88810a2b24ac by task kworker/1:10/666
__asan_memcpy+0x3c/0x60
rmi_hid_write_block+0x1a9/0x350 [hid_rmi]
rmi_driver_set_irq_bits+0x1f6/0x4d0 [rmi_core]
rmi_driver_probe+0x636/0xbf0 [rmi_core]
rmi_input_configured+0x184/0x2e0 [hid_rmi]
rmi_probe+0x952/0xcf0 [hid_rmi]
and, for the zero-length reply, a probe worker left in D state in
rmi_hid_read_block() after 225 replies at 200 ms intervals.
After this change the undersized descriptor is refused at probe with
"rmi reports too small (out=2 in=2)", the oversized read and write are
both rejected, the zero-length reply fails the read with -EIO while
later reads on the same device keep working, and a device declaring
reports large enough for a 21-byte register read still probes normally
and reports its real product id. A device bound through new_id with
RMI_DEVICE in its driver_data no longer reaches rmi_set_page() with an
unallocated writeReport either.
Link: https://lore.kernel.org/linux-input/20260822121007.153988-1-98lawweijie@gmail.com/
Link: https://lore.kernel.org/linux-input/00a489f38b240624dcb5a4bae36a53fcba9cfb47.1787549195.git.98lawweijie@gmail.com/
Link: https://lore.kernel.org/linux-input/20260824122708.76168-1-98lawweijie@gmail.com/
Link: https://lore.kernel.org/linux-input/20260825060954.104890-1-98lawweijie@gmail.com/
Fixes: 9fb6bf02e3ad ("HID: rmi: introduce RMI driver for Synaptics touchpads")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Assisted-by: GLM:glm-5.3
Signed-off-by: Wei Jie Law <98lawweijie@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-rmi.c | 46 +++++++++++++++++++++++++++++++++++++++++++---
1 file changed, 43 insertions(+), 3 deletions(-)
--- a/drivers/hid/hid-rmi.c
+++ b/drivers/hid/hid-rmi.c
@@ -235,7 +235,23 @@ static int rmi_hid_read_block(struct rmi
break;
}
- read_input_count = data->readReport[1];
+ read_input_count = min_t(int, data->readReport[1],
+ data->input_report_size - 2);
+ if (!read_input_count) {
+ /*
+ * A zero length reply advances neither
+ * bytes_read nor bytes_needed, and because a
+ * reply did arrive the wait above does not
+ * time out either, so a device answering 0
+ * forever would spin here indefinitely with
+ * page_mutex held.
+ */
+ hid_warn(hdev, "%s: zero-length read reply\n",
+ __func__);
+ clear_bit(RMI_READ_DATA_PENDING, &data->flags);
+ ret = -EIO;
+ break;
+ }
memcpy(buf + bytes_read, &data->readReport[2],
min(read_input_count, bytes_needed));
@@ -271,6 +287,11 @@ static int rmi_hid_write_block(struct rm
goto exit;
}
+ if (len + 4 > data->output_report_size) {
+ ret = -EINVAL;
+ goto exit;
+ }
+
data->writeReport[0] = RMI_WRITE_REPORT_ID;
data->writeReport[1] = len;
data->writeReport[2] = addr & 0xFF;
@@ -666,8 +687,16 @@ static int rmi_probe(struct hid_device *
return ret;
}
- if (id->driver_data)
- data->device_flags = id->driver_data;
+ /*
+ * RMI_DEVICE can only mean "this probe validated the RMI reports and
+ * allocated writeReport": every bail-out to start below skips that
+ * allocation, and device_flags left carrying RMI_DEVICE from
+ * driver_data would send rmi_input_configured() into rmi_set_page()
+ * with writeReport still NULL. A bind through the new_id sysfs
+ * attribute can supply driver_data with the bit set, so do not let
+ * driver_data grant it.
+ */
+ data->device_flags = id->driver_data & ~RMI_DEVICE;
/*
* Check for the RMI specific report ids. If they are misisng
@@ -696,6 +725,17 @@ static int rmi_probe(struct hid_device *
data->output_report_size = hid_report_len(output_report);
+ /*
+ * The write reports built by this driver occupy 6 bytes and the read
+ * handshake looks at the first 3 bytes of an input report, so refuse
+ * to drive a device whose reports cannot hold them.
+ */
+ if (data->output_report_size < 6 || data->input_report_size < 3) {
+ hid_err(hdev, "rmi reports too small (out=%u in=%u)\n",
+ data->output_report_size, data->input_report_size);
+ goto start;
+ }
+
data->device_flags |= RMI_DEVICE;
alloc_size = data->output_report_size + data->input_report_size;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0054/1376] HID: wacom: validate report length in wacom_intuos_pro2_bt_irq
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0053/1376] HID: rmi: fix OOB access with undersized RMI reports Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0055/1376] dm: fix race when loading and unloading a table Greg Kroah-Hartman
` (944 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ibrahim Hashimov, Jason Gerecke,
Jiri Kosina
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ibrahim Hashimov <security@auditcode.ai>
commit a8e04f3f894ccb52cfcd7e60125a9f35da4a616d upstream.
wacom_intuos_pro2_bt_irq() receives the wire report length in `len`
but never consults it before parsing. After the report-id gate it
unconditionally calls wacom_intuos_pro2_bt_pen() and then, selected by
features.type, a fixed chain of sub-parsers, none of which receive
`len`:
wacom_intuos_pro2_bt_pen(wacom);
if (type == INTUOSP2_BT || type == INTUOSP2S_BT) {
wacom_intuos_pro2_bt_touch(wacom);
wacom_intuos_pro2_bt_pad(wacom);
wacom_intuos_pro2_bt_battery(wacom);
} else {
wacom_intuos_gen3_bt_pad(wacom);
wacom_intuos_gen3_bt_battery(wacom);
}
Each sub-parser dereferences wacom->data at fixed offsets. The furthest
byte touched on each branch is:
INTUOSP2_BT / INTUOSP2S_BT: wacom_intuos_pro2_bt_pad() reads data[285]
(the touchring byte), so the report must be at least 286 bytes;
INTUOSHT3_BT ("gen3"): wacom_intuos_gen3_bt_battery() reads data[45],
so the report must be at least 46 bytes.
features.type is selected from the VID/PID id_table entry and
wacom_setup_device_quirks() force-registers the pen/pad/touch inputs
for that type independent of the report descriptor, so a malicious or
malfunctioning paired/spoofed Bluetooth peripheral can advertise that
VID/PID and send an undersized report that still satisfies the
data[0] == 0x80/0x81 gate. The driver then reads past the received
report and forwards the bytes to userspace via evdev (MSC_SERIAL /
ABS_MISC / ABS_WHEEL on the pen and pad input nodes), an out-of-bounds
read with a concrete userspace read-back channel, and a true
out-of-bounds read on transports whose backing buffer is sized to the
(small) report descriptor rather than a fixed-size staging buffer.
This is the same class of bug commit 2f1763f62909 ("HID: wacom: fix
out-of-bounds read in wacom_intuos_bt_irq") already hardened in the
sibling wacom_intuos_bt_irq(), which guards each report id against its
minimum length before parsing.
Guard wacom_intuos_pro2_bt_irq() the same way: before parsing, reject
reports shorter than the furthest offset the selected branch actually
dereferences, warn, and bail out. Because the whole pen/touch/pad/
battery chain runs unconditionally per branch, a single up-front check
against the maximum offset (286 bytes for INTUOSP2_BT/INTUOSP2S_BT,
46 bytes for the gen3 branch) bounds every sub-parser. Returning 0 on
a short report also skips those calls for the same malformed report,
which is the safe, conservative behavior.
Fixes: 4922cd26f03c ("HID: wacom: Support 2nd-gen Intuos Pro's Bluetooth classic interface")
Cc: stable@vger.kernel.org
Signed-off-by: Ibrahim Hashimov <security@auditcode.ai>
Assisted-by: AuditCode-AI:2026.07
Acked-by: Jason Gerecke <jason.gerecke@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/wacom_wac.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -1548,6 +1548,19 @@ static int wacom_intuos_pro2_bt_irq(stru
return 0;
}
+ if (wacom->features.type == INTUOSP2_BT ||
+ wacom->features.type == INTUOSP2S_BT) {
+ if (len < 286) {
+ dev_warn(wacom->pen_input->dev.parent,
+ "Pro2 BT report too short: %zu bytes\n", len);
+ return 0;
+ }
+ } else if (len < 46) {
+ dev_warn(wacom->pen_input->dev.parent,
+ "Pro2 BT report too short: %zu bytes\n", len);
+ return 0;
+ }
+
wacom_intuos_pro2_bt_pen(wacom);
if (wacom->features.type == INTUOSP2_BT ||
wacom->features.type == INTUOSP2S_BT) {
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0055/1376] dm: fix race when loading and unloading a table
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0054/1376] HID: wacom: validate report length in wacom_intuos_pro2_bt_irq Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0056/1376] dm: fix resume-vs-remove race Greg Kroah-Hartman
` (943 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikulas Patocka
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
commit 5380c7f6335cc6d77eb77d065105e81155c4d9d3 upstream.
If the userspace calls two concurrent table load ioctls and one of them
succeeds and the other fails, there is a race condition because
dm_setup_md_queue walks &md->table_devices without any lock. If the walk
races with dm_table_destroy -> free_devices -> dm_put_table_device, there
is access to invalid memory.
Fix this race by extending the lock over the list walk.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -2608,9 +2608,10 @@ int dm_setup_md_queue(struct mapped_devi
*/
mutex_lock(&md->table_devices_lock);
r = add_disk(md->disk);
- mutex_unlock(&md->table_devices_lock);
- if (r)
+ if (r) {
+ mutex_unlock(&md->table_devices_lock);
return r;
+ }
/*
* Register the holder relationship for devices added before the disk
@@ -2621,18 +2622,21 @@ int dm_setup_md_queue(struct mapped_devi
if (r)
goto out_undo_holders;
}
+ mutex_unlock(&md->table_devices_lock);
r = dm_sysfs_init(md);
if (r)
- goto out_undo_holders;
+ goto lock_out_undo_holders;
md->type = type;
+
return 0;
+lock_out_undo_holders:
+ mutex_lock(&md->table_devices_lock);
out_undo_holders:
list_for_each_entry_continue_reverse(td, &md->table_devices, list)
bd_unlink_disk_holder(td->dm_dev.bdev, md->disk);
- mutex_lock(&md->table_devices_lock);
del_gendisk(md->disk);
mutex_unlock(&md->table_devices_lock);
return r;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0056/1376] dm: fix resume-vs-remove race
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0055/1376] dm: fix race when loading and unloading a table Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0057/1376] dma-direct: return struct page from dma_direct_alloc_from_pool() Greg Kroah-Hartman
` (942 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikulas Patocka
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
commit 44b43ec132f1cf3275ecc182d0c82f50c3c4c3d5 upstream.
If the user issues the resume ioctl and the remove ioctl at the same
time, it may be possible that the device is resumed after it is suspended
in __dm_destroy. The result is that the table is destroyed without
calling the postsuspend method.
Dm targets expect that they may be removed only after the postsuspend
method method was called. If we break this expectation, it can cause
misbehavior in various targets. For example - in the dm-integrity target,
the reboot notifier is not unregistered, leading to use-after-free.
Fix this bug by refusing to resume if the device is being destroyed.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -3112,7 +3112,7 @@ retry:
r = -EINVAL;
mutex_lock_nested(&md->suspend_lock, SINGLE_DEPTH_NESTING);
- if (!dm_suspended_md(md))
+ if (!dm_suspended_md(md) || test_bit(DMF_FREEING, &md->flags))
goto out;
if (dm_suspended_internally_md(md)) {
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0057/1376] dma-direct: return struct page from dma_direct_alloc_from_pool()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0056/1376] dm: fix resume-vs-remove race Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0058/1376] dmaengine: fsl-edma: tracing: no ptr dereference during log output Greg Kroah-Hartman
` (941 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Kelley, Mostafa Saleh,
Jason Gunthorpe, Aneesh Kumar K.V (Arm), Marek Szyprowski
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aneesh Kumar K.V (Arm) <aneesh.kumar@kernel.org>
commit 94a04ad732c9f8b9554270fc4038a06737de5c22 upstream.
Commit 5b138c534fda ("dma-direct: factor out a dma_direct_alloc_from_pool
helper") changed dma_direct_alloc_from_pool() to return the CPU address
from dma_alloc_from_pool(). That fits dma_direct_alloc(), but
dma_direct_alloc_pages() also uses the helper and expects a struct page *.
Fix this by making dma_direct_alloc_from_pool() return the struct page *
again, and pass the CPU address back through an out-parameter for the
dma_direct_alloc() caller.
Fixes: 5b138c534fda ("dma-direct: factor out a dma_direct_alloc_from_pool helper")
Cc: stable@vger.kernel.org
Tested-by: Michael Kelley <mhklinux@outlook.com>
Tested-by: Mostafa Saleh <smostafa@google.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Aneesh Kumar K.V (Arm) <aneesh.kumar@kernel.org>
Reviewed-by: Mostafa Saleh <smostafa@google.com>
Link: https://lore.kernel.org/r/20260717180442.110954-2-aneesh.kumar@kernel.org
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/dma/direct.c | 18 ++++++++++--------
1 file changed, 10 insertions(+), 8 deletions(-)
--- a/kernel/dma/direct.c
+++ b/kernel/dma/direct.c
@@ -168,22 +168,21 @@ static bool dma_direct_use_pool(struct d
return !gfpflags_allow_blocking(gfp) && !is_swiotlb_for_alloc(dev);
}
-static void *dma_direct_alloc_from_pool(struct device *dev, size_t size,
- dma_addr_t *dma_handle, gfp_t gfp)
+static struct page *dma_direct_alloc_from_pool(struct device *dev, size_t size,
+ dma_addr_t *dma_handle, void **cpu_addr, gfp_t gfp)
{
struct page *page;
u64 phys_limit;
- void *ret;
if (WARN_ON_ONCE(!IS_ENABLED(CONFIG_DMA_COHERENT_POOL)))
return NULL;
gfp |= dma_direct_optimal_gfp_mask(dev, &phys_limit);
- page = dma_alloc_from_pool(dev, size, &ret, gfp, dma_coherent_ok);
+ page = dma_alloc_from_pool(dev, size, cpu_addr, gfp, dma_coherent_ok);
if (!page)
return NULL;
*dma_handle = phys_to_dma_direct(dev, page_to_phys(page));
- return ret;
+ return page;
}
static void *dma_direct_alloc_no_mapping(struct device *dev, size_t size,
@@ -251,8 +250,11 @@ void *dma_direct_alloc(struct device *de
* the atomic pools instead if we aren't allowed block.
*/
if ((remap || force_dma_unencrypted(dev)) &&
- dma_direct_use_pool(dev, gfp))
- return dma_direct_alloc_from_pool(dev, size, dma_handle, gfp);
+ dma_direct_use_pool(dev, gfp)) {
+ page = dma_direct_alloc_from_pool(dev, size, dma_handle,
+ &ret, gfp);
+ return page ? ret : NULL;
+ }
/* we always manually zero the memory once we are done */
page = __dma_direct_alloc_pages(dev, size, gfp & ~__GFP_ZERO, true);
@@ -361,7 +363,7 @@ struct page *dma_direct_alloc_pages(stru
void *ret;
if (force_dma_unencrypted(dev) && dma_direct_use_pool(dev, gfp))
- return dma_direct_alloc_from_pool(dev, size, dma_handle, gfp);
+ return dma_direct_alloc_from_pool(dev, size, dma_handle, &ret, gfp);
page = __dma_direct_alloc_pages(dev, size, gfp, false);
if (!page)
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0058/1376] dmaengine: fsl-edma: tracing: no ptr dereference during log output
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0057/1376] dma-direct: return struct page from dma_direct_alloc_from_pool() Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0059/1376] dmaengine: dw-edma: Fix HDMA channel status register access Greg Kroah-Hartman
` (940 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Steven Rostedt, Martin Kaiser,
Frank Li, Vinod Koul
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Kaiser <martin@kaiser.cx>
commit 2ea04dca8e627f722caa7a2037cfbae0257f3501 upstream.
The fsl edma events store a pointer to a struct fsl_edma_engine in the
ringbuffer and dereference it when a log entry is printed. At this time,
the pointer may no longer be valid.
Event injection can be used to trigger a crash:
$ cd /sys/kernel/tracing
$ echo 'value = 0' > events/fsl_edma/edma_writeb/inject
$ cat trace
The log output needs only edma->membase. Add a membase field at the end
of the event and use the new field for log output. Keep the existing
fields for backward compatibility.
Fixes: 11102d0c343b ("dmaengine: fsl-edma: add trace event support")
Cc: stable@vger.kernel.org
Reviewed-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260718130024.341243-1-martin@kaiser.cx
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/fsl-edma-trace.h | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/dma/fsl-edma-trace.h b/drivers/dma/fsl-edma-trace.h
index d3541301a247..45d964a3726d 100644
--- a/drivers/dma/fsl-edma-trace.h
+++ b/drivers/dma/fsl-edma-trace.h
@@ -19,14 +19,16 @@ DECLARE_EVENT_CLASS(edma_log_io,
__field(struct fsl_edma_engine *, edma)
__field(void __iomem *, addr)
__field(u32, value)
+ __field(void __iomem *, membase)
),
TP_fast_assign(
__entry->edma = edma;
__entry->addr = addr;
__entry->value = value;
+ __entry->membase = edma->membase;
),
TP_printk("offset %08x: value %08x",
- (u32)(__entry->addr - __entry->edma->membase), __entry->value)
+ (u32)(__entry->addr - __entry->membase), __entry->value)
);
DEFINE_EVENT(edma_log_io, edma_readl,
--
2.55.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0059/1376] dmaengine: dw-edma: Fix HDMA channel status register access
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0058/1376] dmaengine: fsl-edma: tracing: no ptr dereference during log output Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0060/1376] dmaengine: dw-edma: Complete descriptors before pausing Greg Kroah-Hartman
` (939 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Frank Li, Koichiro Den, Vinod Koul
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <den@valinux.co.jp>
commit ef1b080e03acc83d5bde841da67036985acd50dc upstream.
GET_CH_32() takes the direction before the channel ID, but
dw_hdma_v0_core_ch_status() passed them in the opposite order. This can
make the status callback read another HDMA channel status register.
Use the same argument order as the other HDMA register accesses.
Fixes: e74c39573d35 ("dmaengine: dw-edma: Add support for native HDMA")
Cc: stable@vger.kernel.org
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Link: https://patch.msgid.link/20260717180639.2643243-2-den@valinux.co.jp
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/dw-edma/dw-hdma-v0-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/dma/dw-edma/dw-hdma-v0-core.c
+++ b/drivers/dma/dw-edma/dw-hdma-v0-core.c
@@ -79,7 +79,7 @@ static enum dma_status dw_hdma_v0_core_c
u32 tmp;
tmp = FIELD_GET(HDMA_V0_CH_STATUS_MASK,
- GET_CH_32(dw, chan->id, chan->dir, ch_stat));
+ GET_CH_32(dw, chan->dir, chan->id, ch_stat));
if (tmp == 1)
return DMA_IN_PROGRESS;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0060/1376] dmaengine: dw-edma: Complete descriptors before pausing
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0059/1376] dmaengine: dw-edma: Fix HDMA channel status register access Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0061/1376] dmaengine: dw-edma: Initialize IRQ data before requesting IRQs Greg Kroah-Hartman
` (938 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Frank Li, Koichiro Den, Vinod Koul
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <den@valinux.co.jp>
commit c154060016a9db2ac889bfdb0a3c1322f9be8ded upstream.
If PAUSE is requested while the final burst of a descriptor is in
flight, the DONE interrupt takes the PAUSE path without checking whether
the descriptor has been depleted. The depleted descriptor remains on the
issued list and the channel enters EDMA_ST_PAUSE.
On resume, dw_edma_start_transfer() can select that depleted descriptor
again even though no burst remains, leaving the channel in an invalid
busy state.
Check for descriptor completion before acknowledging PAUSE. If there is
no work to start on resume, leave the channel idle. Also ignore DONE
interrupts while the channel is paused so a stale or repeated interrupt
cannot change its state or start queued work.
Fixes: e63d79d1ffcd ("dmaengine: Add Synopsys eDMA IP core driver")
Cc: stable@vger.kernel.org
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Link: https://patch.msgid.link/20260717180639.2643243-5-den@valinux.co.jp
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/dw-edma/dw-edma-core.c | 20 ++++++++++++++------
1 file changed, 14 insertions(+), 6 deletions(-)
--- a/drivers/dma/dw-edma/dw-edma-core.c
+++ b/drivers/dma/dw-edma/dw-edma-core.c
@@ -271,7 +271,8 @@ static int dw_edma_device_resume(struct
err = -EPERM;
} else {
chan->status = EDMA_ST_BUSY;
- dw_edma_start_transfer(chan);
+ if (!dw_edma_start_transfer(chan))
+ chan->status = EDMA_ST_IDLE;
}
return err;
@@ -621,10 +622,16 @@ static void dw_edma_done_interrupt(struc
unsigned long flags;
spin_lock_irqsave(&chan->vc.lock, flags);
+ if (chan->status == EDMA_ST_PAUSE) {
+ spin_unlock_irqrestore(&chan->vc.lock, flags);
+ return;
+ }
+
vd = vchan_next_desc(&chan->vc);
if (vd) {
switch (chan->request) {
case EDMA_REQ_NONE:
+ case EDMA_REQ_PAUSE:
desc = vd2dw_edma_desc(vd);
if (!desc->chunks_alloc) {
dw_hdma_set_callback_result(vd,
@@ -633,6 +640,12 @@ static void dw_edma_done_interrupt(struc
vchan_cookie_complete(vd);
}
+ if (chan->request == EDMA_REQ_PAUSE) {
+ chan->request = EDMA_REQ_NONE;
+ chan->status = EDMA_ST_PAUSE;
+ break;
+ }
+
/* Continue transferring if there are remaining chunks or issued requests.
*/
chan->status = dw_edma_start_transfer(chan) ? EDMA_ST_BUSY : EDMA_ST_IDLE;
@@ -645,11 +658,6 @@ static void dw_edma_done_interrupt(struc
chan->status = EDMA_ST_IDLE;
break;
- case EDMA_REQ_PAUSE:
- chan->request = EDMA_REQ_NONE;
- chan->status = EDMA_ST_PAUSE;
- break;
-
default:
break;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0061/1376] dmaengine: dw-edma: Initialize IRQ data before requesting IRQs
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0060/1376] dmaengine: dw-edma: Complete descriptors before pausing Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0062/1376] cpuidle: dt_idle_genpd: kfree() the original name allocation Greg Kroah-Hartman
` (937 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Frank Li, Koichiro Den, Vinod Koul
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <den@valinux.co.jp>
commit 647217abea849d3d45f8cb0b8ee5b78d50f26985 upstream.
dw_edma_irq_request() passes struct dw_edma_irq to request_irq() before
dw_edma_channel_setup() fills the back pointer. A shared interrupt can
therefore enter the handler with dw_irq->dw still NULL, leading to a
NULL pointer dereference.
Set the back pointer before installing each handler.
Fixes: e63d79d1ffcd ("dmaengine: Add Synopsys eDMA IP core driver")
Cc: stable@vger.kernel.org
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Link: https://patch.msgid.link/20260721062815.4117887-5-den@valinux.co.jp
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/dw-edma/dw-edma-core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/dma/dw-edma/dw-edma-core.c
+++ b/drivers/dma/dw-edma/dw-edma-core.c
@@ -793,7 +793,6 @@ static int dw_edma_channel_setup(struct
else
irq->rd_mask |= BIT(chan->id);
- irq->dw = dw;
memcpy(&chan->msi, &irq->msi, sizeof(chan->msi));
dev_vdbg(dev, "MSI:\t\tChannel %s[%u] addr=0x%.8x%.8x, data=0x%.8x\n",
@@ -880,6 +879,7 @@ static int dw_edma_irq_request(struct dw
if (chip->nr_irqs == 1) {
/* Common IRQ shared among all channels */
irq = chip->ops->irq_vector(dev, 0);
+ dw->irq[0].dw = dw;
err = request_irq(irq, dw_edma_interrupt_common,
IRQF_SHARED, dw->name, &dw->irq[0]);
if (err) {
@@ -905,6 +905,7 @@ static int dw_edma_irq_request(struct dw
for (i = 0; i < (*wr_alloc + *rd_alloc); i++) {
irq = chip->ops->irq_vector(dev, i);
+ dw->irq[i].dw = dw;
err = request_irq(irq,
i < *wr_alloc ?
dw_edma_interrupt_write :
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0062/1376] cpuidle: dt_idle_genpd: kfree() the original name allocation
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0061/1376] dmaengine: dw-edma: Initialize IRQ data before requesting IRQs Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0063/1376] block: flag zoned disks with GENHD_FL_NO_PART Greg Kroah-Hartman
` (936 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Linkai Gong, Ulf Hansson
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linkai Gong <gonglinkai@kylinos.cn>
commit 2b0ac85512b7f67479127b2713254490662eb13d upstream.
dt_idle_pd_alloc() kasprintf()s the full node path, then points
pd->name at kbasename() of that string. dt_idle_pd_free() kfree()s
pd->name, which is no longer the start of the allocation.
Copy the basename instead.
Fixes: 9d976d6721df ("cpuidle: Factor-out power domain related code from PSCI domain driver")
Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn>
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson <ulfh@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/cpuidle/dt_idle_genpd.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/cpuidle/dt_idle_genpd.c
+++ b/drivers/cpuidle/dt_idle_genpd.c
@@ -99,7 +99,7 @@ struct generic_pm_domain *dt_idle_pd_all
if (!pd)
goto out;
- pd->name = kasprintf(GFP_KERNEL, "%pOF", np);
+ pd->name = kstrdup(kbasename(of_node_full_name(np)), GFP_KERNEL);
if (!pd->name)
goto free_pd;
@@ -112,7 +112,6 @@ struct generic_pm_domain *dt_idle_pd_all
goto free_name;
pd->free_states = pd_free_states;
- pd->name = kbasename(pd->name);
pd->states = states;
pd->state_count = state_count;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0063/1376] block: flag zoned disks with GENHD_FL_NO_PART
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0062/1376] cpuidle: dt_idle_genpd: kfree() the original name allocation Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0064/1376] ceph: lock mutex in ceph_mds_check_access() Greg Kroah-Hartman
` (935 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Bart Van Assche,
Hannes Reinecke, Christoph Hellwig, Hannes Reinecke, Jens Axboe
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <dlemoal@kernel.org>
commit 3f9c7a108c0e8f14425384912017071b71341e3b upstream.
Zoned block devices do not support partitions. However, the partition
table is nevertheless still inspected, and any partition found ignored
with a warning in add_partition(). While this is generally not a problem,
and in fact beneficial to the user as it indicates an invalid use of a
zoned block device, scanning for a partition table on the device may
result in issuing read operations to offline zones (e.g. after a disk head
is depopulated for disks that support head management operations).
Since partitions are ignored anyway, completely disable partition scanning
for zoned gendisks by setting the flag GENHD_FL_NO_PART in __add_disk().
The existing check in add_partition() is left as-is to ensure that we
still get a warning if for whatever reason, despite GENHD_FL_NO_PART, we
still endup trying to add partitions.
Flagging zoned disks with GENHD_FL_NO_PART also has the benefit to expose
through sysfs the ext_range attribute with the value of 1 instead of the
default DISK_MAX_PARTS, thus correctly advertizing the fact that zoned
disks do not support partitions.
Fixes: 5eac3eb30c9a ("block: Remove partition support for zoned block devices")
Cc: stable@vger.kernel.org
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Link: https://patch.msgid.link/20260831025050.667758-1-dlemoal@kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/genhd.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -437,6 +437,13 @@ int __must_check device_add_disk(struct
bdev_set_flag(disk->part0, BD_HAS_SUBMIT_BIO);
/*
+ * We do not support partitions with zoned block devices, so do not try
+ * to scan the partitions table.
+ */
+ if (blk_queue_is_zoned(disk->queue))
+ disk->flags |= GENHD_FL_NO_PART;
+
+ /*
* If the driver provides an explicit major number it also must provide
* the number of minors numbers supported, and those will be used to
* setup the gendisk.
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0064/1376] ceph: lock mutex in ceph_mds_check_access()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0063/1376] block: flag zoned disks with GENHD_FL_NO_PART Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0065/1376] ata: ahci: work around lost interrupts on Marvell 88SE61xx Greg Kroah-Hartman
` (934 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Max Kellermann, Alex Markuze,
Ilya Dryomov
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Kellermann <max.kellermann@ionos.com>
commit a61c6ae1dae2611082b831b4aaa780878099c012 upstream.
MDS session OPEN handling replaces mdsc->s_cap_auths under
mdsc->mutex, freeing the previous array and its strings.
ceph_mds_check_access() traverses this array without holding the
mutex. A concurrent session reopen can therefore free the array while
it is being inspected, resulting in a use-after-free like this:
Unable to handle kernel paging request at virtual address 003aaad64b2c8bb9
[...]
Internal error: Oops: 0000000096000004 [#1] SMP
Modules linked in:
CPU: 56 UID: 2953037534 PID: 1253231 Comm: php-cgi8.4 Not tainted 6.18.45-i2-ampere #1146 NONE
[..]
pc : ceph_mds_check_access+0xd4/0x550
lr : ceph_mds_check_access+0xc8/0x550
[...]
Call trace:
ceph_mds_check_access+0xd4/0x550 (P)
ceph_atomic_open+0x138/0xbe8
path_openat+0xa24/0xfa8
do_filp_open+0x94/0x158
do_sys_openat2+0x88/0xf8
Cc: stable@vger.kernel.org
Fixes: 596afb0b8933 ("ceph: add ceph_mds_check_access() helper")
Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ceph/mds_client.c | 4 ++++
fs/ceph/mds_client.h | 1 +
2 files changed, 5 insertions(+)
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -5795,11 +5795,13 @@ int ceph_mds_check_access(struct ceph_md
doutc(cl, "tpath '%s', mask %d, caller_uid %d, caller_gid %d\n",
tpath, mask, caller_uid, caller_gid);
+ mutex_lock(&mdsc->mutex);
for (i = 0; i < mdsc->s_cap_auths_num; i++) {
struct ceph_mds_cap_auth *s = &mdsc->s_cap_auths[i];
err = ceph_mds_auth_match(mdsc, s, cred, tpath);
if (err < 0) {
+ mutex_unlock(&mdsc->mutex);
put_cred(cred);
return err;
} else if (err > 0) {
@@ -5821,6 +5823,7 @@ int ceph_mds_check_access(struct ceph_md
doutc(cl, "root_squash_perms %d, rw_perms_s %p\n", root_squash_perms,
rw_perms_s);
if (root_squash_perms && rw_perms_s == NULL) {
+ mutex_unlock(&mdsc->mutex);
doutc(cl, "access allowed\n");
return 0;
}
@@ -5835,6 +5838,7 @@ int ceph_mds_check_access(struct ceph_md
!!(mask & MAY_READ), !!(mask & MAY_WRITE));
}
doutc(cl, "access denied\n");
+ mutex_unlock(&mdsc->mutex);
return -EACCES;
}
--- a/fs/ceph/mds_client.h
+++ b/fs/ceph/mds_client.h
@@ -540,6 +540,7 @@ struct ceph_mds_client {
struct rw_semaphore pool_perm_rwsem;
struct rb_root pool_perm_tree;
+ /* protected by mutex */
u32 s_cap_auths_num;
struct ceph_mds_cap_auth *s_cap_auths;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0065/1376] ata: ahci: work around lost interrupts on Marvell 88SE61xx
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0064/1376] ceph: lock mutex in ceph_mds_check_access() Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0066/1376] ima: Check for ERR_PTR from dentry_path() in validate_hash_algo() Greg Kroah-Hartman
` (933 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hajo Noerenberg, Damien Le Moal,
Pali Rohar, Niklas Cassel
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hajo Noerenberg <hajo-linux-ide@noerenberg.de>
commit dc3565a4ae538e584e5e63b3b3cd1eaf502593c1 upstream.
ahci_single_level_irq_intr() services the ports first and clears the
global HOST_IRQ_STAT afterwards, as recommended by AHCI 1.1 section
10.6.2. The Marvell 88SE6111/6121/6145 family stops reporting interrupts
for a port when HOST_IRQ_STAT is cleared while PxIS still holds bits:
PxIS keeps its content, HOST_IRQ_STAT reads back as 0, the port is never
looked at again, and the command in flight only ends in a timeout.
Measured on a Seagate Blackarmor NAS440 (Marvell 88F6281 Kirkwood,
88SE6121 rev B2 behind PCIe) by polling the AHCI registers from userspace
while an IDENTIFY was outstanding:
t=303.046 irqs 127 PxIS 0x00000000 PxCI 0x00000001
IDENTIFY issued
t=303.057 irqs 128 PxIS 0x00000020 PxCI 0x00000000
CI cleared, DPS set, one interrupt taken
... PxIS stays 0x00000020, HOST_IRQ_STAT stays 0 ...
t~308.05 qc timeout after 5000 msecs
The command had completed - PxCI was clear and PxIS had DPS set - so
ahci_qc_complete() would have completed it. It never got the chance
because the handler read HOST_IRQ_STAT as 0 and returned IRQ_NONE.
Marvell's own driver for these chips clears the two registers in the
opposite order and says so ("clear global before channel"), and
ahci_xgene handles its broken edge latch the same way. Since the
reordering costs at most one spurious interrupt per valid one on
conforming controllers, do it in a private interrupt handler selected for
board_ahci_mv instead of changing libahci for everyone.
With this applied, SATA-2 and SATA-3 disks work at 3.0 Gbps on the
88SE6121 without the drive-side 1.5 Gbps jumper that was needed before.
Time from link up to a successful IDENTIFY:
WDC WD5000AADS-00S9B0 port 0 7 ms (never identified before)
WDC WD3202ABYS-01B7A0 port 1 28 ms
WDC WD30EFRX-68EUZN0 port 1 200 ms (3 TB, HPA detection ok)
Only the 88SE6121 was tested; board_ahci_mv also covers the 88SE6145,
which Marvell's driver treats identically.
Fixes: cd70c26617f4 ("[libata] AHCI: Add support for Marvell AHCI-like chips (initially 6145)")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/linux-ide/db6b48b7-d69a-564b-24f0-75fbd6a9e543@noerenberg.de/
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216094
Signed-off-by: Hajo Noerenberg <hajo-linux-ide@noerenberg.de>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Acked-by: Pali Rohar <pali@kernel.org>
Link: https://lore.kernel.org/r/20260831124303.920391-1-hajo-linux-ide@noerenberg.de
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/ahci.c | 49 +++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 49 insertions(+)
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -1676,6 +1676,51 @@ static irqreturn_t ahci_thunderx_irq_han
}
#endif
+/*
+ * The Marvell 88SE6111/6121/6145 ("Thor") family stops reporting interrupts
+ * for a port when HOST_IRQ_STAT is cleared while PxIS still holds bits: PxIS
+ * keeps its content, HOST_IRQ_STAT reads back as 0, the port is never looked
+ * at again and the command in flight only ends in a timeout. On a 88SE6121
+ * this makes every SATA-2 or SATA-3 disk fail to IDENTIFY, while SATA-1 disks
+ * happen to win the race often enough to work.
+ *
+ * Clearing the host status before servicing the ports avoids it. Marvell's
+ * own driver for these chips does the same and says so ("clear global before
+ * channel"), and ahci_xgene handles its broken edge latch the same way. The
+ * price is at most one spurious interrupt per valid one, which is why this is
+ * not the generic behaviour - see AHCI 1.1 section 10.6.2.
+ *
+ * Link: https://bugzilla.kernel.org/show_bug.cgi?id=216094
+ */
+static irqreturn_t ahci_mv_irq_handler(int irq, void *dev_instance)
+{
+ struct ata_host *host = dev_instance;
+ struct ahci_host_priv *hpriv = host->private_data;
+ void __iomem *mmio = hpriv->mmio;
+ unsigned int rc;
+ u32 irq_stat, irq_masked;
+
+ irq_stat = readl(mmio + HOST_IRQ_STAT);
+ if (!irq_stat)
+ return IRQ_NONE;
+
+ irq_masked = irq_stat & hpriv->port_map;
+
+ spin_lock(&host->lock);
+
+ /*
+ * Use the unmasked value to clear the interrupt, as a spurious pending
+ * event on a dummy port might cause a screaming IRQ.
+ */
+ writel(irq_stat, mmio + HOST_IRQ_STAT);
+
+ rc = ahci_handle_port_intr(host, irq_masked);
+
+ spin_unlock(&host->lock);
+
+ return IRQ_RETVAL(rc);
+}
+
static void ahci_remap_check(struct pci_dev *pdev, int bar,
struct ahci_host_priv *hpriv)
{
@@ -1948,6 +1993,10 @@ static int ahci_init_one(struct pci_dev
return -ENOMEM;
hpriv->flags |= (unsigned long)pi.private_data;
+ /* the Marvell "Thor" family needs HOST_IRQ_STAT cleared first */
+ if (board_id == board_ahci_mv)
+ hpriv->irq_handler = ahci_mv_irq_handler;
+
/* MCP65 revision A1 and A2 can't do MSI */
if (board_id == board_ahci_mcp65 &&
(pdev->revision == 0xa1 || pdev->revision == 0xa2))
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0066/1376] ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0065/1376] ata: ahci: work around lost interrupts on Marvell 88SE61xx Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0067/1376] irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout Greg Kroah-Hartman
` (932 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+5ebeb3089ea6439c37be,
Bradley Morgan, Mimi Zohar
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bradley Morgan <brads@mainlining.org>
commit 8861f6d5c0678a7c5089c7b272509fc5931b8437 upstream.
dentry_path() returns ERR_PTR(-ENAMETOOLONG) when the path exceeds the
buffer. validate_hash_algo() passes the result straight to
integrity_audit_msg() without checking. ERR_PTR is not NULL, so
integrity_audit_message() sees a valid pointer and calls strlen() on
it, which faults:
BUG: unable to handle page fault for address: ffffffffffffffdc
RIP: 0010:strlen+0x30/0xa0
Call Trace:
audit_log_untrustedstring+0x19/0x30
integrity_audit_message+0x366/0x4f0
ima_inode_setxattr+0x512/0x5f0
Check for IS_ERR() and use NULL instead, which makes the audit message
skip the name= field instead of crashing.
Fixes: 4f2946aa0c45 ("IMA: introduce a new policy option func=SETXATTR_CHECK")
Cc: stable@vger.kernel.org
Reported-by: syzbot+5ebeb3089ea6439c37be@syzkaller.appspotmail.com
Link: https://lore.kernel.org/all/6a8f89e5.1d9ded08.62e62.00bf.GAE@google.com/
Signed-off-by: Bradley Morgan <brads@mainlining.org>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/integrity/ima/ima_appraise.c | 2 ++
1 file changed, 2 insertions(+)
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -754,6 +754,8 @@ static int validate_hash_algo(struct den
return -EACCES;
path = dentry_path(dentry, pathbuf, PATH_MAX);
+ if (IS_ERR(path))
+ path = NULL;
integrity_audit_msg(AUDIT_INTEGRITY_DATA, d_inode(dentry), path,
"set_data", errmsg, -EACCES, 0);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0067/1376] irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0066/1376] ima: Check for ERR_PTR from dentry_path() in validate_hash_algo() Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0068/1376] kprobes: Protect kprobe_blacklist with RCU Greg Kroah-Hartman
` (931 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ju Nan, Thomas Gleixner, Radu Rendec,
Antonio Borneo
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ju Nan <junan76@163.com>
commit d31fbbade43f880b7e59e2b3a72722fe2725d93f upstream.
HWSPNLCK_TIMEOUT is passed to hwspin_lock_timeout_in_atomic(), whose
timeout argument is in milliseconds, not microseconds:
atomic_delay += HWSPINLOCK_RETRY_DELAY_US;
if (atomic_delay > to * 1000)
return -ETIMEDOUT;
So stm32mp_exti_set_type() asks for a 1 second timeout where the comment
next to the macro says it wants 1 millisecond. The semaphore is polled
with udelay() from a section that holds chip_data->rlock, a
raw_spinlock_t, so preemption stays disabled for the whole wait on every
configuration, PREEMPT_RT included.
The hwspinlock core documents this explicitly:
If the mode is HWLOCK_IN_ATOMIC (called from an atomic context) the
timeout is handled with busy-waiting delays, hence shall not exceed
few msecs.
Fixes: 5257169ade8c ("irqchip/stm32-exti: Use the hwspin_lock_timeout_in_atomic() API")
Signed-off-by: Ju Nan <junan76@163.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Radu Rendec <radu@rendec.net>
Reviewed-by: Antonio Borneo <antonio.borneo@foss.st.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260821024756.24927-2-junan76@163.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/irqchip/irq-stm32mp-exti.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/irqchip/irq-stm32mp-exti.c
+++ b/drivers/irqchip/irq-stm32mp-exti.c
@@ -23,7 +23,7 @@
#define IRQS_PER_BANK 32
-#define HWSPNLCK_TIMEOUT 1000 /* usec */
+#define HWSPNLCK_TIMEOUT_MS 1
#define EXTI_EnCIDCFGR(n) (0x180 + (n) * 4)
#define EXTI_HWCFGR1 0x3f0
@@ -377,7 +377,7 @@ static int stm32mp_exti_set_type(struct
raw_spin_lock(&chip_data->rlock);
if (hwlock) {
- err = hwspin_lock_timeout_in_atomic(hwlock, HWSPNLCK_TIMEOUT);
+ err = hwspin_lock_timeout_in_atomic(hwlock, HWSPNLCK_TIMEOUT_MS);
if (err) {
pr_err("%s can't get hwspinlock (%d)\n", __func__, err);
goto unlock;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0068/1376] kprobes: Protect kprobe_blacklist with RCU
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0067/1376] irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0069/1376] mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave() Greg Kroah-Hartman
` (930 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Masami Hiramatsu (Google)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
commit 0c4256196b3a105307e2235fbfd85e768bbcdd0f upstream.
__within_kprobe_blacklist() traverses kprobe_blacklist without holding
kprobe_mutex. When a module is unloaded, kprobe_remove_area_blacklist()
removes blacklist entries and immediately frees them with kfree().
A concurrent call to within_kprobe_blacklist() can therefore dereference
freed memory.
Furthermore, within_kprobe_blacklist() can be called in atomic or
non-preemptible contexts where the sleeping kprobe_mutex cannot be taken.
Protect kprobe_blacklist with RCU. Use guard(rcu)() and
list_for_each_entry_rcu() for traversal, list_add_tail_rcu() for
insertions, list_del_rcu() for deletions, and kfree_rcu() to reclaim
entries safely after a grace period.
Link: https://lore.kernel.org/all/178810004323.64882.16493230858653316962.stgit@devnote2/
Fixes: 376e242429bf ("kprobes: Introduce NOKPROBE_SYMBOL() macro to maintain kprobes blacklist")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260807155802.F06041F000E9@smtp.kernel.org/
Assisted-by: Antigravity:gemini-3.7-flash
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/kprobes.h | 1 +
kernel/kprobes.c | 14 ++++++++++----
2 files changed, 11 insertions(+), 4 deletions(-)
--- a/include/linux/kprobes.h
+++ b/include/linux/kprobes.h
@@ -181,6 +181,7 @@ struct kprobe_blacklist_entry {
struct list_head list;
unsigned long start_addr;
unsigned long end_addr;
+ struct rcu_head rcu;
};
#ifdef CONFIG_KPROBES
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -1393,8 +1393,14 @@ static bool __within_kprobe_blacklist(un
/*
* If 'kprobe_blacklist' is defined, check the address and
* reject any probe registration in the prohibited area.
+ * Note: this can return true during transition period where
+ * (start_addr, end_addr) in the black list is shrinking
+ * but old entry has not been removed yet. This is acceptable
+ * because the worst case is that we reject more probes than
+ * we should.
*/
- list_for_each_entry(ent, &kprobe_blacklist, list) {
+ guard(rcu)();
+ list_for_each_entry_rcu(ent, &kprobe_blacklist, list) {
if (addr >= ent->start_addr && addr < ent->end_addr)
return true;
}
@@ -2474,7 +2480,7 @@ int kprobe_add_ksym_blacklist(unsigned l
ent->start_addr = entry;
ent->end_addr = entry + size;
INIT_LIST_HEAD(&ent->list);
- list_add_tail(&ent->list, &kprobe_blacklist);
+ list_add_tail_rcu(&ent->list, &kprobe_blacklist);
return (int)size;
}
@@ -2568,8 +2574,8 @@ static void kprobe_remove_area_blacklist
list_for_each_entry_safe(ent, n, &kprobe_blacklist, list) {
if (ent->start_addr < start || ent->start_addr >= end)
continue;
- list_del(&ent->list);
- kfree(ent);
+ list_del_rcu(&ent->list);
+ kfree_rcu(ent, rcu);
}
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0069/1376] mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0068/1376] kprobes: Protect kprobe_blacklist with RCU Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0070/1376] tcp: clear sock_ops cb flags before force-closing a child socket Greg Kroah-Hartman
` (929 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet,
syzbot+0dbf6d295b3350944f0b, Andrew Morton, Gregory Price (Meta),
David Hildenbrand (Arm), Alistair Popple, Byungchul Park,
Huang, Ying, Joshua Hahn, Matthew Brost, Rakie Kim, Zi Yan
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit 540e583b66d6402bf556fde5e53c817a54c1afe5 upstream.
syzbot reported a sleeping function called from invalid context splat in
bucket_table_alloc().
When rhashtable_insert_slow() rehashes the table under rcu_read_lock(), it
calls bucket_table_alloc(..., GFP_ATOMIC | __GFP_NOWARN). If the bucket
table allocation uses vmalloc, __vmalloc_node_range_noprof() invokes
vm_area_alloc_pages() -> alloc_pages_bulk_mempolicy_noprof() with the
passed GFP_ATOMIC flags.
If the current task has an MPOL_WEIGHTED_INTERLEAVE mempolicy,
alloc_pages_bulk_weighted_interleave() is called and currently hardcodes
GFP_KERNEL when allocating the temporary weights array, triggering a
might_alloc() splat in atomic/RCU contexts.
Pass the gfp flags (masked with GFP_RECLAIM_MASK to strip page-allocator
zone modifiers like __GFP_HIGHMEM) received by
alloc_pages_bulk_weighted_interleave() to kmalloc() instead of hardcoding
GFP_KERNEL. Since the weights buffer is immediately initialized in full,
kmalloc() is sufficient.
Link: https://lore.kernel.org/20260821170407.3721004-1-edumazet@google.com
Fixes: fa3bea4e1f82 ("mm/mempolicy: introduce MPOL_WEIGHTED_INTERLEAVE for weighted interleaving")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot+0dbf6d295b3350944f0b@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/lkml/6a88837e.ae6ddae5.3da009.0040.GAE@google.com/T/#u
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Gregory Price (Meta) <gourry@gourry.net>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Byungchul Park <byungchul@sk.com>
Cc: "Huang, Ying" <ying.huang@linux.alibaba.com>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Zi Yan <ziy@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/mempolicy.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -2438,7 +2438,7 @@ static unsigned long alloc_pages_bulk_ar
prev_node = node;
/* create a local copy of node weights to operate on outside rcu */
- weights = kzalloc(nr_node_ids, GFP_KERNEL);
+ weights = kmalloc(nr_node_ids, gfp & GFP_RECLAIM_MASK);
if (!weights)
return total_allocated;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0070/1376] tcp: clear sock_ops cb flags before force-closing a child socket
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0069/1376] mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave() Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0071/1376] Input: aiptek - validate raw macro indices before updating state Greg Kroah-Hartman
` (928 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiayuan Chen, Sechang Lim,
Kuniyuki Iwashima, Eric Dumazet, Jakub Kicinski, Sasha Levin,
Miguel Gazquez (Schneider Electric)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sechang Lim <rhkrqnwk98@gmail.com>
[ Upstream commit 990348e5bb457697c2f1f7f7b65154a3334d9d2b ]
A child socket inherits the listener's bpf_sock_ops_cb_flags via
sk_clone_lock(). If its setup fails in tcp_v4_syn_recv_sock() /
tcp_v6_syn_recv_sock(), the child is freed through put_and_exit, where
inet_csk_prepare_forced_close() drops the socket lock and tcp_done() runs
without it.
If BPF_SOCK_OPS_STATE_CB_FLAG was inherited, tcp_done() -> tcp_set_state()
calls tcp_call_bpf(), which expects the lock and trips sock_owned_by_me():
WARNING: include/net/sock.h:1799 at tcp_set_state+0x433/0x550
RIP: 0010:tcp_set_state+0x433/0x550 include/net/sock.h:1799
Call Trace:
<IRQ>
tcp_done+0xba/0x250 net/ipv4/tcp.c:5095
tcp_v4_syn_recv_sock+0x850/0xa50 net/ipv4/tcp_ipv4.c:1787
tcp_check_req+0xf30/0x1360 net/ipv4/tcp_minisocks.c:926
tcp_v4_rcv+0x1047/0x1b50 net/ipv4/tcp_ipv4.c:2164
</IRQ>
The child is freed before it is ever established, so it should run no
sock_ops callback. Clear its cb flags in inet_csk_prepare_for_destroy_sock(),
the common point for the IPv4, IPv6 and chtls forced-close paths and for the
MPTCP ->syn_recv_sock() failure path (dispose_child), which reaches tcp_done()
on a child that was never established too.
Suggested-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Fixes: d44874910a26 ("bpf: Add BPF_SOCK_OPS_STATE_CB")
Signed-off-by: Sechang Lim <rhkrqnwk98@gmail.com>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260611092923.1895982-1-rhkrqnwk98@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Moved inet_csk_prepare_for_destroy_sock() to inet_connection_sock.c due to header dependency,
Added a guard arount the call to tcp_clear_sock_ops_cb_flags to avoid
calling it for DDCP sockets.]
Signed-off-by: Miguel Gazquez (Schneider Electric) <miguel.gazquez@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/inet_connection_sock.h | 8 +-------
include/net/tcp.h | 9 +++++++++
net/ipv4/inet_connection_sock.c | 9 +++++++++
3 files changed, 19 insertions(+), 7 deletions(-)
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index fe4f8261c4436..41354036b0c87 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -298,14 +298,8 @@ reqsk_timeout(struct request_sock *req, unsigned long max_timeout)
return (unsigned long)min_t(u64, timeout, max_timeout);
}
-static inline void inet_csk_prepare_for_destroy_sock(struct sock *sk)
-{
- /* The below has to be done to allow calling inet_csk_destroy_sock */
- sock_set_flag(sk, SOCK_DEAD);
- this_cpu_inc(*sk->sk_prot->orphan_count);
-}
-
void inet_csk_destroy_sock(struct sock *sk);
+void inet_csk_prepare_for_destroy_sock(struct sock *sk);
void inet_csk_prepare_forced_close(struct sock *sk);
/*
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 64c300659a8ee..8ebaeed6217b9 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -2704,6 +2704,11 @@ static inline int tcp_call_bpf_3arg(struct sock *sk, int op, u32 arg1, u32 arg2,
return tcp_call_bpf(sk, op, 3, args);
}
+static inline void tcp_clear_sock_ops_cb_flags(struct sock *sk)
+{
+ tcp_sk(sk)->bpf_sock_ops_cb_flags = 0;
+}
+
#else
static inline int tcp_call_bpf(struct sock *sk, int op, u32 nargs, u32 *args)
{
@@ -2721,6 +2726,10 @@ static inline int tcp_call_bpf_3arg(struct sock *sk, int op, u32 arg1, u32 arg2,
return -EPERM;
}
+static inline void tcp_clear_sock_ops_cb_flags(struct sock *sk)
+{
+}
+
#endif
static inline u32 tcp_timeout_init(struct sock *sk)
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 91dcdb7567ace..117a424d1fee3 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -1315,6 +1315,15 @@ void inet_csk_destroy_sock(struct sock *sk)
}
EXPORT_SYMBOL(inet_csk_destroy_sock);
+void inet_csk_prepare_for_destroy_sock(struct sock *sk)
+{
+ /* The below has to be done to allow calling inet_csk_destroy_sock */
+ if (sk->sk_protocol == IPPROTO_TCP)
+ tcp_clear_sock_ops_cb_flags(sk);
+ sock_set_flag(sk, SOCK_DEAD);
+ this_cpu_inc(*sk->sk_prot->orphan_count);
+}
+
/* This function allows to force a closure of a socket after the call to
* tcp/dccp_create_openreq_child().
*/
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0071/1376] Input: aiptek - validate raw macro indices before updating state
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0070/1376] tcp: clear sock_ops cb flags before force-closing a child socket Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0072/1376] memcg: make the v1 soft limit knob inert Greg Kroah-Hartman
` (927 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Dmitry Torokhov
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
commit 95dffe32a66cbed07fbfa7afed39d56d5014e04f upstream.
aiptek_irq() derives macro key indices directly from tablet reports and
then uses them to index macroKeyEvents[]. Report types 4 and 5 also save
the derived value in aiptek->lastMacro and later use that state to
release the previous key.
Validate the raw macro index once before it enters that state machine, so
lastMacro only ever stores an in-range macro key. Keep direct bounds
checks for report type 6, which reads the macro number from the packet
body and uses it immediately.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260329001711.88076-1-pengpeng@iscas.ac.cn
[dtor: fix macro fallback in report 5s to use -1]
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/tablet/aiptek.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
--- a/drivers/input/tablet/aiptek.c
+++ b/drivers/input/tablet/aiptek.c
@@ -658,6 +658,8 @@ static void aiptek_irq(struct urb *urb)
pck = (data[1] & aiptek->curSetting.stylusButtonUpper) != 0 ? 1 : 0;
macro = dv && p && tip && !(data[3] & 1) ? (data[3] >> 1) : -1;
+ if (macro >= ARRAY_SIZE(macroKeyEvents))
+ macro = -1;
z = get_unaligned_le16(data + 4);
if (dv) {
@@ -699,7 +701,9 @@ static void aiptek_irq(struct urb *urb)
left = (data[1]& aiptek->curSetting.mouseButtonLeft) != 0 ? 1 : 0;
right = (data[1] & aiptek->curSetting.mouseButtonRight) != 0 ? 1 : 0;
middle = (data[1] & aiptek->curSetting.mouseButtonMiddle) != 0 ? 1 : 0;
- macro = dv && p && left && !(data[3] & 1) ? (data[3] >> 1) : 0;
+ macro = dv && p && left && !(data[3] & 1) ? (data[3] >> 1) : -1;
+ if (macro >= ARRAY_SIZE(macroKeyEvents))
+ macro = -1;
if (dv) {
/* If the selected tool changed, reset the old
@@ -737,11 +741,11 @@ static void aiptek_irq(struct urb *urb)
*/
else if (data[0] == 6) {
macro = get_unaligned_le16(data + 1);
- if (macro > 0) {
+ if (macro > 0 && macro - 1 < ARRAY_SIZE(macroKeyEvents)) {
input_report_key(inputdev, macroKeyEvents[macro - 1],
0);
}
- if (macro < 25) {
+ if (macro + 1 < ARRAY_SIZE(macroKeyEvents)) {
input_report_key(inputdev, macroKeyEvents[macro + 1],
0);
}
@@ -760,7 +764,8 @@ static void aiptek_irq(struct urb *urb)
aiptek->curSetting.toolMode;
}
- input_report_key(inputdev, macroKeyEvents[macro], 1);
+ if (macro < ARRAY_SIZE(macroKeyEvents))
+ input_report_key(inputdev, macroKeyEvents[macro], 1);
input_report_abs(inputdev, ABS_MISC,
1 | AIPTEK_REPORT_TOOL_UNKNOWN);
input_sync(inputdev);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0072/1376] memcg: make the v1 soft limit knob inert
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0071/1376] Input: aiptek - validate raw macro indices before updating state Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0073/1376] rtc: rzn1: Fix weekday underflow when alarm crosses month boundary Greg Kroah-Hartman
` (926 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shakeel Butt,
syzbot+12ee2725d5fde63a9c96, Michal Hocko, Axel Rasmussen,
Barry Song, David Hildenbrand, Johannes Weiner, Kairui Song,
Lorenzo Stoakes, Muchun Song, Roman Gushchin, Andrew Morton
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shakeel Butt <shakeel.butt@linux.dev>
commit a3417097fb107cea3358b19bcbb4eb655fd67f8c upstream.
The v1 soft limit has been deprecated since v6.12 and nobody has reported
depending on it. Start the removal by decoupling the interface from the
implementation: keep memory.soft_limit_in_bytes, but ignore writes to it
and always report the maximum value on read similar to what
memory.kmem.limit_in_bytes already does.
Writes are still parsed, so malformed input keeps returning -EINVAL. The
knob now also behaves the same everywhere: it used to return -EOPNOTSUPP
on PREEMPT_RT, where soft limit reclaim has always been disabled.
This also fixes the syzbot report linked below. Soft limit reclaim is the
only caller that runs shrink_lruvec() from kswapd against a specific
memcg, so it is the only way to reach lru_gen_shrink_lruvec() and in turn
set_mm_walk(), which warns when called from kswapd.
Link: https://lore.kernel.org/20260811203203.3456029-2-shakeel.butt@linux.dev
Signed-off-by: Shakeel Butt <shakeel.butt@linux.dev>
Reported-by: syzbot+12ee2725d5fde63a9c96@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/6a7a6929.b50370da.49fe0.005e.GAE@google.com/
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Barry Song <baohua@kernel.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Kairui Song <kasong@tencent.com>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/admin-guide/cgroup-v1/memory.rst | 49 +++----------------------
mm/memcontrol-v1.c | 43 +++++++++++++--------
2 files changed, 32 insertions(+), 60 deletions(-)
--- a/Documentation/admin-guide/cgroup-v1/memory.rst
+++ b/Documentation/admin-guide/cgroup-v1/memory.rst
@@ -47,7 +47,6 @@ Features:
- pages are linked to per-memcg LRU exclusively, and there is no global LRU.
- optionally, memory+swap usage can be accounted and limited.
- hierarchical accounting
- - soft limit
- moving (recharging) account at moving a task is selectable.
- usage threshold notifier
- memory pressure notifier
@@ -76,10 +75,9 @@ Brief summary of control files.
memory.memsw.failcnt show the number of memory+Swap hits limits
memory.max_usage_in_bytes show max memory usage recorded
memory.memsw.max_usage_in_bytes show max memory+Swap usage recorded
- memory.soft_limit_in_bytes set/show soft limit of memory usage
- This knob is not available on CONFIG_PREEMPT_RT systems.
- This knob is deprecated and shouldn't be
- used.
+ memory.soft_limit_in_bytes This knob is deprecated and has no effect.
+ Writes are ignored and reads always
+ return the maximum value.
memory.stat show various statistics
memory.use_hierarchy set/show hierarchical account enabled
This knob is deprecated and shouldn't be
@@ -346,9 +344,6 @@ memory.kmem.usage_in_bytes, or in a sepa
The main "kmem" counter is fed into the main counter, so kmem charges will
also be visible from the user counter.
-Currently no soft limit is implemented for kernel memory. It is future work
-to trigger slab reclaim when those limits are reached.
-
2.7.1 Current Kernel Memory resources accounted
-----------------------------------------------
@@ -712,42 +707,10 @@ For compatibility reasons writing 1 to m
THIS IS DEPRECATED!
-Soft limits allow for greater sharing of memory. The idea behind soft limits
-is to allow control groups to use as much of the memory as needed, provided
-
-a. There is no memory contention
-b. They do not exceed their hard limit
-
-When the system detects memory contention or low memory, control groups
-are pushed back to their soft limits. If the soft limit of each control
-group is very high, they are pushed back as much as possible to make
-sure that one control group does not starve the others of memory.
-
-Please note that soft limits is a best-effort feature; it comes with
-no guarantees, but it does its best to make sure that when memory is
-heavily contended for, memory is allocated based on the soft limit
-hints/setup. Currently soft limit based reclaim is set up such that
-it gets invoked from balance_pgdat (kswapd).
-
-7.1 Interface
--------------
+Writing to memory.soft_limit_in_bytes has no effect and reading it will
+always return the maximum value.
-Soft limits can be setup by using the following commands (in this example we
-assume a soft limit of 256 MiB)::
-
- # echo 256M > memory.soft_limit_in_bytes
-
-If we want to change this to 1G, we can at any time use::
-
- # echo 1G > memory.soft_limit_in_bytes
-
-.. note::
- Soft limits take effect over a long period of time, since they involve
- reclaiming memory for balancing between memory cgroups
-
-.. note::
- It is recommended to set the soft limit always below the hard limit,
- otherwise the hard limit will take precedence.
+Use memory.low and memory.min in cgroup v2 instead.
.. _cgroup-v1-memory-move-charges:
--- a/mm/memcontrol-v1.c
+++ b/mm/memcontrol-v1.c
@@ -120,7 +120,6 @@ enum {
RES_LIMIT,
RES_MAX_USAGE,
RES_FAILCNT,
- RES_SOFT_LIMIT,
};
#ifdef CONFIG_LOCKDEP
@@ -2440,6 +2439,30 @@ static int mem_cgroup_hierarchy_write(st
return -EINVAL;
}
+static u64 mem_cgroup_soft_limit_read(struct cgroup_subsys_state *css,
+ struct cftype *cft)
+{
+ return (u64)PAGE_COUNTER_MAX * PAGE_SIZE;
+}
+
+static ssize_t mem_cgroup_soft_limit_write(struct kernfs_open_file *of,
+ char *buf, size_t nbytes, loff_t off)
+{
+ unsigned long nr_pages;
+ int ret;
+
+ ret = page_counter_memparse(strstrip(buf), "-1", &nr_pages);
+ if (ret)
+ return ret;
+
+ pr_warn_once("soft_limit_in_bytes is deprecated and will be removed. "
+ "Writing any value to this file has no effect. "
+ "Please report your usecase to linux-mm@kvack.org if you "
+ "depend on this functionality.\n");
+
+ return nbytes;
+}
+
static u64 mem_cgroup_read_u64(struct cgroup_subsys_state *css,
struct cftype *cft)
{
@@ -2476,8 +2499,6 @@ static u64 mem_cgroup_read_u64(struct cg
return (u64)counter->watermark * PAGE_SIZE;
case RES_FAILCNT:
return counter->failcnt;
- case RES_SOFT_LIMIT:
- return (u64)READ_ONCE(memcg->soft_limit) * PAGE_SIZE;
default:
BUG();
}
@@ -2572,17 +2593,6 @@ static ssize_t mem_cgroup_write(struct k
break;
}
break;
- case RES_SOFT_LIMIT:
- if (IS_ENABLED(CONFIG_PREEMPT_RT)) {
- ret = -EOPNOTSUPP;
- } else {
- pr_warn_once("soft_limit_in_bytes is deprecated and will be removed. "
- "Please report your usecase to linux-mm@kvack.org if you "
- "depend on this functionality.\n");
- WRITE_ONCE(memcg->soft_limit, nr_pages);
- ret = 0;
- }
- break;
}
return ret ?: nbytes;
}
@@ -2918,9 +2928,8 @@ struct cftype mem_cgroup_legacy_files[]
},
{
.name = "soft_limit_in_bytes",
- .private = MEMFILE_PRIVATE(_MEM, RES_SOFT_LIMIT),
- .write = mem_cgroup_write,
- .read_u64 = mem_cgroup_read_u64,
+ .write = mem_cgroup_soft_limit_write,
+ .read_u64 = mem_cgroup_soft_limit_read,
},
{
.name = "failcnt",
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0073/1376] rtc: rzn1: Fix weekday underflow when alarm crosses month boundary
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0072/1376] memcg: make the v1 soft limit knob inert Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0074/1376] rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers Greg Kroah-Hartman
` (925 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lad Prabhakar, Wolfram Sang,
Alexandre Belloni
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
commit 022a2839a52006531804a8db55d3228084400b48 upstream.
rzn1_rtc_set_alarm() calculates the alarm weekday from the difference
between the alarm day and the current day of the month. When the alarm
crosses a month boundary, this difference can become negative. Since
days_ahead is unsigned, it underflows and results in an incorrect
weekday being programmed into RZN1_RTC_ALW.
The RTC core already provides a fully populated struct rtc_time for
the alarm, including the correct tm_wday. Use tm->tm_wday directly
instead of recalculating the weekday from the day-of-month.
This avoids the underflow and ensures alarms scheduled across a month
boundary use the correct weekday.
Fixes: b5ad1bf00d2c4 ("rtc: rzn1: Add alarm support")
Cc: stable@vger.kernel.org
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Suggested-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Link: https://patch.msgid.link/20260821211032.13554-4-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/rtc/rtc-rzn1.c | 7 +------
1 file changed, 1 insertion(+), 6 deletions(-)
--- a/drivers/rtc/rtc-rzn1.c
+++ b/drivers/rtc/rtc-rzn1.c
@@ -219,7 +219,6 @@ static int rzn1_rtc_set_alarm(struct dev
struct rzn1_rtc *rtc = dev_get_drvdata(dev);
struct rtc_time *tm = &alrm->time, tm_now;
unsigned long alarm, farest;
- unsigned int days_ahead, wday;
int ret;
ret = rzn1_rtc_read_time(dev, &tm_now);
@@ -232,13 +231,9 @@ static int rzn1_rtc_set_alarm(struct dev
if (time_after(alarm, farest))
return -ERANGE;
- /* Convert alarm day into week day */
- days_ahead = tm->tm_mday - tm_now.tm_mday;
- wday = (tm_now.tm_wday + days_ahead) % 7;
-
writel(bin2bcd(tm->tm_min), rtc->base + RZN1_RTC_ALM);
writel(bin2bcd(tm->tm_hour), rtc->base + RZN1_RTC_ALH);
- writel(BIT(wday), rtc->base + RZN1_RTC_ALW);
+ writel(BIT(tm->tm_wday), rtc->base + RZN1_RTC_ALW);
rzn1_rtc_alarm_irq_enable(dev, alrm->enabled);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0074/1376] rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0073/1376] rtc: rzn1: Fix weekday underflow when alarm crosses month boundary Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0075/1376] perf/x86/intel: Fix kernel address leakages in LBR stack Greg Kroah-Hartman
` (924 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lad Prabhakar, Wolfram Sang,
Alexandre Belloni
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
commit 51458d5b0a1cfb1b6013400abc95aadf16ed2a57 upstream.
rzn1_rtc_set_alarm() updates RZN1_RTC_ALM, RZN1_RTC_ALH and
RZN1_RTC_ALW using separate MMIO writes without first disabling the
alarm interrupt. If a previous alarm is still enabled, the interrupt
can fire while the alarm registers contain a mixture of old and newly
written values.
Fix this by disabling the alarm interrupt before reprogramming ALM, ALH
and ALW with a call to rzn1_rtc_alarm_irq_enable().
Fixes: b5ad1bf00d2c4 ("rtc: rzn1: Add alarm support")
Cc: stable@vger.kernel.org
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Link: https://patch.msgid.link/20260821211032.13554-7-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/rtc/rtc-rzn1.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/rtc/rtc-rzn1.c
+++ b/drivers/rtc/rtc-rzn1.c
@@ -231,6 +231,11 @@ static int rzn1_rtc_set_alarm(struct dev
if (time_after(alarm, farest))
return -ERANGE;
+ /* Disable alarm interrupts before reprogramming the alarm. */
+ ret = rzn1_rtc_alarm_irq_enable(dev, 0);
+ if (ret)
+ return ret;
+
writel(bin2bcd(tm->tm_min), rtc->base + RZN1_RTC_ALM);
writel(bin2bcd(tm->tm_hour), rtc->base + RZN1_RTC_ALH);
writel(BIT(tm->tm_wday), rtc->base + RZN1_RTC_ALW);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0075/1376] perf/x86/intel: Fix kernel address leakages in LBR stack
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0074/1376] rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0076/1376] perf trace: Factor out BPF loop body Greg Kroah-Hartman
` (923 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ian Rogers, Dapeng Mi,
Peter Zijlstra (Intel)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dapeng Mi <dapeng1.mi@linux.intel.com>
commit e2b0575900ff72aa82748af96e7bd564ade5157a upstream.
Before Arch LBR gained CPL filtering support, a user-only branch stack
could still contain kernel addresses. As a result, kernel branch records
may be exposed to user space even when PERF_SAMPLE_BRANCH_USER is
requested.
For example, on Intel Tiger Lake, the following command can still report
SYSRET/ERET entries with kernel-space from addresses:
$ ./perf record -e cycles:p -o - --branch-filter any,save_type,u -- \
./perf bench syscall basic --loop 1000 | \
./perf script -i - --fields brstack|tr ' ' '\n'| \
grep -E '0x[89a-f][0-9a-f]{15}'
Total time: 0.000 [sec]
0.219000 usecs/op
4,566,210 ops/sec
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 0.551 MB - ]
0xffffffff93c001c8/0x7f12a2b1d647/P/-/-/16959/SYSRET/-
0xffffffff93c001c8/0x7f12a2b1d5c2/P/-/-/17535/SYSRET/-
0xffffffff93c01928/0x7f12a2861000/P/-/-/6719/ERET/-
0xffffffff93c01928/0x7f12a297a000/P/-/-/8575/ERET/-
The problem is that intel_pmu_lbr_filter() does not fully validate the
privilege level of sampled entries. It filters some mismatches based on
the branch type and the to address, but it does not reject entries whose
from address violates the requested branch privilege filter.
Fix this by extending software filtering to validate both from and to
addresses against br_sel. Any LBR entry contains kernel address does not
match the requested user filter is dropped. This prevents kernel
addresses from appearing in user-only branch stacks.
Fixes: 47125db27e47 ("perf/x86/intel/lbr: Support Architectural LBR")
Reported-by: Ian Rogers <irogers@google.com>
Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260616044654.3468742-5-dapeng1.mi@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/events/intel/lbr.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
--- a/arch/x86/events/intel/lbr.c
+++ b/arch/x86/events/intel/lbr.c
@@ -1202,7 +1202,7 @@ intel_pmu_lbr_filter(struct cpu_hw_event
{
u64 from, to;
int br_sel = cpuc->br_sel;
- int i, j, type, to_plm;
+ int i, j, type, from_plm, to_plm;
bool compress = false;
/* if sampling all branches, then nothing to filter */
@@ -1234,8 +1234,14 @@ intel_pmu_lbr_filter(struct cpu_hw_event
type |= X86_BR_NO_TX;
}
- /* if type does not correspond, then discard */
- if (type == X86_BR_NONE || (br_sel & type) != type) {
+ from_plm = kernel_ip(from) ? X86_BR_KERNEL : X86_BR_USER;
+ /*
+ * If type does not correspond, then discard.
+ * Specifically reject entries whose from address is in
+ * kernel space when only X86_BR_USER is requested.
+ */
+ if (type == X86_BR_NONE || (br_sel & type) != type ||
+ (!(br_sel & X86_BR_KERNEL) && (from_plm & X86_BR_KERNEL))) {
cpuc->lbr_entries[i].from = 0;
compress = true;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0076/1376] perf trace: Factor out BPF loop body
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0075/1376] perf/x86/intel: Fix kernel address leakages in LBR stack Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0077/1376] perf trace: Refactor augmented_raw_syscalls using bpf_for Greg Kroah-Hartman
` (922 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Viktor Malik, Namhyung Kim
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viktor Malik <vmalik@redhat.com>
commit acff3e1a9cc29a6a039b76b81a438c56016bc0e3 upstream.
The BPF program in augmented_raw_syscalls uses a for loop to iterate all
syscall arguments. The loop body is quite complex and often poses
problems for the BPF verifier. As a preparation step for addressing this
issue, factor out the loop body into a separate function.
Signed-off-by: Viktor Malik <vmalik@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c | 128 ++++++++++--------
1 file changed, 73 insertions(+), 55 deletions(-)
--- a/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c
+++ b/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c
@@ -428,15 +428,80 @@ static bool pid_filter__has(struct pids_
return bpf_map_lookup_elem(pids, &pid) != NULL;
}
+/*
+ * Determine what type of argument and how many bytes to read from user space, using the
+ * value in the beauty_map. This is the relation of parameter type and its corresponding
+ * value in the beauty map, and how many bytes we read eventually:
+ *
+ * string: 1 -> size of string
+ * struct: size of struct -> size of struct
+ * buffer: -1 * (index of paired len) -> value of paired len (maximum: TRACE_AUG_MAX_BUF)
+ */
+static inline int augment_arg(struct syscall_enter_args *args, int i,
+ unsigned int *beauty_map,
+ struct augmented_arg *payload_offset)
+{
+ int index, value_size = sizeof(struct augmented_arg) - offsetof(struct augmented_arg, value);
+ s64 aug_size, size;
+ bool augmented;
+ void *arg;
+
+ arg = (void *)args->args[i];
+ augmented = false;
+ size = beauty_map[i];
+ aug_size = size; /* size of the augmented data read from user space */
+
+ if (size == 0 || arg == NULL)
+ return 0;
+
+ if (size == 1) { /* string */
+ aug_size = bpf_probe_read_user_str(payload_offset->value, value_size, arg);
+ /* minimum of 0 to pass the verifier */
+ if (aug_size < 0)
+ aug_size = 0;
+
+ augmented = true;
+ } else if (size > 0 && size <= value_size) { /* struct */
+ if (!bpf_probe_read_user(payload_offset->value, size, arg))
+ augmented = true;
+ } else if ((int)size < 0 && size >= -6) { /* buffer */
+ index = -(size + 1);
+ barrier_var(index); // Prevent clang (noticed with v18) from removing the &= 7 trick.
+ index &= 7; // Satisfy the bounds checking with the verifier in some kernels.
+ aug_size = args->args[index] > TRACE_AUG_MAX_BUF ? TRACE_AUG_MAX_BUF : args->args[index];
+
+ if (aug_size > 0) {
+ if (!bpf_probe_read_user(payload_offset->value, aug_size, arg))
+ augmented = true;
+ }
+ }
+
+ /* Augmented data size is limited to sizeof(augmented_arg->unnamed union with value field) */
+ if (aug_size > value_size)
+ aug_size = value_size;
+
+ /* write data to payload */
+ if (augmented) {
+ int written = offsetof(struct augmented_arg, value) + aug_size;
+
+ if (written < 0 || written > sizeof(struct augmented_arg))
+ return -1;
+
+ payload_offset->size = aug_size;
+ return written;
+ }
+
+ return 0;
+}
+
static int augment_sys_enter(void *ctx, struct syscall_enter_args *args)
{
- bool augmented, do_output = false;
- int zero = 0, index, value_size = sizeof(struct augmented_arg) - offsetof(struct augmented_arg, value);
+ bool do_output = false;
+ int zero = 0, written;
u64 output = 0; /* has to be u64, otherwise it won't pass the verifier */
- s64 aug_size, size;
unsigned int nr, *beauty_map;
struct beauty_payload_enter *payload;
- void *arg, *payload_offset;
+ void *payload_offset;
/* fall back to do predefined tail call */
if (args == NULL)
@@ -456,58 +521,11 @@ static int augment_sys_enter(void *ctx,
/* copy the sys_enter header, which has the syscall_nr */
__builtin_memcpy(&payload->args, args, sizeof(struct syscall_enter_args));
- /*
- * Determine what type of argument and how many bytes to read from user space, using the
- * value in the beauty_map. This is the relation of parameter type and its corresponding
- * value in the beauty map, and how many bytes we read eventually:
- *
- * string: 1 -> size of string
- * struct: size of struct -> size of struct
- * buffer: -1 * (index of paired len) -> value of paired len (maximum: TRACE_AUG_MAX_BUF)
- */
for (int i = 0; i < 6; i++) {
- arg = (void *)args->args[i];
- augmented = false;
- size = beauty_map[i];
- aug_size = size; /* size of the augmented data read from user space */
-
- if (size == 0 || arg == NULL)
- continue;
-
- if (size == 1) { /* string */
- aug_size = bpf_probe_read_user_str(((struct augmented_arg *)payload_offset)->value, value_size, arg);
- /* minimum of 0 to pass the verifier */
- if (aug_size < 0)
- aug_size = 0;
-
- augmented = true;
- } else if (size > 0 && size <= value_size) { /* struct */
- if (!bpf_probe_read_user(((struct augmented_arg *)payload_offset)->value, size, arg))
- augmented = true;
- } else if ((int)size < 0 && size >= -6) { /* buffer */
- index = -(size + 1);
- barrier_var(index); // Prevent clang (noticed with v18) from removing the &= 7 trick.
- index &= 7; // Satisfy the bounds checking with the verifier in some kernels.
- aug_size = args->args[index] > TRACE_AUG_MAX_BUF ? TRACE_AUG_MAX_BUF : args->args[index];
-
- if (aug_size > 0) {
- if (!bpf_probe_read_user(((struct augmented_arg *)payload_offset)->value, aug_size, arg))
- augmented = true;
- }
- }
-
- /* Augmented data size is limited to sizeof(augmented_arg->unnamed union with value field) */
- if (aug_size > value_size)
- aug_size = value_size;
-
- /* write data to payload */
- if (augmented) {
- int written = offsetof(struct augmented_arg, value) + aug_size;
-
- if (written < 0 || written > sizeof(struct augmented_arg))
- return 1;
-
- ((struct augmented_arg *)payload_offset)->size = aug_size;
+ written = augment_arg(args, i, beauty_map, (struct augmented_arg *)payload_offset);
+ if (written < 0)
+ return 1;
+ if (written > 0) {
output += written;
payload_offset += written;
do_output = true;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0077/1376] perf trace: Refactor augmented_raw_syscalls using bpf_for
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0076/1376] perf trace: Factor out BPF loop body Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0078/1376] perf hisi-ptt: Fix PTT trace TLP header parsing Greg Kroah-Hartman
` (921 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Viktor Malik, Andrii Nakryiko,
Namhyung Kim
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viktor Malik <vmalik@redhat.com>
commit ea6992784d65ef2c01f3525217dbf3a44afa9917 upstream.
The loop for processing syscall args in augment_raw_syscalls has a
history of breaking with Clang updates, see e.g. commit 013eb043f37b
("perf trace: Fix BPF loading failure (-E2BIG)") from Clang 15 to 16.
Now, a similar thing happened between Clang 21 and 22. While the issue
is mitigated on the main line by a recent verifier update, it remains
broken on the 6.12 and 6.18 stable branches:
[linux-6.18.y]# sudo perf trace true
libbpf: prog 'sys_enter': BPF program load failed: -E2BIG
libbpf: prog 'sys_enter': -- BEGIN PROG LOAD LOG --
[...]
BPF program is too large. Processed 1000001 insn
processed 1000001 insns (limit 1000000) max_states_per_insn 40 total_states 37941 peak_states 232 mark_read 0
-- END PROG LOAD LOG --
libbpf: prog 'sys_enter': failed to load: -E2BIG
libbpf: failed to load object 'augmented_raw_syscalls_bpf'
libbpf: failed to load BPF skeleton 'augmented_raw_syscalls_bpf': -E2BIG
Error: failed to get syscall or beauty map fd
[...]
The reason is that the loop is quite complex and the BPF verifier often
struggles to prove that it terminates.
Fix the issue by replacing the standard for loop with the bpf_for macro,
which uses a numeric BPF iterator. This should prevent future breakages
of this kind since the verifier has a much easier job proving that the
loop terminates.
Small adjustments were necessary for the loop to make it work. The main
problem is that the verifier sometimes has problems with bpf_for loops
that use a carry-over state, such as the `payload_offset` and `output`
vars here, since the verifier tries to track their values too precisely
and cannot prove loop convergence. To resolve the issue, we (1)
explicitly recompute `payload_offset` in every iteration and (2) use a
trick with adding a global zero to `output` to help the verifier forget
its precise state and use a range instead.
Finally, to keep backwards compatibility with older kernel versions that
don't have bpf_for (i.e. numeric iterators), fall back to standard loop.
Signed-off-by: Viktor Malik <vmalik@redhat.com>
Cc: stable@vger.kernel.org
Suggested-by: Andrii Nakryiko <andrii@kernel.org>
Fixes: a68fd6a6cdd3 ("perf trace: Collect augmented data using BPF")
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c | 47 +++++++++++++-----
1 file changed, 35 insertions(+), 12 deletions(-)
--- a/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c
+++ b/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c
@@ -428,6 +428,8 @@ static bool pid_filter__has(struct pids_
return bpf_map_lookup_elem(pids, &pid) != NULL;
}
+u64 ZERO = 0;
+
/*
* Determine what type of argument and how many bytes to read from user space, using the
* value in the beauty_map. This is the relation of parameter type and its corresponding
@@ -439,9 +441,10 @@ static bool pid_filter__has(struct pids_
*/
static inline int augment_arg(struct syscall_enter_args *args, int i,
unsigned int *beauty_map,
- struct augmented_arg *payload_offset)
+ struct beauty_payload_enter *payload, u64 offset)
{
int index, value_size = sizeof(struct augmented_arg) - offsetof(struct augmented_arg, value);
+ struct augmented_arg *payload_offset;
s64 aug_size, size;
bool augmented;
void *arg;
@@ -454,6 +457,12 @@ static inline int augment_arg(struct sys
if (size == 0 || arg == NULL)
return 0;
+ /* bounds check for the verifier */
+ if (offset > sizeof(payload->aug_args) - sizeof(payload->aug_args[0]))
+ return -1;
+ barrier_var(offset);
+ payload_offset = (struct augmented_arg *)((void *)&payload->aug_args + offset);
+
if (size == 1) { /* string */
aug_size = bpf_probe_read_user_str(payload_offset->value, value_size, arg);
/* minimum of 0 to pass the verifier */
@@ -497,11 +506,10 @@ static inline int augment_arg(struct sys
static int augment_sys_enter(void *ctx, struct syscall_enter_args *args)
{
bool do_output = false;
- int zero = 0, written;
+ int i, zero = 0, written;
u64 output = 0; /* has to be u64, otherwise it won't pass the verifier */
unsigned int nr, *beauty_map;
struct beauty_payload_enter *payload;
- void *payload_offset;
/* fall back to do predefined tail call */
if (args == NULL)
@@ -513,7 +521,6 @@ static int augment_sys_enter(void *ctx,
/* set up payload for output */
payload = bpf_map_lookup_elem(&beauty_payload_enter_map, &zero);
- payload_offset = (void *)&payload->aug_args;
if (beauty_map == NULL || payload == NULL)
return 1;
@@ -521,14 +528,30 @@ static int augment_sys_enter(void *ctx,
/* copy the sys_enter header, which has the syscall_nr */
__builtin_memcpy(&payload->args, args, sizeof(struct syscall_enter_args));
- for (int i = 0; i < 6; i++) {
- written = augment_arg(args, i, beauty_map, (struct augmented_arg *)payload_offset);
- if (written < 0)
- return 1;
- if (written > 0) {
- output += written;
- payload_offset += written;
- do_output = true;
+ if (bpf_ksym_exists(bpf_iter_num_new)) {
+ bpf_for(i, 0, 6) {
+ written = augment_arg(args, i, beauty_map, payload, output);
+ if (written < 0)
+ return 1;
+ if (written > 0) {
+ output += written;
+ /*
+ * guide the verifier to forget range of `output`, which
+ * helps to prove convergence of the loop
+ */
+ output += ZERO;
+ do_output = true;
+ }
+ }
+ } else {
+ for (i = 0; i < 6; i++) {
+ written = augment_arg(args, i, beauty_map, payload, output);
+ if (written < 0)
+ return 1;
+ if (written > 0) {
+ output += written;
+ do_output = true;
+ }
}
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0078/1376] perf hisi-ptt: Fix PTT trace TLP header parsing
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0077/1376] perf trace: Refactor augmented_raw_syscalls using bpf_for Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0079/1376] i2c: core: fix debugfs UAF on adapter removal Greg Kroah-Hartman
` (920 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, James Clark, Sizhe Liu, Namhyung Kim
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sizhe Liu <liusizhe5@huawei.com>
commit 2b8a2e5d424f0b3369054305d0bf6a5b9faee6c1 upstream.
TLP Headers traced by HiSilicon PCIe tune and trace device (PTT) in
4DW format are shown in the document as below:
bits [31:30] [ 29:25 ][24][23][22][21][ 20:11 ][ 10:0 ]
|-----|---------|---|---|---|---|-------------|-------------|
DW0 [ Fmt ][ Type ][T9][T8][TH][SO][ Length ][ Time ]
DW1 [ Header DW1 ]
DW2 [ Header DW2 ]
DW3 [ Header DW3 ]
Problem:
The DW0 bit field layout of the hisi_ptt_4dw union does not match the
actual bit ordering in little-endian memory, causing incorrect field
decoding.
Test on Kunpeng 930 SOC, generating data flow with `iperf` commands:
- server side:
iperf -s
- client side:
iperf -c $ip_addr -t 30
Trace the TLP headers with hisi_ptt on server side at the same time:
perf record -e hisi_ptt12_0/type=4,filter=0x05101,direction=2,format=0/ \
--max-size 50M -o perf.data &
The trace aims to capture completion TLPs, learn more in the document:
https://docs.kernel.org/trace/hisi-ptt.html
Decode perf.data with hisi_ptt decoder:
perf report -D
The hisi_ptt decoder produces the following result:
[...perf headers and other information]
. ... HISI PTT data: size 8388608 bytes
. 00000000: 68 87 20 94 Format 3 Type 1a T9 0 T8 1 TH 1 SO 1 Length 10 Time 4a1
. 00000004: 40 00 00 00 Header DW1
. 00000008: 40 00 01 51 Header DW2
. 0000000c: 00 00 00 00 Header DW3
[...other hisi_ptt TLP headers]
According to PCIe r5.0 sec 2.2.1, the Fmt & Type of Cpl/CplD is supposed
to be 8b'00001010' / 8b'01001010'
However, the Format & Type decoder analyzing result is 8b'01111010'.
It does not match field encodings of any TLP.
Correct decoder result should be:
[...perf headers and other information]
. ... HISI PTT data: size 8388608 bytes
. 00000000: 94 20 87 68 Format 2 Type a T9 0 T8 0 TH 0 SO 1 Length 10 Time 768
. 00000004: 00 00 00 40 Header DW1
. 00000008: 51 01 00 40 Header DW2
. 0000000c: 00 00 00 00 Header DW3
[...other hisi_ptt TLP headers]
To solve the problem:
1. Drop the union and C bitfield struct, store the raw DW value in
a plain uint32_t, and extract the fields with FIELD_GET() against
GENMASK/BIT masks declared in the header so they can be reused by
other translation units. The masks are portable across endianness and
compilers.
2. Print all DW hex values in big-endian byte order for readability,
matching the bit field layout shown in the 4DW format diagram.
3. Read the DW value with get_unaligned_le32() instead of an unaligned
pointer cast, avoiding both strict-aliasing violations and
alignment hazards on hosts that do not support unaligned access.
Cc: stable@vger.kernel.org
Fixes: 5e91e57e6809 ("perf auxtrace arm64: Add support for parsing HiSilicon PCIe Trace packet")
Reviewed-by: James Clark <james.clark@linaro.org>
Signed-off-by: Sizhe Liu <liusizhe5@huawei.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/trace/hisi-ptt.rst | 28 ++++-----
tools/perf/util/hisi-ptt-decoder/hisi-ptt-pkt-decoder.c | 47 ++++++++--------
tools/perf/util/hisi-ptt-decoder/hisi-ptt-pkt-decoder.h | 12 ++++
3 files changed, 50 insertions(+), 37 deletions(-)
--- a/Documentation/trace/hisi-ptt.rst
+++ b/Documentation/trace/hisi-ptt.rst
@@ -285,20 +285,20 @@ according to the format described previo
[...perf headers and other information]
. ... HISI PTT data: size 4194304 bytes
. 00000000: 00 00 00 00 Prefix
- . 00000004: 01 00 00 60 Header DW0
- . 00000008: 0f 1e 00 01 Header DW1
- . 0000000c: 04 00 00 00 Header DW2
- . 00000010: 40 00 81 02 Header DW3
- . 00000014: 33 c0 04 00 Time
+ . 00000004: 60 00 00 01 Header DW0
+ . 00000008: 01 00 1e 0f Header DW1
+ . 0000000c: 00 00 00 04 Header DW2
+ . 00000010: 02 81 00 40 Header DW3
+ . 00000014: 00 04 c0 33 Time
. 00000020: 00 00 00 00 Prefix
- . 00000024: 01 00 00 60 Header DW0
- . 00000028: 0f 1e 00 01 Header DW1
- . 0000002c: 04 00 00 00 Header DW2
- . 00000030: 40 00 81 02 Header DW3
- . 00000034: 02 00 00 00 Time
+ . 00000024: 60 00 00 01 Header DW0
+ . 00000028: 01 00 1e 0f Header DW1
+ . 0000002c: 00 00 00 04 Header DW2
+ . 00000030: 02 81 00 40 Header DW3
+ . 00000034: 00 00 00 02 Time
. 00000040: 00 00 00 00 Prefix
- . 00000044: 01 00 00 60 Header DW0
- . 00000048: 0f 1e 00 01 Header DW1
- . 0000004c: 04 00 00 00 Header DW2
- . 00000050: 40 00 81 02 Header DW3
+ . 00000044: 60 00 00 01 Header DW0
+ . 00000048: 01 00 1e 0f Header DW1
+ . 0000004c: 00 00 00 04 Header DW2
+ . 00000050: 02 81 00 40 Header DW3
[...]
--- a/tools/perf/util/hisi-ptt-decoder/hisi-ptt-pkt-decoder.c
+++ b/tools/perf/util/hisi-ptt-decoder/hisi-ptt-pkt-decoder.c
@@ -10,6 +10,8 @@
#include <endian.h>
#include <byteswap.h>
#include <linux/bitops.h>
+#include <linux/kernel.h>
+#include <linux/unaligned.h>
#include <stdarg.h>
#include "../color.h"
@@ -73,29 +75,20 @@ static const char * const hisi_ptt_4dw_p
[HISI_PTT_4DW_HEAD3] = "Header DW3",
};
-union hisi_ptt_4dw {
- struct {
- uint32_t format : 2;
- uint32_t type : 5;
- uint32_t t9 : 1;
- uint32_t t8 : 1;
- uint32_t th : 1;
- uint32_t so : 1;
- uint32_t len : 10;
- uint32_t time : 11;
- };
- uint32_t value;
-};
-
static void hisi_ptt_print_pkt(const unsigned char *buf, int pos, const char *desc)
{
const char *color = PERF_COLOR_BLUE;
+ uint8_t byte;
+ uint32_t dw;
int i;
+ dw = get_unaligned_le32(buf + pos);
printf(".");
color_fprintf(stdout, color, " %08x: ", pos);
- for (i = 0; i < HISI_PTT_FIELD_LENTH; i++)
- color_fprintf(stdout, color, "%02x ", buf[pos + i]);
+ for (i = 0; i < HISI_PTT_FIELD_LENTH; i++) {
+ byte = (dw >> (24 - i * 8)) & 0xFF;
+ color_fprintf(stdout, color, "%02x ", byte);
+ }
for (i = 0; i < HISI_PTT_MAX_SPACE_LEN; i++)
color_fprintf(stdout, color, " ");
color_fprintf(stdout, color, " %s\n", desc);
@@ -122,22 +115,30 @@ static int hisi_ptt_8dw_kpt_desc(const u
static void hisi_ptt_4dw_print_dw0(const unsigned char *buf, int pos)
{
const char *color = PERF_COLOR_BLUE;
- union hisi_ptt_4dw dw0;
+ uint8_t byte;
+ uint32_t dw;
int i;
- dw0.value = *(uint32_t *)(buf + pos);
+ dw = get_unaligned_le32(buf + pos);
printf(".");
color_fprintf(stdout, color, " %08x: ", pos);
- for (i = 0; i < HISI_PTT_FIELD_LENTH; i++)
- color_fprintf(stdout, color, "%02x ", buf[pos + i]);
+ for (i = 0; i < HISI_PTT_FIELD_LENTH; i++) {
+ byte = (dw >> (24 - i * 8)) & 0xFF;
+ color_fprintf(stdout, color, "%02x ", byte);
+ }
for (i = 0; i < HISI_PTT_MAX_SPACE_LEN; i++)
color_fprintf(stdout, color, " ");
color_fprintf(stdout, color,
" %s %x %s %x %s %x %s %x %s %x %s %x %s %x %s %x\n",
- "Format", dw0.format, "Type", dw0.type, "T9", dw0.t9,
- "T8", dw0.t8, "TH", dw0.th, "SO", dw0.so, "Length",
- dw0.len, "Time", dw0.time);
+ "Format", FIELD_GET(HISI_PTT_HEAD0_4DW_FORMAT, dw),
+ "Type", FIELD_GET(HISI_PTT_HEAD0_4DW_TYPE, dw),
+ "T9", FIELD_GET(HISI_PTT_HEAD0_4DW_T9, dw),
+ "T8", FIELD_GET(HISI_PTT_HEAD0_4DW_T8, dw),
+ "TH", FIELD_GET(HISI_PTT_HEAD0_4DW_TH, dw),
+ "SO", FIELD_GET(HISI_PTT_HEAD0_4DW_SO, dw),
+ "Length", FIELD_GET(HISI_PTT_HEAD0_4DW_LEN, dw),
+ "Time", FIELD_GET(HISI_PTT_HEAD0_4DW_TIME, dw));
}
static int hisi_ptt_4dw_kpt_desc(const unsigned char *buf, int pos)
--- a/tools/perf/util/hisi-ptt-decoder/hisi-ptt-pkt-decoder.h
+++ b/tools/perf/util/hisi-ptt-decoder/hisi-ptt-pkt-decoder.h
@@ -9,12 +9,24 @@
#include <stddef.h>
#include <stdint.h>
+#include <linux/bits.h>
+#include <linux/bitfield.h>
#define HISI_PTT_8DW_CHECK_MASK GENMASK(31, 11)
#define HISI_PTT_IS_8DW_PKT GENMASK(31, 11)
#define HISI_PTT_MAX_SPACE_LEN 10
#define HISI_PTT_FIELD_LENTH 4
+/* Header DW0 fields for 4DW format */
+#define HISI_PTT_HEAD0_4DW_TIME GENMASK_U32(10, 0)
+#define HISI_PTT_HEAD0_4DW_LEN GENMASK_U32(20, 11)
+#define HISI_PTT_HEAD0_4DW_SO BIT_U32(21)
+#define HISI_PTT_HEAD0_4DW_TH BIT_U32(22)
+#define HISI_PTT_HEAD0_4DW_T8 BIT_U32(23)
+#define HISI_PTT_HEAD0_4DW_T9 BIT_U32(24)
+#define HISI_PTT_HEAD0_4DW_TYPE GENMASK_U32(29, 25)
+#define HISI_PTT_HEAD0_4DW_FORMAT GENMASK_U32(31, 30)
+
enum hisi_ptt_pkt_type {
HISI_PTT_4DW_PKT,
HISI_PTT_8DW_PKT,
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0079/1376] i2c: core: fix debugfs UAF on adapter removal
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0078/1376] perf hisi-ptt: Fix PTT trace TLP header parsing Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0080/1376] i2c: mux: Fix channel node leak on adapter add failure Greg Kroah-Hartman
` (919 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+23ad911c819b923238b7,
Vasileios Almpanis, Andi Shyti
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasileios Almpanis <vasilisalmpanis@gmail.com>
commit b15b548d52b43ba8ac4652bc2c7244a8dd1e9622 upstream.
i2c_del_adapter() frees the adapter's debugfs directory before it
unregisters the adapter device, but the new_device sysfs attribute
stays writable until device_del(). A write racing with removal still
reaches i2c_device_probe(), which passes the freed adap->debugfs to
debugfs_create_dir() as the new client's parent:
BUG: KASAN: slab-use-after-free in lookup_noperm_common+0x407/0x430
Read of size 4 at addr ffff88803ef87810 by task syz.0.61/6090
lookup_noperm_common+0x407/0x430
simple_start_creating+0x9c/0x110
debugfs_start_creating+0xdb/0x1a0
debugfs_create_dir+0x24/0x350
i2c_device_probe+0x814/0xbf0
It's technically possible to create a client after i2c_deregister_clients
has run. That client will never be unregistered and make
wait_for_completion hang.
Close the window by removing the new_device attribute at the start of
i2c_del_adapter(). device_remove_file() will drain any clients left.
Fixes: 73febd775bdb ("i2c: create debugfs entry per adapter")
Reported-by: syzbot+23ad911c819b923238b7@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=23ad911c819b923238b7
Signed-off-by: Vasileios Almpanis <vasilisalmpanis@gmail.com>
Cc: <stable@vger.kernel.org> # v6.8+
Tested-by: syzbot+23ad911c819b923238b7@syzkaller.appspotmail.com
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://patch.msgid.link/20260812-i2c-v2-1-5efaab4c3334@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/i2c-core-base.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -1805,6 +1805,12 @@ void i2c_del_adapter(struct i2c_adapter
return;
}
+ /*
+ * This drains any in-flight writers, so all
+ * clients will be caught by i2c_deregister_clients().
+ */
+ device_remove_file(&adap->dev, &dev_attr_new_device);
+
i2c_acpi_remove_space_handler(adap);
i2c_deregister_clients(adap);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0080/1376] i2c: mux: Fix channel node leak on adapter add failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0079/1376] i2c: core: fix debugfs UAF on adapter removal Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0081/1376] arm64: mm: Fix the lockless page-table walk in show_pte() Greg Kroah-Hartman
` (918 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ahmad Byagowi, Peter Rosin,
Andi Shyti
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahmad Byagowi <ahmadexp@gmail.com>
commit 385c7af4e3b95d0769fd211831674e83b16a2ebf upstream.
i2c_mux_add_adapter() takes a reference to the Device Tree channel node
before registering the new adapter. If adapter registration fails, the
error path frees the private data without dropping that reference.
Release the channel node before freeing the private data.
Fixes: bc45449b1444 ("i2c/of: Automatically populate i2c mux busses from device tree data.")
Signed-off-by: Ahmad Byagowi <ahmadexp@gmail.com>
Cc: <stable@vger.kernel.org> # v3.5+
Acked-by: Peter Rosin <peda@lysator.liu.se>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://patch.msgid.link/b3e46bbee781b3cb4029aca9a71316cc5e36dc17.1787502619.git.ahmadexp@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/i2c-mux.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/i2c/i2c-mux.c
+++ b/drivers/i2c/i2c-mux.c
@@ -411,6 +411,7 @@ int i2c_mux_add_adapter(struct i2c_mux_c
return 0;
err_free_priv:
+ of_node_put(priv->adap.dev.of_node);
kfree(priv);
return ret;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0081/1376] arm64: mm: Fix the lockless page-table walk in show_pte()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0080/1376] i2c: mux: Fix channel node leak on adapter add failure Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0082/1376] ALSA: rawmidi: Return the error from snd_rawmidi_input_params() Greg Kroah-Hartman
` (917 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Will Deacon
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
commit a77644d009dece1104b6fcc6e322b0e4503db0d6 upstream.
show_pte() walks page tables locklessly and can run with interrupts
enabled. A concurrent teardown can free a table page while it is being
walked. It can also clear a parent entry after show_pte() checked it; the
regular pXd_offset() helpers then reread the cleared entry and can derive a
bogus lower-level pointer and fault again.
Use the lockless offset helpers with the saved parent entries, as
gup_fast() does, and pass the saved PMD to pte_offset_map().
For task page tables, arm64 selects MMU_GATHER_RCU_TABLE_FREE. Disable
local interrupts around the walk to hold off RCU-deferred table frees and
block the tlb_remove_table_sync_one() IPI until the walk is finished.
Place the IRQ guard after the header print. This does not make the output a
consistent snapshot, but prevents the task page-table walk from
dereferencing a released table page or deriving a pointer from a different
parent value.
Fixes: 1d18c47c735e ("arm64: MMU fault handling and page table management")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/mm/fault.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -15,6 +15,7 @@
#include <linux/mm.h>
#include <linux/hardirq.h>
#include <linux/init.h>
+#include <linux/irqflags.h>
#include <linux/kasan.h>
#include <linux/kprobes.h>
#include <linux/uaccess.h>
@@ -151,6 +152,9 @@ static void show_pte(unsigned long addr)
pr_alert("%s pgtable: %luk pages, %llu-bit VAs, pgdp=%016lx\n",
mm == &init_mm ? "swapper" : "user", PAGE_SIZE / SZ_1K,
vabits_actual, mm_to_pgd_phys(mm));
+
+ guard(irqsave)();
+
pgdp = pgd_offset(mm, addr);
pgd = READ_ONCE(*pgdp);
pr_alert("[%016lx] pgd=%016llx", addr, pgd_val(pgd));
@@ -164,25 +168,25 @@ static void show_pte(unsigned long addr)
if (pgd_none(pgd) || pgd_bad(pgd))
break;
- p4dp = p4d_offset(pgdp, addr);
+ p4dp = p4d_offset_lockless(pgdp, pgd, addr);
p4d = READ_ONCE(*p4dp);
pr_cont(", p4d=%016llx", p4d_val(p4d));
if (p4d_none(p4d) || p4d_bad(p4d))
break;
- pudp = pud_offset(p4dp, addr);
+ pudp = pud_offset_lockless(p4dp, p4d, addr);
pud = READ_ONCE(*pudp);
pr_cont(", pud=%016llx", pud_val(pud));
if (pud_none(pud) || pud_bad(pud))
break;
- pmdp = pmd_offset(pudp, addr);
+ pmdp = pmd_offset_lockless(pudp, pud, addr);
pmd = READ_ONCE(*pmdp);
pr_cont(", pmd=%016llx", pmd_val(pmd));
if (pmd_none(pmd) || pmd_bad(pmd))
break;
- ptep = pte_offset_map(pmdp, addr);
+ ptep = pte_offset_map(&pmd, addr);
if (!ptep)
break;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0082/1376] ALSA: rawmidi: Return the error from snd_rawmidi_input_params()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0081/1376] arm64: mm: Fix the lockless page-table walk in show_pte() Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0083/1376] ALSA: harmony: initialize locks before requesting IRQ Greg Kroah-Hartman
` (916 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, HyeongJun An, Takashi Iwai
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: HyeongJun An <sammiee5311@gmail.com>
commit f4a23e17d84fd2a152d9e12369761934e1af0ee8 upstream.
The snd_rawmidi_input_params() computes err for the three invalid mode
combinations and for resize_runtime_buffer(), applies the new framing
and clock type only when err is zero, and then returns 0 anyway. A
caller that asked for parameters the kernel rejected is told the change
succeeded, and the substream keeps its old buffer.
The open_mutex conversion turned the early returns into assignments.
It handled the output sibling correctly, which still returns err, and
left this one behind.
Fixes: 94b98194b62e ("ALSA: rawmidi: Take open_mutex around parameter changes")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Link: https://patch.msgid.link/20260902125058.19499-1-sammiee5311@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/rawmidi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -779,7 +779,7 @@ int snd_rawmidi_input_params(struct snd_
substream->framing = framing;
substream->clock_type = clock_type;
}
- return 0;
+ return err;
}
EXPORT_SYMBOL(snd_rawmidi_input_params);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0083/1376] ALSA: harmony: initialize locks before requesting IRQ
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0082/1376] ALSA: rawmidi: Return the error from snd_rawmidi_input_params() Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0084/1376] ALSA: pcm: Fix race between non-atomic ops and trigger-start Greg Kroah-Hartman
` (915 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Takashi Iwai
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
commit 33abb7491e89285a41565670945293dda841afc4 upstream.
snd_harmony_create() registers the IRQ before initializing h->lock and
h->mixer_lock. A pending interrupt can invoke the handler while these
locks are uninitialized.
Initialize both locks before requesting the IRQ so the handler always
sees valid lock state.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Link: https://patch.msgid.link/20260830063411.2215691-1-runyu.xiao@seu.edu.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/parisc/harmony.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/sound/parisc/harmony.c
+++ b/sound/parisc/harmony.c
@@ -889,6 +889,9 @@ snd_harmony_create(struct snd_card *card
goto free_and_ret;
}
+ spin_lock_init(&h->mixer_lock);
+ spin_lock_init(&h->lock);
+
err = request_irq(padev->irq, snd_harmony_interrupt, 0,
"harmony", h);
if (err) {
@@ -898,9 +901,6 @@ snd_harmony_create(struct snd_card *card
}
h->irq = padev->irq;
- spin_lock_init(&h->mixer_lock);
- spin_lock_init(&h->lock);
-
err = snd_device_new(card, SNDRV_DEV_LOWLEVEL, h, &ops);
if (err < 0)
goto free_and_ret;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0084/1376] ALSA: pcm: Fix race between non-atomic ops and trigger-start
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0083/1376] ALSA: harmony: initialize locks before requesting IRQ Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0085/1376] nvme-fabrics: fix DHCHAP secret leak on parse failure Greg Kroah-Hartman
` (914 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+225231fce6755d40d078,
Takashi Iwai
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit acac7b5e07349a9d10d78873afb4b93cd1dc721f upstream.
We protect the races of the concurrent state transitions between
atomic PCM ops, but the checks between the non-atomic ops (hw_params,
hw_free and prepare) and the atomic ops aren't perfect; there is a
check of the conflicting PCM state at the beginning of hw_params & co,
but the atomic PCM ops can be still issued during the non-atomic PCM
operations. An example such scenario is that a thread A re-issues the
PREPARE or HW_PARAMS for the already prepared stream, while another
thread B triggers the PCM start in the middle of the prepare
operation. Although this usually doesn't lead to much serious issues,
it can give some inconsistency as reported by syzkaller (such as
ODEBUG warning).
There are various atomic PCM ops, and basically the only problem is
the PCM start as it operates from the PREPARED state. Other trigger
commands (stop, etc) are for the running or the other special state,
hence they are filtered as pre-condition.
This patch is for preventing the PCM trigger-start during the non-
atomic operations in order to address the problems above.
Fortunately, the hw_params, hw_free and prepare operations call
snd_pcm_buffer_access_lock(), and this can be used for checking the
concurrent operations at the PCM trigger -- which sets the
runtime->buffer_accessing to a negative (if possible), so the PCM
trigger just needs to check the runtime->buffer_accessing value; if
it's negative, it means the concurrent non-atomic PCM ops is running.
Reported-by: syzbot+225231fce6755d40d078@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/6a8f0de8.1d9ded08.62e62.00b5.GAE@google.com
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20260828115542.3999-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/pcm_native.c | 2 ++
1 file changed, 2 insertions(+)
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -1441,6 +1441,8 @@ static int snd_pcm_pre_start(struct snd_
struct snd_pcm_runtime *runtime = substream->runtime;
if (runtime->state != SNDRV_PCM_STATE_PREPARED)
return -EBADFD;
+ if (atomic_read(&runtime->buffer_accessing) < 0)
+ return -EBADFD; /* during hw_params, hw_free or prepare */
if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK &&
!snd_pcm_playback_data(substream))
return -EPIPE;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0085/1376] nvme-fabrics: fix DHCHAP secret leak on parse failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0084/1376] ALSA: pcm: Fix race between non-atomic ops and trigger-start Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0086/1376] nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails Greg Kroah-Hartman
` (913 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Xu Rao,
Keith Busch
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Rao <raoxu@uniontech.com>
commit afdee49a1b88ed9bb44e2b30e855297c169bcc53 upstream.
nvmf_parse_options() duplicates dhchap_secret and dhchap_ctrl_secret
with match_strdup() before validating the DHHC-1: representation.
If validation fails, the parser returns -EINVAL before the temporary
string in p is assigned to opts->dhchap_secret or
opts->dhchap_ctrl_secret. nvmf_create_ctrl() subsequently frees opts,
but nvmf_free_options() cannot release the unassigned temporary string.
Each rejected option therefore leaks one allocation.
This is easy to miss because valid secrets transfer ownership to opts
and are freed normally, while the malformed-secret path still returns
the expected -EINVAL to userspace.
With CONFIG_NVME_HOST_AUTH enabled, the leak is reachable before the
required-option checks and transport lookup. No NVMe-oF target or
working transport connection is required; for example, repeatedly
writing
dhchap_secret=BAD
or
dhchap_ctrl_secret=BAD
to /dev/nvme-fabrics deterministically takes the leaking parse path.
Free the temporary string before leaving both validation error paths.
Use kfree_sensitive() because the copied option may contain secret
material even when its representation is rejected, matching the
sensitive cleanup used for stored DHCHAP secrets.
Fixes: f50fff73d620 ("nvme: implement In-Band authentication")
Cc: stable@vger.kernel.org
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/host/fabrics.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/nvme/host/fabrics.c
+++ b/drivers/nvme/host/fabrics.c
@@ -1025,6 +1025,7 @@ static int nvmf_parse_options(struct nvm
}
if (strlen(p) < 11 || strncmp(p, "DHHC-1:", 7)) {
pr_err("Invalid DH-CHAP secret %s\n", p);
+ kfree_sensitive(p);
ret = -EINVAL;
goto out;
}
@@ -1039,6 +1040,7 @@ static int nvmf_parse_options(struct nvm
}
if (strlen(p) < 11 || strncmp(p, "DHHC-1:", 7)) {
pr_err("Invalid DH-CHAP secret %s\n", p);
+ kfree_sensitive(p);
ret = -EINVAL;
goto out;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0086/1376] nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0085/1376] nvme-fabrics: fix DHCHAP secret leak on parse failure Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0087/1376] nvme-tcp: check the data direction of a C2HData PDU Greg Kroah-Hartman
` (912 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+f58e57380a6083c4041d,
Niklas Cassel, Rihyeon Kim, Hannes Reinecke, Keith Busch
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <cassel@kernel.org>
commit 56e6279266f6962bb2d38a54397e3c605165b0c5 upstream.
nvmf_create_ctrl() owns the fabrics options and frees them whenever
->create_ctrl() returns an error, so a transport must not free them on
its own error paths. nvme-fc tracks this by testing ctrl->ctrl.opts in
nvme_fc_ctrl_free(), which requires nvme_fc_init_ctrl() to clear that
pointer on every error exit.
The coupling is implicit, and commit 1a9e218195a5 ("nvme: split device
add from initialization") broke it by adding a second error exit. When
nvme_add_ctrl() fails, nvme_fc_init_ctrl() jumps to out_put_ctrl:, past
the "ctrl->ctrl.opts = NULL" that only sits on the fail_ctrl: path, so
nvme_fc_ctrl_free() frees the options and nvmf_create_ctrl() frees them
a second time:
BUG: KASAN: slab-use-after-free in nvmf_free_options+0x30/0x190
nvmf_free_options+0x30/0x190 drivers/nvme/host/fabrics.c:1284
nvmf_create_ctrl drivers/nvme/host/fabrics.c:1374 [inline]
Freed by task 5534:
nvme_fc_ctrl_free drivers/nvme/host/fc.c:2374 [inline]
nvme_fc_init_ctrl+0xe17/0x1450 drivers/nvme/host/fc.c:3605
nvme_add_ctrl() fails when dev_set_name() cannot allocate, so this is
reachable under memory pressure or fault injection. Without KASAN the
options are freed twice.
Rather than clear the pointer on the second exit as well, derive
ownership the way nvme-tcp, nvme-rdma and nvme-loop do, from list
membership: their free_ctrl leaves the options alone unless the
controller made it onto the transport list.
The list cannot simply be populated on the success path as it is there.
nvme-fc runs the initial connect synchronously via flush_delayed_work(),
and the controller has to be reachable on rport->ctrl_list for the whole
of it: nvme_fc_unregister_remoteport() needs to find it to signal
connectivity loss, nvme_fc_match_disconn_ls() matches an incoming
Disconnect Association LS against ctrl->association_id, which is only
assigned during that window, nvme_fc_resume_controller() needs it on
remoteport re-registration, and nvme_fc_existing_controller() uses it to
reject a duplicate connect racing the one in flight.
Keep the insertion where it is and add a fail_unlist: label, falling
into fail_ctrl:, for the error paths that run after it. The earlier
error paths never reach the insertion and keep using fail_ctrl:
directly, so the list is only touched where the controller is actually
on it.
nvme_fc_ctrl_free() cannot use the plain "goto free_ctrl" the other
transports use, because it still has to put_device(), release the rport
reference and free the ida entry for resources taken before the
insertion. Sample list_empty() under rport->lock instead.
ctrl->ctrl.opts also stays valid for the whole teardown now. That is
not the bug being fixed, but it removes some fragility around the old
idiom: nvme_free_ctrl() calls nvme_auth_free() before ->free_ctrl(), and
ctrl_max_dhchaps() dereferences ctrl->opts without a NULL check when
ctrl->dhchap_ctxs is set, which nvme-fc permits since NVMF_ALLOWED_OPTS
allows the dhchap options. The nvme sysfs attributes that dereference
ctrl->opts, such as hostnqn and address, evaluate their is_visible()
test once at device_add() time and stay readable until
cdev_device_del().
Fixes: 1a9e218195a5 ("nvme: split device add from initialization")
Cc: stable@vger.kernel.org
Reported-by: syzbot+f58e57380a6083c4041d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f58e57380a6083c4041d
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Tested-by: Rihyeon Kim <rihyeon8648@gmail.com>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/host/fc.c | 26 ++++++++++++++++++++------
1 file changed, 20 insertions(+), 6 deletions(-)
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -2350,9 +2350,15 @@ nvme_fc_ctrl_free(struct kref *ref)
struct nvme_fc_ctrl *ctrl =
container_of(ref, struct nvme_fc_ctrl, ref);
unsigned long flags;
+ bool owns_opts;
- /* remove from rport list */
+ /*
+ * Presence on the rport list means nvme_fc_init_ctrl() completed,
+ * and with it ownership of the fabrics options passed to it. If it
+ * failed instead, the options still belong to nvmf_create_ctrl().
+ */
spin_lock_irqsave(&ctrl->rport->lock, flags);
+ owns_opts = !list_empty(&ctrl->ctrl_list);
list_del(&ctrl->ctrl_list);
spin_unlock_irqrestore(&ctrl->rport->lock, flags);
@@ -2362,7 +2368,7 @@ nvme_fc_ctrl_free(struct kref *ref)
nvme_fc_rport_put(ctrl->rport);
ida_free(&nvme_fc_ctrl_cnt, ctrl->cnum);
- if (ctrl->ctrl.opts)
+ if (owns_opts)
nvmf_free_options(ctrl->ctrl.opts);
kfree(ctrl);
}
@@ -3552,14 +3558,14 @@ nvme_fc_init_ctrl(struct device *dev, st
if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) {
dev_err(ctrl->ctrl.device,
"NVME-FC{%d}: failed to init ctrl state\n", ctrl->cnum);
- goto fail_ctrl;
+ goto fail_unlist;
}
if (!queue_delayed_work(nvme_wq, &ctrl->connect_work, 0)) {
dev_err(ctrl->ctrl.device,
"NVME-FC{%d}: failed to schedule initial connect\n",
ctrl->cnum);
- goto fail_ctrl;
+ goto fail_unlist;
}
flush_delayed_work(&ctrl->connect_work);
@@ -3570,14 +3576,22 @@ nvme_fc_init_ctrl(struct device *dev, st
return &ctrl->ctrl;
+fail_unlist:
+ /*
+ * Leaving the list hands the options back to nvmf_create_ctrl();
+ * see nvme_fc_ctrl_free(). Re-init so that list_empty() there
+ * reports the controller as unlisted.
+ */
+ spin_lock_irqsave(&rport->lock, flags);
+ list_del_init(&ctrl->ctrl_list);
+ spin_unlock_irqrestore(&rport->lock, flags);
+
fail_ctrl:
nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_DELETING);
cancel_work_sync(&ctrl->ioerr_work);
cancel_work_sync(&ctrl->ctrl.reset_work);
cancel_delayed_work_sync(&ctrl->connect_work);
- ctrl->ctrl.opts = NULL;
-
if (ctrl->ctrl.admin_tagset)
nvme_remove_admin_tag_set(&ctrl->ctrl);
/* initiate nvme ctrl ref counting teardown */
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0087/1376] nvme-tcp: check the data direction of a C2HData PDU
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0086/1376] nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0088/1376] nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU Greg Kroah-Hartman
` (911 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Yehyeong Lee,
Keith Busch
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
commit f83af377c148f6ad94b41c0e8313f12adf45e1c1 upstream.
nvme_tcp_handle_c2h_data() finds the request by command id and checks
that it has a payload, but it does not check that the command asked for
data to be read. A controller that answers a write command with C2HData
therefore reaches nvme_tcp_recv_data(), where _copy_to_iter() hits
WARN_ON_ONCE(i->data_source) and returns 0. The receive path turns that
into -EFAULT and resets the controller.
No data is copied, so this is not memory corruption. What a controller
gets is a kernel warning it can raise at will, which is fatal on a host
booted with panic_on_warn.
The send path already knows the direction - it consults rq_data_dir()
when it builds a command - and nvme_tcp_handle_r2t() checks the length
and the offset of the request it names. The C2HData path does not check
the direction at all.
Reject a C2HData PDU whose command is not a read. Rejecting it fails
the command and resets the controller, as the neighbouring check in this
function does; what goes away is the warning.
[ 6.885580] ------------[ cut here ]------------
[ 6.886457] WARNING: lib/iov_iter.c:193 at _copy_to_iter+0x289/0x1330, CPU#0: kworker/0:1H/71
[ 6.888137] CPU: 0 UID: 0 PID: 71 Comm: kworker/0:1H Not tainted 7.2.0-rc5-NVMETCP-gf5098b6bae76 #1 PREEMPT(lazy)
[ 6.891165] Workqueue: nvme_tcp_wq nvme_tcp_io_work
[ 6.891875] RIP: 0010:_copy_to_iter+0x289/0x1330
[ 6.903739] Call Trace:
[ 6.904085] <TASK>
[ 6.909254] __skb_datagram_iter+0x433/0x820
[ 6.911026] skb_copy_datagram_iter+0x37/0x120
[ 6.911622] nvme_tcp_recv_skb+0xa07/0x4320
[ 6.913378] __tcp_read_sock+0x1ab/0x810
[ 6.915788] nvme_tcp_try_recv+0x152/0x1e0
[ 6.918222] nvme_tcp_io_work+0x1e4/0x6c0
[ 6.926906] </TASK>
[ 6.927226] ---[ end trace 0000000000000000 ]---
[ 6.927878] nvme nvme0: queue 1 failed to copy request 0x71 data
[ 6.928709] nvme nvme0: receive failed: -14
Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver")
Cc: stable@vger.kernel.org
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/host/tcp.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -684,6 +684,13 @@ static int nvme_tcp_handle_c2h_data(stru
return -ENOENT;
}
+ if (rq_data_dir(rq) != READ) {
+ dev_err(queue->ctrl->ctrl.device,
+ "queue %d tag %#x unexpected data for a write\n",
+ nvme_tcp_queue_id(queue), rq->tag);
+ return -EIO;
+ }
+
req = blk_mq_rq_to_pdu(rq);
if (!blk_rq_payload_bytes(rq) || !req->curr_bio || !req->data_len) {
dev_err(queue->ctrl->ctrl.device,
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0088/1376] nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0087/1376] nvme-tcp: check the data direction of a C2HData PDU Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0089/1376] nvmet-tcp: reject unsolicited H2CData PDUs Greg Kroah-Hartman
` (910 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shivam Kumar, Sagi Grimberg,
Keith Busch
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shivam Kumar <kumar.shivam43666@gmail.com>
commit 14cc5a7e77731497d5bea70f3bb05df7eda982e4 upstream.
nvmet_tcp_try_recv_pdu() reads a PDU header into the fixed 128-byte
queue->pdu union, then computes the remaining payload length as
queue->left = hdr->hlen - queue->offset + hdgst;
and reads that many more bytes into &queue->pdu + queue->offset, without
ever bounding the result against sizeof(queue->pdu).
A struct nvme_tcp_icreq_pdu is itself 128 bytes, exactly the size of the
union. Once a header digest has been negotiated (hdgst = 4), a second
ICReq passes the hlen == nvmet_tcp_pdu_size() check but yields
queue->left = 128 - 8 + 4 = 124, so bytes 8..132 are written into the
128-byte buffer -- 4 bytes past its end, over queue->hdr_digest and
queue->data_digest. Those bytes are attacker-controlled (an ICReq
carries no digest), and the duplicate ICReq is only rejected later,
after the overflow. A remote unauthenticated host can thus corrupt
kernel memory adjacent to the receive buffer.
Reject any PDU whose declared length would read past the end of
queue->pdu before the second recv.
Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Shivam Kumar <kumar.shivam43666@gmail.com>
Cc: stable@vger.kernel.org
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/target/tcp.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/nvme/target/tcp.c
+++ b/drivers/nvme/target/tcp.c
@@ -1301,6 +1301,8 @@ recv:
}
queue->left = hdr->hlen - queue->offset + hdgst;
+ if (queue->left > sizeof(queue->pdu) - queue->offset)
+ return -EPROTO;
goto recv;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0089/1376] nvmet-tcp: reject unsolicited H2CData PDUs
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0088/1376] nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0090/1376] Revert "irqchip/mbigen: Fix mbigen node address layout" Greg Kroah-Hartman
` (909 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sagi Grimberg, Shivam Kumar,
Keith Busch
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shivam Kumar <kumar.shivam43666@gmail.com>
commit db62b35cbca052860c519cbcabe7650708528738 upstream.
nvmet_tcp_handle_h2c_data_pdu() accepts an H2CData PDU after only checking
that its TTAG is a valid in-range command index and that the command's
data buffers are mapped. It never checks that the target has actually
solicited that data by sending an R2T for the command.
A remote host can abuse this. It submits a write command that takes the
R2T path and, before the target transmits the R2T, sends an H2CData PDU
for that command's tag. The data completes the command early, and when
the command then fails synchronously (e.g. a length mismatch caught by
nvmet_check_transfer_len()), it is completed a second time. Each
completion calls nvmet_tcp_queue_response(), so the same command is added
to queue->resp_list twice while it is still linked; the second llist_add()
makes the node point to itself (lentry->next == lentry).
nvmet_tcp_process_resp_list() then walks that self-referential node and
adds the command to resp_send_list twice. With CONFIG_DEBUG_LIST this
trips the "list_add double add" check (kernel BUG); without it the loop
never terminates and the nvmet_tcp workqueue wedges (soft-lockup). It is
remotely triggerable and needs no authentication on an allow_any_host
subsystem.
Track whether an R2T has been transmitted for a command and reject an
H2CData PDU that arrives before it. The flag is cleared on command reuse
(nvmet_tcp_get_cmd() zeroes cmd->flags) and stays set across the multiple
H2CData PDUs of a single solicited transfer.
Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver")
Cc: stable@vger.kernel.org
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Shivam Kumar <kumar.shivam43666@gmail.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/target/tcp.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/nvme/target/tcp.c
+++ b/drivers/nvme/target/tcp.c
@@ -104,6 +104,7 @@ enum nvmet_tcp_recv_state {
enum {
NVMET_TCP_F_INIT_FAILED = (1 << 0),
+ NVMET_TCP_F_R2T_SENT = (1 << 1),
};
struct nvmet_tcp_cmd {
@@ -785,6 +786,7 @@ static int nvmet_try_send_r2t(struct nvm
return -EAGAIN;
cmd->queue->snd_cmd = NULL;
+ cmd->flags |= NVMET_TCP_F_R2T_SENT;
return 1;
}
@@ -1061,6 +1063,12 @@ static int nvmet_tcp_handle_h2c_data_pdu
cmd = &queue->connect;
}
+ if (unlikely(!(cmd->flags & NVMET_TCP_F_R2T_SENT))) {
+ pr_err("queue %d: unsolicited H2CData (ttag %u)\n",
+ queue->idx, data->ttag);
+ goto err_proto;
+ }
+
if (le32_to_cpu(data->data_offset) != cmd->rbytes_done) {
pr_err("ttag %u unexpected data offset %u (expected %u)\n",
data->ttag, le32_to_cpu(data->data_offset),
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0090/1376] Revert "irqchip/mbigen: Fix mbigen node address layout"
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0089/1376] nvmet-tcp: reject unsolicited H2CData PDUs Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0091/1376] mm/hugetlb: fix missing migratable flag on same-node hugetlb migration Greg Kroah-Hartman
` (908 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marc Zyngier, caina, Thomas Gleixner,
Yipeng Zou
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: caina <caina@uniontech.com>
commit e67091609cf85962f64391c1b0f93d4cbfcd4e22 upstream.
This reverts commit 6be6cba9c4371d27f78d900ccfe34bb880d9ee20.
Commit 6be6cba9c437 ("irqchip/mbigen: Fix mbigen node address layout")
appears to cause a regression on Hi1616.
On-board hns NIC has two ports, enahisic2i0 and enahisic2i1, both
behind mbigen-v2. Port 0 works; port 1 cannot pass any traffic.
Their interrupt pins fall on different mbigen nodes:
enahisic2i0: pins 1152-1198 -> all in node 9
enahisic2i1: pins 1200-1246 -> node 9 (1200-1215) + node 10 (1216-1246)
(nid = (hwirq - 64) / 128 + 1; pin 1215 = node 9, pin 1216 = node 10)
/proc/interrupts shows the break happens exactly at the node boundary:
enahisic2i1-rx0 pin 1200 count 102 <- node 9
enahisic2i1-rx5 pin 1215 count 1 <- node 9, last pin
enahisic2i1-tx5 pin 1216 count 0 <- node 10, first pin
enahisic2i1-rx6 pin 1218 count 0 <- node 10
...all node 10 pins stay at zero.
Port 0 (entirely node 9) is unaffected. Reverting the commit restores
normal operation.
The commit assumes CLEAR occupies a full 4 KB page at [0xa000, 0xb000)
and collides with node 10, so node 10+ gets shifted by 0x1000.
But get_mbigen_clear_reg() uses flat, chip-wide addressing -- it never
multiplies by the node ID:
*addr = (hwirq / 32) * 4 + REG_MBIGEN_CLEAR_OFFSET; /* 0xa000 */
Over the valid hwirq range [64, 1407], CLEAR only spans 0xa008-0xa0af
(168 bytes). Node 10's registers are:
TYPE: 0xa000-0xa00f (16 B) overlaps CLEAR by 8 B (0xa008-0xa00f)
VEC: 0xa200-0xa3ff (512 B) no overlap with CLEAR
Shifting the whole page moves VEC from 0xa200 to 0xb200. The hardware
reads the event ID from the fixed silicon address 0xa200 on interrupt
firing, but software wrote it to 0xb200 -- so the hardware gets an
uninitialised value and the interrupt is lost.
The only real overlap is 8 bytes of TYPE. It can only trigger when a
single mbigen instance has devices on both node 1 (CLEAR 0xa008) and
node 10 (TYPE 0xa008). On Hi1616 those nodes are on separate mbigen
instances, so it never triggers.
Fixes: 6be6cba9c4371d27f78d900ccfe34bb880d9ee20 ("irqchip/mbigen: Fix mbigen node address layout")
Suggested-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: caina <caina@uniontech.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Acked-by: Yipeng Zou <zouyipeng@huawei.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260821091720.16665-1-caina@uniontech.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/irqchip/irq-mbigen.c | 20 ++++----------------
1 file changed, 4 insertions(+), 16 deletions(-)
--- a/drivers/irqchip/irq-mbigen.c
+++ b/drivers/irqchip/irq-mbigen.c
@@ -64,20 +64,6 @@ struct mbigen_device {
void __iomem *base;
};
-static inline unsigned int get_mbigen_node_offset(unsigned int nid)
-{
- unsigned int offset = nid * MBIGEN_NODE_OFFSET;
-
- /*
- * To avoid touched clear register in unexpected way, we need to directly
- * skip clear register when access to more than 10 mbigen nodes.
- */
- if (nid >= (REG_MBIGEN_CLEAR_OFFSET / MBIGEN_NODE_OFFSET))
- offset += MBIGEN_NODE_OFFSET;
-
- return offset;
-}
-
static inline unsigned int get_mbigen_vec_reg(irq_hw_number_t hwirq)
{
unsigned int nid, pin;
@@ -86,7 +72,8 @@ static inline unsigned int get_mbigen_ve
nid = hwirq / IRQS_PER_MBIGEN_NODE + 1;
pin = hwirq % IRQS_PER_MBIGEN_NODE;
- return pin * 4 + get_mbigen_node_offset(nid) + REG_MBIGEN_VEC_OFFSET;
+ return pin * 4 + nid * MBIGEN_NODE_OFFSET
+ + REG_MBIGEN_VEC_OFFSET;
}
static inline void get_mbigen_type_reg(irq_hw_number_t hwirq,
@@ -101,7 +88,8 @@ static inline void get_mbigen_type_reg(i
*mask = 1 << (irq_ofst % 32);
ofst = irq_ofst / 32 * 4;
- *addr = ofst + get_mbigen_node_offset(nid) + REG_MBIGEN_TYPE_OFFSET;
+ *addr = ofst + nid * MBIGEN_NODE_OFFSET
+ + REG_MBIGEN_TYPE_OFFSET;
}
static inline void get_mbigen_clear_reg(irq_hw_number_t hwirq,
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0091/1376] mm/hugetlb: fix missing migratable flag on same-node hugetlb migration
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0090/1376] Revert "irqchip/mbigen: Fix mbigen node address layout" Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0092/1376] nvdimm/btt: reject an arena whose nfree is below the lane count Greg Kroah-Hartman
` (907 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wupeng Ma, David Hildenbrand (Arm),
Baolin Wang, Muchun Song, Oscar Salvador, Andrew Morton
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wupeng Ma <mawupeng1@huawei.com>
commit 8ee1ef0f2f8ce29338f4ab00a3d344c010208058 upstream.
Commit ba23f58de896 ("mm/migrate: don't call
folio_putback_active_hugetlb() on dst hugetlb folio") moved setting of the
migratable flag and active-list placement from
folio_putback_active_hugetlb(dst) into move_hugetlb_state(), so that the
freshly allocated destination folio is handled where allocation is known
to have succeeded.
Unfortunately, the new code was appended after the existing
temporary-folio block in move_hugetlb_state(), which contains an early
return added earlier by commit 5af1ab1d24e08 ("mm/hugetlb: optimize the
surplus state transfer code in move_hugetlb_state()"):
if (folio_test_hugetlb_temporary(new_folio)) {
...
if (new_nid == old_nid)
return; <-- skips the new code
...
}
/* added by ba23f58 */
folio_set_hugetlb_migratable(new_folio);
list_move_tail(&new_folio->lru, ...&h->hugepage_activelist);
When the destination folio is temporary (i.e. the hugetlb pool was
exhausted and the migration callback fell back to
alloc_migrate_hugetlb_folio()) and the migration does not cross a node --
the common case, and always true on a single-NUMA system --
move_hugetlb_state() returns before setting the migratable flag or adding
the new folio to the active list. The destination folio is then installed
in the page table but cannot be isolated afterwards, since
folio_isolate_hugetlb() rejects folios without the migratable flag; a
subsequent soft-offline, hard-offline or memory-hotplug offline of that
folio fails with -EBUSY.
This was reproduced on a single-NUMA arm64 VM: a second MADV_SOFT_OFFLINE
on an already-migrated hugetlb page returned EBUSY and logged "hugepage
isolation failed".
Keep the surplus adjustment, which is the only part that depends on the
node crossing, guarded by `if (new_nid != old_nid)', while making the
migratable flag and active-list placement unconditional. This preserves
the cleanup intent of ba23f58 and closes the early-return hole.
Link: https://lore.kernel.org/20260707110254.3147686-1-mawupeng1@huawei.com
Fixes: ba23f58de896 ("mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio")
Signed-off-by: Wupeng Ma <mawupeng1@huawei.com>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/hugetlb.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -7523,14 +7523,14 @@ void move_hugetlb_state(struct folio *ol
* There is no need to transfer the per-node surplus state
* when we do not cross the node.
*/
- if (new_nid == old_nid)
- return;
- spin_lock_irq(&hugetlb_lock);
- if (h->surplus_huge_pages_node[old_nid]) {
- h->surplus_huge_pages_node[old_nid]--;
- h->surplus_huge_pages_node[new_nid]++;
+ if (new_nid != old_nid) {
+ spin_lock_irq(&hugetlb_lock);
+ if (h->surplus_huge_pages_node[old_nid]) {
+ h->surplus_huge_pages_node[old_nid]--;
+ h->surplus_huge_pages_node[new_nid]++;
+ }
+ spin_unlock_irq(&hugetlb_lock);
}
- spin_unlock_irq(&hugetlb_lock);
}
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0092/1376] nvdimm/btt: reject an arena whose nfree is below the lane count
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0091/1376] mm/hugetlb: fix missing migratable flag on same-node hugetlb migration Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0093/1376] parisc: eisa: Fix infinite loop when parsing invalid IRQ value Greg Kroah-Hartman
` (906 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Alison Schofield
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 6a1f2e5ed9267ca19187038ac635393c165213ac upstream.
The BTT info block's nfree field, the number of reserve free blocks, is
read from the medium without validation. btt_freelist_init() and
btt_rtt_init() size the per-lane freelist[] and rtt[] arrays by nfree,
but the I/O path indexes them by the lane from nd_region_acquire_lane(),
which is bounded by nd_region->num_lanes (ND_MAX_LANES), not by nfree.
A crafted or foreign arena whose nfree is below the lane count makes
freelist[lane]/rtt[lane] run past the allocation: an out-of-bounds write.
btt.rst documents the nlanes = min(nfree, num_cpus) invariant, which the
code does not currently honor: num_lanes is ND_MAX_LANES regardless of
nfree. Reject an arena whose nfree is below num_lanes at discovery,
before the per-lane arrays are allocated, enforcing that invariant.
Fixes: 5212e11fde4d ("nd_btt: atomic sector updates")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Tested-by: Alison Schofield <alison.schofield@intel.com>
Link: https://patch.msgid.link/20260620-b4-disp-88b2514b-v1-1-3834e707d232@proton.me
Signed-off-by: Alison Schofield <alison.schofield@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvdimm/btt.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/nvdimm/btt.c
+++ b/drivers/nvdimm/btt.c
@@ -885,6 +885,14 @@ static int discover_arenas(struct btt *b
arena->external_lba_start = cur_nlba;
parse_arena_meta(arena, super, cur_off);
+ if (arena->nfree < btt->nd_region->num_lanes) {
+ dev_err(to_dev(arena),
+ "nfree %u smaller than lane count %d\n",
+ arena->nfree, btt->nd_region->num_lanes);
+ ret = -ENODEV;
+ goto out;
+ }
+
ret = log_set_indices(arena);
if (ret) {
dev_err(to_dev(arena),
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0093/1376] parisc: eisa: Fix infinite loop when parsing invalid IRQ value
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0092/1376] nvdimm/btt: reject an arena whose nfree is below the lane count Greg Kroah-Hartman
@ 2026-09-12 6:41 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0094/1376] parisc: Fix alignment of asm statements in head.S Greg Kroah-Hartman
` (905 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:41 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pei Xiao, Helge Deller
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pei Xiao <xiaopei01@kylinos.cn>
commit 8b585431a16cfb9d8f2955a9fa0787ce3dceb3c2 upstream.
When an invalid value is passed via the "eisa_irq_edge=" kernel
command line parameter (e.g. "eisa_irq_edge=16,5"), eisa_irq_setup()
prints an error message and continues without advancing the current
position. As a result the same invalid value is parsed again and
again, causing an infinite loop while the kernel boots.
Advance to the next comma-separated entry, or stop parsing when there
is no next entry, before continuing so that the remaining entries are
processed normally.
Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
Cc: stable@vger.kernel.org
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/parisc/eisa.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/parisc/eisa.c
+++ b/drivers/parisc/eisa.c
@@ -442,6 +442,11 @@ static int __init eisa_irq_setup(char *s
val = (int) simple_strtoul(cur, &pe, 0);
if (val > 15 || val < 0) {
printk(KERN_ERR "eisa: EISA irq value are 0-15\n");
+ cur = strchr(cur, ',');
+ if (cur)
+ cur++;
+ else
+ break;
continue;
}
if (val == 2) {
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0094/1376] parisc: Fix alignment of asm statements in head.S
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2026-09-12 6:41 ` [PATCH 6.12 0093/1376] parisc: eisa: Fix infinite loop when parsing invalid IRQ value Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0095/1376] powerpc/kexec_file: Fix null-ptr-def in extra size calculation Greg Kroah-Hartman
` (904 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Helge Deller
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <deller@gmx.de>
commit 04cf68c9a76e3c6b67ad056a66a14923abf85925 upstream.
All assembler statements need to be 4-byte aligned. Prevent a possible
misalignment if someone changes the preceeding string and it's length is
then suddenly not a multiple of 4 any longer.
Cc: stable@vger.kernel.org
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/parisc/kernel/head.S | 1 +
1 file changed, 1 insertion(+)
--- a/arch/parisc/kernel/head.S
+++ b/arch/parisc/kernel/head.S
@@ -105,6 +105,7 @@ $iodc_panic:
or %r10,%r10,%r10 /* qemu idle sleep */
msg1: .ascii "Can't boot kernel which was built for PA8x00 CPUs on this machine.\r\n"
msg1_end:
+ .align 4
$cpu_ok:
#endif
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0095/1376] powerpc/kexec_file: Fix null-ptr-def in extra size calculation
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0094/1376] parisc: Fix alignment of asm statements in head.S Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0096/1376] powerpc/kexec_file: Prevent kexec range truncation Greg Kroah-Hartman
` (903 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jinjie Ruan, Sourabh Jain,
Madhavan Srinivasan
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <ruanjinjie@huawei.com>
commit 761eda315a6e1fda3e8e2185b28430771fb1ac29 upstream.
A static Sashiko AI review identified a potential NULL pointer
dereference in kexec_extra_fdt_size_ppc64().
On platforms without any reserved memory regions,
get_reserved_memory_ranges() can return 0 while leaving 'rmem'
unallocated as NULL. Passing it directly leads to a kernel panic when
evaluating 'rmem->nr_ranges'.
Add a NULL check for 'rmem' to prevent this crash.
Cc: stable@vger.kernel.org
Fixes: 0d3ff067331e ("powerpc/kexec_file: fix extra size calculation for kexec FDT")
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Reviewed-by: Sourabh Jain <sourabhjain@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260729012948.2797865-3-ruanjinjie@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kexec/file_load_64.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/powerpc/kexec/file_load_64.c
+++ b/arch/powerpc/kexec/file_load_64.c
@@ -847,7 +847,7 @@ unsigned int kexec_extra_fdt_size_ppc64(
extra_size += (cpu_nodes - boot_cpu_node_count) * cpu_node_size();
/* Consider extra space for reserved memory ranges if any */
- if (rmem->nr_ranges > 0)
+ if (rmem && rmem->nr_ranges > 0)
extra_size += sizeof(struct fdt_reserve_entry) * rmem->nr_ranges;
return extra_size + kdump_extra_fdt_size_ppc64(image, cpu_nodes);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0096/1376] powerpc/kexec_file: Prevent kexec range truncation
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0095/1376] powerpc/kexec_file: Fix null-ptr-def in extra size calculation Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0097/1376] powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population Greg Kroah-Hartman
` (902 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jinjie Ruan, Sourabh Jain,
Madhavan Srinivasan
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <ruanjinjie@huawei.com>
commit fa40f9dbdd4af53e7445d9135b5b207eb8adf372 upstream.
Sashiko AI review pointed out the following issue.
The __merge_memory_ranges() function incorrectly handles overlapping
memory ranges when merging them. Although sort_memory_ranges() sorts all
ranges by their start address in ascending order beforehand, the merge
logic remains defective in two ways:
1. It compares the current range's start against the previous element (i-1)
instead of the running target index (idx)
2. It unconditionally overwrites 'ranges[idx].end' with 'ranges[i].end'.
This logic flaw leads to critical memory truncation when a larger memory
range completely subsumes subsequent smaller ranges.
For example, consider a sorted input array with three ranges:
Range A (idx=0): [0x1000 - 0x9000]
Range B (i=1): [0x2000 - 0x5000] (completely inside Range A)
Range C (i=2): [0x6000 - 0x8000] (completely inside Range A)
1. When i=1 (Range B):
ranges[1].start (0x2000) <= ranges[0].end + 1 (0x9001) is TRUE.
The code executes: ranges[0].end = ranges[1].end, which erroneously
shrinks Range A's end from 0x9000 down to 0x5000.
2. When i=2 (Range C):
ranges[2].start (0x6000) <= ranges[1].end + 1 (0x5001) is FALSE.
The code falls into the else block, creating a broken new range.
As a result, valid memory fragments [0x5001 - 0x5fff] and [0x8001 - 0x9000]
are completely lost from the kexec exclude lists, potentially allowing
the crash kernel to overwrite active memory, causing data corruption
or crashes.
Fix this by ensuring the start of the current range is compared against the
end of the active merged range (idx), and use max() to safely prevent the
outer boundary from being truncated.
Cc: stable@vger.kernel.org
Fixes: 180adfc532a8 ("powerpc/kexec_file: Add helper functions for getting memory ranges")
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Reviewed-by: Sourabh Jain <sourabhjain@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260729012948.2797865-4-ruanjinjie@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kexec/ranges.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
--- a/arch/powerpc/kexec/ranges.c
+++ b/arch/powerpc/kexec/ranges.c
@@ -21,6 +21,7 @@
#include <linux/of.h>
#include <linux/slab.h>
#include <linux/memblock.h>
+#include <linux/minmax.h>
#include <linux/crash_core.h>
#include <asm/sections.h>
#include <asm/kexec_ranges.h>
@@ -105,19 +106,16 @@ static void __merge_memory_ranges(struct
struct range *ranges;
int i, idx;
- if (!mem_rngs)
+ if (!mem_rngs || mem_rngs->nr_ranges <= 1)
return;
idx = 0;
- ranges = &(mem_rngs->ranges[0]);
+ ranges = mem_rngs->ranges;
for (i = 1; i < mem_rngs->nr_ranges; i++) {
- if (ranges[i].start <= (ranges[i-1].end + 1))
- ranges[idx].end = ranges[i].end;
+ if (ranges[i].start <= (ranges[idx].end + 1))
+ ranges[idx].end = max(ranges[idx].end, ranges[i].end);
else {
idx++;
- if (i == idx)
- continue;
-
ranges[idx] = ranges[i];
}
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0097/1376] powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0096/1376] powerpc/kexec_file: Prevent kexec range truncation Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0098/1376] powerpc/pseries: Handle and log pseries-wdt registration failures Greg Kroah-Hartman
` (901 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Muchun Song, Oscar Salvador,
Ritesh Harjani (IBM), Aneesh Kumar K.V, David Hildenbrand,
Frank van der Linden, Liam R. Howlett, Lorenzo Stoakes,
Madhavan Srinivasan, Michael Ellerman, Mike Rapoport (Microsoft),
Nicholas Piggin, Oscar Salvador (SUSE), Usama Arif,
Vlastimil Babka, Andrew Morton
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muchun Song <songmuchun@bytedance.com>
commit 89a4ae32764172468dea303eb6ae90fe6c859712 upstream.
vmemmap_populate_compound_pages() uses addr_pfn to determine the PFN
offset within a compound page and to decide whether the current vmemmap
slot should be populated as a head page mapping or should reuse a tail
page mapping.
However, addr_pfn is advanced manually in parallel with addr. The loop
itself progresses in vmemmap address space, so each PAGE_SIZE step in addr
covers PAGE_SIZE / sizeof(struct page) struct page slots. Since addr_pfn
is compared against nr_pages in data-PFN units, it should advance by the
same number of PFNs. The existing manual increments do not match that and
therefore do not reliably track the PFN corresponding to the current addr.
As a result, pfn_offset can be computed from the wrong PFN and the code
can make the head/tail decision for the wrong compound-page position.
Fix this by deriving addr_pfn directly from the current vmemmap address
instead of carrying it as loop state.
Link: https://lore.kernel.org/20260612035903.2468601-4-songmuchun@bytedance.com
Fixes: f2b79c0d7968 ("powerpc/book3s64/radix: add support for vmemmap optimization for radix")
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Acked-by: Oscar Salvador <osalvador@suse.de>
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Cc: "Aneesh Kumar K.V" <aneesh.kumar@linux.ibm.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Frank van der Linden <fvdl@google.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Mike Rapoport (Microsoft) <rppt@kernel.org>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Oscar Salvador (SUSE) <osalvador@kernel.org>
Cc: Usama Arif <usama.arif@linux.dev>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/mm/book3s64/radix_pgtable.c | 7 +------
1 file changed, 1 insertion(+), 6 deletions(-)
--- a/arch/powerpc/mm/book3s64/radix_pgtable.c
+++ b/arch/powerpc/mm/book3s64/radix_pgtable.c
@@ -1318,7 +1318,6 @@ int __meminit vmemmap_populate_compound_
* covering out both edges.
*/
unsigned long addr;
- unsigned long addr_pfn = start_pfn;
unsigned long next;
pgd_t *pgd;
p4d_t *p4d;
@@ -1339,7 +1338,6 @@ int __meminit vmemmap_populate_compound_
if (pmd_leaf(READ_ONCE(*pmd))) {
/* existing huge mapping. Skip the range */
- addr_pfn += (PMD_SIZE >> PAGE_SHIFT);
next = pmd_addr_end(addr, end);
continue;
}
@@ -1352,11 +1350,11 @@ int __meminit vmemmap_populate_compound_
* page whose VMEMMAP_RESERVE_NR pages were mapped and
* this request fall in those pages.
*/
- addr_pfn += 1;
next = addr + PAGE_SIZE;
continue;
} else {
unsigned long nr_pages = pgmap_vmemmap_nr(pgmap);
+ unsigned long addr_pfn = page_to_pfn((struct page *)addr);
unsigned long pfn_offset = addr_pfn - ALIGN_DOWN(addr_pfn, nr_pages);
pte_t *tail_page_pte;
@@ -1380,7 +1378,6 @@ int __meminit vmemmap_populate_compound_
if (!pte)
return -ENOMEM;
- addr_pfn += 2;
next = addr + 2 * PAGE_SIZE;
continue;
}
@@ -1396,7 +1393,6 @@ int __meminit vmemmap_populate_compound_
return -ENOMEM;
vmemmap_verify(pte, node, addr, addr + PAGE_SIZE);
- addr_pfn += 1;
next = addr + PAGE_SIZE;
continue;
}
@@ -1406,7 +1402,6 @@ int __meminit vmemmap_populate_compound_
return -ENOMEM;
vmemmap_verify(pte, node, addr, addr + PAGE_SIZE);
- addr_pfn += 1;
next = addr + PAGE_SIZE;
continue;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0098/1376] powerpc/pseries: Handle and log pseries-wdt registration failures
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0097/1376] powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0099/1376] powerpc/pseries: Move H_WATCHDOG definitions to a common header Greg Kroah-Hartman
` (900 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ritesh Harjani (IBM), Sourabh Jain,
Madhavan Srinivasan
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sourabh Jain <sourabhjain@linux.ibm.com>
commit e65b526affa621b50646cafdf6b06505af07032e upstream.
The pseries watchdog initialization registers the pseries-wdt platform
device using platform_device_register_simple(), but currently ignores
its return value.
Check the returned pointer for errors, log a descriptive error message
when registration fails, and propagate the failure code to the caller.
This avoids silently ignoring platform device registration failures.
Cc: stable@vger.kernel.org
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Signed-off-by: Sourabh Jain <sourabhjain@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260727053416.276317-3-sourabhjain@linux.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/pseries/setup.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
--- a/arch/powerpc/platforms/pseries/setup.c
+++ b/arch/powerpc/platforms/pseries/setup.c
@@ -193,8 +193,18 @@ static void __init fwnmi_init(void)
*/
static __init int pseries_wdt_init(void)
{
- if (firmware_has_feature(FW_FEATURE_WATCHDOG))
- platform_device_register_simple("pseries-wdt", 0, NULL, 0);
+ struct platform_device *pdev;
+
+ if (!firmware_has_feature(FW_FEATURE_WATCHDOG))
+ return 0;
+
+ pdev = platform_device_register_simple("pseries-wdt", 0, NULL, 0);
+
+ if (IS_ERR(pdev)) {
+ pr_err("Failed to register pseries-wdt platform device\n");
+ return PTR_ERR(pdev);
+ }
+
return 0;
}
machine_subsys_initcall(pseries, pseries_wdt_init);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0099/1376] powerpc/pseries: Move H_WATCHDOG definitions to a common header
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0098/1376] powerpc/pseries: Handle and log pseries-wdt registration failures Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0100/1376] powerpc/crash: stop watchdogs before booting kdump kernel Greg Kroah-Hartman
` (899 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ritesh Harjani (IBM), Sourabh Jain,
Madhavan Srinivasan
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sourabh Jain <sourabhjain@linux.ibm.com>
commit 516a254918453ec99660201263d01189c082332c upstream.
The H_WATCHDOG input and output definitions are currently local to the
pseries watchdog driver. The next patch in this series also needs these
definitions to issue H_WATCHDOG hypercalls outside the watchdog driver.
Move the H_WATCHDOG definitions to a new common header,
asm/papr-watchdog.h, so they can be shared without duplicating the
PAPR watchdog definitions.
No functional changes.
Cc: stable@vger.kernel.org
Suggested-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Signed-off-by: Sourabh Jain <sourabhjain@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260727053416.276317-2-sourabhjain@linux.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/include/asm/papr-watchdog.h | 58 +++++++++++++++++++++++++++++++
drivers/watchdog/pseries-wdt.c | 53 ----------------------------
2 files changed, 59 insertions(+), 52 deletions(-)
create mode 100644 arch/powerpc/include/asm/papr-watchdog.h
--- /dev/null
+++ b/arch/powerpc/include/asm/papr-watchdog.h
@@ -0,0 +1,58 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+#ifndef _ASM_POWERPC_PAPR_WATCHDOG_H
+#define _ASM_POWERPC_PAPR_WATCHDOG_H
+
+/*
+ * H_WATCHDOG Input
+ *
+ * R4: "flags":
+ *
+ * Bits 48-55: "operation"
+ */
+#define PSERIES_WDTF_OP_START 0x100UL /* start timer */
+#define PSERIES_WDTF_OP_STOP 0x200UL /* stop timer */
+#define PSERIES_WDTF_OP_QUERY 0x300UL /* query timer capabilities */
+
+/*
+ * Bits 56-63: "timeoutAction" (for "Start Watchdog" only)
+ */
+#define PSERIES_WDTF_ACTION_HARD_POWEROFF 0x1UL /* poweroff */
+#define PSERIES_WDTF_ACTION_HARD_RESTART 0x2UL /* restart */
+#define PSERIES_WDTF_ACTION_DUMP_RESTART 0x3UL /* dump + restart */
+
+/*
+ * H_WATCHDOG Output
+ *
+ * R3: Return code
+ *
+ * H_SUCCESS The operation completed.
+ *
+ * H_BUSY The hypervisor is too busy; retry the operation.
+ *
+ * H_PARAMETER The given "flags" are somehow invalid. Either the
+ * "operation" or "timeoutAction" is invalid, or a
+ * reserved bit is set.
+ *
+ * H_P2 The given "watchdogNumber" is zero or exceeds the
+ * supported maximum value.
+ *
+ * H_P3 The given "timeoutInMs" is below the supported
+ * minimum value.
+ *
+ * H_NOOP The given "watchdogNumber" is already stopped.
+ *
+ * H_HARDWARE The operation failed for ineffable reasons.
+ *
+ * H_FUNCTION The H_WATCHDOG hypercall is not supported by this
+ * hypervisor.
+ *
+ * R4:
+ *
+ * - For the "Query Watchdog Capabilities" operation, a 64-bit
+ * structure:
+ */
+#define PSERIES_WDTQ_MIN_TIMEOUT(cap) (((cap) >> 48) & 0xffff)
+#define PSERIES_WDTQ_MAX_NUMBER(cap) (((cap) >> 32) & 0xffff)
+
+#endif /* _ASM_POWERPC_PAPR_WATCHDOG_H */
--- a/drivers/watchdog/pseries-wdt.c
+++ b/drivers/watchdog/pseries-wdt.c
@@ -13,61 +13,10 @@
#include <linux/platform_device.h>
#include <linux/time64.h>
#include <linux/watchdog.h>
+#include <asm/papr-watchdog.h>
#define DRV_NAME "pseries-wdt"
-/*
- * H_WATCHDOG Input
- *
- * R4: "flags":
- *
- * Bits 48-55: "operation"
- */
-#define PSERIES_WDTF_OP_START 0x100UL /* start timer */
-#define PSERIES_WDTF_OP_STOP 0x200UL /* stop timer */
-#define PSERIES_WDTF_OP_QUERY 0x300UL /* query timer capabilities */
-
-/*
- * Bits 56-63: "timeoutAction" (for "Start Watchdog" only)
- */
-#define PSERIES_WDTF_ACTION_HARD_POWEROFF 0x1UL /* poweroff */
-#define PSERIES_WDTF_ACTION_HARD_RESTART 0x2UL /* restart */
-#define PSERIES_WDTF_ACTION_DUMP_RESTART 0x3UL /* dump + restart */
-
-/*
- * H_WATCHDOG Output
- *
- * R3: Return code
- *
- * H_SUCCESS The operation completed.
- *
- * H_BUSY The hypervisor is too busy; retry the operation.
- *
- * H_PARAMETER The given "flags" are somehow invalid. Either the
- * "operation" or "timeoutAction" is invalid, or a
- * reserved bit is set.
- *
- * H_P2 The given "watchdogNumber" is zero or exceeds the
- * supported maximum value.
- *
- * H_P3 The given "timeoutInMs" is below the supported
- * minimum value.
- *
- * H_NOOP The given "watchdogNumber" is already stopped.
- *
- * H_HARDWARE The operation failed for ineffable reasons.
- *
- * H_FUNCTION The H_WATCHDOG hypercall is not supported by this
- * hypervisor.
- *
- * R4:
- *
- * - For the "Query Watchdog Capabilities" operation, a 64-bit
- * structure:
- */
-#define PSERIES_WDTQ_MIN_TIMEOUT(cap) (((cap) >> 48) & 0xffff)
-#define PSERIES_WDTQ_MAX_NUMBER(cap) (((cap) >> 32) & 0xffff)
-
static const unsigned long pseries_wdt_action[] = {
[0] = PSERIES_WDTF_ACTION_HARD_POWEROFF,
[1] = PSERIES_WDTF_ACTION_HARD_RESTART,
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0100/1376] powerpc/crash: stop watchdogs before booting kdump kernel
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0099/1376] powerpc/pseries: Move H_WATCHDOG definitions to a common header Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0101/1376] s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm() Greg Kroah-Hartman
` (898 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mahesh Kumar G, Ritesh Harjani (IBM),
Sourabh Jain, Madhavan Srinivasan
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sourabh Jain <sourabhjain@linux.ibm.com>
commit fb43ba4256543ce18ca0540fc37022bda438a293 upstream.
On pseries LPAR systems, watchdog timers configured from userspace can
remain active after a kernel panic. When a panic triggers kdump, the
crashing kernel jumps directly to the kdump kernel without stopping
active watchdogs. As a result, the watchdogs remain active after the
kdump kernel starts.
If dump capture takes longer than the watchdog timeout, PHYP resets the
LPAR before the dump is fully captured, causing dump capture to fail.
Fix this by issuing the `H_WATCHDOG` hcall during the crash shutdown
sequence to stop all active watchdogs before booting the kdump kernel.
Cc: stable@vger.kernel.org
Fixes: 69472ffa6575 ("watchdog/pseries-wdt: initial support for H_WATCHDOG-based watchdog timers")
Reported-by: Mahesh Kumar G <mahe657@linux.ibm.com>
Suggested-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Signed-off-by: Sourabh Jain <sourabhjain@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260727053416.276317-4-sourabhjain@linux.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/include/asm/papr-watchdog.h | 6 ++++++
arch/powerpc/platforms/pseries/setup.c | 14 ++++++++++++++
2 files changed, 20 insertions(+)
--- a/arch/powerpc/include/asm/papr-watchdog.h
+++ b/arch/powerpc/include/asm/papr-watchdog.h
@@ -22,6 +22,12 @@
#define PSERIES_WDTF_ACTION_DUMP_RESTART 0x3UL /* dump + restart */
/*
+ * R5: "watchdogNumber":
+ * PAPR says use -1 (all ones) to stop all watchdogs.
+ */
+#define PSERIES_WDT_NUM_ALL ((unsigned long)-1)
+
+/*
* H_WATCHDOG Output
*
* R3: Return code
--- a/arch/powerpc/platforms/pseries/setup.c
+++ b/arch/powerpc/platforms/pseries/setup.c
@@ -76,6 +76,7 @@
#include <asm/dtl.h>
#include <asm/hvconsole.h>
#include <asm/setup.h>
+#include <asm/papr-watchdog.h>
#include "pseries.h"
@@ -187,6 +188,16 @@ static void __init fwnmi_init(void)
#endif
}
+static void pseries_crash_stop_watchdogs(void)
+{
+ long rc;
+
+ rc = plpar_hcall_norets_notrace(H_WATCHDOG, PSERIES_WDTF_OP_STOP,
+ PSERIES_WDT_NUM_ALL);
+ if (rc != H_SUCCESS && rc != H_NOOP)
+ pr_warn("Could not stop watchdogs before kdump rc=%ld\n", rc);
+}
+
/*
* Affix a device for the first timer to the platform bus if
* we have firmware support for the H_WATCHDOG hypercall.
@@ -205,6 +216,9 @@ static __init int pseries_wdt_init(void)
return PTR_ERR(pdev);
}
+ if (crash_shutdown_register(pseries_crash_stop_watchdogs))
+ pr_warn("Could not register watchdog crash shutdown handler\n");
+
return 0;
}
machine_subsys_initcall(pseries, pseries_wdt_init);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0101/1376] s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0100/1376] powerpc/crash: stop watchdogs before booting kdump kernel Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0102/1376] s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove Greg Kroah-Hartman
` (897 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthew Rosato, Anthony Krowiak,
Christian Borntraeger, Claudio Imbrenda
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anthony Krowiak <akrowiak@linux.ibm.com>
commit 4400270ec0348d05dc0439d8f0130853ce7f9e20 upstream.
In vfio_ap_mdev_set_kvm(), kvm->arch.crypto.pqap_hook is set to
&matrix_mdev->pqap_hook before the update locks are acquired and the
mdev list is checked for a conflicting assignment. If another mdev is
already attached to the same KVM instance, the function returns -EPERM
without restoring the hook pointer, leaving kvm->arch.crypto.pqap_hook
pointing at the failing matrix_mdev instead of the mdev that legitimately
owns the KVM.
Since matrix_mdev->kvm is never set on this error path,
vfio_ap_mdev_unset_kvm() will not clean up the hook when matrix_mdev
is later closed. If matrix_mdev is subsequently freed, any PQAP
instruction executed by the guest will dereference the stale pointer
through pqap_hook_rwsem, resulting in a use-after-free.
Since kvm->arch.crypto.pqap_hook is only set in the vfio_ap_mdev_set_kvm()
function and is cleared in the vfio_ap_mdev_unset_kvm() function, a check
for 'kvm->arch.crypto.pqap_hook != NULL' is all that is needed to determine
whether it belongs to another mdev. This will alleviate the need to iterate
the matrix_dev->mdev_list list to see if the kvm object is assigned to
another mdev.This was introduced in v3 to alleviate the need to take the
mdevs_lock while iterating the list; however, this did not prevent a
potential race condition.
The pqap_hook_rwsem(write) is now performed inside
get_update_locks_for_kvm(), which is updated to acquire
pqap_hook_rwsem(write) between kvm->lock and mdevs_lock. This ordering
is consistent with the PQAP intercept path, which acquires pqap_hook_rwsem
in read mode while srcu is held under vcpu->mutex, establishing the
dependency: kvm->lock -> vcpu->mutex -> srcu -> pqap_hook_rwsem(read).
The pqap_hook_rwsem is now released inside the
release_update_locks_for_kvm(), which is updated to release
pqap_hook_rwsem(write) between mdevs_lock and kvm->lock.
Additionally, kvm_put_kvm() in vfio_ap_mdev_unset_kvm() is moved
after release_update_locks_for_kvm(). Previously it was called while
kvm->lock was held; if it were ever the last reference, kvm_destroy_vm()
would run under kvm->lock, which would deadlock.
Fixes: 86956e70761b3 ("s390/vfio-ap: replace open coded locks for VFIO_GROUP_NOTIFY_SET_KVM notification")
Cc: stable@vger.kernel.org
Co-developed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Anthony Krowiak <akrowiak@linux.ibm.com>
Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Message-ID: <20260806173435.105044-1-akrowiak@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/crypto/vfio_ap_ops.c | 45 ++++++++++++++++----------------------
1 file changed, 20 insertions(+), 25 deletions(-)
--- a/drivers/s390/crypto/vfio_ap_ops.c
+++ b/drivers/s390/crypto/vfio_ap_ops.c
@@ -48,15 +48,19 @@ static void vfio_ap_mdev_reset_queue(str
* 1. matrix_dev->guests_lock: required to use the KVM pointer to update a KVM
* guest's APCB.
* 2. kvm->lock: required to update a guest's APCB
- * 3. matrix_dev->mdevs_lock: required to access data stored in a matrix_mdev
+ * 3. kvm->arch.crypto.pqap_hook_rwsem: required to update pqap_hook and
+ * serialize against PQAP intercepts
+ * 4. matrix_dev->mdevs_lock: required to access data stored in a matrix_mdev
*
- * Note: If @kvm is NULL, the KVM lock will not be taken.
+ * Note: If @kvm is NULL, the KVM lock and pqap_hook_rwsem will not be taken.
*/
static inline void get_update_locks_for_kvm(struct kvm *kvm)
{
mutex_lock(&matrix_dev->guests_lock);
- if (kvm)
+ if (kvm) {
mutex_lock(&kvm->lock);
+ down_write(&kvm->arch.crypto.pqap_hook_rwsem);
+ }
mutex_lock(&matrix_dev->mdevs_lock);
}
@@ -68,16 +72,19 @@ static inline void get_update_locks_for_
*
* The proper unlocking order is:
* 1. matrix_dev->mdevs_lock
- * 2. kvm->lock
- * 3. matrix_dev->guests_lock
+ * 2. kvm->arch.crypto.pqap_hook_rwsem
+ * 3. kvm->lock
+ * 4. matrix_dev->guests_lock
*
- * Note: If @kvm is NULL, the KVM lock will not be released.
+ * Note: If @kvm is NULL, the KVM lock and pqap_hook_rwsem will not be released.
*/
static inline void release_update_locks_for_kvm(struct kvm *kvm)
{
mutex_unlock(&matrix_dev->mdevs_lock);
- if (kvm)
+ if (kvm) {
+ up_write(&kvm->arch.crypto.pqap_hook_rwsem);
mutex_unlock(&kvm->lock);
+ }
mutex_unlock(&matrix_dev->guests_lock);
}
@@ -1817,26 +1824,17 @@ static const struct attribute_group *vfi
static int vfio_ap_mdev_set_kvm(struct ap_matrix_mdev *matrix_mdev,
struct kvm *kvm)
{
- struct ap_matrix_mdev *m;
-
if (kvm->arch.crypto.crycbd) {
- down_write(&kvm->arch.crypto.pqap_hook_rwsem);
- kvm->arch.crypto.pqap_hook = &matrix_mdev->pqap_hook;
- up_write(&kvm->arch.crypto.pqap_hook_rwsem);
-
get_update_locks_for_kvm(kvm);
-
- list_for_each_entry(m, &matrix_dev->mdev_list, node) {
- if (m != matrix_mdev && m->kvm == kvm) {
- release_update_locks_for_kvm(kvm);
- return -EPERM;
- }
+ if (kvm->arch.crypto.pqap_hook) {
+ release_update_locks_for_kvm(kvm);
+ return -EPERM;
}
+ kvm->arch.crypto.pqap_hook = &matrix_mdev->pqap_hook;
kvm_get_kvm(kvm);
matrix_mdev->kvm = kvm;
vfio_ap_mdev_update_guest_apcb(matrix_mdev);
-
release_update_locks_for_kvm(kvm);
}
@@ -1879,18 +1877,15 @@ static void vfio_ap_mdev_unset_kvm(struc
struct kvm *kvm = matrix_mdev->kvm;
if (kvm && kvm->arch.crypto.crycbd) {
- down_write(&kvm->arch.crypto.pqap_hook_rwsem);
- kvm->arch.crypto.pqap_hook = NULL;
- up_write(&kvm->arch.crypto.pqap_hook_rwsem);
-
get_update_locks_for_kvm(kvm);
+ kvm->arch.crypto.pqap_hook = NULL;
kvm_arch_crypto_clear_masks(kvm);
vfio_ap_mdev_reset_queues(matrix_mdev);
- kvm_put_kvm(kvm);
matrix_mdev->kvm = NULL;
release_update_locks_for_kvm(kvm);
+ kvm_put_kvm(kvm);
}
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0102/1376] s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0101/1376] s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm() Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0103/1376] s390/vfio-ap: Fix control domain removal " Greg Kroah-Hartman
` (896 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anthony Krowiak, Matthew Rosato,
Christian Borntraeger
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anthony Krowiak <akrowiak@linux.ibm.com>
commit b1f092d94f621307927f145e3cc31893da51fc08 upstream.
The do_remove flag in vfio_ap_mdev_cfg_remove() is initialised to zero
before the loop that iterates over the list of matrix mdevs, but is
never reset at the start of each iteration. Since do_remove is
OR-accumulated across iterations, a positive result from one mdev
carries over to subsequent mdevs.
The fix is to set the do_remove flag with the first call to bitmap_and;
for example: do_remove = bitmap_an rather than do_remove |= bitmap_and.
Fixes: eeb386aeb5b7 ("s390/vfio-ap: handle config changed and scan complete notification")
Cc: stable@vger.kernel.org
Signed-off-by: Anthony Krowiak <akrowiak@linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/crypto/vfio_ap_ops.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/s390/crypto/vfio_ap_ops.c
+++ b/drivers/s390/crypto/vfio_ap_ops.c
@@ -2549,15 +2549,15 @@ static void vfio_ap_mdev_cfg_remove(unsi
DECLARE_BITMAP(aprem, AP_DEVICES);
DECLARE_BITMAP(aqrem, AP_DOMAINS);
DECLARE_BITMAP(cdrem, AP_DOMAINS);
- int do_remove = 0;
+ int do_remove;
list_for_each_entry(matrix_mdev, &matrix_dev->mdev_list, node) {
mutex_lock(&matrix_mdev->kvm->lock);
mutex_lock(&matrix_dev->mdevs_lock);
- do_remove |= bitmap_and(aprem, ap_remove,
- matrix_mdev->matrix.apm,
- AP_DEVICES);
+ do_remove = bitmap_and(aprem, ap_remove,
+ matrix_mdev->matrix.apm,
+ AP_DEVICES);
do_remove |= bitmap_and(aqrem, aq_remove,
matrix_mdev->matrix.aqm,
AP_DOMAINS);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0103/1376] s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0102/1376] s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0104/1376] s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL Greg Kroah-Hartman
` (895 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anthony Krowiak, Matthew Rosato,
Christian Borntraeger
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anthony Krowiak <akrowiak@linux.ibm.com>
commit 6b8a02e216f6b520cc029e43ddc83956605135d5 upstream.
The vfio_ap_config_remove function uses the bitmap_andnot function to clear
bits from the matrix_mdev->matrix.adm bitmap (specifies the control domains
assigned to the mdev). This prevents the explicitly unplugged control
domains from being removed the KVM guest. The bitmap_and function is used
instead.
Fixes: eeb386aeb5b7c ("s390/vfio-ap: handle config changed and scan complete notification")
Cc: stable@vger.kernel.org
Signed-off-by: Anthony Krowiak <akrowiak@linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/crypto/vfio_ap_ops.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/s390/crypto/vfio_ap_ops.c
+++ b/drivers/s390/crypto/vfio_ap_ops.c
@@ -2561,9 +2561,9 @@ static void vfio_ap_mdev_cfg_remove(unsi
do_remove |= bitmap_and(aqrem, aq_remove,
matrix_mdev->matrix.aqm,
AP_DOMAINS);
- do_remove |= bitmap_andnot(cdrem, cd_remove,
- matrix_mdev->matrix.adm,
- AP_DOMAINS);
+ do_remove |= bitmap_and(cdrem, cd_remove,
+ matrix_mdev->matrix.adm,
+ AP_DOMAINS);
if (do_remove)
vfio_ap_mdev_hot_unplug_cfg(matrix_mdev, aprem, aqrem,
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0104/1376] s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0103/1376] s390/vfio-ap: Fix control domain removal " Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0105/1376] s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed Greg Kroah-Hartman
` (894 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anthony Krowiak, Matthew Rosato,
Christian Borntraeger
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anthony Krowiak <akrowiak@linux.ibm.com>
commit d50346801b4f144e42b49cd4f1496010498ab114 upstream.
The ap_driver structure has two fields which are function pointers to
callbacks:
* .on_config_changed: called at the start of the AP bus scan function to
notify the device driver that the host AP
configuration has changed and the associated AP
devices will be added or removed accordingly. This
gives the implementor a chance to evaluate the
configuration changes and respond to them before
the associated devices are added or removed.
* .on_scan_complete: Called at the end of the AP bus scan function to
notify the device driver that the host AP
configuration has changed and the AP devices have
been added or removed accordingly. This gives the
implementor the opportunity to respond to the
changes after the associated devices are added or
removed.
These two callbacks are implemented in the vfio_ap device driver via the
vfio_ap_on_cfg_changed and vfio_ap_on_scan_complete functions respectively.
Within the call stack of these two callback functions the
matrix_mdev->kvm->lock mutex is taken without checking whether
matrix_mdev->kvm is NULL or not. If matrix_mdev->kvm has never been set,
trying to take the lock will trigger a NULL pointer dereference. This patch
adds checks for matrix_mdev->kvm == NULL before taking the
matrix_mdev->kvm->lock mutex.
Note that the matrix_mdev->kvm->lock mutex taken in the
vfio_ap_mdev_hot_plug_config function is moved to the calling function
along with the matrix_dev->mdevs_lock which is needed there to access
the fields of the matrix_mdev. It makes little sense to make the change
the check for matrix_mdev->kvm there before taking the kvm->lock
mutex only to have to move it out via another patch, so it is done in
this patch.
It is important to make note of the following:
1. The matrix_dev->guests_lock is acquired at the start of both callback
functions. This ensures that matrix_mdev will not be removed via the
vfio_ap_mdev_remove function because it too takes matrix_dev_guests_lock
before removing the object; so, matrix_mdev will be available for the
duration of the callback functions.
2. The matrix_dev->mdevs_lock mutex must be taken in order to access
fields within the matrix_mdev structure
3. matrix_mdev->kvm->lock mutex must be taken before the
matrix_dev->mdevs_lock to prevent a lockdep splat.
4: The kvm->lock must be held while plugging the guest's AP configuration
into its SIE state description via the vfio_ap_mdev_update_guest_apcb
function.
5. The vfio_ap_mdev_update_guest_apcb checks matrix_mdev->kvm to verify it
is not NULL before doing the hot plug of the guest's AP configuration.
Fixes: eeb386aeb5b7c ("s390/vfio-ap: handle config changed and scan complete notification")
Cc: stable@vger.kernel.org
Signed-off-by: Anthony Krowiak <akrowiak@linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/crypto/vfio_ap_ops.c | 39 +++++++++++++++++++++++++++++---------
1 file changed, 30 insertions(+), 9 deletions(-)
--- a/drivers/s390/crypto/vfio_ap_ops.c
+++ b/drivers/s390/crypto/vfio_ap_ops.c
@@ -2551,8 +2551,20 @@ static void vfio_ap_mdev_cfg_remove(unsi
DECLARE_BITMAP(cdrem, AP_DOMAINS);
int do_remove;
+ /*
+ * It is safe to traverse this list here because the
+ * required guard - matrix_dev->guests_lock - is taken in the
+ * vfio_ap_on_cfg_changed function prior to this function getting
+ * called.
+ */
list_for_each_entry(matrix_mdev, &matrix_dev->mdev_list, node) {
- mutex_lock(&matrix_mdev->kvm->lock);
+ /*
+ * The mdevs_lock must be held to access fields within matrix_mdev,
+ * and kvm->lock must be taken before mdevs_lock to satisfy the lock
+ * ordering requirement and prevent a lockdep splat.
+ */
+ if (matrix_mdev->kvm)
+ mutex_lock(&matrix_mdev->kvm->lock);
mutex_lock(&matrix_dev->mdevs_lock);
do_remove = bitmap_and(aprem, ap_remove,
@@ -2570,7 +2582,8 @@ static void vfio_ap_mdev_cfg_remove(unsi
cdrem);
mutex_unlock(&matrix_dev->mdevs_lock);
- mutex_unlock(&matrix_mdev->kvm->lock);
+ if (matrix_mdev->kvm)
+ mutex_unlock(&matrix_mdev->kvm->lock);
}
}
@@ -2767,9 +2780,6 @@ static void vfio_ap_mdev_hot_plug_cfg(st
DECLARE_BITMAP(apm_filtered, AP_DEVICES);
bool filter_domains, filter_adapters, filter_cdoms, do_hotplug = false;
- mutex_lock(&matrix_mdev->kvm->lock);
- mutex_lock(&matrix_dev->mdevs_lock);
-
filter_adapters = bitmap_intersects(matrix_mdev->matrix.apm,
matrix_mdev->apm_add, AP_DEVICES);
filter_domains = bitmap_intersects(matrix_mdev->matrix.aqm,
@@ -2787,9 +2797,6 @@ static void vfio_ap_mdev_hot_plug_cfg(st
vfio_ap_mdev_update_guest_apcb(matrix_mdev);
reset_queues_for_apids(matrix_mdev, apm_filtered);
-
- mutex_unlock(&matrix_dev->mdevs_lock);
- mutex_unlock(&matrix_mdev->kvm->lock);
}
void vfio_ap_on_scan_complete(struct ap_config_info *new_config_info,
@@ -2800,15 +2807,29 @@ void vfio_ap_on_scan_complete(struct ap_
mutex_lock(&matrix_dev->guests_lock);
list_for_each_entry(matrix_mdev, &matrix_dev->mdev_list, node) {
+ /*
+ * The mdevs_lock must be held to access fields within matrix_mdev,
+ * and kvm->lock must be taken before mdevs_lock to satisfy the lock
+ * ordering requirement and prevent a lockdep splat.
+ */
+ if (matrix_mdev->kvm)
+ mutex_lock(&matrix_mdev->kvm->lock);
+ mutex_lock(&matrix_dev->mdevs_lock);
+
if (bitmap_empty(matrix_mdev->apm_add, AP_DEVICES) &&
bitmap_empty(matrix_mdev->aqm_add, AP_DOMAINS) &&
bitmap_empty(matrix_mdev->adm_add, AP_DOMAINS))
- continue;
+ goto do_unlock;
vfio_ap_mdev_hot_plug_cfg(matrix_mdev);
bitmap_clear(matrix_mdev->apm_add, 0, AP_DEVICES);
bitmap_clear(matrix_mdev->aqm_add, 0, AP_DOMAINS);
bitmap_clear(matrix_mdev->adm_add, 0, AP_DOMAINS);
+
+do_unlock:
+ mutex_unlock(&matrix_dev->mdevs_lock);
+ if (matrix_mdev->kvm)
+ mutex_unlock(&matrix_mdev->kvm->lock);
}
mutex_unlock(&matrix_dev->guests_lock);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0105/1376] s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0104/1376] s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0106/1376] s390/vfio-ap: Fix NULL deref in status_show() during queue probe Greg Kroah-Hartman
` (893 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anthony Krowiak, Matthew Rosato,
Christian Borntraeger
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anthony Krowiak <akrowiak@linux.ibm.com>
commit 917f509bfb88048094dbb85c4e9dbc4d6fe4a886 upstream.
The vfio_ap_mdev_hot_unplug_cfg() function uses the return value of
bitmap_andnot() to determine whether the guest APCB needs to be updated.
However, bitmap_andnot() returns false when the resulting destination
bitmap is empty. This means that if the only adapter, domain or control
domain assigned to an mdev is removed from the host's AP configuration,
the bit is correctly cleared from the shadow APCB, but bitmap_andnot()
returns false because the result is an empty bitmap. Consequently,
do_hotplug remains 0 and vfio_ap_mdev_update_guest_apcb() is never called,
leaving the KVM guest with stale hardware access to the unplugged AP
devices.
Fix this by replacing the bitmap_andnot() return value check with
bitmap_intersects() to determine whether the shadow APCB actually
overlaps with the removal mask. If there is an intersection, call
bitmap_andnot() solely for its side effect of clearing the bits, then
unconditionally set do_hotplug to trigger the guest APCB update.
Fixes: eeb386aeb5b7c ("s390/vfio-ap: handle config changed and scan complete notification")
Cc: stable@vger.kernel.org
Signed-off-by: Anthony Krowiak <akrowiak@linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/crypto/vfio_ap_ops.c | 30 +++++++++++++++++-------------
1 file changed, 17 insertions(+), 13 deletions(-)
--- a/drivers/s390/crypto/vfio_ap_ops.c
+++ b/drivers/s390/crypto/vfio_ap_ops.c
@@ -2505,24 +2505,28 @@ static void vfio_ap_mdev_hot_unplug_cfg(
unsigned long *aqrem,
unsigned long *cdrem)
{
- int do_hotplug = 0;
+ bool do_hotplug = false;
- if (!bitmap_empty(aprem, AP_DEVICES)) {
- do_hotplug |= bitmap_andnot(matrix_mdev->shadow_apcb.apm,
- matrix_mdev->shadow_apcb.apm,
- aprem, AP_DEVICES);
+ if (bitmap_intersects(matrix_mdev->shadow_apcb.apm, aprem, AP_DEVICES)) {
+ bitmap_andnot(matrix_mdev->shadow_apcb.apm,
+ matrix_mdev->shadow_apcb.apm,
+ aprem, AP_DEVICES);
+ do_hotplug = true;
}
- if (!bitmap_empty(aqrem, AP_DOMAINS)) {
- do_hotplug |= bitmap_andnot(matrix_mdev->shadow_apcb.aqm,
- matrix_mdev->shadow_apcb.aqm,
- aqrem, AP_DEVICES);
+ if (bitmap_intersects(matrix_mdev->shadow_apcb.aqm, aqrem, AP_DOMAINS)) {
+ bitmap_andnot(matrix_mdev->shadow_apcb.aqm,
+ matrix_mdev->shadow_apcb.aqm,
+ aqrem, AP_DOMAINS);
+ do_hotplug = true;
}
- if (!bitmap_empty(cdrem, AP_DOMAINS))
- do_hotplug |= bitmap_andnot(matrix_mdev->shadow_apcb.adm,
- matrix_mdev->shadow_apcb.adm,
- cdrem, AP_DOMAINS);
+ if (bitmap_intersects(matrix_mdev->shadow_apcb.adm, cdrem, AP_DOMAINS)) {
+ bitmap_andnot(matrix_mdev->shadow_apcb.adm,
+ matrix_mdev->shadow_apcb.adm,
+ cdrem, AP_DOMAINS);
+ do_hotplug = true;
+ }
if (do_hotplug)
vfio_ap_mdev_update_guest_apcb(matrix_mdev);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0106/1376] s390/vfio-ap: Fix NULL deref in status_show() during queue probe
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0105/1376] s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0107/1376] s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap Greg Kroah-Hartman
` (892 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anthony Krowiak, Matthew Rosato,
Christian Borntraeger
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anthony Krowiak <akrowiak@linux.ibm.com>
commit dd6f4ef6f8a37412909ad787c837332fb070159c upstream.
When vfio_ap_mdev_probe_queue() creates the sysfs attribute group,
the queue's driver data has not yet been set. A concurrent read of
the 'status' attribute can therefore call dev_get_drvdata() and
get NULL, which is then passed directly to
vfio_ap_mdev_for_queue() where q->apqn is unconditionally
dereferenced, causing a NULL pointer dereference.
Fix this by acquiring the update locks before calling
sysfs_create_group(). The status_show() function acquires
guests_lock before reading the driver data, so any concurrent
read will block until after dev_set_drvdata() has been called
and the update locks are released.
As a bonus, the APQN no longer needs to be read from the queue
struct after allocation — it can be read directly from apdev
before allocation and stored in a local variable, which is then
assigned to q->apqn once the allocation succeeds.
Fixes: 260f3ea141382 ("s390/vfio-ap: move probe and remove callbacks to vfio_ap_ops.c")
Cc: stable@vger.kernel.org
Signed-off-by: Anthony Krowiak <akrowiak@linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/crypto/vfio_ap_ops.c | 33 +++++++++++++++++++++++++++++----
1 file changed, 29 insertions(+), 4 deletions(-)
--- a/drivers/s390/crypto/vfio_ap_ops.c
+++ b/drivers/s390/crypto/vfio_ap_ops.c
@@ -2261,6 +2261,23 @@ static ssize_t status_show(struct device
mutex_lock(&matrix_dev->mdevs_lock);
q = dev_get_drvdata(&apdev->device);
+
+ /*
+ * Make sure the drvdata has been set before proceeding. There is a
+ * possibility that the drvdata was not set if the vfio_ap_queue object
+ * could not be allocated when the queue device was probed. In that case,
+ * the locks used in vfio_ap_mdev_probe_queue() are released prior to
+ * removing the sysfs status attribute to avoid a lockdep
+ * splat. That opens a very small window where the status attribute is
+ * still available without the vfio_ap_queue object having been
+ * stored in the device drvdata. In that case, indicate the queue is not
+ * assigned.
+ */
+ if (!q) {
+ nchars = sysfs_emit(buf, "%s\n", AP_QUEUE_UNASSIGNED);
+ goto done;
+ }
+
matrix_mdev = vfio_ap_mdev_for_queue(q);
/* If the queue is assigned to the matrix mediated device, then
@@ -2288,6 +2305,7 @@ static ssize_t status_show(struct device
AP_QUEUE_UNASSIGNED);
}
+done:
mutex_unlock(&matrix_dev->mdevs_lock);
return nchars;
@@ -2361,14 +2379,17 @@ void vfio_ap_mdev_unregister(void)
int vfio_ap_mdev_probe_queue(struct ap_device *apdev)
{
- int ret;
+ int ret, apqn;
struct vfio_ap_queue *q;
DECLARE_BITMAP(apm_filtered, AP_DEVICES);
struct ap_matrix_mdev *matrix_mdev;
+ apqn = to_ap_queue(&apdev->device)->qid;
+ matrix_mdev = get_update_locks_by_apqn(apqn);
+
ret = sysfs_create_group(&apdev->device.kobj, &vfio_queue_attr_group);
if (ret)
- return ret;
+ goto err_release_locks;
q = kzalloc(sizeof(*q), GFP_KERNEL);
if (!q) {
@@ -2376,11 +2397,10 @@ int vfio_ap_mdev_probe_queue(struct ap_d
goto err_remove_group;
}
- q->apqn = to_ap_queue(&apdev->device)->qid;
+ q->apqn = apqn;
q->saved_isc = VFIO_AP_ISC_INVALID;
memset(&q->reset_status, 0, sizeof(q->reset_status));
INIT_WORK(&q->reset_work, apq_reset_check);
- matrix_mdev = get_update_locks_by_apqn(q->apqn);
if (matrix_mdev) {
vfio_ap_mdev_link_queue(matrix_mdev, q);
@@ -2409,8 +2429,13 @@ done:
return ret;
err_remove_group:
+ release_update_locks_for_mdev(matrix_mdev);
sysfs_remove_group(&apdev->device.kobj, &vfio_queue_attr_group);
return ret;
+
+err_release_locks:
+ release_update_locks_for_mdev(matrix_mdev);
+ return ret;
}
void vfio_ap_mdev_remove_queue(struct ap_device *apdev)
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0107/1376] s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0106/1376] s390/vfio-ap: Fix NULL deref in status_show() during queue probe Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0108/1376] s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object Greg Kroah-Hartman
` (891 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anthony Krowiak, Matthew Rosato,
Christian Borntraeger
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anthony Krowiak <akrowiak@linux.ibm.com>
commit bf09b9d7cd7890bc3a3b7eb63d5ece15f88bfde7 upstream.
The DECLARE_BITMAP(apm_filtered, AP_DEVICES) macro allocates the bitmap
on the stack without zero-initializing it.
In vfio_ap_mdev_hot_plug_cfg(), the vfio_ap_mdev_filter_matrix() function
is only called to initialize and populate apm_filtered if either
filter_adapters or filter_domains is true. If the hot plug configuration
change only adds control domains (meaning filter_cdoms is true, but
filter_adapters and filter_domains are both false),
vfio_ap_mdev_filter_matrix() is bypassed.
Consequently, apm_filtered is passed to reset_queues_for_apids() with
uninitialized stack garbage. This can cause reset_queues_for_apids() to
interpret arbitrary stack garbage bits as valid APIDs to reset, potentially
performing unintended guest hardware queue resets.
Fix this by zero-initializing the apm_filtered bitmap at the beginning of
vfio_ap_mdev_hot_plug_cfg() using bitmap_zero().
Fixes: eeb386aeb5b7c ("s390/vfio-ap: handle config changed and scan complete notification")
Cc: stable@vger.kernel.org
Signed-off-by: Anthony Krowiak <akrowiak@linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/crypto/vfio_ap_ops.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/drivers/s390/crypto/vfio_ap_ops.c
+++ b/drivers/s390/crypto/vfio_ap_ops.c
@@ -2809,6 +2809,15 @@ static void vfio_ap_mdev_hot_plug_cfg(st
DECLARE_BITMAP(apm_filtered, AP_DEVICES);
bool filter_domains, filter_adapters, filter_cdoms, do_hotplug = false;
+ /*
+ * Zero out the apm_filtered bitmap in case there are no adapters or
+ * domains to be added, but only control domains. In that case,
+ * vfio_ap_mdev_filter_matrix() - which initializes apm_filtered - will
+ * not get called and the reset_queues_for_apids will crash because it
+ * will access an uninitialized bitmap.
+ */
+ bitmap_zero(apm_filtered, AP_DEVICES);
+
filter_adapters = bitmap_intersects(matrix_mdev->matrix.apm,
matrix_mdev->apm_add, AP_DEVICES);
filter_domains = bitmap_intersects(matrix_mdev->matrix.aqm,
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0108/1376] s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0107/1376] s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0109/1376] mtd: afs: validate v2 image info bounds Greg Kroah-Hartman
` (890 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anthony Krowiak, Matthew Rosato,
Christian Borntraeger
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anthony Krowiak <akrowiak@linux.ibm.com>
commit 5883528250be57fa92270459b33603ff52de0a91 upstream.
In the vfio_ap_mdev_cfg_add function, the apm_add, aqm_add and adm_add
fields of an ap_matrix_mdev object fields are modified while not holding
the matrix_dev->mdevs_lock. This lock must be held while making these
to guard against a race condition with another caller that may be
concurrently modifying these fields or any of the fields in the
matrix_mdev->matrix.
Fixes: eeb386aeb5b7c ("s390/vfio-ap: handle config changed and scan complete notification")
Cc: stable@vger.kernel.org
Signed-off-by: Anthony Krowiak <akrowiak@linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/crypto/vfio_ap_ops.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/s390/crypto/vfio_ap_ops.c
+++ b/drivers/s390/crypto/vfio_ap_ops.c
@@ -2737,12 +2737,20 @@ static void vfio_ap_mdev_cfg_add(unsigne
vfio_ap_filter_apid_by_qtype(apm_add, aqm_add);
list_for_each_entry(matrix_mdev, &matrix_dev->mdev_list, node) {
+ /*
+ * The mdevs_lock must be held in order to access fields
+ * within matrix_mdev
+ */
+ mutex_lock(&matrix_dev->mdevs_lock);
+
bitmap_and(matrix_mdev->apm_add,
matrix_mdev->matrix.apm, apm_add, AP_DEVICES);
bitmap_and(matrix_mdev->aqm_add,
matrix_mdev->matrix.aqm, aqm_add, AP_DOMAINS);
bitmap_and(matrix_mdev->adm_add,
matrix_mdev->matrix.adm, adm_add, AP_DEVICES);
+
+ mutex_unlock(&matrix_dev->mdevs_lock);
}
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0109/1376] mtd: afs: validate v2 image info bounds
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0108/1376] s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0110/1376] mtd: mtdoops: free page bitmap when the backing MTD is removed Greg Kroah-Hartman
` (889 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Linus Walleij,
Miquel Raynal
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
commit e9290031f736e99ad17c25c00311c92c266843b7 upstream.
The AFS v2 parser uses footer[8] to locate the image information block
inside the current erase block, then uses the image information
region_count to walk entries from a fixed local array. The footer offset
and region count come from flash contents and are not checked against the
erase block or the local image-info array before use.
Reject v2 entries whose image information offset would underflow the
erase block calculation, and reject region counts that cannot fit in the
local image-info array before walking region entries.
Fixes: b7cf5e2830bb ("mtd: afs: add v2 partition parsing")
Cc: stable@vger.kernel.org
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Acked-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/parsers/afs.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/mtd/parsers/afs.c
+++ b/drivers/mtd/parsers/afs.c
@@ -235,6 +235,9 @@ static int afs_parse_v2_partition(struct
pr_debug("Parsing v2 partition @%08x-%08x\n",
off, off + mtd->erasesize);
+ if (mtd->erasesize < sizeof(footer))
+ return -EINVAL;
+
/* First read the footer */
ptr = off + mtd->erasesize - sizeof(footer);
ret = mtd_read(mtd, ptr, sizeof(footer), &sz, (u_char *)footer);
@@ -245,6 +248,8 @@ static int afs_parse_v2_partition(struct
}
name = (char *) &footer[0];
version = footer[9];
+ if (footer[8] > mtd->erasesize - sizeof(footer))
+ return -EINVAL;
ptr = off + mtd->erasesize - sizeof(footer) - footer[8];
pr_debug("found image \"%s\", version %08x, info @%08x\n",
@@ -278,6 +283,8 @@ static int afs_parse_v2_partition(struct
entrypoint = imginfo[pad];
attributes = imginfo[pad+1];
region_count = imginfo[pad+2];
+ if (region_count > (ARRAY_SIZE(imginfo) - pad - 3) / 4)
+ return -EINVAL;
block_start = imginfo[20];
block_end = imginfo[21];
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0110/1376] mtd: mtdoops: free page bitmap when the backing MTD is removed
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0109/1376] mtd: afs: validate v2 image info bounds Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0111/1376] mtd: rawnand: validate ONFI extended parameter page sections Greg Kroah-Hartman
` (888 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xu Rao, Miquel Raynal
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Rao <raoxu@uniontech.com>
commit 956e7da12c114f13c63d126ab1d79c3b6a819060 upstream.
mtdoops_notify_add() allocates oops_page_used when the configured MTD
device is registered. mtdoops_notify_remove() detaches from that device
but leaves the bitmap allocated. If the same MTD device is later
registered again, the add path allocates a new bitmap and overwrites the
old pointer, leaking one vmalloc allocation per remove/add cycle.
This is only visible when the backing MTD device can disappear and be
registered again while mtdoops remains loaded, so the usual static MTD
case does not expose it.
Free the bitmap after unregistering the dumper and flushing the pending
workers, then clear the pointer and page count before a later attach can
allocate fresh state. Clearing the pointer also keeps the module exit
path from freeing the same bitmap a second time after a remove event.
Fixes: be95745f0167 ("mtd: mtdoops: keep track of used/unused pages in an array")
Cc: stable@vger.kernel.org
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/mtdoops.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/mtd/mtdoops.c
+++ b/drivers/mtd/mtdoops.c
@@ -393,6 +393,9 @@ static void mtdoops_notify_remove(struct
cxt->mtd = NULL;
flush_work(&cxt->work_erase);
flush_work(&cxt->work_write);
+ vfree(cxt->oops_page_used);
+ cxt->oops_page_used = NULL;
+ cxt->oops_pages = 0;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0111/1376] mtd: rawnand: validate ONFI extended parameter page sections
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0110/1376] mtd: mtdoops: free page bitmap when the backing MTD is removed Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0112/1376] batman-adv: fix stale receive device on merged fragments Greg Kroah-Hartman
` (887 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Miquel Raynal
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
commit e5e415262330bd70f983e091d8919d9dcd99e475 upstream.
nand_flash_detect_ext_param_page() allocates the length declared by the
ONFI parameter page, then treats the data as a fixed header followed by
variable-length sections. It reads that header and advances over sections
without first proving that the fixed page and each current section fit in
the allocation.
Reject pages shorter than the fixed header, track the remaining variable
area while walking sections, and require the ECC section to contain every
field read from struct onfi_ext_ecc_info. Use device-scoped diagnostics
that identify the malformed ONFI section.
Fixes: 6dcbe0cdd83f ("mtd: get the ECC info from the Extended Parameter Page")
Cc: stable@vger.kernel.org
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/nand_onfi.c | 27 +++++++++++++++++++++++++--
1 file changed, 25 insertions(+), 2 deletions(-)
--- a/drivers/mtd/nand/raw/nand_onfi.c
+++ b/drivers/mtd/nand/raw/nand_onfi.c
@@ -35,16 +35,21 @@ static int nand_flash_detect_ext_param_p
struct nand_onfi_params *p)
{
struct nand_device *base = &chip->base;
+ struct mtd_info *mtd = nand_to_mtd(chip);
struct nand_ecc_props requirements;
struct onfi_ext_param_page *ep;
struct onfi_ext_section *s;
struct onfi_ext_ecc_info *ecc;
+ size_t remaining, section_len;
uint8_t *cursor;
int ret;
int len;
int i;
len = le16_to_cpu(p->ext_param_page_length) * 16;
+ if (len < sizeof(*ep))
+ return -EINVAL;
+
ep = kmalloc(len, GFP_KERNEL);
if (!ep)
return -ENOMEM;
@@ -77,11 +82,29 @@ static int nand_flash_detect_ext_param_p
/* find the ECC section. */
cursor = (uint8_t *)(ep + 1);
+ remaining = len - sizeof(*ep);
for (i = 0; i < ONFI_EXT_SECTION_MAX; i++) {
s = ep->sections + i;
- if (s->type == ONFI_SECTION_TYPE_2)
+ section_len = s->length * 16;
+ if (section_len > remaining) {
+ dev_dbg(&mtd->dev,
+ "ONFI extended parameter section %d exceeds page\n",
+ i);
+ goto ext_out;
+ }
+
+ if (s->type == ONFI_SECTION_TYPE_2) {
+ if (section_len < sizeof(*ecc)) {
+ dev_dbg(&mtd->dev,
+ "ONFI extended parameter ECC section %d is too short\n",
+ i);
+ goto ext_out;
+ }
break;
- cursor += s->length * 16;
+ }
+
+ cursor += section_len;
+ remaining -= section_len;
}
if (i == ONFI_EXT_SECTION_MAX) {
pr_debug("We can not find the ECC section.\n");
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0112/1376] batman-adv: fix stale receive device on merged fragments
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0111/1376] mtd: rawnand: validate ONFI extended parameter page sections Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0113/1376] batman-adv: mcast: ensure unshared skb for multicast packets Greg Kroah-Hartman
` (886 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Vega, Zhiling Zou, Sven Eckelmann
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhiling Zou <zhilinz@nebusec.ai>
commit ad46c907d7d9975a285c1e89a4adde652eaa93f5 upstream.
Fragment reassembly reuses the skb from the highest-numbered buffered
fragment as the merged packet. When that fragment was received on a hard
interface which is deleted before the chain completes, the merged skb can
re-enter the receive path with a stale skb->dev and skb_iif.
batadv_batman_skb_recv() passes such merged packets through the normal
receive handlers again. DAT and bridge loop avoidance both derive the ARP
header length from skb->dev, so they can dereference the freed net_device
before the packet reaches the local mesh interface.
Refresh the receive device metadata from the current receive device before
running the packet handlers. This keeps internally reinjected merged
fragments consistent with the normal receive path after hard interface
teardown.
Fixes: 610bfc6bc99b ("batman-adv: Receive fragmented packets and merge")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/main.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
@@ -458,6 +458,10 @@ int batadv_batman_skb_recv(struct sk_buf
if (!skb)
goto err_put;
+ /* Merged fragments re-enter here with reused skb metadata. */
+ skb->dev = dev;
+ skb->skb_iif = dev->ifindex;
+
/* packet should hold at least type and version */
if (unlikely(!pskb_may_pull(skb, 2)))
goto err_free;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0113/1376] batman-adv: mcast: ensure unshared skb for multicast packets
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0112/1376] batman-adv: fix stale receive device on merged fragments Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0114/1376] batman-adv: mcast: linearize skbuff for packet generation Greg Kroah-Hartman
` (885 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sven Eckelmann
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit 82bf207f48ebb7a38157f1d91dac884fc9b8cfd8 upstream.
When a packet is transmitted via a batman-adv interface and has already
enough room for the header then nothing will make sure that the skbuff is
unshared. But it is not allowed to modify a currently shared skbuff.
Always make sure that the pskb_expand_head() is not only called for a too
small header but also for shared skbuffs.
Cc: stable@vger.kernel.org
Fixes: 90039133221e ("batman-adv: mcast: implement multicast packet generation")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/multicast_forw.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/net/batman-adv/multicast_forw.c
+++ b/net/batman-adv/multicast_forw.c
@@ -1100,8 +1100,7 @@ static int batadv_mcast_forw_expand_head
return -EINVAL;
}
- if (skb_headroom(skb) < hdr_size &&
- pskb_expand_head(skb, hdr_size, 0, GFP_ATOMIC) < 0)
+ if (skb_cow(skb, hdr_size) < 0)
return -ENOMEM;
return 0;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0114/1376] batman-adv: mcast: linearize skbuff for packet generation
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0113/1376] batman-adv: mcast: ensure unshared skb for multicast packets Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0115/1376] batman-adv: dat: avoid unaligned fault in IP extraction Greg Kroah-Hartman
` (884 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Sven Eckelmann
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit 6a30a59e2660afd03c975f1b8eae6a2301161197 upstream.
batadv_mcast_forw_packet() and batadv_mcast_forw_scrape() is not only
called (indirectly) by the unsharing+linearizing batadv_recv_mcast_packet()
handler. When it is called (indirectly) by batadv_mcast_forw_mcsend() then
it will be unshared but not linearized. The SKB_LINEAR_ASSERT() can
therefore cause a fatal BUG().
The linearization should happen during the expansion of the head because
the scrape function can be hit already during the initial
batadv_mcast_forw_mode() selection code:
* batadv_interface_tx
* batadv_mcast_forw_mode
* batadv_mcast_forw_mode_by_count()
* batadv_mcast_forw_push()
-> calls batadv_mcast_forw_expand_head() before everything else
* batadv_mcast_forw_push_tvlvs()
* batadv_mcast_forw_push_dests()
* batadv_mcast_forw_push_adjust_padding()
* batadv_mcast_forw_scrape()
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: 90039133221e ("batman-adv: mcast: implement multicast packet generation")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/multicast_forw.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/net/batman-adv/multicast_forw.c
+++ b/net/batman-adv/multicast_forw.c
@@ -1103,6 +1103,10 @@ static int batadv_mcast_forw_expand_head
if (skb_cow(skb, hdr_size) < 0)
return -ENOMEM;
+ /* batadv_mcast_forw_scrape() + batadv_mcast_forw_packet() require linearized skb */
+ if (skb_linearize(skb) < 0)
+ return -ENOMEM;
+
return 0;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0115/1376] batman-adv: dat: avoid unaligned fault in IP extraction
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0114/1376] batman-adv: mcast: linearize skbuff for packet generation Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0116/1376] batman-adv: bla: fix freeing of claims on meshif deletion Greg Kroah-Hartman
` (883 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Sven Eckelmann
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit 0121afa52cdb88cfb4d5d7bd126a23a9100121d8 upstream.
Independent of the alignment of the ARP packet in the SKB, either the
batadv_arp_ip_src or the batadv_arp_ip_dst will have an unaligned access
(on HW without native unaligned read support).
Use get_unaligned() to handle this properly on all architectures.
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: 5c3a0e553593 ("batman-adv: Distributed ARP Table - add ARP parsing functions")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/distributed-arp-table.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -250,7 +250,10 @@ static u8 *batadv_arp_hw_src(struct sk_b
*/
static __be32 batadv_arp_ip_src(struct sk_buff *skb, int hdr_size)
{
- return *(__force __be32 *)(batadv_arp_hw_src(skb, hdr_size) + ETH_ALEN);
+ u8 *src = batadv_arp_hw_src(skb, hdr_size) + ETH_ALEN;
+ __be32 *ip = (__force __be32 *)src;
+
+ return get_unaligned(ip);
}
/**
@@ -275,8 +278,9 @@ static u8 *batadv_arp_hw_dst(struct sk_b
static __be32 batadv_arp_ip_dst(struct sk_buff *skb, int hdr_size)
{
u8 *dst = batadv_arp_hw_src(skb, hdr_size) + ETH_ALEN * 2 + 4;
+ __be32 *ip = (__force __be32 *)dst;
- return *(__force __be32 *)dst;
+ return get_unaligned(ip);
}
/**
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0116/1376] batman-adv: bla: fix freeing of claims on meshif deletion
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0115/1376] batman-adv: dat: avoid unaligned fault in IP extraction Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0117/1376] batman-adv: bla: prevent CRC corruptions after claim flush Greg Kroah-Hartman
` (882 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Sven Eckelmann
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit 8d128c932bced74e3b1625ba3d7c78ef122a88a7 upstream.
When the mesh interface is getting deleted, then
batadv_bla_del_backbone_claims() (via batadv_bla_purge_backbone_gw()) could
make sure that all claims gets removed. But this function is only executed
when bat_priv->bla.claim_hash is not NULL. And since batadv_bla_free() is
always setting it to NULL before it is (indirectly) called, it was never
actually executed.
But the batadv_bla_purge_claims() -> batadv_handle_unclaim() is at the
moment too fragile because the BLA code is not handling the rehashing in
batadv_bla_update_orig_address(). The stored backbone address doesn't have
to be the one actually used for the hash bucket selection during the
initial adding of the backbone. The batadv_handle_unclaim() can therefore
fail to find the respective backbone for the unclaim and then stop the
deletion.
But the actual backbone_gw object is not needed for the unclaim because all
relevant information is always provided by the caller. And the check for
the existence of the backbone_gw doesn't provide any additional security
check for the deletion of a claim.
Cc: stable@kernel.org
Fixes: 23721387c409 ("batman-adv: add basic bridge loop avoidance code")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/bridge_loop_avoidance.c | 10 +---------
1 file changed, 1 insertion(+), 9 deletions(-)
--- a/net/batman-adv/bridge_loop_avoidance.c
+++ b/net/batman-adv/bridge_loop_avoidance.c
@@ -941,26 +941,18 @@ static bool batadv_handle_unclaim(struct
const u8 *backbone_addr, const u8 *claim_addr,
unsigned short vid)
{
- struct batadv_bla_backbone_gw *backbone_gw;
-
/* unclaim in any case if it is our own */
if (primary_if && batadv_compare_eth(backbone_addr,
primary_if->net_dev->dev_addr))
batadv_bla_send_claim(bat_priv, claim_addr, vid,
BATADV_CLAIM_TYPE_UNCLAIM);
- backbone_gw = batadv_backbone_hash_find(bat_priv, backbone_addr, vid);
-
- if (!backbone_gw)
- return true;
-
/* this must be an UNCLAIM frame */
batadv_dbg(BATADV_DBG_BLA, bat_priv,
"%s(): UNCLAIM %pM on vid %d (sent by %pM)...\n", __func__,
- claim_addr, batadv_print_vid(vid), backbone_gw->orig);
+ claim_addr, batadv_print_vid(vid), backbone_addr);
batadv_bla_del_claim(bat_priv, claim_addr, vid);
- batadv_backbone_gw_put(backbone_gw);
return true;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0117/1376] batman-adv: bla: prevent CRC corruptions after claim flush
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0116/1376] batman-adv: bla: fix freeing of claims on meshif deletion Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0118/1376] clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk Greg Kroah-Hartman
` (881 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sven Eckelmann
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit 89f3502ff6878798be96461b2eebd64ba3c3874c upstream.
When batadv_bla_del_backbone_claims() tried to remove all claims of a
backbone, it sets the CRC to 0. It assumes that the it had the last
reference of the claims because batadv_claim_release() (which runs after
the last reference was released), is XORing the crc16 of the claim address
with the backbone CRC.
If there would be a parallel holder of any of these references, it could
happen that the backbone CRC is (0 ^ crc16(delayed_released_claim)). Which
is the wrong starting point for the new claims it may receive when the
remote answers the claim request from batadv_bla_send_request().
This reinitializations can be completely dropped to avoid this problem.
batadv_claim_release() will take care of fixing the backbone CRC.
Cc: stable@vger.kernel.org
Fixes: 23721387c409 ("batman-adv: add basic bridge loop avoidance code")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/bridge_loop_avoidance.c | 5 -----
1 file changed, 5 deletions(-)
--- a/net/batman-adv/bridge_loop_avoidance.c
+++ b/net/batman-adv/bridge_loop_avoidance.c
@@ -323,11 +323,6 @@ batadv_bla_del_backbone_claims(struct ba
}
spin_unlock_bh(list_lock);
}
-
- /* all claims gone, initialize CRC */
- spin_lock_bh(&backbone_gw->crc_lock);
- backbone_gw->crc = BATADV_BLA_CRC_INIT;
- spin_unlock_bh(&backbone_gw->crc_lock);
}
/**
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0118/1376] clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0117/1376] batman-adv: bla: prevent CRC corruptions after claim flush Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0119/1376] clk: qcom: gcc-msm8939: " Greg Kroah-Hartman
` (880 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Stephan Gerhold,
Bjorn Andersson
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <stephan.gerhold@linaro.org>
commit c5339edc6abb601ea10df910ea0b1592fa1016f3 upstream.
According to the APQ8016E TRM, the GCC_BLSP1_SLEEP_CBCR register is
read-only and only has the CLK_OFF bit to check if the clock is running.
This is a shared vote clock, the correct way to enable it is to vote for
BLSP1_SLEEP_CLK_ENA (BIT(9)) in GCC_APCS_CLOCK_BRANCH_ENA_VOTE (0x45004).
Cc: stable@vger.kernel.org
Fixes: 3966fab8b6ab ("clk: qcom: Add MSM8916 Global Clock Controller support")
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
Link: https://lore.kernel.org/r/20260706-qcom-clk-mdm9607-fixes-v2-1-745565101869@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/qcom/gcc-msm8916.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/clk/qcom/gcc-msm8916.c
+++ b/drivers/clk/qcom/gcc-msm8916.c
@@ -1589,9 +1589,10 @@ static struct clk_branch gcc_blsp1_ahb_c
static struct clk_branch gcc_blsp1_sleep_clk = {
.halt_reg = 0x01004,
+ .halt_check = BRANCH_HALT_VOTED,
.clkr = {
- .enable_reg = 0x01004,
- .enable_mask = BIT(0),
+ .enable_reg = 0x45004,
+ .enable_mask = BIT(9),
.hw.init = &(struct clk_init_data){
.name = "gcc_blsp1_sleep_clk",
.parent_data = &(const struct clk_parent_data){
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0119/1376] clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0118/1376] clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0120/1376] clk: rockchip: rk3588: Dont change PLL rates when setting dclk_vop2_src Greg Kroah-Hartman
` (879 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Stephan Gerhold,
Bjorn Andersson
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <stephan.gerhold@linaro.org>
commit fc611445b021262b0d4ace6f716a360663816287 upstream.
MSM8939 is similar to MSM8916, where the GCC_BLSP1_SLEEP_CBCR register is
read-only and only has the CLK_OFF bit to check if the clock is running.
This is a shared vote clock, the correct way to enable it is to vote for
BLSP1_SLEEP_CLK_ENA (BIT(9)) in GCC_APCS_CLOCK_BRANCH_ENA_VOTE (0x45004).
Cc: stable@vger.kernel.org
Fixes: 1664014e4679 ("clk: qcom: gcc-msm8939: Add MSM8939 Generic Clock Controller")
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
Link: https://lore.kernel.org/r/20260706-qcom-clk-mdm9607-fixes-v2-2-745565101869@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/qcom/gcc-msm8939.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/clk/qcom/gcc-msm8939.c
+++ b/drivers/clk/qcom/gcc-msm8939.c
@@ -1929,9 +1929,10 @@ static struct clk_branch gcc_blsp1_ahb_c
static struct clk_branch gcc_blsp1_sleep_clk = {
.halt_reg = 0x01004,
+ .halt_check = BRANCH_HALT_VOTED,
.clkr = {
- .enable_reg = 0x01004,
- .enable_mask = BIT(0),
+ .enable_reg = 0x45004,
+ .enable_mask = BIT(9),
.hw.init = &(struct clk_init_data){
.name = "gcc_blsp1_sleep_clk",
.ops = &clk_branch2_ops,
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0120/1376] clk: rockchip: rk3588: Dont change PLL rates when setting dclk_vop2_src
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0119/1376] clk: qcom: gcc-msm8939: " Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0121/1376] clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src Greg Kroah-Hartman
` (878 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Heiko Stuebner, Quentin Schulz,
Chris Morgan, Heiko Stuebner
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Stuebner <heiko.stuebner@cherry.de>
commit 13b10571cc353448275365ede1a5396d20dfe839 upstream.
dclk_vop2_src currently has the CLK_SET_RATE_PARENT flag set, which is
very different from dclk_vop0_src or dclk_vop1_src, which don't have it.
With this flag in dclk_vop2_src, actually setting the clock then results
in a lot of other peripherals breaking, because setting the rate results
in the PLL source getting changed:
[ 14.898718] clk_core_set_rate_nolock: setting rate for dclk_vop2 to 152840000
[ 15.155017] clk_change_rate: setting rate for pll_gpll to 1680000000
[ clk adjusting every gpll user ]
This includes possibly the other vops, i2s, spdif and even the uarts.
Among other possible things, this breaks the uart console on a board
I use. Sometimes it recovers later on, but there will be a big block
of garbled output for a while at least.
Shared PLLs should not be changed by individual users, so drop this flag
from dclk_vop2_src.
Fixes: f1c506d152ff ("clk: rockchip: add clock controller for the RK3588")
Cc: stable@vger.kernel.org
Tested-by: Quentin Schulz <quentin.schulz@cherry.de> # RK3588 Tiger w/ DP
Signed-off-by: Heiko Stuebner <heiko.stuebner@cherry.de>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Tested-by: Chris Morgan <macromorgan@hotmail.com>
Link: https://patch.msgid.link/20260304121426.1184680-2-heiko@sntech.de
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/rockchip/clk-rk3588.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/clk/rockchip/clk-rk3588.c
+++ b/drivers/clk/rockchip/clk-rk3588.c
@@ -2113,7 +2113,7 @@ static struct rockchip_clk_branch rk3588
COMPOSITE(DCLK_VOP1_SRC, "dclk_vop1_src", gpll_cpll_v0pll_aupll_p, 0,
RK3588_CLKSEL_CON(111), 14, 2, MFLAGS, 9, 5, DFLAGS,
RK3588_CLKGATE_CON(52), 11, GFLAGS),
- COMPOSITE(DCLK_VOP2_SRC, "dclk_vop2_src", gpll_cpll_v0pll_aupll_p, CLK_SET_RATE_PARENT | CLK_SET_RATE_NO_REPARENT,
+ COMPOSITE(DCLK_VOP2_SRC, "dclk_vop2_src", gpll_cpll_v0pll_aupll_p, CLK_SET_RATE_NO_REPARENT,
RK3588_CLKSEL_CON(112), 5, 2, MFLAGS, 0, 5, DFLAGS,
RK3588_CLKGATE_CON(52), 12, GFLAGS),
COMPOSITE_NODIV(DCLK_VOP0, "dclk_vop0", dclk_vop0_p,
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0121/1376] clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0120/1376] clk: rockchip: rk3588: Dont change PLL rates when setting dclk_vop2_src Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0122/1376] clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src Greg Kroah-Hartman
` (877 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Stephan Gerhold,
Bjorn Andersson
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <stephan@gerhold.net>
commit 38d06956f60675f906dc3f5b70b3b52103b86a7d upstream.
This clock does not exist on the specified address on MDM9607.
Reading/writing the registers always results in 0 or crashes. The math in
the frequency table is also broken. GPLL2 on MDM9607 runs at 480 MHz, so:
- F(155000000, P_GPLL2, 6, 0, 0), // 480 MHz/6 = 80 MHz, not 155 MHz
- F(310000000, P_GPLL2, 3, 0, 0), // 480 MHz/3 = 160 MHz, not 310 MHz
Presumably, this definition was mistakenly copied as-is from gcc-msm8916
(which uses 930 MHz for GPLL2). There are no branch consumers of this root
clock inside gcc-mdm9607 (notably, gcc_apss_tcu_clk has bimc_ddr_clk_src as
parent instead of this clock), so we can just drop it.
It seems like this clock does exist on this SoC on a different address, but
since there is no user and reference code for it, it is still better to
drop it.
Cc: stable@vger.kernel.org
Fixes: 48b7253264ea ("clk: qcom: Add MDM9607 GCC driver")
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
Link: https://lore.kernel.org/r/20260706-qcom-clk-mdm9607-fixes-v2-6-745565101869@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/qcom/gcc-mdm9607.c | 35 -----------------------------------
1 file changed, 35 deletions(-)
--- a/drivers/clk/qcom/gcc-mdm9607.c
+++ b/drivers/clk/qcom/gcc-mdm9607.c
@@ -158,20 +158,6 @@ static const struct clk_parent_data gcc_
{ .hw = &gpll2.clkr.hw },
};
-static const struct parent_map gcc_xo_gpll0_gpll1_gpll2_map[] = {
- { P_XO, 0 },
- { P_GPLL0, 1 },
- { P_GPLL1, 2 },
- { P_GPLL2, 3 },
-};
-
-static const struct clk_parent_data gcc_xo_gpll0_gpll1_gpll2[] = {
- { .fw_name = "xo" },
- { .hw = &gpll0.clkr.hw },
- { .hw = &gpll1_vote.hw },
- { .hw = &gpll2.clkr.hw },
-};
-
static const struct freq_tbl ftbl_apss_ahb_clk[] = {
F(19200000, P_XO, 1, 0, 0),
F(50000000, P_GPLL0, 16, 0, 0),
@@ -674,26 +660,6 @@ static struct clk_rcg2 sdcc2_apps_clk_sr
},
};
-static const struct freq_tbl ftbl_gcc_apss_tcu_clk[] = {
- F(155000000, P_GPLL2, 6, 0, 0),
- F(310000000, P_GPLL2, 3, 0, 0),
- F(400000000, P_GPLL0, 2, 0, 0),
- { }
-};
-
-static struct clk_rcg2 apss_tcu_clk_src = {
- .cmd_rcgr = 0x1207c,
- .hid_width = 5,
- .parent_map = gcc_xo_gpll0_gpll1_gpll2_map,
- .freq_tbl = ftbl_gcc_apss_tcu_clk,
- .clkr.hw.init = &(struct clk_init_data){
- .name = "apss_tcu_clk_src",
- .parent_data = gcc_xo_gpll0_gpll1_gpll2,
- .num_parents = 4,
- .ops = &clk_rcg2_ops,
- },
-};
-
static const struct freq_tbl ftbl_gcc_usb_hs_system_clk[] = {
F(19200000, P_XO, 1, 0, 0),
F(57140000, P_GPLL0, 14, 0, 0),
@@ -1511,7 +1477,6 @@ static struct clk_regmap *gcc_mdm9607_cl
[PDM2_CLK_SRC] = &pdm2_clk_src.clkr,
[SDCC1_APPS_CLK_SRC] = &sdcc1_apps_clk_src.clkr,
[SDCC2_APPS_CLK_SRC] = &sdcc2_apps_clk_src.clkr,
- [APSS_TCU_CLK_SRC] = &apss_tcu_clk_src.clkr,
[USB_HS_SYSTEM_CLK_SRC] = &usb_hs_system_clk_src.clkr,
[GCC_BLSP1_AHB_CLK] = &gcc_blsp1_ahb_clk.clkr,
[GCC_BLSP1_SLEEP_CLK] = &gcc_blsp1_sleep_clk.clkr,
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0122/1376] clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0121/1376] clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0123/1376] clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk Greg Kroah-Hartman
` (876 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Stephan Gerhold,
Bjorn Andersson
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <stephan@gerhold.net>
commit 17784427df923a0573a7ea83f9198456ff1ec1a5 upstream.
This clock does not exist on MDM9607. Reading/writing the registers always
results in 0.
Presumably, this definition was mistakenly copied from gcc-msm8916. On
MSM8916, this root clock is used for multimedia subsystems (camera,
display, video). MDM9607 has none of that, so this clock was probably
omitted in the hardware.
There are no users inside gcc-mdm9607, so we can just drop it.
Cc: stable@vger.kernel.org
Fixes: 48b7253264ea ("clk: qcom: Add MDM9607 GCC driver")
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
Link: https://lore.kernel.org/r/20260706-qcom-clk-mdm9607-fixes-v2-7-745565101869@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/qcom/gcc-mdm9607.c | 13 -------------
1 file changed, 13 deletions(-)
--- a/drivers/clk/qcom/gcc-mdm9607.c
+++ b/drivers/clk/qcom/gcc-mdm9607.c
@@ -240,18 +240,6 @@ static struct clk_rcg2 pcnoc_bfdcd_clk_s
},
};
-static struct clk_rcg2 system_noc_bfdcd_clk_src = {
- .cmd_rcgr = 0x26004,
- .hid_width = 5,
- .parent_map = gcc_xo_gpll0_bimc_map,
- .clkr.hw.init = &(struct clk_init_data){
- .name = "system_noc_bfdcd_clk_src",
- .parent_data = gcc_xo_gpll0_bimc,
- .num_parents = ARRAY_SIZE(gcc_xo_gpll0_bimc),
- .ops = &clk_rcg2_ops,
- },
-};
-
static const struct freq_tbl ftbl_gcc_blsp1_qup1_6_i2c_apps_clk[] = {
F(19200000, P_XO, 1, 0, 0),
F(50000000, P_GPLL0, 16, 0, 0),
@@ -1450,7 +1438,6 @@ static struct clk_regmap *gcc_mdm9607_cl
[BIMC_PLL_VOTE] = &bimc_pll_vote,
[BIMC_DDR_CLK_SRC] = &bimc_ddr_clk_src.clkr,
[PCNOC_BFDCD_CLK_SRC] = &pcnoc_bfdcd_clk_src.clkr,
- [SYSTEM_NOC_BFDCD_CLK_SRC] = &system_noc_bfdcd_clk_src.clkr,
[APSS_AHB_CLK_SRC] = &apss_ahb_clk_src.clkr,
[BLSP1_QUP1_I2C_APPS_CLK_SRC] = &blsp1_qup1_i2c_apps_clk_src.clkr,
[BLSP1_QUP1_SPI_APPS_CLK_SRC] = &blsp1_qup1_spi_apps_clk_src.clkr,
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0123/1376] clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0122/1376] clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0124/1376] clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk Greg Kroah-Hartman
` (875 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Stephan Gerhold,
Bjorn Andersson
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <stephan@gerhold.net>
commit 944d0fb38cffe57a1d1ebf82c5c077bad82dcdbb upstream.
MDM9607 is similar to MSM8909, where the GCC_BLSP1_SLEEP_CBCR register is
read-only and only has the CLK_OFF bit to check if the clock is running.
This is a shared vote clock, the correct way to enable it is to vote for
BLSP1_SLEEP_CLK_ENA (BIT(9)) in GCC_APCS_CLOCK_BRANCH_ENA_VOTE (0x45004).
Cc: stable@vger.kernel.org
Fixes: 48b7253264ea ("clk: qcom: Add MDM9607 GCC driver")
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
Link: https://lore.kernel.org/r/20260706-qcom-clk-mdm9607-fixes-v2-3-745565101869@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/qcom/gcc-mdm9607.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/clk/qcom/gcc-mdm9607.c
+++ b/drivers/clk/qcom/gcc-mdm9607.c
@@ -744,9 +744,10 @@ static struct clk_branch gcc_blsp1_ahb_c
static struct clk_branch gcc_blsp1_sleep_clk = {
.halt_reg = 0x1004,
+ .halt_check = BRANCH_HALT_VOTED,
.clkr = {
- .enable_reg = 0x1004,
- .enable_mask = BIT(0),
+ .enable_reg = 0x45004,
+ .enable_mask = BIT(9),
.hw.init = &(struct clk_init_data){
.name = "gcc_blsp1_sleep_clk",
.parent_data = &(const struct clk_parent_data){
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0124/1376] clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0123/1376] clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0125/1376] clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks Greg Kroah-Hartman
` (874 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Taniya Das, Konrad Dybcio,
Stephan Gerhold, Bjorn Andersson
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <stephan.gerhold@linaro.org>
commit ca7e6cc30cde4f0cbeff2e205a84bedf431e9156 upstream.
gcc_apss_axi_clk specifies a halt_reg of 0x4601c, but this is already used
by gcc_apss_ahb_clk. The correct value according to the downstream driver
is 0x46020.
Cc: stable@vger.kernel.org
Fixes: 48b7253264ea ("clk: qcom: Add MDM9607 GCC driver")
Reviewed-by: Taniya Das <taniya.das@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
Link: https://lore.kernel.org/r/20260706-qcom-clk-mdm9607-fixes-v2-4-745565101869@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/qcom/gcc-mdm9607.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/clk/qcom/gcc-mdm9607.c
+++ b/drivers/clk/qcom/gcc-mdm9607.c
@@ -1414,7 +1414,7 @@ static struct clk_branch gcc_apss_ahb_cl
};
static struct clk_branch gcc_apss_axi_clk = {
- .halt_reg = 0x4601c,
+ .halt_reg = 0x46020,
.halt_check = BRANCH_HALT_VOTED,
.clkr = {
.enable_reg = 0x45004,
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0125/1376] clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0124/1376] clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0126/1376] i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure Greg Kroah-Hartman
` (873 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stephan Gerhold, Konrad Dybcio,
Bjorn Andersson
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <stephan.gerhold@linaro.org>
commit e111ddda092ad961870a634e4c9263c10a3e8485 upstream.
The gcc-mdm9607 driver was originally based on gcc-msm8916, but a closer
match nowadays is gcc-msm8909. Looking at the differences between
gcc-mdm9607 and gcc-msm8909, there is quite some confusion around the
definitions for the BIMC PLL.
It turns out the BIMC PLL on MDM9607 is actually an Alpha PLL just like on
MSM8909. We can vote for it using BIT(2), which explains why BIT(3) was
used for GPLL2.
In practice, the BIMC PLL is exclusively controlled by the RPM firmware and
Linux should not touch it. So far, it was defined to model the full clock
hierarchy, but even in read-only mode with CLK_GET_RATE_NOCACHE this is
problematic since the RPM will silently change the clock parents without
notifying Linux about it. The clock framework reads the clock parent only
once during boot, so the resulting rates will still be often wrong.
Follow the example of more recent SoCs and drop the BIMC PLL and all
remaining related clocks to avoid reporting stale status data. This means
we cannot determine the rate of these clocks anymore. This is not a big
problem in practice, since these are NoC-related clocks that are
independently managed through the interconnect subsystem.
Cc: stable@vger.kernel.org
Fixes: 48b7253264ea ("clk: qcom: Add MDM9607 GCC driver")
Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260706-qcom-clk-mdm9607-fixes-v2-8-745565101869@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/qcom/gcc-mdm9607.c | 125 -----------------------------------------
1 file changed, 1 insertion(+), 124 deletions(-)
--- a/drivers/clk/qcom/gcc-mdm9607.c
+++ b/drivers/clk/qcom/gcc-mdm9607.c
@@ -26,7 +26,6 @@
enum {
P_XO,
- P_BIMC,
P_GPLL0,
P_GPLL1,
P_GPLL2,
@@ -121,7 +120,7 @@ static struct clk_alpha_pll gpll2_early
.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
.clkr = {
.enable_reg = 0x45000,
- .enable_mask = BIT(3), /* Yeah, apparently it's not 2 */
+ .enable_mask = BIT(3), /* BIT(2) is used for BIMC PLL */
.hw.init = &(struct clk_init_data)
{
.name = "gpll2_early",
@@ -178,68 +177,6 @@ static struct clk_rcg2 apss_ahb_clk_src
},
};
-static struct clk_pll bimc_pll = {
- .l_reg = 0x23004,
- .m_reg = 0x23008,
- .n_reg = 0x2300c,
- .config_reg = 0x23010,
- .mode_reg = 0x23000,
- .status_reg = 0x2301c,
- .status_bit = 17,
- .clkr.hw.init = &(struct clk_init_data){
- .name = "bimc_pll",
- .parent_data = &(const struct clk_parent_data){
- .fw_name = "xo",
- },
- .num_parents = 1,
- .ops = &clk_pll_ops,
- },
-};
-
-static struct clk_regmap bimc_pll_vote = {
- .enable_reg = 0x45000,
- .enable_mask = BIT(3),
- .hw.init = &(struct clk_init_data){
- .name = "bimc_pll_vote",
- .parent_hws = (const struct clk_hw *[]){ &bimc_pll.clkr.hw },
- .num_parents = 1,
- .ops = &clk_pll_vote_ops,
- },
-};
-
-static const struct parent_map gcc_xo_gpll0_bimc_map[] = {
- { P_XO, 0 },
- { P_GPLL0, 1 },
- { P_BIMC, 2 },
-};
-
-static const struct clk_parent_data gcc_xo_gpll0_bimc[] = {
- { .fw_name = "xo" },
- { .hw = &gpll0.clkr.hw },
- { .hw = &bimc_pll_vote.hw },
-};
-
-static const struct freq_tbl ftbl_pcnoc_bfdcd_clk_src[] = {
- F(19200000, P_XO, 1, 0, 0),
- F(50000000, P_GPLL0, 16, 0, 0),
- F(100000000, P_GPLL0, 8, 0, 0),
- { }
-};
-
-static struct clk_rcg2 pcnoc_bfdcd_clk_src = {
- .cmd_rcgr = 0x27000,
- .freq_tbl = ftbl_pcnoc_bfdcd_clk_src,
- .hid_width = 5,
- .parent_map = gcc_xo_gpll0_bimc_map,
- .clkr.hw.init = &(struct clk_init_data){
- .name = "pcnoc_bfdcd_clk_src",
- .parent_data = gcc_xo_gpll0_bimc,
- .num_parents = ARRAY_SIZE(gcc_xo_gpll0_bimc),
- .ops = &clk_rcg2_ops,
- .flags = CLK_IS_CRITICAL,
- },
-};
-
static const struct freq_tbl ftbl_gcc_blsp1_qup1_6_i2c_apps_clk[] = {
F(19200000, P_XO, 1, 0, 0),
F(50000000, P_GPLL0, 16, 0, 0),
@@ -735,8 +672,6 @@ static struct clk_branch gcc_blsp1_ahb_c
.enable_mask = BIT(10),
.hw.init = &(struct clk_init_data){
.name = "gcc_blsp1_ahb_clk",
- .parent_hws = (const struct clk_hw *[]){ &pcnoc_bfdcd_clk_src.clkr.hw },
- .num_parents = 1,
.ops = &clk_branch2_ops,
},
},
@@ -1038,8 +973,6 @@ static struct clk_branch gcc_boot_rom_ah
.enable_mask = BIT(7),
.hw.init = &(struct clk_init_data){
.name = "gcc_boot_rom_ahb_clk",
- .parent_hws = (const struct clk_hw *[]){ &pcnoc_bfdcd_clk_src.clkr.hw },
- .num_parents = 1,
.ops = &clk_branch2_ops,
},
},
@@ -1053,9 +986,6 @@ static struct clk_branch gcc_crypto_ahb_
.enable_mask = BIT(0),
.hw.init = &(struct clk_init_data){
.name = "gcc_crypto_ahb_clk",
- .parent_hws = (const struct clk_hw *[]){ &pcnoc_bfdcd_clk_src.clkr.hw },
- .num_parents = 1,
- .flags = CLK_SET_RATE_PARENT,
.ops = &clk_branch2_ops,
},
},
@@ -1069,9 +999,6 @@ static struct clk_branch gcc_crypto_axi_
.enable_mask = BIT(1),
.hw.init = &(struct clk_init_data){
.name = "gcc_crypto_axi_clk",
- .parent_hws = (const struct clk_hw *[]){ &pcnoc_bfdcd_clk_src.clkr.hw },
- .num_parents = 1,
- .flags = CLK_SET_RATE_PARENT,
.ops = &clk_branch2_ops,
},
},
@@ -1145,9 +1072,6 @@ static struct clk_branch gcc_mss_cfg_ahb
.enable_mask = BIT(0),
.hw.init = &(struct clk_init_data){
.name = "gcc_mss_cfg_ahb_clk",
- .parent_hws = (const struct clk_hw *[]){ &pcnoc_bfdcd_clk_src.clkr.hw },
- .num_parents = 1,
- .flags = CLK_SET_RATE_PARENT,
.ops = &clk_branch2_ops,
},
},
@@ -1175,9 +1099,6 @@ static struct clk_branch gcc_pdm_ahb_clk
.enable_mask = BIT(0),
.hw.init = &(struct clk_init_data){
.name = "gcc_pdm_ahb_clk",
- .parent_hws = (const struct clk_hw *[]){ &pcnoc_bfdcd_clk_src.clkr.hw },
- .num_parents = 1,
- .flags = CLK_SET_RATE_PARENT,
.ops = &clk_branch2_ops,
},
},
@@ -1191,9 +1112,6 @@ static struct clk_branch gcc_prng_ahb_cl
.enable_mask = BIT(8),
.hw.init = &(struct clk_init_data){
.name = "gcc_prng_ahb_clk",
- .parent_hws = (const struct clk_hw *[]){ &pcnoc_bfdcd_clk_src.clkr.hw },
- .num_parents = 1,
- .flags = CLK_SET_RATE_PARENT,
.ops = &clk_branch2_ops,
},
},
@@ -1206,9 +1124,6 @@ static struct clk_branch gcc_sdcc1_ahb_c
.enable_mask = BIT(0),
.hw.init = &(struct clk_init_data){
.name = "gcc_sdcc1_ahb_clk",
- .parent_hws = (const struct clk_hw *[]){ &pcnoc_bfdcd_clk_src.clkr.hw },
- .num_parents = 1,
- .flags = CLK_SET_RATE_PARENT,
.ops = &clk_branch2_ops,
},
},
@@ -1236,9 +1151,6 @@ static struct clk_branch gcc_sdcc2_ahb_c
.enable_mask = BIT(0),
.hw.init = &(struct clk_init_data){
.name = "gcc_sdcc2_ahb_clk",
- .parent_hws = (const struct clk_hw *[]){ &pcnoc_bfdcd_clk_src.clkr.hw },
- .num_parents = 1,
- .flags = CLK_SET_RATE_PARENT,
.ops = &clk_branch2_ops,
},
},
@@ -1259,19 +1171,6 @@ static struct clk_branch gcc_sdcc2_apps_
},
};
-static struct clk_rcg2 bimc_ddr_clk_src = {
- .cmd_rcgr = 0x32004,
- .hid_width = 5,
- .parent_map = gcc_xo_gpll0_bimc_map,
- .clkr.hw.init = &(struct clk_init_data){
- .name = "bimc_ddr_clk_src",
- .parent_data = gcc_xo_gpll0_bimc,
- .num_parents = 3,
- .ops = &clk_rcg2_ops,
- .flags = CLK_GET_RATE_NOCACHE,
- },
-};
-
static struct clk_branch gcc_mss_q6_bimc_axi_clk = {
.halt_reg = 0x49004,
.clkr = {
@@ -1279,9 +1178,6 @@ static struct clk_branch gcc_mss_q6_bimc
.enable_mask = BIT(0),
.hw.init = &(struct clk_init_data){
.name = "gcc_mss_q6_bimc_axi_clk",
- .parent_hws = (const struct clk_hw *[]){ &bimc_ddr_clk_src.clkr.hw },
- .num_parents = 1,
- .flags = CLK_SET_RATE_PARENT,
.ops = &clk_branch2_ops,
},
},
@@ -1295,8 +1191,6 @@ static struct clk_branch gcc_apss_tcu_cl
.enable_mask = BIT(1),
.hw.init = &(struct clk_init_data){
.name = "gcc_apss_tcu_clk",
- .parent_hws = (const struct clk_hw *[]){ &bimc_ddr_clk_src.clkr.hw },
- .num_parents = 1,
.ops = &clk_branch2_ops,
},
},
@@ -1310,9 +1204,6 @@ static struct clk_branch gcc_smmu_cfg_cl
.enable_mask = BIT(12),
.hw.init = &(struct clk_init_data){
.name = "gcc_smmu_cfg_clk",
- .parent_hws = (const struct clk_hw *[]){ &pcnoc_bfdcd_clk_src.clkr.hw },
- .num_parents = 1,
- .flags = CLK_SET_RATE_PARENT,
.ops = &clk_branch2_ops,
},
},
@@ -1360,9 +1251,6 @@ static struct clk_branch gcc_usb_hs_phy_
.enable_mask = BIT(0),
.hw.init = &(struct clk_init_data){
.name = "gcc_usb_hs_phy_cfg_ahb_clk",
- .parent_hws = (const struct clk_hw *[]){ &pcnoc_bfdcd_clk_src.clkr.hw },
- .num_parents = 1,
- .flags = CLK_SET_RATE_PARENT,
.ops = &clk_branch2_ops,
},
},
@@ -1375,9 +1263,6 @@ static struct clk_branch gcc_usb_hs_ahb_
.enable_mask = BIT(0),
.hw.init = &(struct clk_init_data){
.name = "gcc_usb_hs_ahb_clk",
- .parent_hws = (const struct clk_hw *[]){ &pcnoc_bfdcd_clk_src.clkr.hw },
- .num_parents = 1,
- .flags = CLK_SET_RATE_PARENT,
.ops = &clk_branch2_ops,
},
},
@@ -1406,8 +1291,6 @@ static struct clk_branch gcc_apss_ahb_cl
.enable_mask = BIT(14),
.hw.init = &(struct clk_init_data){
.name = "gcc_apss_ahb_clk",
- .parent_hws = (const struct clk_hw *[]){ &pcnoc_bfdcd_clk_src.clkr.hw },
- .num_parents = 1,
.ops = &clk_branch2_ops,
},
},
@@ -1421,8 +1304,6 @@ static struct clk_branch gcc_apss_axi_cl
.enable_mask = BIT(13),
.hw.init = &(struct clk_init_data){
.name = "gcc_apss_axi_clk",
- .parent_hws = (const struct clk_hw *[]){ &pcnoc_bfdcd_clk_src.clkr.hw },
- .num_parents = 1,
.ops = &clk_branch2_ops,
},
},
@@ -1435,10 +1316,6 @@ static struct clk_regmap *gcc_mdm9607_cl
[GPLL1_VOTE] = &gpll1_vote,
[GPLL2] = &gpll2.clkr,
[GPLL2_EARLY] = &gpll2_early.clkr,
- [BIMC_PLL] = &bimc_pll.clkr,
- [BIMC_PLL_VOTE] = &bimc_pll_vote,
- [BIMC_DDR_CLK_SRC] = &bimc_ddr_clk_src.clkr,
- [PCNOC_BFDCD_CLK_SRC] = &pcnoc_bfdcd_clk_src.clkr,
[APSS_AHB_CLK_SRC] = &apss_ahb_clk_src.clkr,
[BLSP1_QUP1_I2C_APPS_CLK_SRC] = &blsp1_qup1_i2c_apps_clk_src.clkr,
[BLSP1_QUP1_SPI_APPS_CLK_SRC] = &blsp1_qup1_spi_apps_clk_src.clkr,
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0126/1376] i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0125/1376] clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0127/1376] ASoC: cs35l33: drain threaded IRQ before runtime suspend Greg Kroah-Hartman
` (872 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Linkai Gong, Andi Shyti
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linkai Gong <gonglinkai@kylinos.cn>
commit 62edb8ca0aa44517cc23cfa26cd8a51f15ea92fe upstream.
of_parse_phandle() takes a reference on the parent node. If a later
devm_kstrdup() fails, err_rollback only releases nodes for indices
0..i-1, so the current node is leaked.
of_node_put() the current parent before rolling back.
Fixes: 7c0195fa9a9e ("i2c: mux: demux-pinctrl: check the return value of devm_kstrdup()")
Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn>
Cc: <stable@vger.kernel.org> # v6.6+
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://patch.msgid.link/20260813095617.2246320-1-gonglinkai@kylinos.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/muxes/i2c-demux-pinctrl.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/i2c/muxes/i2c-demux-pinctrl.c
+++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c
@@ -247,6 +247,7 @@ static int i2c_demux_pinctrl_probe(struc
props[i].value = devm_kstrdup(&pdev->dev, "ok", GFP_KERNEL);
if (!props[i].name || !props[i].value) {
err = -ENOMEM;
+ of_node_put(adap_np);
goto err_rollback;
}
props[i].length = 3;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0127/1376] ASoC: cs35l33: drain threaded IRQ before runtime suspend
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0126/1376] i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0128/1376] ASoC: cs35l34: " Greg Kroah-Hartman
` (871 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Mark Brown
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
commit e074c12c428c633e079154301207a6079a208583 upstream.
cs35l33_runtime_suspend() currently switches the codec into
regcache_cache_only(true) and powers it down without first quiescing the
threaded IRQ registered by devm_request_threaded_irq(). That leaves a
window where cs35l33_irq_thread() can still run after suspend has closed
off live register access.
A running system can reach this during runtime PM while the driver still
has critical fault IRQs unmasked. If the threaded handler runs in that
window, it reads volatile INT_STATUS_1/2 after cache_only has been
enabled, ignores the regmap_read() failures, and can still drive the
AMP_SHORT_RLS, CAL_ERR_RLS, OTE_RLS, and OTW_RLS release paths.
Use disable_irq() before entering cache_only/power-off so any in-flight
threaded handler is drained and no new IRQ thread can run during the
suspended state. Re-enable the IRQ only after runtime_resume() has
restored live register access with regcache_sync(). Since probe only
warns if devm_request_threaded_irq() fails, track whether the IRQ was
actually installed before disabling or re-enabling it.
Fixes: 3333cb7187b9 ("ASoC: cs35l33: Initial commit of the cs35l33 CODEC driver.")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Link: https://patch.msgid.link/20260611161553.3378721-2-runyu.xiao@seu.edu.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/codecs/cs35l33.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
--- a/sound/soc/codecs/cs35l33.c
+++ b/sound/soc/codecs/cs35l33.c
@@ -40,6 +40,7 @@ struct cs35l33_private {
struct regmap *regmap;
struct gpio_desc *reset_gpio;
bool amp_cal;
+ bool irq_requested;
int mclk_int;
struct regulator_bulk_data core_supplies[2];
int num_core_supplies;
@@ -881,6 +882,9 @@ static int __maybe_unused cs35l33_runtim
goto err;
}
+ if (cs35l33->irq_requested)
+ enable_irq(to_i2c_client(dev)->irq);
+
return 0;
err:
@@ -900,6 +904,10 @@ static int __maybe_unused cs35l33_runtim
/* redo the calibration in next power up */
cs35l33->amp_cal = false;
+ /* Drain and block the threaded IRQ before cache_only/power-off. */
+ if (cs35l33->irq_requested)
+ disable_irq(to_i2c_client(dev)->irq);
+
regcache_cache_only(cs35l33->regmap, true);
regcache_mark_dirty(cs35l33->regmap);
regulator_bulk_disable(cs35l33->num_core_supplies,
@@ -1156,10 +1164,12 @@ static int cs35l33_i2c_probe(struct i2c_
}
ret = devm_request_threaded_irq(&i2c_client->dev, i2c_client->irq, NULL,
- cs35l33_irq_thread, IRQF_ONESHOT | IRQF_TRIGGER_LOW,
- "cs35l33", cs35l33);
+ cs35l33_irq_thread, IRQF_ONESHOT | IRQF_TRIGGER_LOW,
+ "cs35l33", cs35l33);
if (ret != 0)
dev_warn(&i2c_client->dev, "Failed to request IRQ: %d\n", ret);
+ else
+ cs35l33->irq_requested = true;
/* We could issue !RST or skip it based on AMP topology */
cs35l33->reset_gpio = devm_gpiod_get_optional(&i2c_client->dev,
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0128/1376] ASoC: cs35l34: drain threaded IRQ before runtime suspend
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0127/1376] ASoC: cs35l33: drain threaded IRQ before runtime suspend Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0129/1376] ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure Greg Kroah-Hartman
` (870 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Mark Brown
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
commit 4105a4c0678b2808fc8046b60321b4f1cc7dae75 upstream.
cs35l34_runtime_suspend() currently switches the codec into
regcache_cache_only(true), asserts reset low, and powers the device off
without first quiescing the threaded IRQ registered by
devm_request_threaded_irq(). That leaves a window where
cs35l34_irq_thread() can still run after suspend has removed live
hardware access.
A running system can reach this during runtime PM while the driver still
has critical fault IRQs unmasked. If the threaded handler runs in that
window, it reads volatile INT_STATUS_1..4 after cache_only has been
enabled, ignores the regmap_read() failures, and can still execute the
PROT_RELEASE_CTL release sequence or the BST fault power-down writes.
Use disable_irq() before entering cache_only/reset-low/power-off so any
in-flight threaded handler is drained and no new IRQ thread can run
while the device is suspended. Re-enable the IRQ only after
runtime_resume() has restored live register access with regcache_sync().
Since probe only logs request_threaded_irq() failures and keeps going,
track whether the IRQ was actually installed before disabling or
re-enabling it.
Fixes: c1124c09e103 ("ASoC: cs35l34: Initial commit of the cs35l34 CODEC driver.")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Link: https://patch.msgid.link/20260611161553.3378721-3-runyu.xiao@seu.edu.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/codecs/cs35l34.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
--- a/sound/soc/codecs/cs35l34.c
+++ b/sound/soc/codecs/cs35l34.c
@@ -45,6 +45,7 @@ struct cs35l34_private {
int num_core_supplies;
int mclk_int;
bool tdm_mode;
+ bool irq_requested;
struct gpio_desc *reset_gpio; /* Active-low reset GPIO */
};
@@ -1032,10 +1033,12 @@ static int cs35l34_i2c_probe(struct i2c_
}
ret = devm_request_threaded_irq(&i2c_client->dev, i2c_client->irq, NULL,
- cs35l34_irq_thread, IRQF_ONESHOT | IRQF_TRIGGER_LOW,
- "cs35l34", cs35l34);
+ cs35l34_irq_thread, IRQF_ONESHOT | IRQF_TRIGGER_LOW,
+ "cs35l34", cs35l34);
if (ret != 0)
dev_err(&i2c_client->dev, "Failed to request IRQ: %d\n", ret);
+ else
+ cs35l34->irq_requested = true;
cs35l34->reset_gpio = devm_gpiod_get_optional(&i2c_client->dev,
"reset", GPIOD_OUT_LOW);
@@ -1140,6 +1143,9 @@ static int __maybe_unused cs35l34_runtim
dev_err(dev, "Failed to restore register cache\n");
goto err;
}
+
+ if (cs35l34->irq_requested)
+ enable_irq(to_i2c_client(dev)->irq);
return 0;
err:
regcache_cache_only(cs35l34->regmap, true);
@@ -1153,6 +1159,10 @@ static int __maybe_unused cs35l34_runtim
{
struct cs35l34_private *cs35l34 = dev_get_drvdata(dev);
+ /* Drain and block the threaded IRQ before cache_only/power-off. */
+ if (cs35l34->irq_requested)
+ disable_irq(to_i2c_client(dev)->irq);
+
regcache_cache_only(cs35l34->regmap, true);
regcache_mark_dirty(cs35l34->regmap);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0129/1376] ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0128/1376] ASoC: cs35l34: " Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0130/1376] ASoC: hdac_hda: Fix hlink refcount leak on component registration failure Greg Kroah-Hartman
` (869 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Haoxiang Li, Mark Brown
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <haoxiang_li2024@163.com>
commit 3a89ddcf0c3d9a068631e8c24d5c9e81d1e6512a upstream.
mpc5200_audio_dma_create() creates the DMA resources before registering
the component. If snd_soc_register_component() fails, the function
returns directly and leaves the DMA resources allocated.
Call mpc5200_audio_dma_destroy() before returning from this error path.
Fixes: f515b67381de ("ASoC: fsl: mpc5200 combine psc_dma platform data")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Link: https://patch.msgid.link/20260622094822.926166-1-haoxiang_li2024@163.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/fsl/mpc5200_psc_i2s.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/soc/fsl/mpc5200_psc_i2s.c
+++ b/sound/soc/fsl/mpc5200_psc_i2s.c
@@ -170,6 +170,7 @@ static int psc_i2s_of_probe(struct platf
psc_i2s_dai, ARRAY_SIZE(psc_i2s_dai));
if (rc != 0) {
pr_err("Failed to register DAI\n");
+ mpc5200_audio_dma_destroy(op);
return rc;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0130/1376] ASoC: hdac_hda: Fix hlink refcount leak on component registration failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0129/1376] ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0131/1376] AsoC: intel: sst: fix PCI device reference leak on probe failure Greg Kroah-Hartman
` (868 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Haoxiang Li, Mark Brown
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <haoxiang_li2024@163.com>
commit 6ad4892c4f5cb437a928a02f5b7d37d496aa9268 upstream.
hdac_hda_dev_probe() gets the HDA link with snd_hdac_ext_bus_link_get()
before registering the ASoC component. If component registration fails,
the function returns without dropping the link reference.
Always call snd_hdac_ext_bus_link_put() after the registration attempt so
the reference taken during probe is balanced on both success and failure.
Fixes: 6bae5ea94989 ("ASoC: hdac_hda: add asoc extension for legacy HDA codec drivers")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Link: https://patch.msgid.link/20260622145645.1184986-1-haoxiang_li2024@163.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/codecs/hdac_hda.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/sound/soc/codecs/hdac_hda.c
+++ b/sound/soc/codecs/hdac_hda.c
@@ -643,10 +643,8 @@ static int hdac_hda_dev_probe(struct hda
&hdac_hda_codec, hdac_hda_dais,
ARRAY_SIZE(hdac_hda_dais));
- if (ret < 0) {
+ if (ret < 0)
dev_err(&hdev->dev, "%s: failed to register HDA codec %d\n", __func__, ret);
- return ret;
- }
snd_hdac_ext_bus_link_put(hdev->bus, hlink);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0131/1376] AsoC: intel: sst: fix PCI device reference leak on probe failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0130/1376] ASoC: hdac_hda: Fix hlink refcount leak on component registration failure Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0132/1376] ASoC: loongson: Fix error handling in ACPI property parsing Greg Kroah-Hartman
` (867 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Haoxiang Li, Mark Brown
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <haoxiang_li2024@163.com>
commit 016f29997ebd29d6ab59c8162ce0e7f73bd1e517 upstream.
intel_sst_probe() takes a reference to the PCI device with pci_dev_get().
If sst_platform_get_resources() fails afterwards, the probe error path
cleans up the driver context but does not drop the PCI device reference.
Add a pci_dev_put() error path for failures after pci_dev_get().
Fixes: f533a035e4da ("ASoC: Intel: mrfld - create separate module for pci part")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Link: https://patch.msgid.link/20260622091620.897478-1-haoxiang_li2024@163.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/intel/atom/sst/sst_pci.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/sound/soc/intel/atom/sst/sst_pci.c
+++ b/sound/soc/intel/atom/sst/sst_pci.c
@@ -140,13 +140,15 @@ static int intel_sst_probe(struct pci_de
sst_drv_ctx->pci = pci_dev_get(pci);
ret = sst_platform_get_resources(sst_drv_ctx);
if (ret < 0)
- goto do_free_drv_ctx;
+ goto do_put_pci;
pci_set_drvdata(pci, sst_drv_ctx);
sst_configure_runtime_pm(sst_drv_ctx);
return ret;
+do_put_pci:
+ pci_dev_put(sst_drv_ctx->pci);
do_free_drv_ctx:
sst_context_cleanup(sst_drv_ctx);
dev_err(sst_drv_ctx->dev, "Probe failed with %d\n", ret);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0132/1376] ASoC: loongson: Fix error handling in ACPI property parsing
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0131/1376] AsoC: intel: sst: fix PCI device reference leak on probe failure Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0133/1376] ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get Greg Kroah-Hartman
` (866 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Binbin Zhou, Mark Brown
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Binbin Zhou <zhoubinbin@loongson.cn>
commit 0eb0e3c623ac1da8b85d518043fef7660af7805d upstream.
In loongson_card_parse_acpi(), the return value of
device_property_read_string() for the `codec-dai-name` property was
ignored. If the property is missing or invalid, an uninitialized pointer
would be used later, potentially leading to undefined behavior.
Fix this by checking the return value and propagating the error
appropriately.
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/cover.1780538113.git.zhoubinbin@loongson.cn?part=5
Fixes: ddb538a3004b ("ASoC: loongson: Factor out loongson_card_acpi_find_device() function")
Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn>
Link: https://patch.msgid.link/08e44a54708eae053be148524346bb8dfcd55b03.1782439646.git.zhoubinbin@loongson.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/loongson/loongson_card.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/sound/soc/loongson/loongson_card.c
+++ b/sound/soc/loongson/loongson_card.c
@@ -91,7 +91,7 @@ static int loongson_card_parse_acpi(stru
const char *codec_dai_name;
struct acpi_device *adev;
struct device *phy_dev;
- int i;
+ int i, ret;
/* fixup platform name based on reference node */
adev = loongson_card_acpi_find_device(card, "cpu");
@@ -108,7 +108,9 @@ static int loongson_card_parse_acpi(stru
return -ENOENT;
snprintf(codec_name, sizeof(codec_name), "i2c-%s", acpi_dev_name(adev));
- device_property_read_string(card->dev, "codec-dai-name", &codec_dai_name);
+ ret = device_property_read_string(card->dev, "codec-dai-name", &codec_dai_name);
+ if (ret)
+ return ret;
for (i = 0; i < card->num_links; i++) {
loongson_dai_links[i].platforms->name = dev_name(phy_dev);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0133/1376] ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0132/1376] ASoC: loongson: Fix error handling in ACPI property parsing Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0134/1376] iio: adc: max34408: add missing select REGMAP_I2C to Kconfig Greg Kroah-Hartman
` (865 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, WenTao Liang, Mark Brown
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: WenTao Liang <vulab@iscas.ac.cn>
commit fb5d1b1c5f8a920ee697545fa6dee16825085717 upstream.
In aries_audio_probe(), aries_dai[0].platforms->of_node is assigned the
same pointer as aries_dai[0].cpus->of_node (from of_parse_phandle)
without calling of_node_get(). When the sound card is deregistered, the
ASoC framework calls of_node_put() on both cpus->of_node and
platforms->of_node, causing a double put on the same node and a refcount
underflow.
Add of_node_get(aries_dai[0].cpus->of_node) before the assignment.
Cc: stable@vger.kernel.org
Fixes: 7a3a7671fa6c ("ASoC: samsung: Add driver for Aries boards")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260627035251.60172-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/samsung/aries_wm8994.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/soc/samsung/aries_wm8994.c
+++ b/sound/soc/samsung/aries_wm8994.c
@@ -658,6 +658,7 @@ static int aries_audio_probe(struct plat
goto out;
}
+ of_node_get(aries_dai[0].cpus->of_node);
aries_dai[0].platforms->of_node = aries_dai[0].cpus->of_node;
/* Set CPU of_node for BT DAI */
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0134/1376] iio: adc: max34408: add missing select REGMAP_I2C to Kconfig
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0133/1376] ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0135/1376] iio: adc: pac1921: fix wrong channel used in trigger handler read Greg Kroah-Hartman
` (864 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joshua Crofts, Andy Shevchenko,
Jonathan Cameron
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Crofts <joshua.crofts1@gmail.com>
commit 947f1079074a260ba200419d5cba6b8549d5ac0c upstream.
The Kconfig entry for the MAX34408 is missing a 'select REGMAP_I2C',
causing build failures.
Fixes: cf27775838c5 ("iio: adc: Add driver support for MAX34408/9")
Cc: stable@vger.kernel.org
Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/Kconfig | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/iio/adc/Kconfig
+++ b/drivers/iio/adc/Kconfig
@@ -841,6 +841,7 @@ config MAX1363
config MAX34408
tristate "Maxim max34408/max344089 ADC driver"
depends on I2C
+ select REGMAP_I2C
help
Say yes here to build support for Maxim max34408/max34409 current sense
monitor with 8-bits ADC interface with overcurrent delay/threshold and
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0135/1376] iio: adc: pac1921: fix wrong channel used in trigger handler read
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0134/1376] iio: adc: max34408: add missing select REGMAP_I2C to Kconfig Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0136/1376] iio: buffer: Fix potential use-after-free in anonymous buffer release Greg Kroah-Hartman
` (863 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cong Nguyen, Matteo Martelli,
David Lechner, Jonathan Cameron
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cong Nguyen <congnt264@gmail.com>
commit 3364c56b20c1c496bdb8c8df32f96a9947dbf98e upstream.
pac1921_trigger_handler() walks the enabled channels with
iio_for_each_active_channel(), which yields the scan index (bit) of each
active channel, while ch is a separate counter used to pack the samples
contiguously into the scan buffer.
The register to read was looked up with the packing counter instead of
the scan index:
ret = pac1921_read_res(priv, idev->channels[ch].address, &val);
pac1921_channels[] is ordered by scan index, so channels[bit] is the
channel that is actually enabled, whereas channels[ch] is merely the
ch-th array entry. These coincide only when the enabled channels form a
contiguous prefix (e.g. all channels enabled). With a sparse scan mask -
for example when only the power channel (scan index 3) is enabled - the
handler reads the wrong register (VBUS instead of VPOWER) and pushes it
to userspace as the enabled channel's data.
Index the channel array by the scan index (bit) to read the correct
register, keeping ch only for contiguous packing into the scan buffer.
Fixes: 371f778b83cd ("iio: adc: add support for pac1921")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4
Signed-off-by: Cong Nguyen <congnt264@gmail.com>
Acked-by: Matteo Martelli <matteomartelli3@gmail.com>
Reviewed-by: David Lechner <dlechner@baylibre.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/pac1921.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/adc/pac1921.c
+++ b/drivers/iio/adc/pac1921.c
@@ -1020,7 +1020,7 @@ static irqreturn_t pac1921_trigger_handl
iio_for_each_active_channel(idev, bit) {
u16 val;
- ret = pac1921_read_res(priv, idev->channels[ch].address, &val);
+ ret = pac1921_read_res(priv, idev->channels[bit].address, &val);
if (ret)
goto done;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0136/1376] iio: buffer: Fix potential use-after-free in anonymous buffer release
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0135/1376] iio: adc: pac1921: fix wrong channel used in trigger handler read Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0137/1376] iio: buffer: Make IIO DMA fence release RCU-safe Greg Kroah-Hartman
` (862 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lars-Peter Clausen, Andy Shevchenko,
Stable, Jonathan Cameron
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lars-Peter Clausen <lars@metafoo.de>
commit 6288b593e76eb10329326f2cd51e32557203b9e5 upstream.
An anonymous buffer handle holds a reference to the underlying IIO device.
The reference is dropped in the buffer handle's release function. If the
device has been removed, either through unbind or hot-unplug, the buffer
handle might hold the last reference.
The release function takes the mutex for the buffer using a guard, which
means the unlock happens after all the code in the function, including
`iio_device_put()`. If the anonymous buffer holds the last reference this
might free both the IIO device and the buffer, which contains the mutex,
leading to use-after-free when the mutex is unlocked.
Fix this by using a scoped guard just around the buffer dmabuf list access,
making sure the mutex is unlocked before releasing the IIO device.
Version 10 of the patch that introduced this issue used this exact scheme
of first unlocking and then dropping the reference [1]. During review it
was suggested to use a guard instead, and version 11 made that change [2].
Reported-by: codex:gpt-5.6
Fixes: 3e26d9f08fbe ("iio: core: Add new DMABUF interface infrastructure")
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Link: https://lore.kernel.org/linux-iio/20240605110845.86740-4-paul@crapouillou.net #[1]
Link: https://lore.kernel.org/linux-iio/20240618100302.72886-4-paul@crapouillou.net #[2]
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/industrialio-buffer.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -1599,12 +1599,16 @@ static int iio_buffer_chrdev_release(str
wake_up(&buffer->pollq);
- guard(mutex)(&buffer->dmabufs_mutex);
-
- /* Close all attached DMABUFs */
- list_for_each_entry_safe(priv, tmp, &buffer->dmabufs, entry) {
- list_del_init(&priv->entry);
- iio_buffer_dmabuf_put(priv->attach);
+ /*
+ * The mutex must be unlocked before iio_device_put(), which might drop the
+ * last reference and free the buffer.
+ */
+ scoped_guard(mutex, &buffer->dmabufs_mutex) {
+ /* Close all attached DMABUFs */
+ list_for_each_entry_safe(priv, tmp, &buffer->dmabufs, entry) {
+ list_del_init(&priv->entry);
+ iio_buffer_dmabuf_put(priv->attach);
+ }
}
kfree(ib);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0137/1376] iio: buffer: Make IIO DMA fence release RCU-safe
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0136/1376] iio: buffer: Fix potential use-after-free in anonymous buffer release Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0138/1376] iio: buffer: Tie IIO dma fence lock lifetime to the fence Greg Kroah-Hartman
` (861 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lars-Peter Clausen, Stable,
Jonathan Cameron
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lars-Peter Clausen <lars@metafoo.de>
commit 8662e56c31cf23b61ca3d11b516efb94c35b8026 upstream.
The `dma_fence` documentation states that if a custom release
implementation is provided, the `dma_fence` object must be freed in an
RCU-safe way. The current `iio_dma_fence` implementation uses `kfree()`,
which might result in a use-after-free.
Remove the custom `release` implementation. This makes the DMA fence core
fall back to `dma_fence_free()`, which calls `kfree_rcu()` on the fence.
This requires that the fence be the first member of `struct iio_dma_fence`.
Using the default release method for extended DMA fence structures is a
common pattern.
Reported-by: codex:gpt-5.6
Fixes: 3e26d9f08fbe ("iio: core: Add new DMABUF interface infrastructure")
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/industrialio-buffer.c | 13 ++++---------
1 file changed, 4 insertions(+), 9 deletions(-)
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -57,6 +57,10 @@ struct iio_dmabuf_priv {
};
struct iio_dma_fence {
+ /*
+ * Must remain the first member so the default release callback can pass
+ * the fence directly to dma_fence_free().
+ */
struct dma_fence base;
struct iio_dmabuf_priv *priv;
struct work_struct work;
@@ -1811,18 +1815,9 @@ iio_buffer_dma_fence_get_driver_name(str
return "iio";
}
-static void iio_buffer_dma_fence_release(struct dma_fence *fence)
-{
- struct iio_dma_fence *iio_fence =
- container_of(fence, struct iio_dma_fence, base);
-
- kfree(iio_fence);
-}
-
static const struct dma_fence_ops iio_buffer_dma_fence_ops = {
.get_driver_name = iio_buffer_dma_fence_get_driver_name,
.get_timeline_name = iio_buffer_dma_fence_get_driver_name,
- .release = iio_buffer_dma_fence_release,
};
static int iio_buffer_enqueue_dmabuf(struct iio_dev_buffer_pair *ib,
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0138/1376] iio: buffer: Tie IIO dma fence lock lifetime to the fence
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0137/1376] iio: buffer: Make IIO DMA fence release RCU-safe Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0139/1376] iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable Greg Kroah-Hartman
` (860 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lars-Peter Clausen, Stable,
Jonathan Cameron
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lars-Peter Clausen <lars@metafoo.de>
commit f25ec4627d935dedfb5fe83bd2c2678cdcc19611 upstream.
The `iio_dma_fence` implementation currently uses a lock embedded in the
`iio_dmabuf_priv`. But the `iio_dma_fence` can outlive the
`iio_dmabuf_priv`, which can cause a use-after-free.
Tie the lifetime of the lock to the lifetime of the fence by embedding them
in the same struct.
We can't just hold a reference to the `iio_dmabuf_priv` from the
`iio_dma_fence` since `iio_buffer_dmabuf_release()` might sleep and the
fence release callback is not allowed to sleep.
Note that the `dma_fence` framework now has an internal lock that gets used
when the passing `NULL` for `lock` in `dma_fence_init()`, but in order to
allow this patch to be backportable use an external lock.
Reported-by: codex:gpt-5.6
Fixes: 3e26d9f08fbe ("iio: core: Add new DMABUF interface infrastructure")
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/industrialio-buffer.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -47,9 +47,6 @@ struct iio_dmabuf_priv {
u64 context;
- /* Spinlock used for locking the dma_fence */
- spinlock_t lock;
-
struct dma_buf_attachment *attach;
struct sg_table *sgt;
enum dma_data_direction dir;
@@ -62,6 +59,7 @@ struct iio_dma_fence {
* the fence directly to dma_fence_free().
*/
struct dma_fence base;
+ spinlock_t lock; /* protects base */
struct iio_dmabuf_priv *priv;
struct work_struct work;
};
@@ -1690,7 +1688,6 @@ static int iio_buffer_attach_dmabuf(stru
if (!priv)
return -ENOMEM;
- spin_lock_init(&priv->lock);
priv->context = dma_fence_context_alloc(1);
dmabuf = dma_buf_get(fd);
@@ -1871,6 +1868,8 @@ static int iio_buffer_enqueue_dmabuf(str
goto err_attachment_put;
}
+ spin_lock_init(&fence->lock);
+
fence->priv = priv;
seqno = atomic_add_return(1, &priv->seqno);
@@ -1881,7 +1880,7 @@ static int iio_buffer_enqueue_dmabuf(str
* the dma_fence.
*/
dma_fence_init(&fence->base, &iio_buffer_dma_fence_ops,
- &priv->lock, priv->context, seqno);
+ &fence->lock, priv->context, seqno);
ret = iio_dma_resv_lock(dmabuf, nonblock);
if (ret)
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0139/1376] iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (137 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0138/1376] iio: buffer: Tie IIO dma fence lock lifetime to the fence Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0140/1376] iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF Greg Kroah-Hartman
` (859 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Moksh Panicker, Jonathan Cameron
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moksh Panicker <mokshpanicker.7@gmail.com>
commit bcd3f72e26314edfce7eaf8d7160b3119c7b7fed upstream.
atlas_buffer_postenable() acquires a runtime PM reference with
pm_runtime_resume_and_get() but returns the result of
atlas_set_interrupt() directly. If atlas_set_interrupt() fails,
the runtime PM reference is leaked and the device can never
autosuspend.
Add pm_runtime_put_autosuspend() on the error path to balance
the reference.
Fixes: 0e4f336f50de ("iio: chemical: atlas-sensor: Balance runtime pm + pm_runtime_resume_and_get()")
Cc: stable@vger.kernel.org
Signed-off-by: Moksh Panicker <mokshpanicker.7@gmail.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/chemical/atlas-sensor.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/iio/chemical/atlas-sensor.c
+++ b/drivers/iio/chemical/atlas-sensor.c
@@ -414,7 +414,11 @@ static int atlas_buffer_postenable(struc
if (ret)
return ret;
- return atlas_set_interrupt(data, true);
+ ret = atlas_set_interrupt(data, true);
+ if (ret)
+ pm_runtime_put_autosuspend(&data->client->dev);
+
+ return ret;
}
static int atlas_buffer_predisable(struct iio_dev *indio_dev)
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0140/1376] iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0139/1376] iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0141/1376] iio: chemical: sgp30: Handle IAQ thread creation failure Greg Kroah-Hartman
` (858 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fan Wu, Jonathan Cameron
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
commit be61c8c6252671ecf1fee0ad90f87669e0be1e20 upstream.
The atlas driver requests its hardware data-ready IRQ with
devm_request_threaded_irq(); its threaded handler queues an irq_work,
atlas_work_handler(), that calls iio_trigger_poll(data->trig).
The IRQ is devm-managed, so free_irq() runs from the devres unwind after
atlas_remove() returns without flushing that irq_work. Once a buffer is
enabled, conversion-complete IRQs keep firing and queueing it; a pending
irq_work can therefore run after the unwind has freed atlas_data/indio_dev
and the trigger, when atlas_work_handler() derives the atlas_data pointer
via container_of() and dereferences data->trig, a use-after-free.
Call iio_trigger_poll_nested() directly from the threaded handler instead
of bouncing through irq_work. free_irq() then drains the threaded handler,
closing the window; other iio drivers with a threaded data-ready IRQ do the
same (e.g. bmi270).
This issue was found by an in-house static analysis tool.
Fixes: 7103b99b031c ("iio: chemical: atlas-ph-sensor: reorg driver to allow multiple chips")
Cc: stable@vger.kernel.org # v6.4+
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/chemical/atlas-sensor.c | 13 +------------
1 file changed, 1 insertion(+), 12 deletions(-)
--- a/drivers/iio/chemical/atlas-sensor.c
+++ b/drivers/iio/chemical/atlas-sensor.c
@@ -13,7 +13,6 @@
#include <linux/mutex.h>
#include <linux/err.h>
#include <linux/irq.h>
-#include <linux/irq_work.h>
#include <linux/i2c.h>
#include <linux/mod_devicetable.h>
#include <linux/regmap.h>
@@ -89,7 +88,6 @@ struct atlas_data {
struct iio_trigger *trig;
const struct atlas_device *chip;
struct regmap *regmap;
- struct irq_work work;
unsigned int interrupt_enabled;
/* 96-bit data + 32-bit pad + 64-bit timestamp */
__be32 buffer[6] __aligned(8);
@@ -443,13 +441,6 @@ static const struct iio_buffer_setup_ops
.predisable = atlas_buffer_predisable,
};
-static void atlas_work_handler(struct irq_work *work)
-{
- struct atlas_data *data = container_of(work, struct atlas_data, work);
-
- iio_trigger_poll(data->trig);
-}
-
static irqreturn_t atlas_trigger_handler(int irq, void *private)
{
struct iio_poll_func *pf = private;
@@ -475,7 +466,7 @@ static irqreturn_t atlas_interrupt_handl
struct iio_dev *indio_dev = private;
struct atlas_data *data = iio_priv(indio_dev);
- irq_work_queue(&data->work);
+ iio_trigger_poll_nested(data->trig);
return IRQ_HANDLED;
}
@@ -673,8 +664,6 @@ static int atlas_probe(struct i2c_client
goto unregister_trigger;
}
- init_irq_work(&data->work, atlas_work_handler);
-
if (client->irq > 0) {
/* interrupt pin toggles on new conversion */
ret = devm_request_threaded_irq(&client->dev, client->irq,
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0141/1376] iio: chemical: sgp30: Handle IAQ thread creation failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0140/1376] iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0142/1376] iio: dac: m62332: Fix regulator reference count imbalance Greg Kroah-Hartman
` (857 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linmao Li, Joshua Crofts, Stable,
Jonathan Cameron
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linmao Li <lilinmao@kylinos.cn>
commit 1135d6875d2dbda3f6ec718f3421a6ce4378bd63 upstream.
kthread_run() can fail and return an error pointer, but sgp_probe() stores
it and returns success, so the device is registered without its IAQ thread
and sgp_remove() later passes the error pointer to kthread_stop(). Return
the error from probe instead.
Fixes: ce514124161a ("iio: chemical: sgp30: Support Sensirion SGP30/SGPC3 sensors")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/chemical/sgp30.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/iio/chemical/sgp30.c
+++ b/drivers/iio/chemical/sgp30.c
@@ -548,6 +548,9 @@ static int sgp_probe(struct i2c_client *
data->iaq_thread = kthread_run(sgp_iaq_threadfn, data,
"%s-iaq", data->client->name);
+ if (IS_ERR(data->iaq_thread))
+ return dev_err_probe(dev, PTR_ERR(data->iaq_thread),
+ "failed to start IAQ thread\n");
return 0;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0142/1376] iio: dac: m62332: Fix regulator reference count imbalance
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0141/1376] iio: chemical: sgp30: Handle IAQ thread creation failure Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0143/1376] iio: gyro: mpu3050: fix sign of raw angular velocity readings Greg Kroah-Hartman
` (856 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Erick Henrique,
Jonathan Cameron
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erick Henrique <erick.henrique.rodrigues@usp.br>
commit a130404ce0b69ca1438126bd81c1985d3b4d2e6f upstream.
m62332_set_value() enables the Vcc regulator on every write of a
non-zero value and disables it on every write of zero, without tracking
the channel's current state. Because the regulator is reference counted,
changing a channel directly from one non-zero value to another enables
it more than once, while a later write of zero disables it only once.
The reference count never returns to zero and the regulator is left
enabled indefinitely.
Only enable the regulator on the transition from zero to non-zero, and
only disable it on the transition from non-zero to zero, using the
previously stored channel value to detect the edge. Balance the
regulator on the I2C error path so the reference count stays consistent
if the write fails.
Fixes: b87b0c0f81e8 ("iio: add m62332 DAC driver")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260418130322.106769-1-erick.henrique.rodrigues%40usp.br
Cc: stable@vger.kernel.org
Signed-off-by: Erick Henrique <erick.henrique.rodrigues@usp.br>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/dac/m62332.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
--- a/drivers/iio/dac/m62332.c
+++ b/drivers/iio/dac/m62332.c
@@ -32,6 +32,7 @@ static int m62332_set_value(struct iio_d
{
struct m62332_data *data = iio_priv(indio_dev);
struct i2c_client *client = data->client;
+ bool enabling, disabling;
u8 outbuf[2];
int res;
@@ -43,7 +44,10 @@ static int m62332_set_value(struct iio_d
mutex_lock(&data->mutex);
- if (val) {
+ enabling = val && !data->raw[channel];
+ disabling = !val && data->raw[channel];
+
+ if (enabling) {
res = regulator_enable(data->vcc);
if (res)
goto out;
@@ -52,14 +56,17 @@ static int m62332_set_value(struct iio_d
res = i2c_master_send(client, outbuf, ARRAY_SIZE(outbuf));
if (res >= 0 && res != ARRAY_SIZE(outbuf))
res = -EIO;
- if (res < 0)
+ if (res < 0) {
+ if (enabling)
+ regulator_disable(data->vcc);
goto out;
+ }
- data->raw[channel] = val;
-
- if (!val)
+ if (disabling)
regulator_disable(data->vcc);
+ data->raw[channel] = val;
+
mutex_unlock(&data->mutex);
return 0;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0143/1376] iio: gyro: mpu3050: fix sign of raw angular velocity readings
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0142/1376] iio: dac: m62332: Fix regulator reference count imbalance Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0144/1376] iio: light: cm32181: return zero after writing calibscale Greg Kroah-Hartman
` (855 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cong Nguyen, Linus Walleij,
Joshua Crofts, David Lechner, Jonathan Cameron
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cong Nguyen <congnt264@gmail.com>
commit 06fab97602fe400bea843176f485bbac07a668e2 upstream.
The MPU-3050 gyroscope output registers hold 16-bit two's complement
values; the angular velocity channels are declared with .sign = 's'.
When mpu3050_read_raw() handles IIO_CHAN_INFO_RAW it reads the register
via a big-endian regmap_bulk_read() and assigns it with:
*val = be16_to_cpu(raw_val);
be16_to_cpu() yields an unsigned 16-bit quantity, so negative rates
(bit 15 set) are reported to userspace as large positive integers
(e.g. -1 becomes 65535) instead of the correct negative value.
Cast to s16 before the assignment, matching the temperature channel a
few lines above which already handles the sign correctly.
Fixes: 3904b28efb2c ("iio: gyro: Add driver for the MPU-3050 gyroscope")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4
Signed-off-by: Cong Nguyen <congnt264@gmail.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>
Reviewed-by: David Lechner <dlechner@baylibre.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/gyro/mpu3050-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/gyro/mpu3050-core.c
+++ b/drivers/iio/gyro/mpu3050-core.c
@@ -356,7 +356,7 @@ static int mpu3050_read_raw(struct iio_d
goto out_read_raw_unlock;
}
- *val = be16_to_cpu(raw_val);
+ *val = (s16)be16_to_cpu(raw_val);
ret = IIO_VAL_INT;
goto out_read_raw_unlock;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0144/1376] iio: light: cm32181: return zero after writing calibscale
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0143/1376] iio: gyro: mpu3050: fix sign of raw angular velocity readings Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0145/1376] iio: light: gp2ap002: Disable regulators on resume failure Greg Kroah-Hartman
` (854 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Giorgi Tchankvetadze, Joshua Crofts,
Stable, Jonathan Cameron
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Giorgi Tchankvetadze <giorgi@tchankvetadze.com>
commit 8756acd30919a3e9f547ea4a1d4b7f7895f4d340 upstream.
The write_raw callback is documented to return 0 on success or a
negative error code. However, the IIO_CHAN_INFO_CALIBSCALE case
returns 'val' (the user-supplied value) instead of 0.
Fix it by returning 0 on success, matching the behavior of other
calibscale implementations in the subsystem.
Fixes: 971672c0b3cc ("iio: add Capella CM32181 ambient light sensor driver.")
Signed-off-by: Giorgi Tchankvetadze <giorgi@tchankvetadze.com>
Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/light/cm32181.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/light/cm32181.c
+++ b/drivers/iio/light/cm32181.c
@@ -370,7 +370,7 @@ static int cm32181_write_raw(struct iio_
switch (mask) {
case IIO_CHAN_INFO_CALIBSCALE:
cm32181->calibscale = val;
- return val;
+ return 0;
case IIO_CHAN_INFO_INT_TIME:
ret = cm32181_write_als_it(cm32181, val2);
return ret;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0145/1376] iio: light: gp2ap002: Disable regulators on resume failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0144/1376] iio: light: cm32181: return zero after writing calibscale Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0146/1376] iio: light: ltrf216a: fix runtime PM reference leak in error path Greg Kroah-Hartman
` (853 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Laxman Acharya Padhya, Linus Walleij,
Stable, Jonathan Cameron
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
commit a41000ba3a230bed1e422f283486ff8f77fe0d30 upstream.
If enabling VIO fails after VDD has been enabled, runtime resume
returns without disabling VDD. Likewise, if device reinitialization
fails, both supplies remain enabled. The runtime PM core keeps the
device suspended when its resume callback fails, so the supplies must
be restored to the suspended state.
Disable the supplies enabled by the callback before returning an error.
Fixes: 97d642e23037 ("iio: light: Add a driver for Sharp GP2AP002x00F")
Assisted-by: Codex:gpt-5
Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/light/gp2ap002.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--- a/drivers/iio/light/gp2ap002.c
+++ b/drivers/iio/light/gp2ap002.c
@@ -671,7 +671,7 @@ static int gp2ap002_runtime_resume(struc
ret = regulator_enable(gp2ap002->vio);
if (ret) {
dev_err(dev, "failed to enable VIO regulator in resume path\n");
- return ret;
+ goto out_disable_vdd;
}
msleep(20);
@@ -679,13 +679,19 @@ static int gp2ap002_runtime_resume(struc
ret = gp2ap002_init(gp2ap002);
if (ret) {
dev_err(dev, "re-initialization failed\n");
- return ret;
+ goto out_disable_vio;
}
/* Re-activate the IRQ */
enable_irq(gp2ap002->irq);
return 0;
+
+out_disable_vio:
+ regulator_disable(gp2ap002->vio);
+out_disable_vdd:
+ regulator_disable(gp2ap002->vdd);
+ return ret;
}
static DEFINE_RUNTIME_DEV_PM_OPS(gp2ap002_dev_pm_ops, gp2ap002_runtime_suspend,
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0146/1376] iio: light: ltrf216a: fix runtime PM reference leak in error path
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0145/1376] iio: light: gp2ap002: Disable regulators on resume failure Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0147/1376] iio: pressure: dps310: fix NULL pointer dereference on ACPI probe Greg Kroah-Hartman
` (852 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vidhu Sarwal, Joshua Crofts, Stable,
Jonathan Cameron
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vidhu Sarwal <vidhu.linux@gmail.com>
commit c132aef0e757a39036b1d40faf0569f2e343b13e upstream.
ltrf216a_get_lux() acquires a runtime PM reference by calling
ltrf216a_set_power_state(data, true). However, if
ltrf216a_read_data() fails, the function returns immediately without
dropping the reference.
This leaves the runtime PM usage count unbalanced, preventing the device
from autosuspending after a failed read.
Fix this by releasing the runtime PM reference before returning from the
error path.
Fixes: 83f0bcd40d5c ("iio: light: Add support for ltrf216a sensor")
Signed-off-by: Vidhu Sarwal <vidhu.linux@gmail.com>
Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/light/ltrf216a.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/iio/light/ltrf216a.c
+++ b/drivers/iio/light/ltrf216a.c
@@ -249,11 +249,10 @@ static int ltrf216a_get_lux(struct ltrf2
return ret;
greendata = ltrf216a_read_data(data, LTRF216A_ALS_DATA_0);
+ ltrf216a_set_power_state(data, false);
if (greendata < 0)
return greendata;
- ltrf216a_set_power_state(data, false);
-
lux = greendata * data->info->lux_multiplier * LTRF216A_WIN_FAC;
return lux;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0147/1376] iio: pressure: dps310: fix NULL pointer dereference on ACPI probe
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0146/1376] iio: light: ltrf216a: fix runtime PM reference leak in error path Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0148/1376] iio: pressure: mpl115: Fix runtime PM cleanup Greg Kroah-Hartman
` (851 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Rupesh Majhi, Jonathan Cameron
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rupesh Majhi <zoone.rupert@gmail.com>
commit 26e9213898fc949923188ef0aeea31fc87708836 upstream.
When the device is enumerated through its ACPI HID (IFX3100),
i2c_client_get_device_id() returns NULL: the ACPI-derived client name
does not match the driver's i2c_device_id table. dps310_probe() then
dereferences that NULL pointer in "iio->name = id->name" and crashes the
kernel during probe.
The IIO device name is always "dps310", so set it directly and drop the
now-unused device-id lookup.
Fixes: 72ff282819d0 ("iio: pressure: dps310: Add ACPI HID table")
Cc: stable@vger.kernel.org
Signed-off-by: Rupesh Majhi <zoone.rupert@gmail.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/pressure/dps310.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/iio/pressure/dps310.c
+++ b/drivers/iio/pressure/dps310.c
@@ -845,7 +845,6 @@ static const struct iio_info dps310_info
static int dps310_probe(struct i2c_client *client)
{
- const struct i2c_device_id *id = i2c_client_get_device_id(client);
struct dps310_data *data;
struct iio_dev *iio;
int rc;
@@ -858,7 +857,7 @@ static int dps310_probe(struct i2c_clien
data->client = client;
mutex_init(&data->lock);
- iio->name = id->name;
+ iio->name = DPS310_DEV_NAME;
iio->channels = dps310_channels;
iio->num_channels = ARRAY_SIZE(dps310_channels);
iio->info = &dps310_info;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0148/1376] iio: pressure: mpl115: Fix runtime PM cleanup
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0147/1376] iio: pressure: dps310: fix NULL pointer dereference on ACPI probe Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0149/1376] iio: srf04: fix pm_runtime handling on probe error path Greg Kroah-Hartman
` (850 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, jonathan.cameron, Can Peng
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Can Peng <pengcan@kylinos.cn>
commit 0b5e142ced4bcf20532da051934bd694d1bbd470 upstream.
mpl115_probe() enables runtime PM when a shutdown GPIO is present and
then returns the result of devm_iio_device_register(). If registration
fails, runtime PM remains enabled and autosuspend remains selected.
The same unmanaged runtime PM state is also left behind on driver
unbind, as the IIO device registration is managed but the runtime PM
setup is not.
Use devm_pm_runtime_enable() so runtime PM is disabled automatically on
probe failure and driver unbind, and check pm_runtime_set_active() so
setup errors are reported.
Set the autosuspend parameters before enabling runtime PM. Once probe
has completed, the driver core queues an idle request for the device, so
an explicit pm_runtime_get_noresume()/pm_runtime_put() pair is not
needed to start autosuspend.
Fixes: 0c3a333524a3 ("iio: pressure: mpl115: Implementing low power mode by shutdown gpio")
Cc: stable@vger.kernel.org
Suggested-by: jonathan.cameron@oss.qualcomm.com
Signed-off-by: Can Peng <pengcan@kylinos.cn>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/pressure/mpl115.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/drivers/iio/pressure/mpl115.c
+++ b/drivers/iio/pressure/mpl115.c
@@ -203,9 +203,9 @@ int mpl115_probe(struct device *dev, con
if (data->shutdown) {
/* Enable runtime PM */
- pm_runtime_get_noresume(dev);
- pm_runtime_set_active(dev);
- pm_runtime_enable(dev);
+ ret = pm_runtime_set_active(dev);
+ if (ret)
+ return ret;
/*
* As the device takes 3 ms to come up with a fresh
@@ -215,7 +215,10 @@ int mpl115_probe(struct device *dev, con
*/
pm_runtime_set_autosuspend_delay(dev, 2000);
pm_runtime_use_autosuspend(dev);
- pm_runtime_put(dev);
+
+ ret = devm_pm_runtime_enable(dev);
+ if (ret)
+ return ret;
dev_dbg(dev, "low-power mode enabled");
} else
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0149/1376] iio: srf04: fix pm_runtime handling on probe error path
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0148/1376] iio: pressure: mpl115: Fix runtime PM cleanup Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0150/1376] iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() Greg Kroah-Hartman
` (849 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cong Nguyen, Jonathan Cameron
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cong Nguyen <congnt264@gmail.com>
commit a40b2e7a17f26e38ab054363c9c7cde149588357 upstream.
When pm_runtime_set_active() fails during probe, the driver logs the
error and unregisters the IIO device, but then falls through and still
calls pm_runtime_enable() before returning the error.
Since probe returns an error, srf04_remove() is never called, so
runtime PM is left enabled without a matching pm_runtime_disable().
This leaks the enable and triggers an "Unbalanced pm_runtime_enable!"
warning on a subsequent bind of the device.
Return the error right after unregistering the IIO device so that
runtime PM is not enabled on the failure path.
Fixes: 2251157b335b ("iio: srf04: add power management feature")
Cc: stable@vger.kernel.org
Signed-off-by: Cong Nguyen <congnt264@gmail.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/proximity/srf04.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/iio/proximity/srf04.c
+++ b/drivers/iio/proximity/srf04.c
@@ -335,6 +335,7 @@ static int srf04_probe(struct platform_d
if (ret) {
dev_err(data->dev, "pm_runtime_set_active: %d\n", ret);
iio_device_unregister(indio_dev);
+ return ret;
}
pm_runtime_enable(data->dev);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0150/1376] iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0149/1376] iio: srf04: fix pm_runtime handling on probe error path Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0151/1376] iio: light: opt4001: Fix power down clearing bits of the wrong register Greg Kroah-Hartman
` (848 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maxwell Doose, Andy Shevchenko,
Sanjay Chitroda, Srinivas Pandruvada, Jonathan Cameron
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanjay Chitroda <sanjayembeddedse@gmail.com>
commit 967d066f5334740f656577bc51c381a1bb707b61 upstream.
Avoid using devm_iio_device_register(), as this driver requires explicit
error handling and teardown ordering.
With devm_iio_device_register(), IIO device remains registered until the
devres cleanup phase. However, driver's remove() callback removes the
sensor hub callback and trigger support. This can create a race window
where IIO device is still visible and read_raw() requests are issued.
These requests might call sensor_hub_input_attr_get_raw_value(), which
waits up to 5 seconds for a response from the sensor hub callback that
has already been removed.
Add an explicit iio_device_unregister() call in the teardown path to
ensure deterministic cleanup, so that userspace can no longer access the
device once backend resources begin to be dismantled.
Fixes: 59d0f2da3569 ("iio: hid: Add temperature sensor support")
Cc: stable@vger.kernel.org
Reviewed-by: Maxwell Doose <m32285159@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Sanjay Chitroda <sanjayembeddedse@gmail.com>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/temperature/hid-sensor-temperature.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/iio/temperature/hid-sensor-temperature.c
+++ b/drivers/iio/temperature/hid-sensor-temperature.c
@@ -243,7 +243,7 @@ static int hid_temperature_probe(struct
if (ret)
goto error_remove_trigger;
- ret = devm_iio_device_register(indio_dev->dev.parent, indio_dev);
+ ret = iio_device_register(indio_dev);
if (ret)
goto error_remove_callback;
@@ -263,6 +263,7 @@ static void hid_temperature_remove(struc
struct iio_dev *indio_dev = platform_get_drvdata(pdev);
struct temperature_state *temp_st = iio_priv(indio_dev);
+ iio_device_unregister(indio_dev);
sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_TEMPERATURE);
hid_sensor_remove_trigger(indio_dev, &temp_st->common_attributes);
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0151/1376] iio: light: opt4001: Fix power down clearing bits of the wrong register
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0150/1376] iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0152/1376] iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem() Greg Kroah-Hartman
` (847 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jonathan Cameron, Nikhil Gautam,
Andy Shevchenko, Stable, Jonathan Cameron
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikhil Gautam <nikhilgtr@gmail.com>
commit 3b2cd82c524c75a2173f2e3f874652a75f81cd1d upstream.
opt4001_power_down() intends to clear the operating mode bits in the
CTRL register but reads OPT4001_DEVICE_ID instead of OPT4001_CTRL, so
the value written back to CTRL contains device ID bits rather than the
current configuration.
Fix and simplify this by using regmap_clear_bits() on the CTRL register
directly in the devm action, and drop opt4001_power_down() which has no
other users.
Suggested-by: Jonathan Cameron <jic23@kernel.org>
Fixes: 9a9608418292 ("iio: light: Add support for TI OPT4001 light sensor")
Signed-off-by: Nikhil Gautam <nikhilgtr@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/light/opt4001.c | 27 ++++-----------------------
1 file changed, 4 insertions(+), 23 deletions(-)
--- a/drivers/iio/light/opt4001.c
+++ b/drivers/iio/light/opt4001.c
@@ -222,33 +222,14 @@ static int opt4001_set_conf(struct opt40
return ret;
}
-static int opt4001_power_down(struct opt4001_chip *chip)
-{
- struct device *dev = &chip->client->dev;
- int ret;
- unsigned int reg;
-
- ret = regmap_read(chip->regmap, OPT4001_DEVICE_ID, ®);
- if (ret) {
- dev_err(dev, "Failed to read configuration\n");
- return ret;
- }
-
- /* MODE_OFF is 0x0 so just set bits to 0 */
- reg &= ~OPT4001_CTRL_OPER_MODE_MASK;
-
- ret = regmap_write(chip->regmap, OPT4001_CTRL, reg);
- if (ret)
- dev_err(dev, "Failed to set configuration to power down\n");
-
- return ret;
-}
-
static void opt4001_chip_off_action(void *data)
{
struct opt4001_chip *chip = data;
+ int ret;
- opt4001_power_down(chip);
+ ret = regmap_clear_bits(chip->regmap, OPT4001_CTRL, OPT4001_CTRL_OPER_MODE_MASK);
+ if (ret)
+ dev_err(&chip->client->dev, "Failed to power down\n");
}
static const struct iio_chan_spec opt4001_channels[] = {
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0152/1376] iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0151/1376] iio: light: opt4001: Fix power down clearing bits of the wrong register Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0153/1376] iio: light: opt4001: Reject integration times with a non-zero seconds part Greg Kroah-Hartman
` (846 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nikhil Gautam, Andy Shevchenko,
Stable, Jonathan Cameron
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikhil Gautam <nikhilgtr@gmail.com>
commit afa28741c9a2cf6edb2e41e25ff146a562160bb3 upstream.
div_u64_rem() takes a u32 * for the remainder but is passed val2, which
is an int *. There is no functional impact as int and u32 have the same
size and representation on all supported architectures and the remainder
is always smaller than the divisor, so it fits in the positive range of
int. Fix the type mismatch by using a local u32 for the remainder and
assigning the result to *val2.
Fixes: 9a9608418292 ("iio: light: Add support for TI OPT4001 light sensor")
Signed-off-by: Nikhil Gautam <nikhilgtr@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/light/opt4001.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/iio/light/opt4001.c
+++ b/drivers/iio/light/opt4001.c
@@ -173,6 +173,7 @@ static int opt4001_read_lux_value(struct
u8 crc;
u8 calc_crc;
u64 lux_raw;
+ u32 rem;
int ret;
ret = regmap_read(chip->regmap, OPT4001_LIGHT1_MSB, &light1);
@@ -199,8 +200,8 @@ static int opt4001_read_lux_value(struct
lux_raw = lux_raw << exp;
lux_raw = lux_raw * chip->chip_info->mul;
- *val = div_u64_rem(lux_raw, chip->chip_info->div, val2);
- *val2 = *val2 * 100;
+ *val = div_u64_rem(lux_raw, chip->chip_info->div, &rem);
+ *val2 = rem * 100;
return IIO_VAL_INT_PLUS_NANO;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0153/1376] iio: light: opt4001: Reject integration times with a non-zero seconds part
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0152/1376] iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem() Greg Kroah-Hartman
@ 2026-09-12 6:42 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0154/1376] iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask Greg Kroah-Hartman
` (845 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:42 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nikhil Gautam, Andy Shevchenko,
Stable, Jonathan Cameron
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikhil Gautam <nikhilgtr@gmail.com>
commit d0f21621f8b2b46661ea066d20705dbf7253db87 upstream.
opt4001_write_raw() only looks at val2 when setting the integration
time, so a write such as 1.000600 is silently accepted as 600 us.
Return -EINVAL if val is non-zero.
Fixes: 9a9608418292 ("iio: light: Add support for TI OPT4001 light sensor")
Signed-off-by: Nikhil Gautam <nikhilgtr@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/light/opt4001.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/iio/light/opt4001.c
+++ b/drivers/iio/light/opt4001.c
@@ -269,6 +269,9 @@ static int opt4001_write_raw(struct iio_
switch (mask) {
case IIO_CHAN_INFO_INT_TIME:
+ if (val)
+ return -EINVAL;
+
int_time = opt4001_als_time_to_index(val2);
if (int_time < 0)
return int_time;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0154/1376] iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2026-09-12 6:42 ` [PATCH 6.12 0153/1376] iio: light: opt4001: Reject integration times with a non-zero seconds part Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0155/1376] KVM: nVMX: Always flush vpid02 on first use Greg Kroah-Hartman
` (844 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nikhil Gautam, Andy Shevchenko,
Stable, Jonathan Cameron
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikhil Gautam <nikhilgtr@gmail.com>
commit d64bfd9f3352b9d9bdeca06de1a0a1c1bd47b896 upstream.
GENMASK(h, l) requires h >= l, but OPT4001_CTRL_FAULT_COUNT is defined
as GENMASK(0, 1). The define is currently unused so there is no
functional impact, but fix it before anyone builds on it, and add the
_MASK suffix for consistency with the neighbouring definitions.
Fixes: 9a9608418292 ("iio: light: Add support for TI OPT4001 light sensor")
Signed-off-by: Nikhil Gautam <nikhilgtr@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/light/opt4001.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/light/opt4001.c
+++ b/drivers/iio/light/opt4001.c
@@ -39,7 +39,7 @@
#define OPT4001_CTRL_OPER_MODE_MASK GENMASK(5, 4)
#define OPT4001_CTRL_LATCH_MASK GENMASK(3, 3)
#define OPT4001_CTRL_INT_POL_MASK GENMASK(2, 2)
-#define OPT4001_CTRL_FAULT_COUNT GENMASK(0, 1)
+#define OPT4001_CTRL_FAULT_COUNT_MASK GENMASK(1, 0)
/* OPT4001 constants */
#define OPT4001_DEVICE_ID_VAL 0x121
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0155/1376] KVM: nVMX: Always flush vpid02 on first use
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (153 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0154/1376] iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0156/1376] KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 Greg Kroah-Hartman
` (843 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yosry Ahmed, Kai Huang, Jim Mattson,
Sean Christopherson
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yosry Ahmed <yosry@kernel.org>
commit f0772389413dce9657c7d6950abf3edbbd511356 upstream.
Make sure vpid02 is always flushed on first use by setting last_vpid=0
when allocating vpid02. nested_vmx_transition_tlb_flush() will always
detect a VPID change on first VM-Enter after VMXON, because VPID=0 in
vmcs12 is not allowed if L1 enables VPID.
This avoids using stale TLB entries from a previous lifetime of the
VPID, that might have been associated with a different vCPU (or a
completely different VM).
Note that last_vpid is already being initialized as 0 when the vCPU is
created, but it is not reset when vpid02 is freed on VMXOFF. Hence, the
problem can only occur if L1 does VMXOFF -> VMXON, runs an L2, and KVM
happens to reuse a VPID that has TLB entries on the physical CPU.
Cc: stable@vger.kernel.org
Signed-off-by: Yosry Ahmed <yosry@kernel.org>
Reviewed-by: Kai Huang <kai.huang@intel.com>
Reviewed-by: Jim Mattson <jmattson@google.com>
Link: https://patch.msgid.link/20260616214652.2157032-2-yosry@kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx/nested.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -1235,6 +1235,9 @@ static void nested_vmx_transition_tlb_fl
* is the VPID incorporated into the MMU context. I.e. KVM must assume
* that the new vpid12 has never been used and thus represents a new
* guest ASID that cannot have entries in the TLB.
+ *
+ * Note, last_vpid is initialized as 0, so the first nested VM-Enter
+ * after VMXON will always flush the TLB to avoid using stale entries.
*/
if (is_vmenter && vmcs12->virtual_processor_id != vmx->nested.last_vpid) {
vmx->nested.last_vpid = vmcs12->virtual_processor_id;
@@ -5343,6 +5346,13 @@ static int enter_vmx_operation(struct kv
vmx->nested.vpid02 = allocate_vpid();
+ /*
+ * Clear last_vpid to ensure that the VPID is flushed on the first
+ * nested VM-Enter. Otherwise, stale TLB entries from a previous life of
+ * the VPID (e.g. different vCPU or even different VM) could be used.
+ */
+ vmx->nested.last_vpid = 0;
+
vmx->nested.vmcs02_initialized = false;
vmx->nested.vmxon = true;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0156/1376] KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (154 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0155/1376] KVM: nVMX: Always flush vpid02 on first use Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0157/1376] KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit Greg Kroah-Hartman
` (842 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yosry Ahmed, Kai Huang,
Sean Christopherson
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
commit 32912404b4b1ee98400744941c78f019a63d6e8f upstream.
Separate the INVVPID operand checks from the actual flushing of vpid02 so
the flushing can be adjusted to do the right thing when vmcs02 was last
loaded on a different pCPU, without having to duplicate the logic across
multiple case-statements.
Opportunistically let the VM-Fail paths poke out past 80 chars.
No functional change intended.
Cc: stable@vger.kernel.org
Signed-off-by: Yosry Ahmed <yosry@kernel.org>
Reviewed-by: Kai Huang <kai.huang@intel.com>
Link: https://patch.msgid.link/20260616214652.2157032-3-yosry@kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx/nested.c | 43 +++++++++++++------------------------------
1 file changed, 13 insertions(+), 30 deletions(-)
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -5980,7 +5980,6 @@ static int handle_invvpid(struct kvm_vcp
u64 vpid;
u64 gla;
} operand;
- u16 vpid02;
int r, gpr_index;
if (!(vmx->nested.msrs.secondary_ctls_high &
@@ -6015,8 +6014,15 @@ static int handle_invvpid(struct kvm_vcp
return kvm_handle_memory_failure(vcpu, r, &e);
if (operand.vpid >> 16)
- return nested_vmx_fail(vcpu,
- VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
+ return nested_vmx_fail(vcpu, VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
+
+ if (type != VMX_VPID_EXTENT_ALL_CONTEXT && !operand.vpid)
+ return nested_vmx_fail(vcpu, VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
+
+ /* LAM doesn't apply to addresses that are inputs to TLB invalidation. */
+ if (type == VMX_VPID_EXTENT_INDIVIDUAL_ADDR &&
+ is_noncanonical_invlpg_address(operand.gla, vcpu))
+ return nested_vmx_fail(vcpu, VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
/*
* Always flush the effective vpid02, i.e. never flush the current VPID
@@ -6024,33 +6030,10 @@ static int handle_invvpid(struct kvm_vcp
* VMCS, and so whether or not the current vmcs12 has VPID enabled is
* irrelevant (and there may not be a loaded vmcs12).
*/
- vpid02 = nested_get_vpid02(vcpu);
- switch (type) {
- case VMX_VPID_EXTENT_INDIVIDUAL_ADDR:
- /*
- * LAM doesn't apply to addresses that are inputs to TLB
- * invalidation.
- */
- if (!operand.vpid ||
- is_noncanonical_invlpg_address(operand.gla, vcpu))
- return nested_vmx_fail(vcpu,
- VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
- vpid_sync_vcpu_addr(vpid02, operand.gla);
- break;
- case VMX_VPID_EXTENT_SINGLE_CONTEXT:
- case VMX_VPID_EXTENT_SINGLE_NON_GLOBAL:
- if (!operand.vpid)
- return nested_vmx_fail(vcpu,
- VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
- vpid_sync_context(vpid02);
- break;
- case VMX_VPID_EXTENT_ALL_CONTEXT:
- vpid_sync_context(vpid02);
- break;
- default:
- WARN_ON_ONCE(1);
- return kvm_skip_emulated_instruction(vcpu);
- }
+ if (type == VMX_VPID_EXTENT_INDIVIDUAL_ADDR)
+ vpid_sync_vcpu_addr(nested_get_vpid02(vcpu), operand.gla);
+ else
+ vpid_sync_context(nested_get_vpid02(vcpu));
/*
* Sync the shadow page tables if EPT is disabled, L1 is invalidating
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0157/1376] KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (155 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0156/1376] KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0158/1376] KVM: nVMX: Service local TLB flushes on failed nested VM-Enter Greg Kroah-Hartman
` (841 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yosry Ahmed, Sean Christopherson
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
commit 11722439fb206c88e6f31be54173efa9880b4ccb upstream.
Always check and clear KVM_REQ_GET_NESTED_STATE_PAGES when emulating a
nested VM-Exit to ensure the request is cleared, even when KVM was built
with CONFIG_KVM_HYPERV=n, as KVM subtly relies on the "check" to clear
the flag and thus avoid double-mapping the vmcs12 pages, e.g. if KVM
manages to bail from VM-Enter without processing the request, and then
emulates VMLAUNCH or VMRESUME.
Fixes: b4f69df0f65e ("KVM: x86: Make Hyper-V emulation optional")
Cc: stable@vger.kernel.org
Reported-by: Yosry Ahmed <yosry@kernel.org>
Reviewed-by: Yosry Ahmed <yosry@kernel.org>
Link: https://patch.msgid.link/20260724004757.131420-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx/nested.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -4962,8 +4962,9 @@ void nested_vmx_vmexit(struct kvm_vcpu *
/* trying to cancel vmlaunch/vmresume is a bug */
WARN_ON_ONCE(vmx->nested.nested_run_pending);
-#ifdef CONFIG_KVM_HYPERV
+ /* Note, "checking" the request also clears the request. */
if (kvm_check_request(KVM_REQ_GET_NESTED_STATE_PAGES, vcpu)) {
+#ifdef CONFIG_KVM_HYPERV
/*
* KVM_REQ_GET_NESTED_STATE_PAGES is also used to map
* Enlightened VMCS after migration and we still need to
@@ -4971,8 +4972,8 @@ void nested_vmx_vmexit(struct kvm_vcpu *
* the first L2 run.
*/
(void)nested_get_evmcs_page(vcpu);
- }
#endif
+ }
/* Service pending TLB flush requests for L2 before switching to L1. */
kvm_service_local_tlb_flush_requests(vcpu);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0158/1376] KVM: nVMX: Service local TLB flushes on failed nested VM-Enter
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (156 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0157/1376] KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0159/1376] KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU Greg Kroah-Hartman
` (840 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Christopherson, Yosry Ahmed,
Sashiko
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yosry Ahmed <yosry@kernel.org>
commit 05a0b701d1089fb57beeb8982f23c3bbafe0fa8b upstream.
KVM services local TLB flushes on "full" nested VM-Exits (through
__nested_vmx_vmexit()), but not if a nested VM-Enter fails (e.g. due to
failed VMCS checks in nested_vmx_enter_non_root_mode()).
However, it is possible that KVM had queued TLB flushes that need to be
performed, even if the nested VM-Enter was not successful. For example,
if VPID is disabled for L2 (via nested_vmx_transition_tlb_flush(), or if
via the MSR load lists, as the SDM says:
If any MSR is being loaded in such a way that would architecturally
require a TLB flush, the TLBs are updated so that, after VM entry, the
logical processor will not use any translations that were cached before
the transition.
The SDM is unclear about when the TLB flush should occur, and whether or
not a failed VM entry would flush the TLB, so it is safer to always
do the TLB flush in this case.
More concretely, KVM also updates the last VPID L1 used for L2 in
nested_vmx_transition_tlb_flush() (i.e. last_vpid), even if the VM entry
ultimately fails. With the current code, KVM could miss a TLB flush if
L1 changes L2's VPID, then does a failed VM entry followed by a
successful one, as the failed VM entry would update last_vpid but not
actually flush the TLB. Servicing local TLB flushes on failed VM entries
makes sure that the TLB is always flushed when last_vpid is updated.
Fixes: 5c614b3583e7 ("KVM: nVMX: nested VPID emulation")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org> # Internal review
Suggested-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Yosry Ahmed <yosry@kernel.org>
Link: https://patch.msgid.link/20260722230128.1587363-1-yosry@kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx/nested.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -3670,6 +3670,14 @@ enum nvmx_vmentry_status nested_vmx_ente
vmentry_fail_vmexit_guest_mode:
if (vmcs12->cpu_based_vm_exec_control & CPU_BASED_USE_TSC_OFFSETTING)
vcpu->arch.tsc_offset -= vmcs12->tsc_offset;
+
+ /*
+ * Handle any TLB flush requests that were queued for L2 if KVM made it
+ * far enough along to switch to L2 context. Note, loading host state
+ * will generate any flushes for L1 required by VM-Exit.
+ */
+ kvm_service_local_tlb_flush_requests(vcpu);
+
leave_guest_mode(vcpu);
vmentry_fail_vmexit:
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0159/1376] KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (157 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0158/1376] KVM: nVMX: Service local TLB flushes on failed nested VM-Enter Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0160/1376] KVM: x86/mmu: Fold kvm_mmu_zap_memslot() into kvm_arch_flush_shadow_memslot() Greg Kroah-Hartman
` (839 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yosry Ahmed, Kai Huang,
Sean Christopherson
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yosry Ahmed <yosry@kernel.org>
commit 6d00e67326d831e6e610933a3800712f4ffe6ec1 upstream.
When emulating INVVPID, KVM executes INVVPID on the physical CPU using
vpid02 (instead of the L1 assigned VPID), after doing some validations
on the operands. However, it is possible that the physical CPU KVM
executes INVVPID on is different from the CPU L2 is running on.
For example, in the following scenario:
- L2 runs on CPU #1 and exits to L1 (vmx->nested.vmcs02.cpu=1)
- L1 migrates to CPU #2 and executes INVVPID
- KVM executes INVVPID on CPU #2
- L1 migrates back to CPU #1 and runs L2 (vmx->nested.vmcs02.cpu=1)
The TLB entries on CPU #1 are never invalidated, because INVVPID was
executed on CPU #2, and vmcs02 never ran on a different pCPU (i.e.
vmx_vcpu_load_vmcs() will *not* request KVM_REQ_TLB_FLUSH).
Ensure that INVVPID is being executed on the same pCPU that L2 last ran
on, and if not, fallback to clearing last_vpid=0 to trigger a full VPID
flush on the next nested VM-Enter (as KVM will detect L1 using a
different VPID for L2). If L2 ends up running on a different pCPU, KVM
will flush the TLB anyway through vmx_vcpu_load_vmcs().
Cc: stable@vger.kernel.org
Signed-off-by: Yosry Ahmed <yosry@kernel.org>
Reviewed-by: Kai Huang <kai.huang@intel.com>
Link: https://patch.msgid.link/20260616214652.2157032-4-yosry@kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx/nested.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -5990,6 +5990,7 @@ static int handle_invvpid(struct kvm_vcp
u64 gla;
} operand;
int r, gpr_index;
+ int cpu;
if (!(vmx->nested.msrs.secondary_ctls_high &
SECONDARY_EXEC_ENABLE_VPID) ||
@@ -6038,11 +6039,19 @@ static int handle_invvpid(struct kvm_vcp
* and never explicitly flush vpid01. INVVPID targets a VPID, not a
* VMCS, and so whether or not the current vmcs12 has VPID enabled is
* irrelevant (and there may not be a loaded vmcs12).
+ *
+ * If vmcs02 was last loaded on a different pCPU, then defer the flush
+ * by invalidating the nested VPID tracking to ensure that KVM performs
+ * the invalidation on the correct pCPU.
*/
- if (type == VMX_VPID_EXTENT_INDIVIDUAL_ADDR)
+ cpu = get_cpu();
+ if (cpu != vmx->nested.vmcs02.cpu)
+ vmx->nested.last_vpid = 0;
+ else if (type == VMX_VPID_EXTENT_INDIVIDUAL_ADDR)
vpid_sync_vcpu_addr(nested_get_vpid02(vcpu), operand.gla);
else
vpid_sync_context(nested_get_vpid02(vcpu));
+ put_cpu();
/*
* Sync the shadow page tables if EPT is disabled, L1 is invalidating
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0160/1376] KVM: x86/mmu: Fold kvm_mmu_zap_memslot() into kvm_arch_flush_shadow_memslot()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (158 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0159/1376] KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0161/1376] KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock Greg Kroah-Hartman
` (838 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Roth, Sean Christopherson
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
commit 06d38eaa78fdac1cc889f261fa420eba8e9caa1a upstream.
Fold kvm_mmu_zap_memslot() into its sole caller so that its GFN range
structure can be used to trigger guest_memfd invalidations regardless of
whether KVM will do a partial or full zap of the MMU.
No functional change intended.
Cc: stable@vger.kernel.org # 6.12.x
Reviewed-by: Michael Roth <michael.roth@amd.com>
Link: https://patch.msgid.link/20260709204948.1988414-8-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/mmu/mmu.c | 35 +++++++++++++++--------------------
1 file changed, 15 insertions(+), 20 deletions(-)
--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -7107,23 +7107,6 @@ out_flush:
kvm_mmu_remote_flush_or_zap(kvm, &invalid_list, flush);
}
-static void kvm_mmu_zap_memslot(struct kvm *kvm,
- struct kvm_memory_slot *slot)
-{
- struct kvm_gfn_range range = {
- .slot = slot,
- .start = slot->base_gfn,
- .end = slot->base_gfn + slot->npages,
- .may_block = true,
- };
- bool flush;
-
- write_lock(&kvm->mmu_lock);
- flush = kvm_unmap_gfn_range(kvm, &range);
- kvm_mmu_zap_memslot_pages_and_flush(kvm, slot, flush);
- write_unlock(&kvm->mmu_lock);
-}
-
static inline bool kvm_memslot_flush_zap_all(struct kvm *kvm)
{
return kvm->arch.vm_type == KVM_X86_DEFAULT_VM &&
@@ -7133,10 +7116,22 @@ static inline bool kvm_memslot_flush_zap
void kvm_arch_flush_shadow_memslot(struct kvm *kvm,
struct kvm_memory_slot *slot)
{
- if (kvm_memslot_flush_zap_all(kvm))
+ struct kvm_gfn_range range = {
+ .slot = slot,
+ .start = slot->base_gfn,
+ .end = slot->base_gfn + slot->npages,
+ .may_block = true,
+ };
+ bool flush;
+
+ if (kvm_memslot_flush_zap_all(kvm)) {
kvm_mmu_zap_all_fast(kvm);
- else
- kvm_mmu_zap_memslot(kvm, slot);
+ } else {
+ write_lock(&kvm->mmu_lock);
+ flush = kvm_unmap_gfn_range(kvm, &range);
+ kvm_mmu_zap_memslot_pages_and_flush(kvm, slot, flush);
+ write_unlock(&kvm->mmu_lock);
+ }
}
void kvm_mmu_invalidate_mmio_sptes(struct kvm *kvm, u64 gen)
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0161/1376] KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (159 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0160/1376] KVM: x86/mmu: Fold kvm_mmu_zap_memslot() into kvm_arch_flush_shadow_memslot() Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0162/1376] KVM: x86: Serialize writes to disabled_quirks using kvm->lock Greg Kroah-Hartman
` (837 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vitaly Kuznetsov,
syzbot+3d5461510f8dc4adfe30, Carlos López,
Sean Christopherson
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos López <clopez@suse.de>
commit 0ca49fbd2883cd53d32d85b50feef17fa04d0fbf upstream.
Fix an issue where userspace or the guest can program an Hyper-V
synthetic timer to have a deadline in the past via integer overflow,
preventing the CPU from making progress and triggering an RCU stall.
Hyper-V's SynIC exposes 4 per-vCPU synthetic timers to the
guest, which are emulated by KVM. Each is programmed through the
HV_X64_MSR_STIMERi_CONFIG and HV_X64_MSR_STIMERi_COUNT MSRs. Depending
on CONFIG, COUNT represents either the absolute expiration time or the
period of a periodic timer, both expressed in 100ns ticks. These timers
may be set both by the guest (WRMSR) and the host (KVM_SET_MSRS).
When the timer is enabled, stimer_start() translates COUNT to an
absolute monotonic deadline and arms an hrtimer. If COUNT is set to a
value close to U64_MAX, the deadline calculation can overflow.
ktime_add_ns(ktime_now, 100 * (stimer->exp_time - time_now))
This can result in a CPU livelock. stimer_start() arms the timer
via hrtimer_start() with a deadline in the past, which causes it to
immediately fire. The stimer callback then raises KVM_RQ_HV_STIMER, with
the intention of causing KVM to deliver a synthetic interrupt on the
next vCPU guest enter.
Then, once userspace issues KVM_RUN, vcpu_enter_guest() consumes the
request, calling kvm_hv_process_stimers(). This would normally disable
the timer via stimer_expiration() once the deadline is in the past.
However, the deadline comparison is done between the KVM reference
counter and stime->exp_time, which is a big value close to U64_MAX, so
this never happens for a few thousand years.
kvm_hv_process_timers() then re-arms the timer via stimer_start(), since
it was not disabled, which again fires immediately. Before entering
the guest, kvm_vcpu_exit_request() checks kvm_request_pending(),
which returns true due to the newly raised KVM_REQ_HV_STIMER. Then
vcpu_enter_guest() aborts the guest entry, returning early into
vcpu_run(), which loops back again into vcpu_enter_guest(), restarting
the cycle.
Since there are no manual yields in this loop, a task with SCHED_FIFO
may starve RCU grace-period kthreads, which exposes the stalls found
by syzcaller:
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: (detected by 1, t=10502 jiffies, g=14269, q=1142 ncpus=2)
rcu: All QSes seen, last rcu_preempt kthread activity 10500 (4294965239-4294954739), jiffies_till_next_fqs=1, root ->qsmask 0x0
rcu: rcu_preempt kthread starved for 10500 jiffies! g14269 f0x2 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
( ... )
Call Trace:
<IRQ>
__run_hrtimer kernel/time/hrtimer.c:1773 [inline]
__hrtimer_run_queues+0x408/0xc30 kernel/time/hrtimer.c:1841
hrtimer_interrupt+0x45b/0xaa0 kernel/time/hrtimer.c:1903
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1045 [inline]
__sysvec_apic_timer_interrupt+0x102/0x3e0 arch/x86/kernel/apic/apic.c:1062
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1056
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xa8/0x110 kernel/locking/spinlock.c:194
Code: 74 05 e8 0b f4 5f f6 48 c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f6 44 24 21 02 75 4f f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 <e8> 23 6b 27 f6 65 8b 05 7c 60 5a 07 85 c0 74 40 48 c7 04 24 0e 36
RSP: 0018:ffffc900040a7320 EFLAGS: 00000206
RAX: 5de15cb931505900 RBX: 0000000000000a06 RCX: 5de15cb931505900
RDX: 0000000000000007 RSI: ffffffff8daa9dc3 RDI: 0000000000000001
RBP: ffffc900040a73b0 R08: ffffffff8fc3d077 R09: 1ffffffff1f87a0e
R10: dffffc0000000000 R11: fffffbfff1f87a0f R12: dffffc0000000000
R13: 0000000000000000 R14: ffff8880b8628240 R15: 1ffff92000814e64
hrtimer_start include/linux/hrtimer.h:259 [inline]
stimer_start arch/x86/kvm/hyperv.c:682 [inline]
kvm_hv_process_stimers+0xd0a/0x16a0 arch/x86/kvm/hyperv.c:893
vcpu_enter_guest arch/x86/kvm/x86.c:11193 [inline]
vcpu_run+0x2240/0x76b0 arch/x86/kvm/x86.c:11639
kvm_arch_vcpu_ioctl_run+0x1148/0x1c90 arch/x86/kvm/x86.c:11984
kvm_vcpu_ioctl+0x99a/0xed0 virt/kvm/kvm_main.c:4492
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f635278f749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f635365c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f63529e5fa0 RCX: 00007f635278f749
RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005
RBP: 00007f6352813f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f63529e6038 R14: 00007f63529e5fa0 R15: 00007ffd5b219358
</TASK>
Fix this by clamping the deadline computation to KTIME_MAX, which
preserves the intent of arming a timer very far in the future.
ktime_add_safe() already does this type of clamping, so use it after
checking that that multiplying by the 100ns time tick also does not
overflow.
Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Reported-by: syzbot+3d5461510f8dc4adfe30@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3d5461510f8dc4adfe30
Fixes: 1f4b34f825e8 ("kvm/x86: Hyper-V SynIC timers")
Cc: stable@vger.kernel.org
Signed-off-by: Carlos López <clopez@suse.de>
Link: https://patch.msgid.link/20260714133212.3916611-3-clopez@suse.de
[sean: tag for stable]
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/hyperv.c | 25 ++++++++++++++++++-------
1 file changed, 18 insertions(+), 7 deletions(-)
--- a/arch/x86/kvm/hyperv.c
+++ b/arch/x86/kvm/hyperv.c
@@ -623,6 +623,18 @@ static enum hrtimer_restart stimer_timer
}
/*
+ * Translate a stimer expiry given in 100ns reference ticks into an
+ * an absolute deadline. Saturates on overflow.
+ */
+static ktime_t stimer_add_delta(ktime_t now, u64 delta_100ns)
+{
+ if (delta_100ns >= KTIME_MAX / 100)
+ return KTIME_MAX;
+
+ return ktime_add_safe(now, 100 * delta_100ns);
+}
+
+/*
* stimer_start() assumptions:
* a) stimer->count is not equal to 0
* b) stimer->config has HV_STIMER_ENABLE flag
@@ -631,6 +643,7 @@ static int stimer_start(struct kvm_vcpu_
{
u64 time_now;
ktime_t ktime_now;
+ ktime_t deadline;
time_now = get_time_ref_counter(hv_stimer_to_vcpu(stimer)->kvm);
ktime_now = ktime_get();
@@ -653,10 +666,8 @@ static int stimer_start(struct kvm_vcpu_
stimer->index,
time_now, stimer->exp_time);
- hrtimer_start(&stimer->timer,
- ktime_add_ns(ktime_now,
- 100 * (stimer->exp_time - time_now)),
- HRTIMER_MODE_ABS);
+ deadline = stimer_add_delta(ktime_now, stimer->exp_time - time_now);
+ hrtimer_start(&stimer->timer, deadline, HRTIMER_MODE_ABS);
return 0;
}
stimer->exp_time = stimer->count;
@@ -675,9 +686,9 @@ static int stimer_start(struct kvm_vcpu_
stimer->index,
time_now, stimer->count);
- hrtimer_start(&stimer->timer,
- ktime_add_ns(ktime_now, 100 * (stimer->count - time_now)),
- HRTIMER_MODE_ABS);
+ deadline = stimer_add_delta(ktime_now, stimer->count - time_now);
+ hrtimer_start(&stimer->timer, deadline, HRTIMER_MODE_ABS);
+
return 0;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0162/1376] KVM: x86: Serialize writes to disabled_quirks using kvm->lock
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (160 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0161/1376] KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0163/1376] KVM: x86: Ensure runtime reads of disabled_quirks are resolved once Greg Kroah-Hartman
` (836 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Roth, Sean Christopherson
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
commit ba76b23ed36ab230fc2577aba24f65851114902f upstream.
Protect writes to disabled_quirks with kvm->lock to ensure KVM doesn't
clobber state in the unlikely scenario that userspace disables disparate
quirks from multiple tasks. More importantly, this will allow wrapping
accesses with {READ,WRITE}_ONCE without "needing" to also guard the writer
with a useless and confusing READ_ONCE (since the RMW wouldn't be atomic
anyways).
Ideally, KVM would disallow disabling quirks once quirks are "live", but
that would be a potentially breaking userspace ABI change, and while all
existing quirks are fully live only after vCPUs have been created, several
MMU-related quirks, IGNORE_GUEST_PAT and SLOT_ZAP_ALL, are partially live
at all times. Because populating MMUs requires a vCPU, the guest-visible
behavior of IGNORE_GUEST_PAT and SLOT_ZAP_ALL requires a vCPU, but for KVM
itself, processing the quirk (or not) has functional impact, i.e. for all
intents and purposes, KVM can't prevent those quirks from being disabled
after they've been consumed.
Cc: stable@vger.kernel.org # 6.12.x
Reviewed-by: Michael Roth <michael.roth@amd.com>
Link: https://patch.msgid.link/20260709204948.1988414-6-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/x86.c | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -6552,7 +6552,9 @@ int kvm_vm_ioctl_enable_cap(struct kvm *
break;
fallthrough;
case KVM_CAP_DISABLE_QUIRKS:
+ mutex_lock(&kvm->lock);
kvm->arch.disabled_quirks |= cap->args[0] & kvm_caps.supported_quirks;
+ mutex_unlock(&kvm->lock);
r = 0;
break;
case KVM_CAP_SPLIT_IRQCHIP: {
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0163/1376] KVM: x86: Ensure runtime reads of disabled_quirks are resolved once
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (161 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0162/1376] KVM: x86: Serialize writes to disabled_quirks using kvm->lock Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0164/1376] KVM: s390: Fix length check __import_wp_info() Greg Kroah-Hartman
` (835 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Roth, Sean Christopherson
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
commit ed15cb21999217e549414c128b4a0485debf6278 upstream.
Wrap the sole reader of disabled_quirks with READ_ONCE(), and wrap the
post-VM-creation write to disabled_quirks with WRITE_ONCE(), to ensure
checking the status of a quirk doesn't re-read disabled_quirks *if* the
caller needs such a guarantee. This will allow splitting the "fast" MMU
zap into front and back halves, without potentially skipping the back
half if SLOT_ZAP_ALL were concurrently disabled (which would be "fine" in
the current code base, but far from ideal).
Cc: stable@vger.kernel.org # 6.12.x
Reviewed-by: Michael Roth <michael.roth@amd.com>
Link: https://patch.msgid.link/20260709204948.1988414-7-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/x86.c | 3 ++-
arch/x86/kvm/x86.h | 2 +-
2 files changed, 3 insertions(+), 2 deletions(-)
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -6553,7 +6553,8 @@ int kvm_vm_ioctl_enable_cap(struct kvm *
fallthrough;
case KVM_CAP_DISABLE_QUIRKS:
mutex_lock(&kvm->lock);
- kvm->arch.disabled_quirks |= cap->args[0] & kvm_caps.supported_quirks;
+ WRITE_ONCE(kvm->arch.disabled_quirks,
+ kvm->arch.disabled_quirks | (cap->args[0] & kvm_caps.supported_quirks));
mutex_unlock(&kvm->lock);
r = 0;
break;
--- a/arch/x86/kvm/x86.h
+++ b/arch/x86/kvm/x86.h
@@ -357,7 +357,7 @@ static inline void kvm_register_write(st
static inline bool kvm_check_has_quirk(struct kvm *kvm, u64 quirk)
{
- return !(kvm->arch.disabled_quirks & quirk);
+ return !(READ_ONCE(kvm->arch.disabled_quirks) & quirk);
}
void kvm_inject_realmode_interrupt(struct kvm_vcpu *vcpu, int irq, int inc_eip);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0164/1376] KVM: s390: Fix length check __import_wp_info()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (162 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0163/1376] KVM: x86: Ensure runtime reads of disabled_quirks are resolved once Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0165/1376] KVM: s390: Fix memory leak in guest debug handling Greg Kroah-Hartman
` (834 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Christian Borntraeger,
Claudio Imbrenda
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Borntraeger <borntraeger@linux.ibm.com>
commit 4c07680a467e2f7697245bcd11691bffb2a6f0ed upstream.
struct kvm_hw_breakpoint::len is a __u64 that is fully controlled by user
space. This is then assigned to wp_info->len, which is an int. The bounds
check is done on the truncated value while the allocation uses the
untruncated one:
wp_info->len = bp_data->len;
[...]
if (wp_info->len < 0 || wp_info->len > MAX_WP_SIZE)
return -EINVAL;
wp_info->old_data = kmalloc(bp_data->len, GFP_KERNEL_ACCOUNT);
Use the validated value for the allocation as intended. Without this
fix userspace can trigger >4GB allocations which will fail and result
in a WARN due to MAX_PAGE_ORDER.
Fixes: 27291e2165b6 ("KVM: s390: hardware support for guest debugging")
Cc: stable@vger.kernel.org
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Message-ID: <20260805110455.7200-9-borntraeger@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kvm/guestdbg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/s390/kvm/guestdbg.c
+++ b/arch/s390/kvm/guestdbg.c
@@ -184,7 +184,7 @@ static int __import_wp_info(struct kvm_v
if (wp_info->len < 0 || wp_info->len > MAX_WP_SIZE)
return -EINVAL;
- wp_info->old_data = kmalloc(bp_data->len, GFP_KERNEL_ACCOUNT);
+ wp_info->old_data = kmalloc(wp_info->len, GFP_KERNEL_ACCOUNT);
if (!wp_info->old_data)
return -ENOMEM;
/* try to backup the original value */
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0165/1376] KVM: s390: Fix memory leak in guest debug handling
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (163 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0164/1376] KVM: s390: Fix length check __import_wp_info() Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0166/1376] KVM: s390: Fix old_data leak in guest debug error path Greg Kroah-Hartman
` (833 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Borntraeger,
Matthew Rosato, Claudio Imbrenda
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Borntraeger <borntraeger@linux.ibm.com>
commit 121ea1de927c8b9bfdf53c31cad27b86d5de0293 upstream.
bp_data is freed only for the error case by kfree(bp_data).
Every successful KVM_SET_GUEST_DEBUG will leak bp_data.
Fixes: 27291e2165b6 ("KVM: s390: hardware support for guest debugging")
Cc: stable@vger.kernel.org
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Message-ID: <20260805110455.7200-5-borntraeger@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kvm/guestdbg.c | 1 +
1 file changed, 1 insertion(+)
--- a/arch/s390/kvm/guestdbg.c
+++ b/arch/s390/kvm/guestdbg.c
@@ -271,6 +271,7 @@ int kvm_s390_import_bp_data(struct kvm_v
vcpu->arch.guestdbg.hw_bp_info = bp_info;
vcpu->arch.guestdbg.nr_hw_wp = nr_wp;
vcpu->arch.guestdbg.hw_wp_info = wp_info;
+ kfree(bp_data);
return 0;
error:
kfree(bp_data);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0166/1376] KVM: s390: Fix old_data leak in guest debug error path
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (164 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0165/1376] KVM: s390: Fix memory leak in guest debug handling Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0167/1376] KVM: s390: Free guest debug data on vcpu destroy Greg Kroah-Hartman
` (832 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Borntraeger,
Matthew Rosato, Claudio Imbrenda
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Borntraeger <borntraeger@linux.ibm.com>
commit aa9c8e8baf1e765fa65b93212522c636f25d846f upstream.
__import_wp_info() allocates a per-watchpoint old_data buffer to back up
the original guest memory contents. If a later watchpoint of the same
KVM_SET_GUEST_DEBUG request fails to import, kvm_s390_import_bp_data()
jumps to the error label, which frees the wp_info array but not the
old_data buffers of the entries that were imported successfully. Up to
MAX_BP_COUNT - 1 buffers of up to MAX_WP_SIZE bytes are leaked per failed
request, and the request can be repeated.
Create error handling for cleaning up all created old_data memory
areas.
Fixes: 27291e2165b6 ("KVM: s390: hardware support for guest debugging")
Cc: stable@vger.kernel.org
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Message-ID: <20260805110455.7200-6-borntraeger@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kvm/guestdbg.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/arch/s390/kvm/guestdbg.c
+++ b/arch/s390/kvm/guestdbg.c
@@ -256,7 +256,7 @@ int kvm_s390_import_bp_data(struct kvm_v
ret = __import_wp_info(vcpu, &bp_data[i],
&wp_info[nr_wp]);
if (ret)
- goto error;
+ goto error_wp;
nr_wp++;
break;
case KVM_HW_BP:
@@ -273,6 +273,10 @@ int kvm_s390_import_bp_data(struct kvm_v
vcpu->arch.guestdbg.hw_wp_info = wp_info;
kfree(bp_data);
return 0;
+
+error_wp:
+ while (nr_wp--)
+ kfree(wp_info[nr_wp].old_data);
error:
kfree(bp_data);
kfree(wp_info);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0167/1376] KVM: s390: Free guest debug data on vcpu destroy
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (165 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0166/1376] KVM: s390: Fix old_data leak in guest debug error path Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0168/1376] KVM: s390: Take srcu when importing watchpoint data Greg Kroah-Hartman
` (831 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Borntraeger,
Matthew Rosato, Claudio Imbrenda
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Borntraeger <borntraeger@linux.ibm.com>
commit e7f698b09d4a7c36b299acf680fc50fe868e2bcd upstream.
kvm_s390_clear_bp_data() is only called from
kvm_arch_vcpu_ioctl_set_guest_debug(), i.e. when user space changes or
disables debugging. A vCPU that is destroyed while hardware breakpoints
are still armed - the normal case when the VMM just exits or crashes -
leaks hw_bp_info, hw_wp_info and all old_data buffers, since generic KVM
frees the vCPU right after kvm_arch_vcpu_destroy().
That is bounded by MAX_BP_COUNT entries, so roughly 8 KiB per vCPU, but
it is unbounded over VM lifetimes. The allocations are
GFP_KERNEL_ACCOUNT, so the charge also outlives the exiting process and
pins dying memcgs.
Fix by clearing the debug data on vCPU destruction. Calling it
unconditionally is fine: struct kvm_vcpu is zero allocated, so for a vCPU
that never enabled debugging the counters are 0 and the pointers NULL.
Fixes: 27291e2165b6 ("KVM: s390: hardware support for guest debugging")
Cc: stable@vger.kernel.org
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Message-ID: <20260805110455.7200-8-borntraeger@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kvm/kvm-s390.c | 1 +
1 file changed, 1 insertion(+)
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -3440,6 +3440,7 @@ void kvm_arch_vcpu_destroy(struct kvm_vc
trace_kvm_s390_destroy_vcpu(vcpu->vcpu_id);
kvm_s390_clear_local_irqs(vcpu);
kvm_clear_async_pf_completion_queue(vcpu);
+ kvm_s390_clear_bp_data(vcpu);
if (!kvm_is_ucontrol(vcpu->kvm))
sca_del_vcpu(vcpu);
kvm_s390_update_topology_change_report(vcpu->kvm, 1);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0168/1376] KVM: s390: Take srcu when importing watchpoint data
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (166 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0167/1376] KVM: s390: Free guest debug data on vcpu destroy Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0169/1376] KVM: s390: Zero initialize irq in reinject_machine_check Greg Kroah-Hartman
` (830 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Christian Borntraeger,
Claudio Imbrenda
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Borntraeger <borntraeger@linux.ibm.com>
commit a4e482def8533ebace517d9f67f1465841b1f982 upstream.
__import_wp_info() backs up the original guest memory contents of a
watchpoint with read_guest_abs(), which is kvm_read_guest() and therefore
resolves the memslot via __kvm_memslots(). That requires kvm->srcu (or
kvm->slots_lock) to be held, otherwise a concurrent memslot update can
free the memslots array under us once its SRCU grace period has elapsed.
As this is not fast path, following lock ordering (mutex first, then
srcu) take the big hammer and hold the srcu for the full import.
Fixes: 27291e2165b6 ("KVM: s390: hardware support for guest debugging")
Cc: stable@vger.kernel.org
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Message-ID: <20260805110455.7200-7-borntraeger@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kvm/kvm-s390.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -4393,8 +4393,10 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(
/* enforce guest PER */
kvm_s390_set_cpuflags(vcpu, CPUSTAT_P);
- if (dbg->control & KVM_GUESTDBG_USE_HW_BP)
- rc = kvm_s390_import_bp_data(vcpu, dbg);
+ if (dbg->control & KVM_GUESTDBG_USE_HW_BP) {
+ scoped_guard(srcu, &vcpu->kvm->srcu)
+ rc = kvm_s390_import_bp_data(vcpu, dbg);
+ }
} else {
kvm_s390_clear_cpuflags(vcpu, CPUSTAT_P);
vcpu->arch.guestdbg.last_bp = 0;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0169/1376] KVM: s390: Zero initialize irq in reinject_machine_check
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (167 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0168/1376] KVM: s390: Take srcu when importing watchpoint data Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0170/1376] KVM: s390: pv: Fix rc/rrc offset for PVM_DUMP Greg Kroah-Hartman
` (829 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Borntraeger,
Matthew Rosato, Claudio Imbrenda
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Borntraeger <borntraeger@linux.ibm.com>
commit b239410c7653ff6781d4cf1d63cfc52a1bb71788 upstream.
kvm_s390_reinject_machine_check() fills cr14, mcic, ext_damage_code and
failing_storage_address of the on-stack struct kvm_s390_irq, but struct
kvm_s390_mchk_info also has a pad word and a 16 byte fixed_logout array.
struct mcck_volatile_info carries no logout data, so there is nothing to
copy there and both stay whatever was on the stack.
__inject_mchk() then memcpy()s fixed_logout into the vcpu local
interrupt state unconditionally. This will reach the guest during
deliver and userspace during migration.
Reflecting zeroes is the correct behaviour here, as KVM has no logout
data for a reinjected machine check.
This needs a host machine check while the cpu is in SIE so not trivial
to trigger.
Fixes: 4d62fcc0b692 ("KVM: s390: Inject machine check into the guest")
Cc: stable@vger.kernel.org
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Message-ID: <20260805110455.7200-4-borntraeger@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kvm/interrupt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -2863,7 +2863,7 @@ void kvm_s390_reinject_machine_check(str
struct mcck_volatile_info *mcck_info)
{
struct kvm_s390_interrupt_info inti;
- struct kvm_s390_irq irq;
+ struct kvm_s390_irq irq = {};
struct kvm_s390_mchk_info *mchk;
union mci mci;
__u64 cr14 = 0; /* upper bits are not used */
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0170/1376] KVM: s390: pv: Fix rc/rrc offset for PVM_DUMP
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (168 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0169/1376] KVM: s390: Zero initialize irq in reinject_machine_check Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0171/1376] KVM: s390: Restore sigset on error path Greg Kroah-Hartman
` (828 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Christian Borntraeger,
Claudio Imbrenda
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Borntraeger <borntraeger@linux.ibm.com>
commit 1e3c8e7b3465fb8a49d3623d2d0f449c0b5b48f3 upstream.
The rc/rrc value is copied to the cmd location of the cmd in the kvm_pv_cmd
structure. Fix the offset.
Fixes: 8aba09588d2a ("KVM: s390: Add CPU dump functionality")
Cc: stable@vger.kernel.org
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Message-ID: <20260811153738.206885-4-borntraeger@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kvm/kvm-s390.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -5718,7 +5718,7 @@ long kvm_arch_vcpu_ioctl(struct file *fi
r = kvm_s390_handle_pv_vcpu_dump(vcpu, &cmd);
/* Always copy over UV rc / rrc data */
- if (copy_to_user((__u8 __user *)argp, &cmd.rc,
+ if (copy_to_user(argp + offsetof(struct kvm_pv_cmd, rc), &cmd.rc,
sizeof(cmd.rc) + sizeof(cmd.rrc)))
r = -EFAULT;
break;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0171/1376] KVM: s390: Restore sigset on error path
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (169 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0170/1376] KVM: s390: pv: Fix rc/rrc offset for PVM_DUMP Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0172/1376] LoongArch: KVM: Fix TOCTOU race on pv_features Greg Kroah-Hartman
` (827 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Christian Borntraeger,
Claudio Imbrenda
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Borntraeger <borntraeger@linux.ibm.com>
commit c44d36d8e6501c4934412d9014e5e02da9efdb8f upstream.
kvm_sigset_activate() installs vcpu->sigset via sigprocmask() and
stashes the caller's mask in current->real_blocked; only
kvm_sigset_deactivate() restores it.
For KVM_RUN on a STOPPED vcpu the error path will not restore the
userspace mask. Re-arrange the error handling to also restore the
signal mask.
Fixes: 6352e4d2dd9a3 ("KVM: s390: implement KVM_(S|G)ET_MP_STATE for user space state control")
Cc: stable@vger.kernel.org
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Message-ID: <20260811153738.206885-5-borntraeger@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kvm/kvm-s390.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -5067,7 +5067,7 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_v
pr_err_ratelimited("can't run stopped vcpu %d\n",
vcpu->vcpu_id);
rc = -EINVAL;
- goto out;
+ goto out_sigset;
}
kernel_fpu_begin(&fpu, KERNEL_FPC | KERNEL_VXR);
@@ -5096,9 +5096,11 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_v
store_regs(vcpu);
kernel_fpu_end(&fpu, KERNEL_FPC | KERNEL_VXR);
+ vcpu->stat.exit_userspace++;
+
+out_sigset:
kvm_sigset_deactivate(vcpu);
- vcpu->stat.exit_userspace++;
out:
vcpu_put(vcpu);
return rc;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0172/1376] LoongArch: KVM: Fix TOCTOU race on pv_features
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (170 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0171/1376] KVM: s390: Restore sigset on error path Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0173/1376] LoongArch: KVM: Free init resources if kvm_init() fails Greg Kroah-Hartman
` (826 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bibo Mao, Tao Cui, Huacai Chen
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tao Cui <cuitao@kylinos.cn>
commit 9296375902579f9b0e456bbb76e5cf179e5a4e0b upstream.
In kvm_loongarch_cpucfg_set_attr() the check-then-set on
kvm->arch.pv_features is lockless, so two vCPUs can race past the
validation and set different values. Add a spinlock to protect it.
Cc: stable@vger.kernel.org
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/loongarch/include/asm/kvm_host.h | 1 +
arch/loongarch/kvm/vcpu.c | 6 +++++-
arch/loongarch/kvm/vm.c | 1 +
3 files changed, 7 insertions(+), 1 deletion(-)
--- a/arch/loongarch/include/asm/kvm_host.h
+++ b/arch/loongarch/include/asm/kvm_host.h
@@ -110,6 +110,7 @@ struct kvm_arch {
unsigned int pte_shifts[MAX_PGTABLE_LEVELS];
unsigned int root_level;
spinlock_t phyid_map_lock;
+ spinlock_t pv_setting_lock;
struct kvm_phyid_map *phyid_map;
/* Enabled PV features */
unsigned long pv_features;
--- a/arch/loongarch/kvm/vcpu.c
+++ b/arch/loongarch/kvm/vcpu.c
@@ -1088,10 +1088,14 @@ static int kvm_loongarch_cpucfg_set_attr
return -EINVAL;
/* All vCPUs need set the same PV features */
+ spin_lock(&kvm->arch.pv_setting_lock);
if ((kvm->arch.pv_features & LOONGARCH_PV_FEAT_UPDATED)
- && ((kvm->arch.pv_features & valid) != val))
+ && ((kvm->arch.pv_features & valid) != val)) {
+ spin_unlock(&kvm->arch.pv_setting_lock);
return -EINVAL;
+ }
kvm->arch.pv_features = val | LOONGARCH_PV_FEAT_UPDATED;
+ spin_unlock(&kvm->arch.pv_setting_lock);
return 0;
default:
return -ENXIO;
--- a/arch/loongarch/kvm/vm.c
+++ b/arch/loongarch/kvm/vm.c
@@ -38,6 +38,7 @@ int kvm_arch_init_vm(struct kvm *kvm, un
return -ENOMEM;
}
spin_lock_init(&kvm->arch.phyid_map_lock);
+ spin_lock_init(&kvm->arch.pv_setting_lock);
kvm_init_vmcs(kvm);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0173/1376] LoongArch: KVM: Free init resources if kvm_init() fails
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (171 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0172/1376] LoongArch: KVM: Fix TOCTOU race on pv_features Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0174/1376] LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY Greg Kroah-Hartman
` (825 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bibo Mao, Chaithanya Lagisetty,
Huacai Chen
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chaithanya Lagisetty <nagachaithanya9911@gmail.com>
commit f7a1064cce3b100b54780c68529176232d8eb01e upstream.
kvm_loongarch_init() calls kvm_loongarch_env_init() to allocate the
per-CPU kvm_context (vmcs) and kvm_loongarch_ops and to register the
perf callbacks, and then calls kvm_init(). If kvm_init() fails its
result is returned directly, but since module_init() does not run the
module_exit() stuff on failure, so kvm_loongarch_env_exit() is never
called and those resources are leaked.
So call kvm_loongarch_env_exit() when kvm_init() fails, matching the
teardown-on-failure pattern used by riscv_kvm_init().
Cc: stable@vger.kernel.org
Fixes: 2bd6ac687261 ("LoongArch: KVM: Implement kvm module related interface")
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Signed-off-by: Chaithanya Lagisetty <nagachaithanya9911@gmail.com>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/loongarch/kvm/main.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/arch/loongarch/kvm/main.c
+++ b/arch/loongarch/kvm/main.c
@@ -377,7 +377,11 @@ static int kvm_loongarch_init(void)
if (r)
return r;
- return kvm_init(sizeof(struct kvm_vcpu), 0, THIS_MODULE);
+ r = kvm_init(sizeof(struct kvm_vcpu), 0, THIS_MODULE);
+ if (r)
+ kvm_loongarch_env_exit();
+
+ return r;
}
static void kvm_loongarch_exit(void)
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0174/1376] LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (172 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0173/1376] LoongArch: KVM: Free init resources if kvm_init() fails Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0175/1376] LoongArch: Fix acpi_package_ids[] array overflow Greg Kroah-Hartman
` (824 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tao Cui, Bibo Mao, Zeng Chi,
Huacai Chen
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zeng Chi <zengchi@kylinos.cn>
commit 27a9bfee3bbcb3cabb77797354f07e0e44e49831 upstream.
kvm_arch_prepare_memory_region() computes new->arch.flags, i.e. whether
a memslot is KVM_MEM_HUGEPAGE_CAPABLE or KVM_MEM_HUGEPAGE_INCAPABLE,
only for KVM_MR_CREATE and KVM_MR_MOVE, and returns early for every
other change. But the generic code allocates a zeroed memslot for every
change and never copies old->arch, so after a KVM_MR_FLAGS_ONLY update,
e.g. toggling KVM_MEM_LOG_DIRTY_PAGES for live migration, the active
memslot has arch.flags == 0.
With both flags clear, fault_supports_huge_mapping() falls through to
the alignment check on the HVA range alone, which no longer verifies
that the GPA and HVA have the same offset within a PMD. A memslot that
was marked KVM_MEM_HUGEPAGE_INCAPABLE because of a GPA/HVA offset
mismatch can then be mapped with PMD entries on read faults, and since
kvm_map_page() aligns the gfn and the pfn independently, the guest ends
up accessing the wrong host pages, exactly the "d -> f, e -> g" case
described in the comment above the check.
Carry the arch flags over from the old memslot for KVM_MR_FLAGS_ONLY,
as the GPA, HVA and size are guaranteed to be unchanged for that case.
Cc: stable@vger.kernel.org
Fixes: 7ab6fb505b2a ("LoongArch: KVM: Optimization for memslot hugepage checking")
Tested-by: Tao Cui <cuitao@kylinos.cn>
Reviewed-by: Tao Cui <cuitao@kylinos.cn>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Signed-off-by: Zeng Chi <zengchi@kylinos.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/loongarch/kvm/mmu.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/arch/loongarch/kvm/mmu.c
+++ b/arch/loongarch/kvm/mmu.c
@@ -383,6 +383,16 @@ int kvm_arch_prepare_memory_region(struc
hva_t hva_start;
size_t size, gpa_offset, hva_offset;
+ /*
+ * The generic code allocates a fresh, zeroed memslot for every change,
+ * so the arch flags computed below must be carried over when only the
+ * userspace flags change, e.g. when dirty logging is toggled.
+ */
+ if (change == KVM_MR_FLAGS_ONLY) {
+ new->arch = old->arch;
+ return 0;
+ }
+
if ((change != KVM_MR_MOVE) && (change != KVM_MR_CREATE))
return 0;
/*
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0175/1376] LoongArch: Fix acpi_package_ids[] array overflow
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (173 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0174/1376] LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0176/1376] LoongArch: Do not select HAVE_RUST when KASAN is enabled Greg Kroah-Hartman
` (823 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tao Cui, Bibo Mao, Huacai Chen
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bibo Mao <maobibo@loongson.cn>
commit 2a2367d46d7a4ee4122b7a86e57125542dbbe963 upstream.
With LoongArch virt machine, a typical setting is one core per socket,
there will max 256 sockets (packages) on one VM. With PPTT acpi table,
array acpi_package_ids[] will be overflowed.
Here change the array size of acpi_package_ids[] with the max value of
MAX_PACKAGES and KVM_MAX_VCPUS.
Cc: stable@vger.kernel.org # 6.7+
Fixes: 4e8f58620f67 ("LoongArch: Retrieve CPU package ID from PPTT when available")
Reviewed-by: Tao Cui <cuitao@kylinos.cn>
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/loongarch/kernel/acpi.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/arch/loongarch/kernel/acpi.c
+++ b/arch/loongarch/kernel/acpi.c
@@ -12,6 +12,7 @@
#include <linux/efi-bgrt.h>
#include <linux/irq.h>
#include <linux/irqdomain.h>
+#include <linux/kvm_host.h>
#include <linux/memblock.h>
#include <linux/of_fdt.h>
#include <linux/serial_core.h>
@@ -201,7 +202,7 @@ static void __init acpi_process_madt(voi
int pptt_enabled;
static int acpi_nr_packages;
-static int acpi_package_ids[MAX_PACKAGES];
+static int acpi_package_ids[MAX(MAX_PACKAGES, KVM_MAX_VCPUS)];
int __init parse_acpi_topology(void)
{
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0176/1376] LoongArch: Do not select HAVE_RUST when KASAN is enabled
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (174 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0175/1376] LoongArch: Fix acpi_package_ids[] array overflow Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0177/1376] LoongArch: Do not save/restore percpu base register in rethook trampoline Greg Kroah-Hartman
` (822 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Miguel Ojeda, Nathan Chancellor,
Huacai Chen
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <nathan@kernel.org>
commit 63b6a48c951d63bf39d44603ada48a987ccf66eb upstream.
After commit 2625480a1bf7 ("hardening: Default randstruct off with rust
for better allmodconfig support"), which allows Rust to be enabled for
allmodconfig, ARCH=loongarch allmodconfig starts failing with:
error: kernel-address sanitizer is not supported for this target
error: aborting due to 1 previous error
make[4]: *** [rust/Makefile:741: rust/core.o] Error 1
For the same reason as the commit 84a0f7caafc679f7 ("ARM: Do not select
HAVE_RUST when KASAN is enabled"), do not select HAVE_RUST when KASAN
is enabled until the loongarch64-unknown-none-softfloat target in rustc
supports KASAN.
Cc: stable@vger.kernel.org
Fixes: 90868ff9cade ("LoongArch: Enable initial Rust support")
Acked-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/loongarch/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/loongarch/Kconfig
+++ b/arch/loongarch/Kconfig
@@ -161,7 +161,7 @@ config LOONGARCH
select HAVE_RELIABLE_STACKTRACE if UNWINDER_ORC
select HAVE_RETHOOK
select HAVE_RSEQ
- select HAVE_RUST
+ select HAVE_RUST if !KASAN
select HAVE_SAMPLE_FTRACE_DIRECT
select HAVE_SAMPLE_FTRACE_DIRECT_MULTI
select HAVE_SETUP_PER_CPU_AREA if NUMA
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0177/1376] LoongArch: Do not save/restore percpu base register in rethook trampoline
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (175 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0176/1376] LoongArch: Do not select HAVE_RUST when KASAN is enabled Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0178/1376] LoongArch: Avoid preempt count underflow without probe Greg Kroah-Hartman
` (821 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wentao Guan, Huacai Chen
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Guan <guanwentao@uniontech.com>
commit c3f2feace5e4f4b01b68b9f947b19adb4155c32e upstream.
The rethook trampoline saves $r21 ($u0), the percpu base, into its frame
at entry and restores it at exit. Inbetween rethook_trampoline_handler()
may schedule via preempt_enable_notrace().
If the task migrates to another CPU, the frame's $r21 holds the old
CPU's percpu base, and restoring it poisons $r21 on the new CPU. Until
the next user->kernel transition heals $r21, all this_cpu_*() accesses
(runqueues, RCU per-CPU data, timer tick programming, FPU ownership)
hit the wrong CPU's percpu area.
Under kretprobe-heavy preemptible load this can corrupt scheduler and
timer state: scheduling-while-atomic splats, wrong-CPU RCU warnings,
WARN_ON_ONCE(rq != this_rq()) in nohz_balance_exit_idle(), and CPUs
parking in the idle loop with the constant timer never re-armed (hard
lockup). Reproduces on a Loongson-3A6000 with kretprobes on VFS paths
plus heavy file churn (OS install / unsquashfs).
By convention $r21 always holds the current CPU's percpu base in kernel
mode: SAVE_SOME() at exception entry reloads it only when coming from
user mode, and RESTORE_SOME() restores it only when returning to user
mode; the context-switch path never writes it. Therefore the live $r21
at trampoline exit is already correct, and nothing inbetween can change
it legitimately (kernel C code cannot write a global register variable).
The same flaw existed even in the pre-rethook kretprobe trampoline since
v6.3; it was carried over when rethook replaced it. Drop both the save
and the restore here. Drop the restore is enough to solve the issue, and
drop the save is to keep the code tidy and no need to clear it.
Cc: stable@vger.kernel.org # v6.3+
Fixes: 3f5536860086d ("LoongArch: Add kretprobes support")
Assisted-by: Kimi:Kimi-K3 # debug and root-cause analysis
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/loongarch/kernel/rethook_trampoline.S | 2 --
1 file changed, 2 deletions(-)
--- a/arch/loongarch/kernel/rethook_trampoline.S
+++ b/arch/loongarch/kernel/rethook_trampoline.S
@@ -24,7 +24,6 @@
cfi_st t6, PT_R18
cfi_st t7, PT_R19
cfi_st t8, PT_R20
- cfi_st u0, PT_R21
cfi_st fp, PT_R22
cfi_st s0, PT_R23
cfi_st s1, PT_R24
@@ -59,7 +58,6 @@
cfi_ld t6, PT_R18
cfi_ld t7, PT_R19
cfi_ld t8, PT_R20
- cfi_ld u0, PT_R21
cfi_ld fp, PT_R22
cfi_ld s0, PT_R23
cfi_ld s1, PT_R24
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0178/1376] LoongArch: Avoid preempt count underflow without probe
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (176 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0177/1376] LoongArch: Do not save/restore percpu base register in rethook trampoline Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0179/1376] media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref Greg Kroah-Hartman
` (820 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jérémy Jean, Huacai Chen
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
commit 72ce4b24676e8b3b75376c4c559dd81c1ac52d5a upstream.
LoongArch uses break 11 for the breakpoint placed after an instruction
that Kprobes executes out of line. Since userspace can issue the same
break instruction, do_bp() can reach kprobe_singlestep_handler() when
there is no current probe.
The handler actually returns false in this case, but it first calls
preempt_enable_no_resched(). The corresponding preempt_disable() is done
by kprobe_breakpoint_handler() on a real Kprobe hit, so it has not run
here. As a result, an ordinary userspace breakpoint (code 11) underflows
the current task's preempt count.
This also makes in_interrupt() return true until the task schedules. One
visible consequence is the socket cgroup attribution: cgroup_sk_alloc()
treats the allocation as interrupt context and assigns the socket to the
root cgroup. A socket opened from the SIGTRAP handler can then avoid a
BPF_CGROUP_INET_SOCK_CREATE policy attached to the task's own cgroup.
Return as soon as kprobe_running() reports no active probe.
The same check has appeared in [PATCH v10 2/4] of the original LoongArch
Kprobes series, but was dropped before the feature reached mainline.
Cc: stable@vger.kernel.org
Fixes: 6d4cc40fb5f5 ("LoongArch: Add kprobes support")
Link: https://lore.kernel.org/loongarch/1670575981-14389-3-git-send-email-yangtiezhu@loongson.cn/
Assisted-by: Codex:gpt-5
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/loongarch/kernel/kprobes.c | 3 +++
1 file changed, 3 insertions(+)
--- a/arch/loongarch/kernel/kprobes.c
+++ b/arch/loongarch/kernel/kprobes.c
@@ -273,6 +273,9 @@ bool kprobe_singlestep_handler(struct pt
struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
unsigned long addr = instruction_pointer(regs);
+ if (!cur)
+ return false;
+
if (cur && (kcb->kprobe_status & (KPROBE_HIT_SS | KPROBE_REENTER)) &&
((unsigned long)&cur->ainsn.insn[1] == addr)) {
restore_local_irqflag(kcb, regs);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0179/1376] media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (177 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0178/1376] LoongArch: Avoid preempt count underflow without probe Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0180/1376] media: amphion: Remove obsolete frame_count check in venc_start_session Greg Kroah-Hartman
` (819 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hans Verkuil, Valery Borovsky
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Valery Borovsky <vebohr@gmail.com>
commit 2f378dc45e685fc825d2dd08e7864666d6fcc009 upstream.
airspy_disconnect() clears s->udev under v4l2_lock, but
airspy_stop_streaming() unconditionally calls airspy_ctrl_msg() and
airspy_free_stream_bufs() afterwards. If a streaming user closes the
device after disconnect, stop_streaming() runs and dereferences the
NULL s->udev:
airspy_stop_streaming()
airspy_ctrl_msg(s, CMD_RECEIVER_MODE, 0, 0, NULL, 0)
usb_sndctrlpipe(s->udev, 0) /* NULL deref */
airspy_free_stream_bufs(s)
usb_free_coherent(s->udev, ...) /* NULL deref */
The airspy driver uses vb2_fop_release() in its file_operations, so
replace video_unregister_device(&s->vdev) with
vb2_video_unregister_device(&s->vdev) and move it before clearing
s->udev. vb2_video_unregister_device() releases the vb2 queue, which
synchronously runs airspy_stop_streaming() if streaming is active, so
the URBs, coherent DMA stream buffers and the hardware stop control
message all execute while s->udev is still valid.
vb2_video_unregister_device() locks vdev->queue->lock (vb_queue_lock)
internally, and stop_streaming() locks v4l2_lock, so the previous outer
mutex_lock(&s->vb_queue_lock) / mutex_lock(&s->v4l2_lock) pair around
the unregister sequence would self-deadlock and has been removed. A
short v4l2_lock critical section around s->udev = NULL remains so any
ioctl path that still holds the file descriptor sees coherent state.
Issue identified by automated review of the INV-003 series at
https://sashiko.dev/
Fixes: 634fe5033951 ("[media] airspy: AirSpy SDR driver")
Cc: stable@vger.kernel.org
Suggested-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Valery Borovsky <vebohr@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/airspy/airspy.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
--- a/drivers/media/usb/airspy/airspy.c
+++ b/drivers/media/usb/airspy/airspy.c
@@ -464,14 +464,21 @@ static void airspy_disconnect(struct usb
dev_dbg(s->dev, "\n");
- mutex_lock(&s->vb_queue_lock);
+ /*
+ * vb2_video_unregister_device() releases the vb2 queue, which
+ * triggers airspy_stop_streaming() if streaming is active.
+ * stop_streaming() dereferences s->udev via airspy_ctrl_msg() and
+ * airspy_free_stream_bufs(), so it must run before s->udev is
+ * cleared. vb2_video_unregister_device() locks vb_queue_lock
+ * internally and stop_streaming() locks v4l2_lock, so neither may
+ * be held by the caller.
+ */
+ v4l2_device_disconnect(&s->v4l2_dev);
+ vb2_video_unregister_device(&s->vdev);
+
mutex_lock(&s->v4l2_lock);
- /* No need to keep the urbs around after disconnection */
s->udev = NULL;
- v4l2_device_disconnect(&s->v4l2_dev);
- video_unregister_device(&s->vdev);
mutex_unlock(&s->v4l2_lock);
- mutex_unlock(&s->vb_queue_lock);
v4l2_device_put(&s->v4l2_dev);
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0180/1376] media: amphion: Remove obsolete frame_count check in venc_start_session
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (178 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0179/1376] media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0181/1376] media: cec: core: Fix kmemleak due to missed rc_free_device() call Greg Kroah-Hartman
` (818 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ming Qian, Frank Li,
Nicolas Dufresne, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Qian <ming.qian@oss.nxp.com>
commit 2be6ee86385badab95b1bace984735bde6e0fec0 upstream.
The dev_err() log warning about no input when starting was originally
meaningful when min_queued_buffers was set, as it indicated an abnormal
condition. However, since commit 5633ec763a2a ("media: amphion: Drop
min_queued_buffers assignment") removed the min_queued_buffers
assignment, having frame_count == 0 at start is a normal condition.
Remove this misleading log that no longer serves any purpose.
Fixes: 5633ec763a2a ("media: amphion: Drop min_queued_buffers assignment")
Cc: stable@vger.kernel.org
Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/amphion/venc.c | 2 --
1 file changed, 2 deletions(-)
--- a/drivers/media/platform/amphion/venc.c
+++ b/drivers/media/platform/amphion/venc.c
@@ -967,8 +967,6 @@ static int venc_start_session(struct vpu
venc->ready_count = 0;
venc->stopped = false;
vpu_process_output_buffer(inst);
- if (venc->frame_count == 0)
- dev_err(inst->dev, "[%d] there is no input when starting\n", inst->id);
return 0;
error:
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0181/1376] media: cec: core: Fix kmemleak due to missed rc_free_device() call
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (179 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0180/1376] media: amphion: Remove obsolete frame_count check in venc_start_session Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0182/1376] media: cec: disable delayed work before freeing an interrupted transmit Greg Kroah-Hartman
` (817 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jonas Karlman, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Karlman <jonas@kwiboo.se>
commit a24ba0653f7154e671dc8d2bf64682ab2d042792 upstream.
The commit dccc0c3ddf8f ("media: rc: fix race between unregister and
urb/irq callbacks") removed the implicit call to rc_free_device() from
rc_unregister_device(). However, the commit missed to remove the NULL
assignment of adap->rc that is now causing rc_free_device() to never be
called on an allocated rc device.
kmemleak reports following after e.g. dw-hdmi unbind:
unreferenced object 0xffff00010ac10000 (size 4096):
comm "kworker/u16:1", pid 39, jiffies 4294897739
hex dump (first 32 bytes):
20 23 4b 0a 01 00 ff ff 08 00 c1 0a 01 00 ff ff #K.............
08 00 c1 0a 01 00 ff ff 00 00 00 00 00 00 00 00 ................
backtrace (crc e11baccc):
kmemleak_alloc+0x38/0x44
__kmalloc_cache_noprof+0x4a8/0x5e0
rc_allocate_device+0x48/0x2a0
cec_allocate_adapter+0x3ac/0x800
dw_hdmi_cec_probe+0x264/0x634
platform_probe+0xc0/0x188
really_probe+0x4a4/0x8e0
__driver_probe_device+0x2f8/0x440
driver_probe_device+0x60/0x160
__device_attach_driver+0x1a0/0x2a0
bus_for_each_drv+0x100/0x1a0
__device_attach+0x174/0x350
device_initial_probe+0x90/0xb0
bus_probe_device+0x4c/0x120
device_add+0xdec/0x116c
platform_device_add+0x354/0x598
Remove the assignment of adap->rc to NULL to let cec_delete_adapter()
free the allocated rc device after last user of the cec device exits to
fix the kmemleak.
Fixes: dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks")
Cc: stable@vger.kernel.org
Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/cec/core/cec-core.c | 2 --
1 file changed, 2 deletions(-)
--- a/drivers/media/cec/core/cec-core.c
+++ b/drivers/media/cec/core/cec-core.c
@@ -370,9 +370,7 @@ void cec_unregister_adapter(struct cec_a
return;
#ifdef CONFIG_MEDIA_CEC_RC
- /* Note: rc_unregister also calls rc_free */
rc_unregister_device(adap->rc);
- adap->rc = NULL;
#endif
debugfs_remove_recursive(adap->cec_dir);
#ifdef CONFIG_CEC_NOTIFIER
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0182/1376] media: cec: disable delayed work before freeing an interrupted transmit
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (180 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0181/1376] media: cec: core: Fix kmemleak due to missed rc_free_device() call Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0183/1376] media: cec: extron-da-hd-4k-plus: add sanity check Greg Kroah-Hartman
` (816 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+051024d603432b4ab395,
Hillf Danton, Biren Pandya, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biren Pandya <birenpandya@gmail.com>
commit 0fbd5c2327020858c45b2d1c65775d64cdeca523 upstream.
cec_transmit_msg_fh() drops adap->lock to wait for a blocking transmit in
wait_for_completion_killable(). If that wait is interrupted by a signal,
cancel_delayed_work_sync() can run before the CEC kthread arms the reply
timeout via schedule_delayed_work(&data->work) in cec_transmit_done_ts().
The work is then armed after the cancel, and the data is freed with its
delayed_work still pending:
ODEBUG: free active (active state 0) object: ... hint: cec_wait_timeout
Use disable_delayed_work_sync(): it cancels the work and disables it, so
the later schedule_delayed_work() becomes a no-op and the work cannot be
re-armed. The data is freed right after, so it need not be re-enabled.
Fixes: 490d84f6d73c ("media: cec: forgot to cancel delayed work")
Reported-by: syzbot+051024d603432b4ab395@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=051024d603432b4ab395
Suggested-by: Hillf Danton <hdanton@sina.com>
Cc: stable@vger.kernel.org
Signed-off-by: Biren Pandya <birenpandya@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/cec/core/cec-adap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/cec/core/cec-adap.c
+++ b/drivers/media/cec/core/cec-adap.c
@@ -964,7 +964,7 @@ int cec_transmit_msg_fh(struct cec_adapt
*/
mutex_unlock(&adap->lock);
err = wait_for_completion_killable(&data->c);
- cancel_delayed_work_sync(&data->work);
+ disable_delayed_work_sync(&data->work);
mutex_lock(&adap->lock);
if (err)
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0183/1376] media: cec: extron-da-hd-4k-plus: add sanity check
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (181 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0182/1376] media: cec: disable delayed work before freeing an interrupted transmit Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0184/1376] media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash Greg Kroah-Hartman
` (815 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hans Verkuil, Sean Young
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <hverkuil+cisco@kernel.org>
commit abac9820b26b5cfcb01eb79efe2abdd0ac7e07c3 upstream.
Add check to prevent overflowing msg.msg[] in case the incoming data
is malformed.
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Reviewed-by: Sean Young <sean@mess.org>
Fixes: 056f2821b631 ("media: cec: extron-da-hd-4k-plus: add the Extron DA HD 4K Plus CEC driver")
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c
+++ b/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c
@@ -656,7 +656,8 @@ static void extron_process_received(stru
if (!port || port->disconnected)
return;
- if (len < 5 || (len - 2) % 3 || data[len - 2] != '*')
+ if (len < 5 || ((len - 2) / 3 > sizeof(msg.msg)) ||
+ (len - 2) % 3 || data[len - 2] != '*')
goto malformed;
while (*data != '*') {
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0184/1376] media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (182 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0183/1376] media: cec: extron-da-hd-4k-plus: add sanity check Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0185/1376] media: cec: Serialize exclusive follower delivery Greg Kroah-Hartman
` (814 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yi Ding, Neil Armstrong,
Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yi Ding <yi.s.ding@gmail.com>
commit 172c5a7d81deb922ddedd1bc920751c7fed6c43c upstream.
The driver registers two regmaps on the same platform device: an MMIO
regmap for the AO CEC registers, and an indirect regmap (using
reg_read()/reg_write() callbacks) for the CEC controller core registers.
Neither regmap_config sets a .name, so both default their debugfs
directory to the device name and collide:
debugfs: 'ff800280.cec' already exists in 'regmap'
Because of the clash the second regmap's debugfs directory fails to
register, so its registers can no longer be inspected via debugfs.
Give the indirect CEC core regmap a distinct name. The two debugfs
directories then become "<dev>.cec" and "<dev>.cec-core". This only
affects debugfs naming; register access is unchanged.
Tested on an ODROID-N2 (Amlogic S922X): the warning is gone and both
/sys/kernel/debug/regmap/ff800280.cec and ff800280.cec-core are present.
Fixes: b7778c46683c ("media: platform: meson: Add Amlogic Meson G12A AO CEC Controller driver")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Yi Ding <yi.s.ding@gmail.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/cec/platform/meson/ao-cec-g12a.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/media/cec/platform/meson/ao-cec-g12a.c
+++ b/drivers/media/cec/platform/meson/ao-cec-g12a.c
@@ -405,6 +405,7 @@ static int meson_ao_cec_g12a_write(void
}
static const struct regmap_config meson_ao_cec_g12a_cec_regmap_conf = {
+ .name = "core",
.reg_bits = 8,
.val_bits = 8,
.reg_read = meson_ao_cec_g12a_read,
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0185/1376] media: cec: Serialize exclusive follower delivery
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (183 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0184/1376] media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0186/1376] media: cedrus: fix memory leak in cedrus_init_ctrls() Greg Kroah-Hartman
` (813 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ruoyu Wang, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <ruoyuw560@gmail.com>
commit 1924d0788caa6c66fd320dd4704fae99487fd2c7 upstream.
cec_receive_notify() reads the exclusive follower pointer without the
adapter lock. Serialize the no-follower check and message delivery
against mode changes and release.
Fixes: 9881fe0ca187 ("[media] cec: add HDMI CEC framework (adapter)")
Cc: stable@vger.kernel.org
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/cec/core/cec-adap.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/media/cec/core/cec-adap.c
+++ b/drivers/media/cec/core/cec-adap.c
@@ -2209,9 +2209,13 @@ static int cec_receive_notify(struct cec
* Unprocessed messages are aborted if userspace isn't doing
* any processing either.
*/
+ mutex_lock(&adap->lock);
if (!is_broadcast && !is_reply && !adap->follower_cnt &&
- !adap->cec_follower && msg->msg[1] != CEC_MSG_FEATURE_ABORT)
+ !adap->cec_follower && msg->msg[1] != CEC_MSG_FEATURE_ABORT) {
+ mutex_unlock(&adap->lock);
return cec_feature_abort(adap, msg);
+ }
+ mutex_unlock(&adap->lock);
break;
}
@@ -2224,10 +2228,12 @@ skip_processing:
* Send to the exclusive follower if there is one, otherwise send
* to all followers.
*/
+ mutex_lock(&adap->lock);
if (adap->cec_follower)
cec_queue_msg_fh(adap->cec_follower, msg);
else
cec_queue_msg_followers(adap, msg);
+ mutex_unlock(&adap->lock);
return 0;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0186/1376] media: cedrus: fix memory leak in cedrus_init_ctrls()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (184 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0185/1376] media: cec: Serialize exclusive follower delivery Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0187/1376] media: cobalt: Avoid freeing ALSA private data twice Greg Kroah-Hartman
` (812 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dawei Feng, Jernej Skrabec,
Dan Carpenter, Nicolas Dufresne, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dawei Feng <dawei.feng@seu.edu.cn>
commit 9df2fbe563194da1967a5db083442186c1323efe upstream.
In cedrus_init_ctrls(), the V4L2 control handler is initialized before
allocating memory for ctx->ctrls. If this allocation fails, the function
returns -ENOMEM without freeing the previously allocated handler
resources, leading to a memory leak.
Fix this by calling v4l2_ctrl_handler_free() on the ctx->ctrls allocation
failure path.
The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available. Manual inspection confirms that the bug is still
present in v7.1.1.
An x86_64 allyesconfig build showed no new warnings. As we do not have an
Allwinner SoC or board with a Cedrus VPU available to test with, no
runtime testing was able to be performed.
Fixes: 50e761516f2b ("media: platform: Add Cedrus VPU decoder driver")
Cc: stable@vger.kernel.org
Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Reviewed-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/media/sunxi/cedrus/cedrus.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/staging/media/sunxi/cedrus/cedrus.c
+++ b/drivers/staging/media/sunxi/cedrus/cedrus.c
@@ -285,8 +285,10 @@ static int cedrus_init_ctrls(struct cedr
ctrl_size = sizeof(ctrl) * CEDRUS_CONTROLS_COUNT + 1;
ctx->ctrls = kzalloc(ctrl_size, GFP_KERNEL);
- if (!ctx->ctrls)
+ if (!ctx->ctrls) {
+ v4l2_ctrl_handler_free(hdl);
return -ENOMEM;
+ }
j = 0;
for (i = 0; i < CEDRUS_CONTROLS_COUNT; i++) {
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0187/1376] media: cobalt: Avoid freeing ALSA private data twice
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (185 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0186/1376] media: cedrus: fix memory leak in cedrus_init_ctrls() Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0188/1376] media: cx231xx: reject geometry changes while the VBI queue is busy Greg Kroah-Hartman
` (811 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ruoyu Wang, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <ruoyuw560@gmail.com>
commit 3a7d6b9c4cb5ac18cbd3f1c7f8c7b159c42ba0b1 upstream.
snd_cobalt_card_create() stores cobsc in sc->private_data and installs
snd_cobalt_card_private_free() as sc->private_free. From that point,
snd_card_free(sc) releases cobsc through the ALSA card cleanup path.
If cobalt_alsa_init() fails after snd_cobalt_card_create(), the
err_exit_free path calls snd_card_free(sc) and then kfree(cobsc). That
second free releases the same object again.
Remove the explicit kfree(cobsc) and leave ownership with the ALSA card.
This issue was found by a static analysis checker and confirmed by
manual source review.
Fixes: 85756a069c55 ("[media] cobalt: add new driver")
Cc: stable@vger.kernel.org
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/pci/cobalt/cobalt-alsa-main.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/media/pci/cobalt/cobalt-alsa-main.c
+++ b/drivers/media/pci/cobalt/cobalt-alsa-main.c
@@ -135,7 +135,6 @@ int cobalt_alsa_init(struct cobalt_strea
err_exit_free:
if (sc != NULL)
snd_card_free(sc);
- kfree(cobsc);
err_exit:
return ret;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0188/1376] media: cx231xx: reject geometry changes while the VBI queue is busy
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (186 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0187/1376] media: cobalt: Avoid freeing ALSA private data twice Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0189/1376] media: cx23885: cancel NetUP CI work before teardown Greg Kroah-Hartman
` (810 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 627a121c15fe05a541f44d86016294b80bada75d upstream.
vidioc_s_fmt_vid_cap() and vidioc_s_std() change the device-wide
dev->width / dev->norm but only refuse the change when the *video* queue
(dev->vidq) is busy. The VBI queue (dev->vbiq) shares that same geometry:
cx231xx_init_vbi_isoc() latches dma_q->lines_per_field from dev->norm,
the VBI videobuf2 plane is sized from dev->width / dev->norm in
vbi_queue_setup() and vbi_buf_prepare(), and cx231xx_do_vbi_copy() then
recomputes the destination offset from the *live* dev->width and the
latched lines_per_field on every URB completion:
offset = lines_completed * (dev->width << 1) + ...;
if (dma_q->current_field == 2)
offset += dev->width * 2 * dma_q->lines_per_field;
memcpy(plane + offset, p_buffer, lencopy);
Because the VBI node shares video_ioctl_ops with the video node, an
application can size a small VBI plane (REQBUFS/QBUF with a small width,
or with the NTSC standard), then enlarge dev->width (or switch dev->norm
to PAL) through the video node while the VBI stream is running -- the
change is allowed because only dev->vidq is checked -- and let the device
deliver a field-2 VBI payload. cx231xx_do_vbi_copy() now computes the
offset with the larger geometry and memcpy()s past the end of the smaller
plane that was already allocated, a heap out-of-bounds write whose offset
is attacker-chosen and whose contents come from the device. The
per-field guard in cx231xx_copy_vbi_line() does not help: it bounds the
copy against the latched lines_per_field, not the plane's real capacity,
and vb2 does not re-run buf_prepare() for an already prepared buffer.
Refuse the format/standard change when the VBI queue is busy as well, so
the geometry cannot change underneath an allocated VBI buffer.
Fixes: 7c617138b825 ("media: cx231xx: convert to the vb2 framework")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/cx231xx/cx231xx-video.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/media/usb/cx231xx/cx231xx-video.c
+++ b/drivers/media/usb/cx231xx/cx231xx-video.c
@@ -900,7 +900,7 @@ static int vidioc_s_fmt_vid_cap(struct f
if (rc)
return rc;
- if (vb2_is_busy(&dev->vidq)) {
+ if (vb2_is_busy(&dev->vidq) || vb2_is_busy(&dev->vbiq)) {
dev_err(dev->dev, "%s: queue busy\n", __func__);
return -EBUSY;
}
@@ -935,7 +935,7 @@ static int vidioc_s_std(struct file *fil
if (dev->norm == norm)
return 0;
- if (vb2_is_busy(&dev->vidq))
+ if (vb2_is_busy(&dev->vidq) || vb2_is_busy(&dev->vbiq))
return -EBUSY;
dev->norm = norm;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0189/1376] media: cx23885: cancel NetUP CI work before teardown
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (187 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0188/1376] media: cx231xx: reject geometry changes while the VBI queue is busy Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0190/1376] media: em28xx: defer audio-only extension registration Greg Kroah-Hartman
` (809 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fan Wu, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
commit 4e143d662ca94888b494b2427fc9e34494eb933a upstream.
netup_ci_exit() frees a netup_ci_state while its work item,
netup_read_ci_status(), may still be pending or running on the system
workqueue. The worker obtains the state with container_of() and
dereferences it, so it must not outlive the state.
netup_ci_init() queues the initial status read, and CI GPIO interrupts
subsequently queue the same work from netup_ci_slot_status(). During
remove, cx23885_finidev() calls free_irq() before the CI device is
unregistered. free_irq() prevents further IRQ handlers from running,
but does not drain work queued previously, so the worker can run after
netup_ci_exit() frees the state.
Call cancel_work_sync() before dvb_ca_en50221_release() and kfree().
This issue was found by an in-house static analysis tool.
Fixes: c184dcd28233 ("V4L/DVB (10798): Add CIMax(R) SP2 Common Interface code for NetUP Dual DVB-S2 CI card")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/pci/cx23885/cimax2.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/media/pci/cx23885/cimax2.c
+++ b/drivers/media/pci/cx23885/cimax2.c
@@ -528,6 +528,7 @@ void netup_ci_exit(struct cx23885_tsport
if (NULL == state->ca.data)
return;
+ cancel_work_sync(&state->work);
dvb_ca_en50221_release(&state->ca);
kfree(state);
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0190/1376] media: em28xx: defer audio-only extension registration
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (188 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0189/1376] media: cx23885: cancel NetUP CI work before teardown Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0191/1376] media: em28xx: fix use-after-free of dev_next->devlist on disconnect Greg Kroah-Hartman
` (808 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+a11c46f37ee083a73deb,
Fedor Pchelkin, Diego Fernando Mancera Gomez, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Diego Fernando Mancera Gomez <diegomancera.dev@gmail.com>
commit 95f76f51937fdfb0fc1e14cae606b1ef574a56f3 upstream.
The audio-only path registers extensions while probing the primary device.
For a dual-TS board, this happens before dev_next is created. The duplicate
device inherits is_audio_only and is then independently inserted into
em28xx_devlist.
The list is intended to contain only primary devices: extension operations
reach the secondary device through dev_next. The independently linked
secondary can be freed during disconnect while its list node remains
reachable, resulting in a use-after-free.
Defer audio-only extension registration to the module-request work item. It
runs only after probing has completed construction of the optional
secondary device, so only the primary is registered and extension callbacks
reach the secondary through dev_next.
Fixes: 4a089668ef22 ("media: em28xx-cards: rework the em28xx probing code")
Cc: stable@vger.kernel.org
Reported-by: syzbot+a11c46f37ee083a73deb@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/66ec3c83.050a0220.29194.002f.GAE@google.com/T/
Suggested-by: Fedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: Diego Fernando Mancera Gomez <diegomancera.dev@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/em28xx/em28xx-cards.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/media/usb/em28xx/em28xx-cards.c
+++ b/drivers/media/usb/em28xx/em28xx-cards.c
@@ -3448,6 +3448,7 @@ static void request_module_async(struct
* intf. Don't register extensions twice on those devices.
*/
if (dev->is_audio_only) {
+ em28xx_init_extension(dev);
#if defined(CONFIG_MODULES) && defined(MODULE)
request_module("em28xx-alsa");
#endif
@@ -3676,8 +3677,6 @@ static int em28xx_init_dev(struct em28xx
retval = -ENODEV;
goto err_deinit_media;
}
- em28xx_init_extension(dev);
-
return 0;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0191/1376] media: em28xx: fix use-after-free of dev_next->devlist on disconnect
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (189 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0190/1376] media: em28xx: defer audio-only extension registration Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0192/1376] media: go7007: defer the ALSA v4l2 put until card release Greg Kroah-Hartman
` (807 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+99d6c66dbbc484f50e1c,
Jiangong.Han, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiangong.Han <jiangong.han@windriver.com>
commit 826915b6b65e2d3251e7248ea54289a22d748c84 upstream.
When a device with has_dual_ts=1 is probed and the is_audio_only path
is taken, both dev and dev->dev_next are added to the global
em28xx_devlist via em28xx_init_extension(). However, during disconnect,
em28xx_close_extension(dev) only calls list_del(&dev->devlist), leaving
dev->dev_next->devlist still linked in the global list. When dev_next is
subsequently freed via kref_put(), its devlist entry becomes a dangling
pointer in em28xx_devlist. The next device probe that calls
em28xx_init_extension() triggers a list corruption BUG when list_add_tail
detects the freed node.
This bug was exposed by commit a368ecde8a50 ("USB: core: Fix duplicate
endpoint bug by clearing reserved bits in the descriptor") which clears
reserved bits in bEndpointAddress during endpoint parsing. This causes
fuzzed endpoint addresses like 0xf3 to be normalized to 0x83, which
em28xx interprets as a vendor audio endpoint, enabling the
is_audio_only + has_dual_ts code path that was previously unreachable
with such descriptors.
Fix this by removing dev->dev_next->devlist from the global list in
em28xx_close_extension() before the device is freed.
Fixes: f410b4093fdd ("media: em28xx: split up em28xx_dvb_init to reduce stack size")
Cc: stable@vger.kernel.org
Reported-by: syzbot+99d6c66dbbc484f50e1c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=99d6c66dbbc484f50e1c
Signed-off-by: Jiangong.Han <jiangong.han@windriver.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/em28xx/em28xx-core.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/media/usb/em28xx/em28xx-core.c
+++ b/drivers/media/usb/em28xx/em28xx-core.c
@@ -1134,6 +1134,8 @@ void em28xx_close_extension(struct em28x
ops->fini(dev);
}
}
+ if (dev->dev_next)
+ list_del(&dev->dev_next->devlist);
list_del(&dev->devlist);
mutex_unlock(&em28xx_devlist_mutex);
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0192/1376] media: go7007: defer the ALSA v4l2 put until card release
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (190 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0191/1376] media: em28xx: fix use-after-free of dev_next->devlist on disconnect Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0193/1376] media: i2c: alvium: Fix: Correct name of register in alvium_set_ctrl_auto_exposure Greg Kroah-Hartman
` (806 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Shuangpeng Bai, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
commit 1bd456afeb8a515137e567967069fce6f8fcd23e upstream.
go7007_snd_init() already takes a v4l2_device reference for the ALSA
side, but go7007_snd_remove() drops it immediately after calling
snd_card_free_when_closed().
That is too early when a userspace process still has the capture PCM open.
The ALSA card and its PCM callbacks remain alive until the last file is
closed, so the release path can still reach struct go7007 through
pcm->private_data and call go7007_snd_hw_free() after the V4L2 release path
has freed the object.
Move the matching v4l2_device_put() to the ALSA card private_free callback
so the existing ALSA reference covers the whole deferred card lifetime.
Closes: https://lore.kernel.org/r/178144969601.60470.6005237146425573205@gmail.com
Fixes: d5d3a7cc127d ("[media] go7007: fix unregister/disconnect handling")
Cc: stable@vger.kernel.org
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/go7007/snd-go7007.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/drivers/media/usb/go7007/snd-go7007.c
+++ b/drivers/media/usb/go7007/snd-go7007.c
@@ -195,6 +195,13 @@ static const struct snd_device_ops go700
.dev_free = go7007_snd_free,
};
+static void go7007_snd_card_free(struct snd_card *card)
+{
+ struct go7007 *go = card->private_data;
+
+ v4l2_device_put(&go->v4l2_dev);
+}
+
int go7007_snd_init(struct go7007 *go)
{
static int dev;
@@ -245,6 +252,8 @@ int go7007_snd_init(struct go7007 *go)
gosnd->substream = NULL;
go->snd_context = gosnd;
v4l2_device_get(&go->v4l2_dev);
+ gosnd->card->private_data = go;
+ gosnd->card->private_free = go7007_snd_card_free;
++dev;
return 0;
@@ -263,7 +272,6 @@ int go7007_snd_remove(struct go7007 *go)
snd_card_disconnect(gosnd->card);
snd_card_free_when_closed(gosnd->card);
- v4l2_device_put(&go->v4l2_dev);
return 0;
}
EXPORT_SYMBOL(go7007_snd_remove);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0193/1376] media: i2c: alvium: Fix: Correct name of register in alvium_set_ctrl_auto_exposure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (191 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0192/1376] media: go7007: defer the ALSA v4l2 put until card release Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0194/1376] media: i2c: imx415: Return test pattern write errors Greg Kroah-Hartman
` (805 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Martin Hecht, Sakari Ailus
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Hecht <mhecht73@gmail.com>
commit 58ca8a0bff9e78841a39863474b96e59ef60da19 upstream.
Write value for auto-exposure into correct register REG_BCRM_EXPOSURE_AUTO_RW
instead of wrong register REG_BCRM_WHITE_BALANCE_AUTO_RW.
Fixes: 0a7af872915e ("media: i2c: Add support for alvium camera")
Cc: stable@vger.kernel.org
Signed-off-by: Martin Hecht <mhecht73@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/i2c/alvium-csi2.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/i2c/alvium-csi2.c
+++ b/drivers/media/i2c/alvium-csi2.c
@@ -1291,7 +1291,7 @@ static int alvium_set_ctrl_auto_exposure
struct device *dev = &alvium->i2c_client->dev;
int ret;
- ret = alvium_write_hshake(alvium, REG_BCRM_WHITE_BALANCE_AUTO_RW,
+ ret = alvium_write_hshake(alvium, REG_BCRM_EXPOSURE_AUTO_RW,
on ? 0x02 : 0x00);
if (ret) {
dev_err(dev, "Fail to set autoexposure reg\n");
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0194/1376] media: i2c: imx415: Return test pattern write errors
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (192 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0193/1376] media: i2c: alvium: Fix: Correct name of register in alvium_set_ctrl_auto_exposure Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0195/1376] media: i2c: ov02a10: fix endpoint parsing use-after-free Greg Kroah-Hartman
` (804 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Riesch,
Narasimharao Vadlamudi, Sakari Ailus
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Narasimharao Vadlamudi <ahmisaranrao@gmail.com>
commit 8cd5735b88d76dda80b089031747b6f18ee0bca2 upstream.
imx415_set_testpattern() accumulates failures from cci_write(), but drops
the value and always returns success. Return the accumulated error so V4L2
reports failures to userspace.
Fixes: d5df1c7f3f83 ("media: i2c: imx415: Convert to new CCI register access helpers")
Cc: stable@vger.kernel.org
Reviewed-by: Michael Riesch <michael.riesch@collabora.com>
Signed-off-by: Narasimharao Vadlamudi <ahmisaranrao@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/i2c/imx415.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/i2c/imx415.c
+++ b/drivers/media/i2c/imx415.c
@@ -721,7 +721,7 @@ static int imx415_set_testpattern(struct
cci_write(sensor->regmap, IMX415_DIG_CLP_MODE, 0x01, &ret);
cci_write(sensor->regmap, IMX415_WRJ_OPEN, 0x01, &ret);
}
- return 0;
+ return ret;
}
static int imx415_s_ctrl(struct v4l2_ctrl *ctrl)
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0195/1376] media: i2c: ov02a10: fix endpoint parsing use-after-free
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (193 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0194/1376] media: i2c: imx415: Return test pattern write errors Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0196/1376] media: i2c: ov7740: fix use-after-destroy in remove Greg Kroah-Hartman
` (803 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Biren Pandya, Vladimir Zapolskiy,
Sakari Ailus
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biren Pandya <birenpandya@gmail.com>
commit 94971ba0592ca77ec99b292226a4b398763315b8 upstream.
The ov02a10_check_hwcfg() function calls fwnode_handle_put(ep)
immediately after allocating and parsing the endpoint. However, it
subsequently calls fwnode_property_read_u32() using the same 'ep'
handle, leading to a potential use-after-free.
Additionally, reading the optional 'ovti,mipi-clock-voltage' property
used to overwrite the 'ret' variable. If the property was missing,
'ret' would become negative, and this failure code would be incorrectly
returned at the end of the function, causing probe to fail entirely.
Fix the use-after-free by moving fwnode_property_read_u32() before
the endpoint is parsed and freed. Avoid the error leak by not
assigning the result of fwnode_property_read_u32() to 'ret'.
Fixes: 91807efbe8ec ("media: i2c: add OV02A10 image sensor driver")
Cc: stable@vger.kernel.org
Signed-off-by: Biren Pandya <birenpandya@gmail.com>
Reviewed-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/i2c/ov02a10.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
--- a/drivers/media/i2c/ov02a10.c
+++ b/drivers/media/i2c/ov02a10.c
@@ -822,18 +822,16 @@ static int ov02a10_check_hwcfg(struct de
if (!ep)
return -ENXIO;
+ /* Optional indication of MIPI clock voltage unit */
+ if (!fwnode_property_read_u32(ep, "ovti,mipi-clock-voltage",
+ &clk_volt))
+ ov02a10->mipi_clock_voltage = clk_volt;
+
ret = v4l2_fwnode_endpoint_alloc_parse(ep, &bus_cfg);
fwnode_handle_put(ep);
if (ret)
return ret;
- /* Optional indication of MIPI clock voltage unit */
- ret = fwnode_property_read_u32(ep, "ovti,mipi-clock-voltage",
- &clk_volt);
-
- if (!ret)
- ov02a10->mipi_clock_voltage = clk_volt;
-
for (i = 0; i < ARRAY_SIZE(link_freq_menu_items); i++) {
for (j = 0; j < bus_cfg.nr_of_link_frequencies; j++) {
if (link_freq_menu_items[i] ==
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0196/1376] media: i2c: ov7740: fix use-after-destroy in remove
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (194 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0195/1376] media: i2c: ov02a10: fix endpoint parsing use-after-free Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0197/1376] media: intel/ipu6: fix async notifier cleanup leak on parse error Greg Kroah-Hartman
` (802 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Biren Pandya, Sakari Ailus
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biren Pandya <birenpandya@gmail.com>
commit 5d1b3dea5a44124bab6c14a2d71b977dabed54e7 upstream.
The ov7740_remove() function had a severe teardown order bug where it
destroyed the driver's mutex before freeing the V4L2 control handler
which relies on that mutex, leading to a use-after-destroy kernel panic.
Furthermore, the driver explicitly called v4l2_ctrl_handler_free() and
mutex_destroy() sequentially, but then called ov7740_free_controls()
which invokes both of them a second time, resulting in a double-free.
This patch fixes the issue by unregistering the subdevice first, and
relying exclusively on ov7740_free_controls() to safely tear down the
mutex and control handler in the correct order.
Fixes: 39c5c4471b8d ("media: i2c: Add the ov7740 image sensor driver")
Cc: stable@vger.kernel.org
Signed-off-by: Biren Pandya <birenpandya@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/i2c/ov7740.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/drivers/media/i2c/ov7740.c
+++ b/drivers/media/i2c/ov7740.c
@@ -1119,10 +1119,8 @@ static void ov7740_remove(struct i2c_cli
struct v4l2_subdev *sd = i2c_get_clientdata(client);
struct ov7740 *ov7740 = container_of(sd, struct ov7740, subdev);
- mutex_destroy(&ov7740->mutex);
- v4l2_ctrl_handler_free(ov7740->subdev.ctrl_handler);
- media_entity_cleanup(&ov7740->subdev.entity);
v4l2_async_unregister_subdev(sd);
+ media_entity_cleanup(&ov7740->subdev.entity);
ov7740_free_controls(ov7740);
pm_runtime_get_sync(&client->dev);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0197/1376] media: intel/ipu6: fix async notifier cleanup leak on parse error
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (195 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0196/1376] media: i2c: ov7740: fix use-after-destroy in remove Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0198/1376] media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common Greg Kroah-Hartman
` (801 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cong Nguyen, Sakari Ailus
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cong Nguyen <congnt264@gmail.com>
commit abb1f808ceab5a3275f8a6b4e37cff17f9f781c1 upstream.
isys_notifier_init() calls v4l2_async_nf_init() and then adds fwnode
remote subdevs in a loop with v4l2_async_nf_add_fwnode_remote(). If an
endpoint parse or add fails partway through the loop, it jumps to
err_parse and returns without calling v4l2_async_nf_cleanup(), leaking
every v4l2_async_connection already added to the notifier's waiting
list.
The register-failure path just below already cleans up correctly, and
the caller only tears the notifier down (isys_notifier_cleanup()) once
isys_notifier_init() has returned success. Clean up the notifier on the
parse error path too.
Fixes: f50c4ca0a820 ("media: intel/ipu6: add the main input system driver")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4
Signed-off-by: Cong Nguyen <congnt264@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/pci/intel/ipu6/ipu6-isys.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/media/pci/intel/ipu6/ipu6-isys.c
+++ b/drivers/media/pci/intel/ipu6/ipu6-isys.c
@@ -761,6 +761,7 @@ static int isys_notifier_init(struct ipu
err_parse:
fwnode_handle_put(ep);
+ v4l2_async_nf_cleanup(&isys->notifier);
return ret;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0198/1376] media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (196 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0197/1376] media: intel/ipu6: fix async notifier cleanup leak on parse error Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0199/1376] media: platform: mtk-mdp3: Fix SCP device refcounting Greg Kroah-Hartman
` (800 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Hewitt, Nicolas Dufresne,
Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Hewitt <christianshewitt@gmail.com>
commit 20aa934ace6917262ff579a73ec018d06a7bad1c upstream.
When VIDIOC_TRY_FMT is called with an unsupported pixel format on the
OUTPUT queue, vdec_try_fmt_common() falls back to V4L2_PIX_FMT_MPEG2.
However, if a distro has locally patched MPEG2 support out (as it has
been broken for some time) the platform format table does not contain
MPEG2 so find_format() returns NULL and the subsequent dereference of
fmt_out->max_width triggers a NULL pointer dereference.
Fix this by falling back to the first format in the platform's format
array instead of hardcoding V4L2_PIX_FMT_MPEG2. This is always valid
since every platform defines at least one format.
Fixes: 3e7f51bd9607 ("media: meson: add v4l2 m2m video decoder driver")
Cc: stable@vger.kernel.org
Signed-off-by: Christian Hewitt <christianshewitt@gmail.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/media/meson/vdec/vdec.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/staging/media/meson/vdec/vdec.c
+++ b/drivers/staging/media/meson/vdec/vdec.c
@@ -506,8 +506,8 @@ vdec_try_fmt_common(struct amvdec_sessio
case V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE:
fmt_out = find_format(fmts, size, pixmp->pixelformat);
if (!fmt_out) {
- pixmp->pixelformat = V4L2_PIX_FMT_MPEG2;
- fmt_out = find_format(fmts, size, pixmp->pixelformat);
+ pixmp->pixelformat = fmts[0].pixfmt;
+ fmt_out = &fmts[0];
}
break;
case V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE:
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0199/1376] media: platform: mtk-mdp3: Fix SCP device refcounting
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (197 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0198/1376] media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0200/1376] media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup Greg Kroah-Hartman
` (799 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Johan Hovold,
Nicolas Dufresne, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
commit 55793e4665b7f15151e6f5ab51ca980e73abed5d upstream.
mdp_probe() first tries to get the SCP handle with scp_get(). When that
fails, it falls back to looking up the SCP platform device with
__get_pdev_by_id() and then reads its driver data.
The fallback lookup returns the platform device with a reference, just
like scp_get() does. However, the fallback path currently drops that
reference immediately after platform_get_drvdata(). The driver later
still calls scp_put(mdp->scp) unconditionally from the probe error path
and from mdp_video_device_release(), which drops the SCP device
reference again.
Keep the fallback reference until the existing scp_put() call, so that
the fallback path follows the same ownership rules as the scp_get()
path.
Fixes: 8f6f3aa21517 ("media: platform: mtk-mdp3: fix device leaks at probe")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c
+++ b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c
@@ -311,7 +311,6 @@ static int mdp_probe(struct platform_dev
goto err_destroy_clock_wq;
}
mdp->scp = platform_get_drvdata(mm_pdev);
- put_device(&mm_pdev->dev);
}
mdp->rproc_handle = scp_get_rproc(mdp->scp);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0200/1376] media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (198 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0199/1376] media: platform: mtk-mdp3: Fix SCP device refcounting Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0201/1376] media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing Greg Kroah-Hartman
` (798 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Moudy Ho, Johan Hovold,
Nicolas Dufresne, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 90368323fb244da0504e3da37a182f8e89bcc3b9 upstream.
Add the missing sanity check after looking up the SCP to avoid
dereferencing a NULL-pointer in case its driver has not yet been bound.
Fixes: 61890ccaefaf ("media: platform: mtk-mdp3: add MediaTek MDP3 driver")
Cc: stable@vger.kernel.org # 6.1
Cc: Moudy Ho <moudy.ho@mediatek.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c
+++ b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c
@@ -313,6 +313,11 @@ static int mdp_probe(struct platform_dev
mdp->scp = platform_get_drvdata(mm_pdev);
}
+ if (!mdp->scp) {
+ ret = -EPROBE_DEFER;
+ goto err_destroy_clock_wq;
+ }
+
mdp->rproc_handle = scp_get_rproc(mdp->scp);
dev_dbg(&pdev->dev, "MDP rproc_handle: %pK", mdp->rproc_handle);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0201/1376] media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (199 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0200/1376] media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0202/1376] media: nxp: imx8-isi: Correct color map between V4L2 and ISI Greg Kroah-Hartman
` (797 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guoniu Zhou, Laurent Pinchart,
Frank Li, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guoniu Zhou <guoniu.zhou@oss.nxp.com>
commit 795bd2863591f2fee33fab8f10cf9c383c94342e upstream.
The crossbar routing validation has a critical bug where it validates
the wrong routing table, allowing userspace to bypass validation entirely.
The __mxc_isi_crossbar_set_routing() function is called to validate and
apply a new routing table from userspace. However, the validation loop
iterates over state->routing (the currently active routing table) instead
of the routing parameter (the new table being validated):
for_each_active_route(&state->routing, route) {
This means userspace can submit any invalid routing configuration and it
will pass validation as long as the currently active routing is valid.
This is a security issue as it allows userspace to configure routes that
violate hardware constraints, potentially causing undefined hardware
behavior.
Fix by validating the routing table that will actually be applied.
Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver")
Cc: stable@vger.kernel.org
Signed-off-by: Guoniu Zhou <guoniu.zhou@oss.nxp.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260720-isi-v2-1-45845bc5d4fa@oss.nxp.com
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c
+++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c
@@ -107,7 +107,7 @@ static int __mxc_isi_crossbar_set_routin
return ret;
/* The memory input can be routed to the first pipeline only. */
- for_each_active_route(&state->routing, route) {
+ for_each_active_route(routing, route) {
if (route->sink_pad == xbar->num_sinks - 1 &&
route->source_pad != xbar->num_sinks) {
dev_dbg(xbar->isi->dev,
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0202/1376] media: nxp: imx8-isi: Correct color map between V4L2 and ISI
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (200 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0201/1376] media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0203/1376] media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks Greg Kroah-Hartman
` (796 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guoniu Zhou, Laurent Pinchart,
Frank Li, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guoniu Zhou <guoniu.zhou@oss.nxp.com>
commit 4640ec1cb0121473867e7a6850c7449340dcd428 upstream.
Fix the ISI input format for the color map V4L2_PIX_FMT_XBGR32 in
memory-to-memory mode.
Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver")
Cc: stable@vger.kernel.org
Signed-off-by: Guoniu Zhou <guoniu.zhou@oss.nxp.com>
Tested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260720-isi-v2-5-45845bc5d4fa@oss.nxp.com
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c
+++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c
@@ -151,7 +151,7 @@ static const struct mxc_isi_format_info
.fourcc = V4L2_PIX_FMT_XBGR32,
.type = MXC_ISI_VIDEO_CAP | MXC_ISI_VIDEO_M2M_OUT
| MXC_ISI_VIDEO_M2M_CAP,
- .isi_in_format = CHNL_MEM_RD_CTRL_IMG_TYPE_XBGR8,
+ .isi_in_format = CHNL_MEM_RD_CTRL_IMG_TYPE_XRGB8,
.isi_out_format = CHNL_IMG_CTRL_FORMAT_XRGB888,
.mem_planes = 1,
.color_planes = 1,
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0203/1376] media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (201 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0202/1376] media: nxp: imx8-isi: Correct color map between V4L2 and ISI Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0204/1376] media: rc: sunxi-cir: Unregister rc device on probe failure Greg Kroah-Hartman
` (795 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guoniu Zhou, Laurent Pinchart,
Frank Li, Loic Poulain, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guoniu Zhou <guoniu.zhou@oss.nxp.com>
commit 77e60a2c5d824ad2d493f53dc17137ae065753fe upstream.
Use BIT_ULL() instead of BIT() for u64 stream masks to avoid incorrect
results on 32-bit architectures when stream IDs are 32 or greater.
Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver")
Cc: stable@vger.kernel.org
Signed-off-by: Guoniu Zhou <guoniu.zhou@oss.nxp.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Link: https://patch.msgid.link/20260728-isi-v5-1-1d22ab91602a@oss.nxp.com
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c
+++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c
@@ -145,10 +145,10 @@ mxc_isi_crossbar_xlate_streams(struct mx
*/
for_each_active_route(&state->routing, route) {
if (route->source_pad != source_pad ||
- !(source_streams & BIT(route->source_stream)))
+ !(source_streams & BIT_ULL(route->source_stream)))
continue;
- sink_streams |= BIT(route->sink_stream);
+ sink_streams |= BIT_ULL(route->sink_stream);
sink_pad = route->sink_pad;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0204/1376] media: rc: sunxi-cir: Unregister rc device on probe failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (202 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0203/1376] media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0205/1376] media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak Greg Kroah-Hartman
` (794 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak, Sean Young
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
commit 479aa6fa8c50f1052f1451326ef7d4d586d340c3 upstream.
After rc_register_device() succeeds, later probe failures must undo the
registration with rc_unregister_device(). The current error path jumps to
the allocation cleanup label and only calls rc_free_device(), leaving the
rc device registration and resources created by rc_register_device()
behind.
Add a registered-device unwind label for the IRQ lookup, IRQ request, and
hardware initialization failure paths. Keep rc_free_device() for failures
before rc_register_device() succeeds.
Fixes: b4e3e59fb59c ("[media] rc: add sunxi-ir driver")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/rc/sunxi-cir.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/drivers/media/rc/sunxi-cir.c
+++ b/drivers/media/rc/sunxi-cir.c
@@ -344,22 +344,25 @@ static int sunxi_ir_probe(struct platfor
ir->irq = platform_get_irq(pdev, 0);
if (ir->irq < 0) {
ret = ir->irq;
- goto exit_free_dev;
+ goto exit_unregister_dev;
}
ret = devm_request_irq(dev, ir->irq, sunxi_ir_irq, 0, SUNXI_IR_DEV, ir);
if (ret) {
dev_err(dev, "failed request irq\n");
- goto exit_free_dev;
+ goto exit_unregister_dev;
}
ret = sunxi_ir_hw_init(dev);
if (ret)
- goto exit_free_dev;
+ goto exit_unregister_dev;
dev_info(dev, "initialized sunXi IR driver\n");
return 0;
+exit_unregister_dev:
+ rc_unregister_device(ir->rc);
+
exit_free_dev:
rc_free_device(ir->rc);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0205/1376] media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (203 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0204/1376] media: rc: sunxi-cir: Unregister rc device on probe failure Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0206/1376] media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure Greg Kroah-Hartman
` (793 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hans Verkuil, Valery Borovsky
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Valery Borovsky <vebohr@gmail.com>
commit dabb047c62668f280998e29117c55e41aabac336 upstream.
rtl2832_sdr_remove() runs on USB disconnect and clears dev->udev to
NULL before any pending streaming teardown has run. When user space
later closes its file descriptor, vb2 calls rtl2832_sdr_stop_streaming()
which in turn calls rtl2832_sdr_free_stream_bufs(). That helper releases
each coherent buffer with:
usb_free_coherent(dev->udev, dev->buf_size,
dev->buf_list[dev->buf_num],
dev->dma_addr[dev->buf_num]);
usb_free_coherent() returns immediately when its dev argument is NULL,
so every DMA stream buffer that was live at disconnect is silently
leaked. The URBs allocated in rtl2832_sdr_alloc_urbs() outlive the
device for the same reason.
The rtl2832_sdr driver uses vb2_fop_release() in its file_operations,
so replace video_unregister_device(&dev->vdev) with
vb2_video_unregister_device(&dev->vdev) and move it before clearing
dev->udev. vb2_video_unregister_device() releases the vb2 queue, which
synchronously runs rtl2832_sdr_stop_streaming() if streaming is active,
so URBs and coherent DMA stream buffers are freed while dev->udev is
still valid.
vb2_video_unregister_device() locks vdev->queue->lock (vb_queue_lock)
internally, and stop_streaming() locks v4l2_lock, so the previous outer
mutex_lock(&dev->vb_queue_lock) / mutex_lock(&dev->v4l2_lock) pair
around the unregister sequence would self-deadlock and has been removed.
A short v4l2_lock critical section around dev->udev = NULL remains so
any ioctl path that still holds the file descriptor sees coherent state.
Issue identified by automated review of the INV-003 series at
https://sashiko.dev/
Fixes: 771138920eaf ("[media] rtl2832_sdr: Realtek RTL2832 SDR driver module")
Cc: stable@vger.kernel.org
Suggested-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Valery Borovsky <vebohr@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/dvb-frontends/rtl2832_sdr.c | 18 +++++++++++++-----
1 file changed, 13 insertions(+), 5 deletions(-)
--- a/drivers/media/dvb-frontends/rtl2832_sdr.c
+++ b/drivers/media/dvb-frontends/rtl2832_sdr.c
@@ -1479,14 +1479,22 @@ static void rtl2832_sdr_remove(struct pl
dev_dbg(&pdev->dev, "\n");
- mutex_lock(&dev->vb_queue_lock);
+ /*
+ * vb2_video_unregister_device() releases the vb2 queue, which
+ * triggers rtl2832_sdr_stop_streaming() if streaming is active.
+ * stop_streaming() uses dev->udev to free URBs and coherent DMA
+ * stream buffers via usb_free_coherent(), so it must run before
+ * dev->udev is cleared. vb2_video_unregister_device() locks
+ * vb_queue_lock internally and stop_streaming() locks v4l2_lock,
+ * so neither may be held by the caller.
+ */
+ v4l2_device_disconnect(&dev->v4l2_dev);
+ vb2_video_unregister_device(&dev->vdev);
+
mutex_lock(&dev->v4l2_lock);
- /* No need to keep the urbs around after disconnection */
dev->udev = NULL;
- v4l2_device_disconnect(&dev->v4l2_dev);
- video_unregister_device(&dev->vdev);
mutex_unlock(&dev->v4l2_lock);
- mutex_unlock(&dev->vb_queue_lock);
+
v4l2_device_put(&dev->v4l2_dev);
module_put(pdev->dev.parent->driver->owner);
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0206/1376] media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (204 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0205/1376] media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0207/1376] media: s2255: bound JPEG frame size before copying into the buffer Greg Kroah-Hartman
` (792 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Valery Borovsky, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Valery Borovsky <vebohr@gmail.com>
commit fe50cdaebf12cd32ff9a44d92bfd6fbc2300dbd4 upstream.
rtl2832_sdr_start_streaming() calls rtl2832_sdr_alloc_stream_bufs(),
rtl2832_sdr_alloc_urbs() and rtl2832_sdr_submit_urbs() in sequence and
shares a single err: label that only unlocks the mutex and returns.
When alloc_urbs() succeeds but submit_urbs() fails, or when alloc_urbs()
itself returns -ENOMEM after alloc_stream_bufs() has already succeeded,
the URBs and/or the coherent DMA stream buffers stay allocated while
streaming reports failure to vb2. Two latent defects follow on the next
VIDIOC_STREAMON:
1) rtl2832_sdr_alloc_stream_bufs() unconditionally resets dev->buf_num
to 0 and overwrites dev->buf_list[]/dev->dma_addr[], permanently
leaking the coherent DMA memory allocated by the previous attempt.
2) rtl2832_sdr_alloc_urbs() never resets dev->urbs_initialized and only
increments it. After a second successful pass urbs_initialized can
exceed MAX_BULK_BUFS, so the subsequent rtl2832_sdr_free_urbs() walks
from urbs_initialized - 1 down to 0 and reads past the end of
dev->urb_list[], passing garbage pointers to usb_free_urb().
Mirror the teardown that stop_streaming() already performs: on the error
path call rtl2832_sdr_free_urbs() and rtl2832_sdr_free_stream_bufs()
before unlocking. Both helpers are idempotent (free_urbs kills and zeros
urbs_initialized; free_stream_bufs is gated on URB_BUF and clears the
buf_num counter), so partial-failure paths and the no-allocation paths
remain safe.
Issue identified by automated review of the INV-003 series at
https://sashiko.dev/
Fixes: 771138920eaf ("[media] rtl2832_sdr: Realtek RTL2832 SDR driver module")
Cc: stable@vger.kernel.org
Signed-off-by: Valery Borovsky <vebohr@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/dvb-frontends/rtl2832_sdr.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/media/dvb-frontends/rtl2832_sdr.c
+++ b/drivers/media/dvb-frontends/rtl2832_sdr.c
@@ -906,9 +906,12 @@ static int rtl2832_sdr_start_streaming(s
goto err;
mutex_unlock(&dev->v4l2_lock);
+
return 0;
err:
+ rtl2832_sdr_free_urbs(dev);
+ rtl2832_sdr_free_stream_bufs(dev);
rtl2832_sdr_cleanup_queued_bufs(dev, VB2_BUF_STATE_QUEUED);
mutex_unlock(&dev->v4l2_lock);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0207/1376] media: s2255: bound JPEG frame size before copying into the buffer
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (205 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0206/1376] media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0208/1376] media: s2255: check firmware size before reading trailing marker Greg Kroah-Hartman
` (791 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, HyeongJun An, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: HyeongJun An <sammiee5311@gmail.com>
commit e504cc888f42999dd76b6a43788c422610f2aad2 upstream.
s2255_fillbuff() memcpy()s vc->jpg_size bytes of a captured JPEG/MJPEG
frame into the vb2 plane. vc->jpg_size is taken verbatim from the
S2255_MARKER_FRAME header the device sends (pdword[4] in save_frame())
and, unlike the frame payload length just above it, is never bounded:
payload = le32_to_cpu(pdword[3]);
if (payload > vc->req_image_size) /* payload is checked ... */
return -EINVAL;
vc->pkt_size = payload;
vc->jpg_size = le32_to_cpu(pdword[4]); /* ... jpg_size is not */
A malicious or malfunctioning device can therefore report a jpg_size
larger than the destination vb2 plane, and the memcpy() writes past it.
jpg_size is a signed int, so a value with the top bit set also turns
into a huge length.
Reject a frame whose jpg_size is negative or exceeds the plane size
before copying it.
Fixes: 38f993ad8b1f ("V4L/DVB (8125): This driver adds support for the Sensoray 2255 devices.")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/s2255/s2255drv.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/media/usb/s2255/s2255drv.c
+++ b/drivers/media/usb/s2255/s2255drv.c
@@ -617,6 +617,12 @@ static void s2255_fillbuff(struct s2255_
break;
case V4L2_PIX_FMT_JPEG:
case V4L2_PIX_FMT_MJPEG:
+ if (jpgsize < 0 ||
+ jpgsize > vb2_plane_size(&buf->vb.vb2_buf, 0)) {
+ dprintk(dev, 1, "bad JPEG frame size %d\n",
+ jpgsize);
+ break;
+ }
vb2_set_plane_payload(&buf->vb.vb2_buf, 0, jpgsize);
memcpy(vbuf, tmpbuf, jpgsize);
break;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0208/1376] media: s2255: check firmware size before reading trailing marker
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (206 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0207/1376] media: s2255: bound JPEG frame size before copying into the buffer Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0209/1376] media: saa7164: fix cleanup on resource allocation failure Greg Kroah-Hartman
` (790 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lei Huang, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lei Huang <huanglei@kylinos.cn>
commit 330f2936ab768c7215322a476f033143e8891d28 upstream.
s2255_probe() reads a 4-byte marker and version from the last 8 bytes
of the firmware blob (fw->data[fw_size - 8] and [fw_size - 4]). If the
firmware file is shorter than 8 bytes, fw_size - 8 underflows and the
access reads out of bounds. Validate the firmware size before indexing.
Fixes: 14d962602c8b ("V4L/DVB (8752): s2255drv: firmware improvement patch")
Cc: stable@vger.kernel.org
Signed-off-by: Lei Huang <huanglei@kylinos.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/s2255/s2255drv.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/media/usb/s2255/s2255drv.c
+++ b/drivers/media/usb/s2255/s2255drv.c
@@ -2289,6 +2289,11 @@ static int s2255_probe(struct usb_interf
}
/* check the firmware is valid */
fw_size = dev->fw_data->fw->size;
+ if (fw_size < 8) {
+ dev_err(&interface->dev, "Firmware invalid: too small.\n");
+ retval = -ENODEV;
+ goto errorFWMARKER;
+ }
pdata = (__le32 *) &dev->fw_data->fw->data[fw_size - 8];
if (*pdata != S2255_FW_MARKER) {
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0209/1376] media: saa7164: fix cleanup on resource allocation failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (207 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0208/1376] media: s2255: check firmware size before reading trailing marker Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0210/1376] media: tda18250: fix possible integer overflow Greg Kroah-Hartman
` (789 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
commit 28e84c6e2e6753ed238ea097b2842a32a6a6879b upstream.
saa7164_dev_setup() adds the device to the global saa7164_devlist before
requesting the PCI BAR memory regions.
If get_resources() fails, saa7164_dev_setup() decrements the device count
and returns an error, but leaves the device on saa7164_devlist. The probe
error path then frees the device, leaving a dangling entry on the global
list.
Reuse the existing MMIO mapping error path to remove the device from
saa7164_devlist and decrement the device count before returning.
Also release BAR0 if it was successfully requested but the BAR2 request
fails.
Fixes: 443c1228d505 ("V4L/DVB (12923): SAA7164: Add support for the NXP SAA7164 silicon")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/pci/saa7164/saa7164-core.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/drivers/media/pci/saa7164/saa7164-core.c
+++ b/drivers/media/pci/saa7164/saa7164-core.c
@@ -878,6 +878,9 @@ static int get_resources(struct saa7164_
if (request_mem_region(pci_resource_start(dev->pci, 2),
pci_resource_len(dev->pci, 2), dev->name))
return 0;
+
+ release_mem_region(pci_resource_start(dev->pci, 0),
+ pci_resource_len(dev->pci, 0));
}
printk(KERN_ERR "%s: can't get MMIO memory @ 0x%llx or 0x%llx\n",
@@ -1000,8 +1003,7 @@ static int saa7164_dev_setup(struct saa7
dev->name, dev->pci->subsystem_vendor,
dev->pci->subsystem_device);
- saa7164_devcount--;
- return -ENODEV;
+ goto err_devlist;
}
/* PCI/e allocations */
@@ -1039,7 +1041,7 @@ err_ioremap_bar2:
iounmap(dev->lmmio);
err_ioremap_bar0:
release_resources(dev);
-
+err_devlist:
scoped_guard(mutex, &devlist) {
list_del(&dev->devlist);
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0210/1376] media: tda18250: fix possible integer overflow
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (208 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0209/1376] media: saa7164: fix cleanup on resource allocation failure Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0211/1376] media: v4l2-async: avoid deleting unlinked ASC entry on link error Greg Kroah-Hartman
` (788 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ilya Krutskih, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Krutskih <devsec@tpz.ru>
commit 6dd8e257f7cafda7fbf10d81b3c55c9bba4825f4 upstream.
Integer overflow may occur, when variable exp equals to zero. Result
of shift 1 << (exp - 1) may then leads to undefined behavior.
Fixes: 148abd3b5b14 ("media: tda18250: support for new silicon tuner")
Cc: stable@vger.kernel.org
Signed-off-by: Ilya Krutskih <devsec@tpz.ru>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/tuners/tda18250.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/media/tuners/tda18250.c
+++ b/drivers/media/tuners/tda18250.c
@@ -440,8 +440,8 @@ static int tda18250_pll_calc(struct dvb_
goto err;
exp = (uval & 0x70) >> 4;
- if (exp > 5)
- exp = 0;
+ if (exp == 0 || exp > 5)
+ exp = 1;
lopd = 1 << (exp - 1);
scale = uval & 0x0f;
fvco = lopd * scale * ((c->frequency / 1000) + dev->if_frequency);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0211/1376] media: v4l2-async: avoid deleting unlinked ASC entry on link error
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (209 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0210/1376] media: tda18250: fix possible integer overflow Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0212/1376] media: v4l2-ctrls: Allow unknown HDR10 white point and luminance Greg Kroah-Hartman
` (787 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xu Rao, Sakari Ailus
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Rao <raoxu@uniontech.com>
commit 47d82b605351c0e04f6365e42c8ffe2fcfdba615 upstream.
v4l2_async_match_notify() creates ancillary media links before adding
asc->asc_subdev_entry to sd->asc_list.
If ancillary link creation fails, the function jumps to
err_call_unbind while asc_subdev_entry has not been linked yet. Async
connections are zero-allocated, so the list entry still has NULL next
and prev pointers on this path. Calling list_del() on it can therefore
dereference NULL instead of returning the original link creation error.
Do not delete asc_subdev_entry from err_call_unbind. There is no list
insertion to undo on this path; the bound callback and sub-device
registration are the operations that need to be rolled back.
Fixes: 28a1295795d8 ("media: v4l: async: Allow multiple connections between entities")
Cc: stable@vger.kernel.org
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/v4l2-core/v4l2-async.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/media/v4l2-core/v4l2-async.c
+++ b/drivers/media/v4l2-core/v4l2-async.c
@@ -392,7 +392,6 @@ static int v4l2_async_match_notify(struc
err_call_unbind:
v4l2_async_nf_call_unbind(notifier, sd, asc);
- list_del(&asc->asc_subdev_entry);
err_unregister_subdev:
if (registered)
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0212/1376] media: v4l2-ctrls: Allow unknown HDR10 white point and luminance
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (210 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0211/1376] media: v4l2-async: avoid deleting unlinked ASC entry on link error Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0213/1376] media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link Greg Kroah-Hartman
` (786 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ming Qian, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Qian <ming.qian@oss.nxp.com>
commit 49af0c7cad889f7dabe5cf080b019392066122a3 upstream.
SMPTE ST 2086 defines the nominal ranges for mastering display
chromaticity and luminance values. Its Annex A also documents that
CTA 861-G uses zero maximum and minimum luminance values to signal
that the corresponding values are unknown, and the xy chromaticity
coordinate (0, 0) to signal that the white point chromaticity is
unknown.
The V4L2 HDR10 mastering display compound control currently rejects
these values. Consequently, an unknown white point or luminance value
prevents the entire compound control from being updated, making the
other valid mastering display metadata unavailable to userspace.
Accept (0, 0) as an unknown white point and zero as an unknown maximum
or minimum mastering luminance. Continue to reject partially zero white
point coordinates and non-zero values outside the nominal ranges.
Display primary validation remains unchanged.
Document the newly accepted unknown values in the V4L2 userspace API.
Fixes: 1ad0de78e794 ("media: v4l: Add HDR10 static metadata controls")
Cc: stable@vger.kernel.org
Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/userspace-api/media/v4l/ext-ctrls-colorimetry.rst | 12 ++
drivers/media/v4l2-core/v4l2-ctrls-core.c | 49 ++++++----
2 files changed, 44 insertions(+), 17 deletions(-)
--- a/Documentation/userspace-api/media/v4l/ext-ctrls-colorimetry.rst
+++ b/Documentation/userspace-api/media/v4l/ext-ctrls-colorimetry.rst
@@ -79,15 +79,25 @@ Colorimetry Control IDs
- ``white_point_x``
- Specifies the normalized x chromaticity coordinate of the white
point of the mastering display in increments of 0.00002.
+ When both ``white_point_x`` and ``white_point_y`` are zero,
+ the white point chromaticity is unknown. If either coordinate is
+ non-zero, both coordinates shall be within their valid ranges.
* - __u16
- ``white_point_y``
- Specifies the normalized y chromaticity coordinate of the white
point of the mastering display in increments of 0.00002.
+ When both ``white_point_x`` and ``white_point_y`` are zero,
+ the white point chromaticity is unknown. If either coordinate is
+ non-zero, both coordinates shall be within their valid ranges.
* - __u32
- ``max_luminance``
- Specifies the nominal maximum display luminance of the mastering
display in units of 0.0001 cd/m\ :sup:`2`.
+ A value of zero indicates that the nominal maximum display
+ luminance is unknown.
* - __u32
- ``min_luminance``
- - specifies the nominal minimum display luminance of the mastering
+ - Specifies the nominal minimum display luminance of the mastering
display in units of 0.0001 cd/m\ :sup:`2`.
+ A value of zero indicates that the nominal minimum display
+ luminance is unknown.
--- a/drivers/media/v4l2-core/v4l2-ctrls-core.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls-core.c
@@ -1133,24 +1133,41 @@ static int std_validate_compound(const s
return -EINVAL;
}
- if (p_hdr10_mastering->white_point_x <
- V4L2_HDR10_MASTERING_WHITE_POINT_X_LOW ||
- p_hdr10_mastering->white_point_x >
- V4L2_HDR10_MASTERING_WHITE_POINT_X_HIGH ||
- p_hdr10_mastering->white_point_y <
- V4L2_HDR10_MASTERING_WHITE_POINT_Y_LOW ||
- p_hdr10_mastering->white_point_y >
- V4L2_HDR10_MASTERING_WHITE_POINT_Y_HIGH)
+ /*
+ * SMPTE ST 2086 Annex A documents that CTA 861-G uses
+ * (0, 0) to indicate that the white point chromaticity
+ * is unknown.
+ */
+ if (p_hdr10_mastering->white_point_x ||
+ p_hdr10_mastering->white_point_y) {
+ if (p_hdr10_mastering->white_point_x <
+ V4L2_HDR10_MASTERING_WHITE_POINT_X_LOW ||
+ p_hdr10_mastering->white_point_x >
+ V4L2_HDR10_MASTERING_WHITE_POINT_X_HIGH ||
+ p_hdr10_mastering->white_point_y <
+ V4L2_HDR10_MASTERING_WHITE_POINT_Y_LOW ||
+ p_hdr10_mastering->white_point_y >
+ V4L2_HDR10_MASTERING_WHITE_POINT_Y_HIGH)
+ return -EINVAL;
+ }
+
+ /*
+ * SMPTE ST 2086 Annex A documents that CTA 861-G uses zero
+ * maximum and minimum luminance values to indicate that
+ * the corresponding values are unknown.
+ */
+ if (p_hdr10_mastering->max_display_mastering_luminance &&
+ (p_hdr10_mastering->max_display_mastering_luminance <
+ V4L2_HDR10_MASTERING_MAX_LUMA_LOW ||
+ p_hdr10_mastering->max_display_mastering_luminance >
+ V4L2_HDR10_MASTERING_MAX_LUMA_HIGH))
return -EINVAL;
- if (p_hdr10_mastering->max_display_mastering_luminance <
- V4L2_HDR10_MASTERING_MAX_LUMA_LOW ||
- p_hdr10_mastering->max_display_mastering_luminance >
- V4L2_HDR10_MASTERING_MAX_LUMA_HIGH ||
- p_hdr10_mastering->min_display_mastering_luminance <
- V4L2_HDR10_MASTERING_MIN_LUMA_LOW ||
- p_hdr10_mastering->min_display_mastering_luminance >
- V4L2_HDR10_MASTERING_MIN_LUMA_HIGH)
+ if (p_hdr10_mastering->min_display_mastering_luminance &&
+ (p_hdr10_mastering->min_display_mastering_luminance <
+ V4L2_HDR10_MASTERING_MIN_LUMA_LOW ||
+ p_hdr10_mastering->min_display_mastering_luminance >
+ V4L2_HDR10_MASTERING_MIN_LUMA_HIGH))
return -EINVAL;
/* The following restriction comes from ITU-T Rec. H.265 spec */
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0213/1376] media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (211 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0212/1376] media: v4l2-ctrls: Allow unknown HDR10 white point and luminance Greg Kroah-Hartman
@ 2026-09-12 6:43 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0214/1376] media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() Greg Kroah-Hartman
` (785 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:43 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Biren Pandya, Sakari Ailus
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biren Pandya <birenpandya@gmail.com>
commit a6e86efd7f85e519bf48417f41923f8bd51f1597 upstream.
In v4l2_fwnode_parse_link(), the remote endpoint fwnode reference is
acquired using fwnode_graph_get_remote_endpoint(). This reference is
properly released in the error paths, but it is leaked on the success
path.
Add the missing fwnode_handle_put() before returning 0 to prevent the
reference leak.
Signed-off-by: Biren Pandya <birenpandya@gmail.com>
Fixes: ca50c197bd96 ("[media] v4l: fwnode: Support generic fwnode for parsing standardised properties")
Cc: stable@vger.kernel.org
[Sakari Ailus: Fix subject prefix and coding style a little.]
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/v4l2-core/v4l2-fwnode.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/media/v4l2-core/v4l2-fwnode.c
+++ b/drivers/media/v4l2-core/v4l2-fwnode.c
@@ -582,6 +582,8 @@ int v4l2_fwnode_parse_link(struct fwnode
if (!link->remote_node)
goto err_put_remote_endpoint;
+ fwnode_handle_put(fwnode);
+
return 0;
err_put_remote_endpoint:
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0214/1376] media: venus: fix payload size returned by parse_caps() and parse_alloc_mode()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (212 preceding siblings ...)
2026-09-12 6:43 ` [PATCH 6.12 0213/1376] media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0215/1376] media: venus: fix payload size calculation in parse_raw_formats() Greg Kroah-Hartman
` (784 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mohammed EL Kadiri, Dmitry Baryshkov,
Bryan ODonoghue
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mohammed EL Kadiri <med08elkadiri@gmail.com>
commit a51cea23e409278f6e2ea072280aba93cc1dd75e upstream.
parse_caps() and parse_alloc_mode() return only the size of their fixed
header fields, excluding the flexible array payload. hfi_parser() uses
this return value to advance through the firmware response buffer, so
underreporting causes parser desynchronization.
Return the full consumed size (header + entries), matching the correct
pattern used by parse_profile_level().
Fixes: 9edaaa8e3e15 ("media: venus: hfi_parser: refactor hfi packet parsing logic")
Cc: stable@vger.kernel.org
Signed-off-by: Mohammed EL Kadiri <med08elkadiri@gmail.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/qcom/venus/hfi_parser.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/media/platform/qcom/venus/hfi_parser.c
+++ b/drivers/media/platform/qcom/venus/hfi_parser.c
@@ -85,7 +85,7 @@ parse_alloc_mode(struct venus_core *core
type++;
}
- return sizeof(*mode);
+ return mode->num_entries * sizeof(u32) + sizeof(*mode);
}
static void fill_profile_level(struct hfi_plat_caps *cap, const void *data,
@@ -146,7 +146,7 @@ parse_caps(struct venus_core *core, u32
for_each_codec(core->caps, ARRAY_SIZE(core->caps), codecs, domain,
fill_caps, caps_arr, num_caps);
- return sizeof(*caps);
+ return num_caps * sizeof(*cap) + sizeof(u32);
}
static void fill_raw_fmts(struct hfi_plat_caps *cap, const void *fmts,
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0215/1376] media: venus: fix payload size calculation in parse_raw_formats()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (213 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0214/1376] media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0216/1376] media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure Greg Kroah-Hartman
` (783 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mohammed EL Kadiri, Dmitry Baryshkov,
Bryan ODonoghue
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mohammed EL Kadiri <med08elkadiri@gmail.com>
commit bd595b745eb770e80347c31ffc25351046935305 upstream.
The consumed size is computed after the loop using the num_planes value
from the last iteration for all entries. When entries have different
plane counts, this produces an incorrect total.
Accumulate the actual size during the loop instead.
Fixes: 9edaaa8e3e15 ("media: venus: hfi_parser: refactor hfi packet parsing logic")
Cc: stable@vger.kernel.org
Signed-off-by: Mohammed EL Kadiri <med08elkadiri@gmail.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/qcom/venus/hfi_parser.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/drivers/media/platform/qcom/venus/hfi_parser.c
+++ b/drivers/media/platform/qcom/venus/hfi_parser.c
@@ -171,7 +171,7 @@ parse_raw_formats(struct venus_core *cor
u32 entries = fmt->format_entries;
unsigned int i = 0;
u32 num_planes = 0;
- u32 size;
+ u32 size = 2 * sizeof(u32);
while (entries) {
num_planes = pinfo->num_planes;
@@ -186,6 +186,7 @@ parse_raw_formats(struct venus_core *cor
if (pinfo->num_planes > MAX_PLANES)
break;
+ size += sizeof(*constr) * num_planes + 2 * sizeof(u32);
pinfo = (void *)pinfo + sizeof(*constr) * num_planes +
2 * sizeof(u32);
entries--;
@@ -193,8 +194,6 @@ parse_raw_formats(struct venus_core *cor
for_each_codec(core->caps, ARRAY_SIZE(core->caps), codecs, domain,
fill_raw_fmts, rawfmts, i);
- size = fmt->format_entries * (sizeof(*constr) * num_planes + 2 * sizeof(u32))
- + 2 * sizeof(u32);
return size;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0216/1376] media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (214 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0215/1376] media: venus: fix payload size calculation in parse_raw_formats() Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0217/1376] media: vimc: fix pixel format lookup in enum_framesizes Greg Kroah-Hartman
` (782 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Uday Khare, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uday Khare <udaykhare77@gmail.com>
commit 76e379754ba618989f6215be608d5c04774a611d upstream.
kthread_run() returns an ERR_PTR on failure, not NULL.
When start_streaming() fails, data->kthread_vid_cap is left holding
this error pointer instead of being cleared.
This causes two subsequent bugs:
1. A future call to start_streaming() sees a non-NULL kthread_vid_cap
and returns 0 (success) immediately, without actually starting the
capture thread.
2. A call to stop_streaming() checks 'kthread_vid_cap == NULL' which
is false for an error pointer, and proceeds to call kthread_stop()
on the error pointer, leading to a kernel crash.
Fix this by resetting kthread_vid_cap to NULL on failure before
jumping to the error path.
Fixes: 5cebaac60974 ("media: video-i2c: add video-i2c driver")
Cc: stable@vger.kernel.org
Signed-off-by: Uday Khare <udaykhare77@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/i2c/video-i2c.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/media/i2c/video-i2c.c
+++ b/drivers/media/i2c/video-i2c.c
@@ -533,8 +533,12 @@ static int start_streaming(struct vb2_qu
data->kthread_vid_cap = kthread_run(video_i2c_thread_vid_cap, data,
"%s-vid-cap", data->v4l2_dev.name);
ret = PTR_ERR_OR_ZERO(data->kthread_vid_cap);
- if (!ret)
- return 0;
+ if (ret) {
+ data->kthread_vid_cap = NULL;
+ goto error_rpm_put;
+ }
+
+ return 0;
error_rpm_put:
pm_runtime_mark_last_busy(dev);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0217/1376] media: vimc: fix pixel format lookup in enum_framesizes
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (215 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0216/1376] media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0218/1376] media: zoran: Avoid freeing a registered video_device twice Greg Kroah-Hartman
` (781 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Arash Golgol, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arash Golgol <arash.golgol@gmail.com>
commit ad4c65fa30cfb00e2e06adae9a8eb407086eaa66 upstream.
vimc_capture_enum_framesizes() looks up the requested format using
vimc_pix_map_by_code(), which searches the pix map table by media
bus code (MEDIA_BUS_FMT_*).
However, v4l2_frmsizeenum::pixel_format holds a V4L2 pixel format
(V4L2_PIX_FMT_*), not a media bus code, so valid pixel formats end
up being rejected with -EINVAL.
Fix this by using vimc_pix_map_by_pixelformat() instead, which
performs the lookup by pixel format as the ioctl expects.
Fixes: 09c41a23a2e2 ("media: Revert "media: vimc: propagate pixel format in the stream"")
Cc: stable@vger.kernel.org
Signed-off-by: Arash Golgol <arash.golgol@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/test-drivers/vimc/vimc-capture.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/media/test-drivers/vimc/vimc-capture.c
+++ b/drivers/media/test-drivers/vimc/vimc-capture.c
@@ -177,8 +177,8 @@ static int vimc_capture_enum_framesizes(
if (fsize->index)
return -EINVAL;
- /* Only accept code in the pix map table */
- vpix = vimc_pix_map_by_code(fsize->pixel_format);
+ /* Only accept pixel_format in the pix map table */
+ vpix = vimc_pix_map_by_pixelformat(fsize->pixel_format);
if (!vpix)
return -EINVAL;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0218/1376] media: zoran: Avoid freeing a registered video_device twice
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (216 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0217/1376] media: vimc: fix pixel format lookup in enum_framesizes Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0219/1376] media: chips-media: wave5: Guard bit depth check with initial_info_obtained Greg Kroah-Hartman
` (780 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ruoyu Wang, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <ruoyuw560@gmail.com>
commit 0735e0b5a96761a9ce277a238e834008ad92a0a5 upstream.
zoran_init_video_device() installs zoran_vdev_release() as the
video_device release callback through zoran_template. After
video_register_device() succeeds, video_unregister_device() drops the
registered video_device reference and the V4L2 core eventually invokes
that release callback, which kfree()s the video_device.
zoran_exit_video_devices() called video_unregister_device() and then
kfree(zr->video_dev), so device teardown could free the same
video_device twice.
Remove the direct kfree() and clear the cached pointer after
unregistering. The pre-registration failure path keeps its manual free
because the video_device was not registered there.
This issue was found by a static analysis checker and confirmed by
manual source review.
Fixes: 82e3a496eb56 ("media: staging: media: zoran: move videodev alloc")
Cc: stable@vger.kernel.org
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/pci/zoran/zoran_card.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/pci/zoran/zoran_card.c
+++ b/drivers/media/pci/zoran/zoran_card.c
@@ -889,7 +889,7 @@ static int zoran_init_video_device(struc
static void zoran_exit_video_devices(struct zoran *zr)
{
video_unregister_device(zr->video_dev);
- kfree(zr->video_dev);
+ zr->video_dev = NULL;
}
static int zoran_init_video_devices(struct zoran *zr)
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0219/1376] media: chips-media: wave5: Guard bit depth check with initial_info_obtained
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (217 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0218/1376] media: zoran: Avoid freeing a registered video_device twice Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0220/1376] scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers Greg Kroah-Hartman
` (779 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jackson Lee, Nas Chung,
Nicolas Dufresne, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jackson Lee <jackson.lee@chipsnmedia.com>
commit 1551386934ad43d934c3bb7317929207e1edcd6a upstream.
When CAPTURE STREAMON is called before the VPU has completed sequence
initialization (initial_info_obtained == false), the initial_info fields
contain uninitialized data. The driver checks
luma_bitdepth and rejects anything other than 8-bit, so garbage values
(e.g. 15) cause STREAMON to fail spuriously.
This is reproducible with the following multi-threaded test scenario:
1. Allocate 2 CAPTURE buffers.
2. Call STREAMON on the CAPTURE queue.
3. Call DQBUF, which blocks waiting for a decoded frame.
4. A second thread calls STREAMOFF on the CAPTURE queue.
5. The blocked DQBUF should be released, allowing graceful termination.
At step 2, STREAMON reads uninitialized luma_bitdepth and rejects the
stream, causing the test to fail.
Fix this by checking initial_info_obtained before accessing the bit
depth fields, so the validation is only performed when the sequence
info has actually been parsed by the VPU.
Fixes: 035371c9e509 ("media: chips-media: wave5: Fix timeout while testing 10bit hevc fluster")
Cc: stable@vger.kernel.org
Signed-off-by: Jackson Lee <jackson.lee@chipsnmedia.com>
Signed-off-by: Nas Chung <nas.chung@chipsnmedia.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c
@@ -1430,6 +1430,7 @@ static int wave5_vpu_dec_start_streaming
} else if (q->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE) {
struct dec_initial_info *initial_info =
&inst->codec_info->dec_info.initial_info;
+ struct dec_info *p_dec_info = &inst->codec_info->dec_info;
if (inst->state == VPU_INST_STATE_STOP)
ret = switch_state(inst, VPU_INST_STATE_INIT_SEQ);
@@ -1437,6 +1438,7 @@ static int wave5_vpu_dec_start_streaming
goto return_buffers;
if (inst->state == VPU_INST_STATE_INIT_SEQ &&
+ p_dec_info->initial_info_obtained &&
inst->dev->product_code == WAVE521C_CODE) {
if (initial_info->luma_bitdepth != 8) {
dev_info(inst->dev->dev, "%s: no support for %d bit depth",
@@ -1445,7 +1447,6 @@ static int wave5_vpu_dec_start_streaming
goto return_buffers;
}
}
-
}
return ret;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0220/1376] scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (218 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0219/1376] media: chips-media: wave5: Guard bit depth check with initial_info_obtained Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0221/1376] scsi: qla2xxx: Bound i2c->length in I2C " Greg Kroah-Hartman
` (778 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Nilesh Javali,
Martin K. Petersen (Oracle)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilesh Javali <njavali@marvell.com>
commit b47d4a1547d9ef21b2e9d1a739fe2204d4be05dc upstream.
The FRU and I2C bsg handlers stage their transfer in a DMA_POOL_SIZE
(256-byte) bounce buffer obtained from dma_pool_alloc(), which does not
zero the allocation. They initialize only a few leading bytes before
handing the buffer to qla2x00_write_sfp().
qla2x00_write_sfp() can override the transfer length with a user-supplied
value:
if (len == 1)
opt |= BIT_0;
if (opt & BIT_0)
len = *sfp;
*sfp is the first byte of the (user-controlled) payload, so len can grow
up to 255. The device then DMA-reads len bytes from the 256-byte pool
buffer. Since only a small prefix was written
(e.g. MAX_FRU_SIZE == 36 bytes for a FRU version, one byte for a FRU
status register), the hardware reads past the initialized region and
writes up to ~219 bytes of stale DMA-pool heap memory to the device
flash.
Allocate the buffer with dma_pool_zalloc() in all five FRU/I2C handlers
so any bytes beyond the initialized data are zero rather than stale heap
contents.
Fixes: 697a4bc69159 ("[SCSI] qla2xxx: Provide method for updating I2C attached VPD.")
Fixes: 9ebb5d9c69f1 ("[SCSI] qla2xxx: Add I2C BSG interface.")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-dev@google.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://patch.msgid.link/20260730155838.2119230-32-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_bsg.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_bsg.c
+++ b/drivers/scsi/qla2xxx/qla_bsg.c
@@ -1565,7 +1565,7 @@ qla2x00_update_fru_versions(struct bsg_j
struct qla_image_version *image;
uint32_t count;
dma_addr_t sfp_dma;
- void *sfp = dma_pool_alloc(ha->s_dma_pool, GFP_KERNEL, &sfp_dma);
+ void *sfp = dma_pool_zalloc(ha->s_dma_pool, GFP_KERNEL, &sfp_dma);
if (!sfp) {
bsg_reply->reply_data.vendor_reply.vendor_rsp[0] =
@@ -1616,7 +1616,7 @@ qla2x00_read_fru_status(struct bsg_job *
uint8_t bsg[DMA_POOL_SIZE];
struct qla_status_reg *sr = (void *)bsg;
dma_addr_t sfp_dma;
- uint8_t *sfp = dma_pool_alloc(ha->s_dma_pool, GFP_KERNEL, &sfp_dma);
+ uint8_t *sfp = dma_pool_zalloc(ha->s_dma_pool, GFP_KERNEL, &sfp_dma);
if (!sfp) {
bsg_reply->reply_data.vendor_reply.vendor_rsp[0] =
@@ -1667,7 +1667,7 @@ qla2x00_write_fru_status(struct bsg_job
uint8_t bsg[DMA_POOL_SIZE];
struct qla_status_reg *sr = (void *)bsg;
dma_addr_t sfp_dma;
- uint8_t *sfp = dma_pool_alloc(ha->s_dma_pool, GFP_KERNEL, &sfp_dma);
+ uint8_t *sfp = dma_pool_zalloc(ha->s_dma_pool, GFP_KERNEL, &sfp_dma);
if (!sfp) {
bsg_reply->reply_data.vendor_reply.vendor_rsp[0] =
@@ -1714,7 +1714,7 @@ qla2x00_write_i2c(struct bsg_job *bsg_jo
uint8_t bsg[DMA_POOL_SIZE];
struct qla_i2c_access *i2c = (void *)bsg;
dma_addr_t sfp_dma;
- uint8_t *sfp = dma_pool_alloc(ha->s_dma_pool, GFP_KERNEL, &sfp_dma);
+ uint8_t *sfp = dma_pool_zalloc(ha->s_dma_pool, GFP_KERNEL, &sfp_dma);
if (!sfp) {
bsg_reply->reply_data.vendor_reply.vendor_rsp[0] =
@@ -1760,7 +1760,7 @@ qla2x00_read_i2c(struct bsg_job *bsg_job
uint8_t bsg[DMA_POOL_SIZE];
struct qla_i2c_access *i2c = (void *)bsg;
dma_addr_t sfp_dma;
- uint8_t *sfp = dma_pool_alloc(ha->s_dma_pool, GFP_KERNEL, &sfp_dma);
+ uint8_t *sfp = dma_pool_zalloc(ha->s_dma_pool, GFP_KERNEL, &sfp_dma);
if (!sfp) {
bsg_reply->reply_data.vendor_reply.vendor_rsp[0] =
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0221/1376] scsi: qla2xxx: Bound i2c->length in I2C bsg handlers
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (219 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0220/1376] scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0222/1376] scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check Greg Kroah-Hartman
` (777 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Nilesh Javali,
Martin K. Petersen (Oracle)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilesh Javali <njavali@marvell.com>
commit 0918ee2c0eeb4d7f45b82b3dc11e65c2d9b7ad59 upstream.
struct qla_i2c_access carries a 16-bit length field alongside a fixed
64-byte buffer:
struct qla_i2c_access {
uint16_t device, offset, option, length;
uint8_t buffer[0x40];
} __packed;
qla2x00_write_i2c() and qla2x00_read_i2c() use the user-supplied
i2c->length without any bounds check. i2c is overlaid on a 256-byte
on-stack buffer and sfp is a 256-byte DMA-pool buffer, so a length up to
65535 overruns both:
- write: memcpy(sfp, i2c->buffer, i2c->length) over-reads the stack and
over-writes the sfp heap buffer, and qla2x00_write_sfp() then DMAs
i2c->length bytes out of the 256-byte buffer.
- read: qla2x00_read_sfp() DMAs i2c->length bytes into the 256-byte sfp,
then memcpy(i2c->buffer, sfp, i2c->length) overflows the 64-byte
buffer inside the on-stack array.
A caller holding CAP_SYS_RAWIO can use this to corrupt the heap and the
kernel stack. Reject requests whose length exceeds the buffer before any
copy or DMA transfer in both handlers.
Fixes: 9ebb5d9c69f1 ("[SCSI] qla2xxx: Add I2C BSG interface.")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-dev@google.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://patch.msgid.link/20260730155838.2119230-33-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_bsg.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/drivers/scsi/qla2xxx/qla_bsg.c
+++ b/drivers/scsi/qla2xxx/qla_bsg.c
@@ -1725,6 +1725,12 @@ qla2x00_write_i2c(struct bsg_job *bsg_jo
sg_copy_to_buffer(bsg_job->request_payload.sg_list,
bsg_job->request_payload.sg_cnt, i2c, sizeof(*i2c));
+ if (i2c->length > sizeof(i2c->buffer)) {
+ bsg_reply->reply_data.vendor_reply.vendor_rsp[0] =
+ EXT_STATUS_INVALID_PARAM;
+ goto dealloc;
+ }
+
memcpy(sfp, i2c->buffer, i2c->length);
rval = qla2x00_write_sfp(vha, sfp_dma, sfp,
i2c->device, i2c->offset, i2c->length, i2c->option);
@@ -1771,6 +1777,12 @@ qla2x00_read_i2c(struct bsg_job *bsg_job
sg_copy_to_buffer(bsg_job->request_payload.sg_list,
bsg_job->request_payload.sg_cnt, i2c, sizeof(*i2c));
+ if (i2c->length > sizeof(i2c->buffer)) {
+ bsg_reply->reply_data.vendor_reply.vendor_rsp[0] =
+ EXT_STATUS_INVALID_PARAM;
+ goto dealloc;
+ }
+
rval = qla2x00_read_sfp(vha, sfp_dma, sfp,
i2c->device, i2c->offset, i2c->length, i2c->option);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0222/1376] scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (220 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0221/1376] scsi: qla2xxx: Bound i2c->length in I2C " Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0223/1376] scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters Greg Kroah-Hartman
` (776 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nilesh Javali, Hannes Reinecke,
Martin K. Petersen (Oracle)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilesh Javali <njavali@marvell.com>
commit c20ee380ca59c5a8646750c4849969a815924e2e upstream.
qla_chk_edif_rx_sa_delete_pending() obtains the SCSI command via
GET_CMD_SP(sp) and immediately dereferences cmd->sc_data_direction.
That command pointer can be NULL: the firmware may post a status
completion for a command that has already been returned or aborted. The
caller qla2x00_status_entry() acknowledges this on the very same status
path, re-fetching GET_CMD_SP(sp) and bailing out with the "Command
already returned" message when it is NULL -- but that check runs only
after qla_chk_edif_rx_sa_delete_pending() has already dereferenced the
pointer, so a NULL cmd crashes the kernel in interrupt context.
Return early when cmd is NULL, before touching cmd->sc_data_direction.
Fixes: dd30706e73b7 ("scsi: qla2xxx: edif: Add key update")
Cc: stable@vger.kernel.org
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Link: https://patch.msgid.link/20260723050413.3897522-47-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_edif.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/scsi/qla2xxx/qla_edif.c
+++ b/drivers/scsi/qla2xxx/qla_edif.c
@@ -3491,6 +3491,9 @@ void qla_chk_edif_rx_sa_delete_pending(s
struct scsi_cmnd *cmd = GET_CMD_SP(sp);
uint32_t handle;
+ if (!cmd)
+ return;
+
handle = (uint32_t)LSW(sts24->handle);
/* find out if this status iosb is for a scsi read */
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0223/1376] scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (221 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0222/1376] scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0224/1376] scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() Greg Kroah-Hartman
` (775 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nilesh Javali, Hannes Reinecke,
Martin K. Petersen (Oracle)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilesh Javali <njavali@marvell.com>
commit eb137255fd7aa834c4d639ae7b5e9e8ecf3a4fb2 upstream.
In the CS_PORT_LOGGED_OUT case of qla2x00_chk_ms_status(), the
FWI2-capable branch compared ms_pkt->loop_id.extended against NPH_SNS to
decide whether the Name Server had logged out. On FWI2 and later
adapters the response is a ct_entry_24xx / ct_entry_24xx_ext, where
loop_id.extended (via the legacy ms_iocb_entry_t view) aliases offset 8,
which is comp_status, not nport_handle (offset 10). As this code runs
under CS_PORT_LOGGED_OUT, the field read back 0x29 (CS_PORT_LOGGED_OUT)
and the comparison against NPH_SNS (0x7fc) was always false.
As a result the driver never recognized a Name Server logout on FWI2/
29xx adapters: it returned the generic QLA_FUNCTION_FAILED instead of
QLA_NOT_LOGGED_IN and skipped setting LOOP_RESYNC_NEEDED /
LOCAL_LOOP_UPDATE, so the fabric rediscovery triggered by an SNS logout
did not happen.
Read nport_handle from the ct_entry_24xx layout (offset 10) instead.
nport_handle is at the same offset in ct_entry_24xx and
ct_entry_24xx_ext, so a single cast covers 24xx-class and 29xx. The
non-FWI2 branch keeps using loop_id.extended, which is correct for the
ms_iocb_entry_t response on those adapters.
Fixes: b98ae0d748db ("scsi: qla2xxx: Fix name server relogin")
Cc: stable@vger.kernel.org
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Link: https://patch.msgid.link/20260723050413.3897522-48-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_gs.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_gs.c
+++ b/drivers/scsi/qla2xxx/qla_gs.c
@@ -157,8 +157,8 @@ qla2x00_chk_ms_status(scsi_qla_host_t *v
break;
case CS_PORT_LOGGED_OUT:
if (IS_FWI2_CAPABLE(ha)) {
- if (le16_to_cpu(ms_pkt->loop_id.extended) ==
- NPH_SNS)
+ if (le16_to_cpu(((struct ct_entry_24xx *)
+ ms_pkt)->nport_handle) == NPH_SNS)
lid_is_sns = true;
} else {
if (le16_to_cpu(ms_pkt->loop_id.extended) ==
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0224/1376] scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (222 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0223/1376] scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0225/1376] scsi: qla2xxx: Initialize NVMe abort_work once at submission Greg Kroah-Hartman
` (774 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nilesh Javali, Hannes Reinecke,
Martin K. Petersen (Oracle)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilesh Javali <njavali@marvell.com>
commit 793cedee296fd819bfadc2a7ec4d52faf9c09a0a upstream.
In the format 1 path, the virtual port is located on ha->vp_list while
holding vport_slock, but the lock is dropped before vp is used:
qla_update_host_map() is called and VP_IDX_ACQUIRED/REGISTER_FC4_NEEDED/
REGISTER_FDMI_NEEDED are set on vp. No reference is taken across that
window, so a concurrent qla24xx_deallocate_vp_id() can tear the vport
down and free it, leading to a use-after-free.
Take a vport reference (vref_count) under vport_slock when the matching
vp is found, and drop it after the last use of
vp. qla24xx_deallocate_vp_id() waits for vref_count to reach zero before
unlinking and freeing the vport, so the pointer stays valid. This
matches the reference idiom already used by the other ha->vp_list
traversals.
Fixes: 2c3dfe3f6ad8 ("[SCSI] qla2xxx: add support for NPIV")
Cc: stable@vger.kernel.org
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Link: https://patch.msgid.link/20260723050413.3897522-51-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_mbx.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -4146,6 +4146,7 @@ qla24xx_report_id_acquisition(scsi_qla_h
list_for_each_entry(vp, &ha->vp_list, list) {
if (rptid_entry->vp_idx == vp->vp_idx) {
found = 1;
+ atomic_inc(&vp->vref_count);
break;
}
}
@@ -4163,6 +4164,8 @@ qla24xx_report_id_acquisition(scsi_qla_h
set_bit(VP_IDX_ACQUIRED, &vp->vp_flags);
set_bit(REGISTER_FC4_NEEDED, &vp->dpc_flags);
set_bit(REGISTER_FDMI_NEEDED, &vp->dpc_flags);
+
+ atomic_dec(&vp->vref_count);
}
set_bit(VP_DPC_NEEDED, &vha->dpc_flags);
qla2xxx_wake_dpc(vha);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0225/1376] scsi: qla2xxx: Initialize NVMe abort_work once at submission
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (223 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0224/1376] scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0226/1376] scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config() Greg Kroah-Hartman
` (773 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nilesh Javali, Hannes Reinecke,
Martin K. Petersen (Oracle)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilesh Javali <njavali@marvell.com>
commit 7e85f6dbc85616de2172bce8eaf84b387a723cd1 upstream.
qla_nvme_fcp_abort() and qla_nvme_ls_abort() ran INIT_WORK() on
priv->abort_work immediately before schedule_work(). INIT_WORK()
reinitializes the work_struct, resetting its list head and clearing the
pending bit. If an abort is issued more than once for the same command
(for example, concurrent transport teardown and a timeout-driven abort),
the second INIT_WORK() reinitializes a work item that is already queued,
which can corrupt the workqueue list and lead to crashes or a looping
worker.
Initialize priv->abort_work once at command submission, next to the
existing per-command spin_lock_init(&priv->cmd_lock), and leave only
schedule_work() in the abort paths. schedule_work() already does nothing
when the work item is still pending, so a repeated abort no longer
disturbs an in-flight work item. The command is not returned to the
transport until the final kref_put()/release callback runs after
abort_work has completed, so the work item is idle before priv is reused
and the single submission-time INIT_WORK() is safe.
Fixes: e473b3074104 ("scsi: qla2xxx: Add FC-NVMe abort processing")
Cc: stable@vger.kernel.org
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Link: https://patch.msgid.link/20260723050413.3897522-52-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_nvme.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_nvme.c
+++ b/drivers/scsi/qla2xxx/qla_nvme.c
@@ -463,7 +463,6 @@ static void qla_nvme_ls_abort(struct nvm
}
spin_unlock_irqrestore(&priv->cmd_lock, flags);
- INIT_WORK(&priv->abort_work, qla_nvme_abort_work);
schedule_work(&priv->abort_work);
}
@@ -501,6 +500,7 @@ static int qla_nvme_ls_req(struct nvme_f
priv->sp = sp;
kref_init(&sp->cmd_kref);
spin_lock_init(&priv->cmd_lock);
+ INIT_WORK(&priv->abort_work, qla_nvme_abort_work);
nvme = &sp->u.iocb_cmd;
priv->fd = fd;
nvme->u.nvme.desc = fd;
@@ -545,7 +545,6 @@ static void qla_nvme_fcp_abort(struct nv
}
spin_unlock_irqrestore(&priv->cmd_lock, flags);
- INIT_WORK(&priv->abort_work, qla_nvme_abort_work);
schedule_work(&priv->abort_work);
}
@@ -811,6 +810,7 @@ static int qla_nvme_post_cmd(struct nvme
kref_init(&sp->cmd_kref);
spin_lock_init(&priv->cmd_lock);
+ INIT_WORK(&priv->abort_work, qla_nvme_abort_work);
sp->priv = priv;
priv->sp = sp;
sp->type = SRB_NVME_CMD;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0226/1376] scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (224 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0225/1376] scsi: qla2xxx: Initialize NVMe abort_work once at submission Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0227/1376] scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() Greg Kroah-Hartman
` (772 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nilesh Javali, Hannes Reinecke,
Martin K. Petersen (Oracle)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilesh Javali <njavali@marvell.com>
commit 9101c51649f5b6773a97bf5271785c948589ea1d upstream.
The Modify VP Config completion handler labelled its first error branch
"error status" but tested vpmod->comp_status instead of
vpmod->entry_status. Because CS_COMPLETE is 0, the following
"comp_status != CS_COMPLETE" branch duplicated that test and was dead
code, and entry_status was never examined at all.
When firmware rejects the IOCB early it sets entry_status while leaving
comp_status zero. As the IOCB is allocated with dma_pool_zalloc(), both
comp_status branches evaluate false and the handler falls through to the
success path, calling fc_vport_set_state(FC_VPORT_INITIALIZING) for a
configuration the firmware never accepted. This can leave the virtual
port enabled on top of an invalid config and surface later as login
timeouts or follow-on firmware errors.
Test entry_status in the first branch, matching qla_ctrlvp_completed()
and the login/logout/abort/reset IOCB handlers; the comp_status branch
then becomes the live completion-status check.
Fixes: 2c3dfe3f6ad8 ("[SCSI] qla2xxx: add support for NPIV")
Cc: stable@vger.kernel.org
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Link: https://patch.msgid.link/20260723050413.3897522-50-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_mbx.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -4276,10 +4276,10 @@ qla24xx_modify_vp_config(scsi_qla_host_t
if (rval != QLA_SUCCESS) {
ql_dbg(ql_dbg_mbx, vha, 0x10bd,
"Failed to issue VP config IOCB (%x).\n", rval);
- } else if (vpmod->comp_status != 0) {
+ } else if (vpmod->entry_status != 0) {
ql_dbg(ql_dbg_mbx, vha, 0x10be,
"Failed to complete IOCB -- error status (%x).\n",
- vpmod->comp_status);
+ vpmod->entry_status);
rval = QLA_FUNCTION_FAILED;
} else if (vpmod->comp_status != cpu_to_le16(CS_COMPLETE)) {
ql_dbg(ql_dbg_mbx, vha, 0x10bf,
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0227/1376] scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (225 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0226/1376] scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config() Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0228/1376] scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject Greg Kroah-Hartman
` (771 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nilesh Javali, Hannes Reinecke,
Martin K. Petersen (Oracle)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilesh Javali <njavali@marvell.com>
commit de62cf265dbe309f34f144a6cdbca9240317727e upstream.
qla2x00_update_fru_versions() copies the user-supplied BSG request into
a fixed 256-byte stack buffer (bsg[DMA_POOL_SIZE]) and then iterates
list->count times over the qla_image_version array embedded in that
buffer, advancing the image pointer each iteration. count is taken
directly from user input with no upper bound, while only (DMA_POOL_SIZE
- sizeof(list->count)) / sizeof(struct qla_image_version) = 6 entries
actually fit. A larger count walks the image pointer off the end of the
stack buffer, reading adjacent kernel stack memory and sending it to the
device via qla2x00_write_sfp().
Reject requests whose declared count does not fit in the buffer.
Fixes: 697a4bc69159 ("[SCSI] qla2xxx: Provide method for updating I2C attached VPD.")
Cc: stable@vger.kernel.org
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Link: https://patch.msgid.link/20260723050413.3897522-56-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_bsg.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/scsi/qla2xxx/qla_bsg.c
+++ b/drivers/scsi/qla2xxx/qla_bsg.c
@@ -1578,6 +1578,13 @@ qla2x00_update_fru_versions(struct bsg_j
image = list->version;
count = list->count;
+
+ if (struct_size(list, version, count) > sizeof(bsg)) {
+ bsg_reply->reply_data.vendor_reply.vendor_rsp[0] =
+ EXT_STATUS_INVALID_PARAM;
+ goto dealloc;
+ }
+
while (count--) {
memcpy(sfp, &image->field_info, sizeof(image->field_info));
rval = qla2x00_write_sfp(vha, sfp_dma, sfp,
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0228/1376] scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (226 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0227/1376] scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0229/1376] scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation Greg Kroah-Hartman
` (770 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nilesh Javali, Hannes Reinecke,
Martin K. Petersen (Oracle)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilesh Javali <njavali@marvell.com>
commit f743488e4a203049f27ec5d8cd0caccc483af01e upstream.
qla_nvme_ls_reject_iocb() allocates from and advances the request ring
through __qla2x00_alloc_iocbs() (which assumes the hardware_lock is
held) and qla2x00_start_iocbs() (which advances the ring and rings the
request-in doorbell), but takes no lock itself. Two of its callers
invoke it without the producer lock held:
- qla_nvme_xmt_ls_rsp(), the NVMe-FC .xmt_ls_rsp transport callback, on
its error path, and
- qla2xxx_process_purls_pkt(), run from the purex work/DPC context.
Both use ha->base_qpair, whose qp_lock_ptr is hardware_lock, so they can
run concurrently with normal I/O submission on the base ring and corrupt
the ring producer state, leading to duplicated or dropped commands. The
third caller, qla2xxx_process_purls_iocb(), runs inside
qla24xx_process_response_queue() with the qpair lock already held and is
safe; that is also why the lock cannot be taken inside the helper itself
(it would recursively re-acquire hardware_lock on the response path).
Take qp_lock_ptr around the two unlocked callers and document the helper
as caller-locked. Both run in process context, so spin_lock_irqsave() is
used and nothing in the locked region sleeps.
Fixes: 875386b98857 ("scsi: qla2xxx: Add Unsolicited LS Request and Response Support for NVMe")
Cc: stable@vger.kernel.org
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Link: https://patch.msgid.link/20260723050413.3897522-53-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_nvme.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/drivers/scsi/qla2xxx/qla_nvme.c
+++ b/drivers/scsi/qla2xxx/qla_nvme.c
@@ -374,6 +374,7 @@ static int qla_nvme_xmt_ls_rsp(struct nv
srb_t *sp;
int rval = QLA_FUNCTION_FAILED;
uint8_t cnt = 0;
+ unsigned long flags;
if (!fcport || fcport->deleted)
goto out;
@@ -440,7 +441,9 @@ out:
a.vp_idx = vha->vp_idx;
a.nport_handle = uctx->nport_handle;
a.xchg_address = uctx->exchange_address;
+ spin_lock_irqsave(ha->base_qpair->qp_lock_ptr, flags);
qla_nvme_ls_reject_iocb(vha, ha->base_qpair, &a, true);
+ spin_unlock_irqrestore(ha->base_qpair->qp_lock_ptr, flags);
kfree(uctx);
return rval;
}
@@ -1127,6 +1130,10 @@ static void qla_nvme_lsrjt_pt_iocb(struc
lsrjt_iocb->rx_byte_count = 0;
}
+/*
+ * Allocates from and advances the request ring, so the caller must hold
+ * qp->qp_lock_ptr (the response-queue caller already holds it).
+ */
static int
qla_nvme_ls_reject_iocb(struct scsi_qla_host *vha, struct qla_qpair *qp,
struct qla_nvme_lsrjt_pt_arg *a, bool is_xchg_terminate)
@@ -1183,6 +1190,7 @@ qla2xxx_process_purls_pkt(struct scsi_ql
{
struct qla_nvme_unsol_ctx *uctx = item->purls_context;
struct qla_nvme_lsrjt_pt_arg a;
+ unsigned long flags;
int ret = 1;
#if (IS_ENABLED(CONFIG_NVME_FC))
@@ -1195,7 +1203,9 @@ qla2xxx_process_purls_pkt(struct scsi_ql
a.vp_idx = vha->vp_idx;
a.nport_handle = uctx->nport_handle;
a.xchg_address = uctx->exchange_address;
+ spin_lock_irqsave(vha->hw->base_qpair->qp_lock_ptr, flags);
qla_nvme_ls_reject_iocb(vha, vha->hw->base_qpair, &a, true);
+ spin_unlock_irqrestore(vha->hw->base_qpair->qp_lock_ptr, flags);
list_del(&uctx->elem);
kfree(uctx);
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0229/1376] scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (227 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0228/1376] scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0230/1376] scsi: qla2xxx: Serialize flash version read in reset handler Greg Kroah-Hartman
` (769 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Nilesh Javali,
Martin K. Petersen (Oracle)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilesh Javali <njavali@marvell.com>
commit ebfd35c64433821bd5619a6d07ccc2df8b5b1de3 upstream.
ha->msix_count is u16, but ha->max_req_queues, ha->max_rsp_queues and
ha->max_qpairs are u8. Deriving the queue count as
"ha->max_req_queues = ha->msix_count - 1" therefore truncates: a board
(or a misconfigured/malicious hot-plugged device) advertising 257 MSI-X
vectors yields msix_count - 1 == 256, which truncates to 0. An MSI-X
count of 1 zeroes it as well, and in target mode the subsequent
"ha->max_req_queues--" then underflows 0 to 255.
When the count is 0, qla2x00_alloc_queues() calls
kzalloc_objs(struct req_que *, 0), which returns ZERO_SIZE_PTR. That is
not NULL, so the allocation check passes and the following
"ha->req_q_map[0] = req" dereferences ZERO_SIZE_PTR, corrupting memory
or crashing the kernel.
Add qla_calc_queue_count() to clamp the derived value into
[1, QLA_MAX_QUEUES - 1] so it always fits in u8 and is never zero, and
use it at all three derivation sites (qla25xx_iospace_config(),
qla83xx_iospace_config() and qla24xx_enable_msix()). Also guard the
target-mode decrement so it cannot reintroduce a zero (which would in
turn underflow max_qpairs).
Fixes: d74595278f4a ("scsi: qla2xxx: Add multiple queue pair functionality.")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-dev@google.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://patch.msgid.link/20260730155838.2119230-2-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_inline.h | 13 +++++++++++++
drivers/scsi/qla2xxx/qla_isr.c | 4 ++--
drivers/scsi/qla2xxx/qla_os.c | 6 +++---
3 files changed, 18 insertions(+), 5 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_inline.h
+++ b/drivers/scsi/qla2xxx/qla_inline.h
@@ -54,6 +54,19 @@ qla2x00_debounce_register(volatile __le1
return (first);
}
+static inline u8
+qla_calc_queue_count(u16 msix_count)
+{
+ /*
+ * Request/response queues are bounded by the MSI-X vector count less
+ * the mailbox vector. These counters are u8, so a board advertising
+ * e.g. 257 vectors would truncate msix_count - 1 (256) to 0 and hand
+ * kzalloc_objs() a zero count (ZERO_SIZE_PTR), faulting on the first
+ * ha->req_q_map[0] store. Clamp into [1, QLA_MAX_QUEUES - 1].
+ */
+ return clamp_t(u16, msix_count - 1, 1, QLA_MAX_QUEUES - 1);
+}
+
static inline void
qla2x00_poll(struct rsp_que *rsp)
{
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -4548,10 +4548,10 @@ qla24xx_enable_msix(struct qla_hw_data *
ha->msix_count = ret;
/* Recalculate queue values */
if (ha->mqiobase && (ql2xmqsupport || ql2xnvmeenable)) {
- ha->max_req_queues = ha->msix_count - 1;
+ ha->max_req_queues = qla_calc_queue_count(ha->msix_count);
/* ATIOQ needs 1 vector. That's 1 less QPair */
- if (QLA_TGT_MODE_ENABLED())
+ if (QLA_TGT_MODE_ENABLED() && ha->max_req_queues > 1)
ha->max_req_queues--;
ha->max_rsp_queues = ha->max_req_queues;
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -2123,7 +2123,7 @@ skip_pio:
ha->msix_count = msix + 1;
/* Max queues are bounded by available msix vectors */
/* MB interrupt uses 1 vector */
- ha->max_req_queues = ha->msix_count - 1;
+ ha->max_req_queues = qla_calc_queue_count(ha->msix_count);
ha->max_rsp_queues = ha->max_req_queues;
/* Queue pairs is the max value minus the base queue pair */
ha->max_qpairs = ha->max_rsp_queues - 1;
@@ -2209,10 +2209,10 @@ qla83xx_iospace_config(struct qla_hw_dat
*/
if (ql2xmqsupport || ql2xnvmeenable) {
/* MB interrupt uses 1 vector */
- ha->max_req_queues = ha->msix_count - 1;
+ ha->max_req_queues = qla_calc_queue_count(ha->msix_count);
/* ATIOQ needs 1 vector. That's 1 less QPair */
- if (QLA_TGT_MODE_ENABLED())
+ if (QLA_TGT_MODE_ENABLED() && ha->max_req_queues > 1)
ha->max_req_queues--;
ha->max_rsp_queues = ha->max_req_queues;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0230/1376] scsi: qla2xxx: Serialize flash version read in reset handler
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (228 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0229/1376] scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0231/1376] scsi: qla2xxx: Fix cs84xx use-after-free on host teardown Greg Kroah-Hartman
` (768 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Nilesh Javali,
Martin K. Petersen (Oracle)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilesh Javali <njavali@marvell.com>
commit f606ed93de0c4f1e7e3618779e9fad731455314a upstream.
The "update cache versions without reset" sysfs reset operation (0x20261)
calls get_flash_version(), which reads hardware flash registers, without
holding ha->optrom_mutex. The VPD update path serializes the same call
under optrom_mutex, so this reset path can interleave its flash register
accesses with a concurrent VPD or optrom flash operation and corrupt the
reads.
Hold ha->optrom_mutex across the get_flash_version() call to match the
VPD update path.
Fixes: 8c2cf7d4e387 ("[SCSI] qla2xxx: Add a new interface to update versions.")
Reported-by: Sashiko <sashiko-dev@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://patch.msgid.link/20260730155838.2119230-4-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_attr.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -816,7 +816,9 @@ qla2x00_sysfs_write_reset(struct file *f
"Unable to allocate memory for VPD information update.\n");
return -ENOMEM;
}
+ mutex_lock(&ha->optrom_mutex);
ha->isp_ops->get_flash_version(vha, tmp_data);
+ mutex_unlock(&ha->optrom_mutex);
vfree(tmp_data);
break;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0231/1376] scsi: qla2xxx: Fix cs84xx use-after-free on host teardown
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (229 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0230/1376] scsi: qla2xxx: Serialize flash version read in reset handler Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0232/1376] scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump Greg Kroah-Hartman
` (767 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Nilesh Javali,
Martin K. Petersen (Oracle)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilesh Javali <njavali@marvell.com>
commit 33d102102d925357c5fd172dd6672a27d74b3215 upstream.
qla84xx_put_chip() drops the last reference to ha->cs84xx and frees it via
__qla84xx_chip_release() without clearing ha->cs84xx. During teardown it ran
before scsi_remove_host(), which is what removes the 84xx_fw_version host
sysfs attribute. A concurrent read of that attribute in the window between
the two calls executes qla24xx_84xx_fw_version_show(), which dereferences
the freed ha->cs84xx, resulting in a use-after-free.
Move qla84xx_put_chip() to after scsi_remove_host() in both
qla2x00_remove_one() and qla2x00_disable_board_on_pci_error(). Once
scsi_remove_host() returns, the sysfs attribute is gone and kernfs has
drained any in-flight show(), so no reader can touch cs84xx; the put still
runs before the host and ha are freed.
Fixes: fe1b806f4f71 ("[SCSI] qla2xxx: Refactor shutdown code so some functionality can be reused.")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-dev@google.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://patch.msgid.link/20260730155838.2119230-7-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_os.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -3929,8 +3929,6 @@ qla2x00_remove_one(struct pci_dev *pdev)
qla2x00_dfs_remove(base_vha);
- qla84xx_put_chip(base_vha);
-
/* Disable timer */
if (base_vha->timer_active)
qla2x00_stop_timer(base_vha);
@@ -3955,6 +3953,8 @@ qla2x00_remove_one(struct pci_dev *pdev)
scsi_remove_host(base_vha->host);
+ qla84xx_put_chip(base_vha);
+
qla2x00_free_device(base_vha);
qla2x00_clear_drv_active(ha);
@@ -6826,8 +6826,6 @@ qla2x00_disable_board_on_pci_error(struc
qla2x00_dfs_remove(base_vha);
- qla84xx_put_chip(base_vha);
-
if (base_vha->timer_active)
qla2x00_stop_timer(base_vha);
@@ -6845,6 +6843,8 @@ qla2x00_disable_board_on_pci_error(struc
scsi_remove_host(base_vha->host);
+ qla84xx_put_chip(base_vha);
+
base_vha->flags.init_done = 0;
qla25xx_delete_queues(base_vha);
qla2x00_free_fcports(base_vha);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0232/1376] scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (230 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0231/1376] scsi: qla2xxx: Fix cs84xx use-after-free on host teardown Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0233/1376] scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() Greg Kroah-Hartman
` (766 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Nilesh Javali,
Martin K. Petersen (Oracle)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilesh Javali <njavali@marvell.com>
commit 53298efcbbb0f0438366d45cb7ed7e6d93dd5531 upstream.
qla2x00_free_fce_trace() freed and cleared ha->fce while holding only
fce_mutex. The firmware-dump consumers qla27xx_fwdt_entry_t264() and
qla25xx_copy_fce() read ha->fce (NULL check followed by a copy of the
buffer) under hardware_lock and never take fce_mutex. A debugfs FCE
disable could therefore free the DMA buffer between a dump's NULL check
and its copy, resulting in a use-after-free.
Unpublish ha->fce under hardware_lock, then release the lock and free
the DMA buffer (dma_free_coherent() may sleep). A concurrent dump either
completes its check and copy with the buffer still valid, or observes
ha->fce == NULL and skips it.
Fixes: 841df27d619e ("scsi: qla2xxx: Move FCE Trace buffer allocation to user control")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-dev@google.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://patch.msgid.link/20260730155838.2119230-11-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_init.c | 20 ++++++++++++++++++--
1 file changed, 18 insertions(+), 2 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -3764,11 +3764,27 @@ int qla2x00_alloc_fce_trace(scsi_qla_hos
void qla2x00_free_fce_trace(struct qla_hw_data *ha)
{
- if (!ha->fce)
+ void *fce;
+ dma_addr_t fce_dma;
+ unsigned long flags;
+
+ /*
+ * Unpublish ha->fce under hardware_lock so a firmware dump in
+ * progress (which reads ha->fce under the same lock) cannot race
+ * with the buffer being freed.
+ */
+ spin_lock_irqsave(&ha->hardware_lock, flags);
+ if (!ha->fce) {
+ spin_unlock_irqrestore(&ha->hardware_lock, flags);
return;
- dma_free_coherent(&ha->pdev->dev, FCE_SIZE, ha->fce, ha->fce_dma);
+ }
+ fce = ha->fce;
+ fce_dma = ha->fce_dma;
ha->fce = NULL;
ha->fce_dma = 0;
+ spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
+ dma_free_coherent(&ha->pdev->dev, FCE_SIZE, fce, fce_dma);
}
static void
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0233/1376] scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (231 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0232/1376] scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0234/1376] scsi: qla2xxx: Fix FCE trace enable parsing in debugfs Greg Kroah-Hartman
` (765 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Nilesh Javali,
Martin K. Petersen (Oracle)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilesh Javali <njavali@marvell.com>
commit 9efaa782845b4d5fb3e01242be0d06ebc7428d8f upstream.
The mbx_cmd_t is allocated on the stack but left uninitialized.
qla2x00_mailbox_command() has several early-return paths (PCI permanent
failure, device failed, EEH busy, ISP abort pending, mailbox access
timeout, purge mbox) that return without writing the input mailbox
registers back into mcp->mb[]. qla2x00_get_firmware_state() then
unconditionally copies mcp->mb[1..6] (and mb[12]) into the caller's
states[] array regardless of the return value.
On such a failure the copied values are uninitialized kernel stack
memory, which is then exposed to userspace via the fw_state and
mpi_fw_state sysfs handlers. Zero the mailbox struct so a failed query
yields deterministic zeroed state instead of leaking stack contents.
Fixes: 4d4df1932b6b ("[SCSI] qla2xxx: Add ISP84XX support.")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-dev@google.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://patch.msgid.link/20260730155838.2119230-9-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_mbx.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -2214,6 +2214,8 @@ qla2x00_get_firmware_state(scsi_qla_host
if (!ha->flags.fw_started)
return QLA_FUNCTION_FAILED;
+ memset(&mc, 0, sizeof(mc));
+
mcp->mb[0] = MBC_GET_FIRMWARE_STATE;
mcp->out_mb = MBX_0;
if (IS_FWI2_CAPABLE(vha->hw))
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0234/1376] scsi: qla2xxx: Fix FCE trace enable parsing in debugfs
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (232 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0233/1376] scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0235/1376] scsi: qla2xxx: Dont query firmware state while chip is down Greg Kroah-Hartman
` (764 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Nilesh Javali,
Martin K. Petersen (Oracle)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilesh Javali <njavali@marvell.com>
commit b7368687e3d11f51392d3c4774ec0263d5fbf31f upstream.
qla2x00_dfs_fce_write() called kstrtoul() with a NULL result pointer,
so a successful parse would dereference NULL and oops. Worse, the int
return value (0 on success, negative errno on failure) was assigned to
the unsigned long enable flag, inverting the intended logic: a valid
number was treated as "disable" while a parse failure enabled FCE.
Parse the value into enable and propagate parse errors to userspace.
Fixes: 841df27d619e ("scsi: qla2xxx: Move FCE Trace buffer allocation to user control")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-dev@google.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://patch.msgid.link/20260730155838.2119230-10-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_dfs.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/scsi/qla2xxx/qla_dfs.c
+++ b/drivers/scsi/qla2xxx/qla_dfs.c
@@ -518,7 +518,9 @@ qla2x00_dfs_fce_write(struct file *file,
return PTR_ERR(buf);
}
- enable = kstrtoul(buf, 0, 0);
+ rc = kstrtoul(buf, 0, &enable);
+ if (rc)
+ goto out_free;
rc = count;
mutex_lock(&ha->fce_mutex);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0235/1376] scsi: qla2xxx: Dont query firmware state while chip is down
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (233 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0234/1376] scsi: qla2xxx: Fix FCE trace enable parsing in debugfs Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0236/1376] scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path Greg Kroah-Hartman
` (763 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Nilesh Javali,
Martin K. Petersen (Oracle)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilesh Javali <njavali@marvell.com>
commit e0cebe20dcffbed9c078fe30e2d18cd5046d9eff upstream.
qla2x00_fw_state_show() initializes rval to QLA_FUNCTION_FAILED and jumps
to the out: label when the chip is down or EEH is busy. The out: block
then re-issued qla2x00_get_firmware_state() because rval != QLA_SUCCESS,
defeating the chip-down/EEH-busy guards and issuing a mailbox command
(outside optrom_mutex) during ISP reset or PCI error recovery, which can
hang the adapter. It also turned a normal in-lock mailbox failure into a
second unsynchronized mailbox attempt.
Make the out: fallback only mark the firmware state as unknown. The
mailbox is now issued at most once, inside optrom_mutex, and only when
the chip is up and not EEH-busy.
Fixes: b6faaaf796d7 ("scsi: qla2xxx: Serialize mailbox request")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-dev@google.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://patch.msgid.link/20260730155838.2119230-8-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_attr.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -1662,10 +1662,8 @@ qla2x00_fw_state_show(struct device *dev
rval = qla2x00_get_firmware_state(vha, state);
mutex_unlock(&vha->hw->optrom_mutex);
out:
- if (rval != QLA_SUCCESS) {
+ if (rval != QLA_SUCCESS)
memset(state, -1, sizeof(state));
- rval = qla2x00_get_firmware_state(vha, state);
- }
return scnprintf(buf, PAGE_SIZE, "0x%x 0x%x 0x%x 0x%x 0x%x 0x%x\n",
state[0], state[1], state[2], state[3], state[4], state[5]);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0236/1376] scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (234 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0235/1376] scsi: qla2xxx: Dont query firmware state while chip is down Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0237/1376] scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb() Greg Kroah-Hartman
` (762 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Nilesh Javali,
Martin K. Petersen (Oracle)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilesh Javali <njavali@marvell.com>
commit 0f41d07d72f2245208c45374ca8d0a1846cad667 upstream.
qla2x00_status_entry() filters out non-TYPE_SRB entries and the
SRB_NVME_CMD, SRB_BIDI_CMD and SRB_TM_CMD types, then falls through to a
SCSI fast path that assumes the command is an SRB_SCSI_CMD. The first
thing on that path, qla_chk_edif_rx_sa_delete_pending(), and the
subsequent handling both evaluate GET_CMD_SP(sp), i.e. sp->u.scmd.cmd.
The srb u union overlays the SCSI command pointer with other command
layouts (bsg_job, iocb_cmd). If firmware delivers an unexpected
STATUS_TYPE IOCB for a non-SCSI handle, sp->u.scmd.cmd can read as a
non-NULL garbage pointer, bypassing the NULL checks in
qla_chk_edif_rx_sa_delete_pending() and at the cp == NULL test, and
leading to a wild pointer dereference.
Reject any SRB whose type is not SRB_SCSI_CMD before entering the fast
path. The outstanding_cmds slot is left untouched so a genuinely
non-SCSI command still completes through its proper handler.
Fixes: dd30706e73b7 ("scsi: qla2xxx: edif: Add key update")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-dev@google.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://patch.msgid.link/20260730155838.2119230-19-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_dbg.c | 2 +-
drivers/scsi/qla2xxx/qla_isr.c | 8 ++++++++
2 files changed, 9 insertions(+), 1 deletion(-)
--- a/drivers/scsi/qla2xxx/qla_dbg.c
+++ b/drivers/scsi/qla2xxx/qla_dbg.c
@@ -16,7 +16,7 @@
* | | | 0x2127-0x2128 |
* | Queue Command and IO tracing | 0x3074 | 0x300b |
* | | | 0x3027-0x3028 |
- * | | | 0x303d-0x3041 |
+ * | | | 0x303e-0x3041 |
* | | | 0x302e,0x3033 |
* | | | 0x3036,0x3038 |
* | | | 0x303a |
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -3406,6 +3406,14 @@ qla2x00_status_entry(scsi_qla_host_t *vh
return;
}
+ /* Everything below is the SCSI fast path; reject other SRB types. */
+ if (sp->type != SRB_SCSI_CMD) {
+ ql_dbg(ql_dbg_io, vha, 0x303d,
+ "Unexpected SRB type %x for status IOCB, sp %p.\n",
+ sp->type, sp);
+ return;
+ }
+
/* Fast path completion. */
qla_chk_edif_rx_sa_delete_pending(vha, sp, sts24);
sp->qpair->cmd_completion_cnt++;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0237/1376] scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (235 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0236/1376] scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0238/1376] scsi: qla2xxx: Quiesce response IRQ before freeing request queue Greg Kroah-Hartman
` (761 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Nilesh Javali,
Martin K. Petersen (Oracle)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilesh Javali <njavali@marvell.com>
commit 3ba019bdd89d931499d9476456b5d9c7ab7fa753 upstream.
qla24xx_process_response_queue() advances ring_ptr past the head IOCB
before dispatching, so by the time __qla_consume_iocb() runs, ring_ptr
already points at the first continuation IOCB. The function however
looped purex->entry_count times starting at ring_ptr. As entry_count
includes the head, this consumed one entry too many: it stamped
RESPONSE_PROCESSED on the next, unrelated IOCB and advanced the ring
past it, silently dropping a legitimate firmware response. The head
IOCB's signature was also never marked.
Mark the head processed and account for it, then consume only the
entry_count - 1 continuation IOCBs, matching __qla_copy_purex_to_buffer().
Fixes: fac2807946c1 ("scsi: qla2xxx: edif: Add extraction of auth_els from the wire")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-dev@google.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://patch.msgid.link/20260730155838.2119230-14-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_isr.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -205,6 +205,17 @@ void __qla_consume_iocb(struct scsi_qla_
struct purex_entry_24xx *purex = *pkt;
entry_count_remaining = purex->entry_count;
+
+ /*
+ * The caller already advanced ring_ptr past the head IOCB, so mark
+ * the head processed and account for it here, then consume only the
+ * continuation IOCBs that follow.
+ */
+ ((response_t *)purex)->signature = RESPONSE_PROCESSED;
+ /* flush signature */
+ wmb();
+ --entry_count_remaining;
+
while (entry_count_remaining > 0) {
new_pkt = rsp_q->ring_ptr;
*pkt = new_pkt;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0238/1376] scsi: qla2xxx: Quiesce response IRQ before freeing request queue
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (236 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0237/1376] scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb() Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0239/1376] scsi: qla2xxx: Avoid double completion in async IOCB timeout Greg Kroah-Hartman
` (760 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Nilesh Javali,
Martin K. Petersen (Oracle)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilesh Javali <njavali@marvell.com>
commit 505753ec2594c6af09a601f0dd60be7d840c1d2d upstream.
qla2xxx_delete_qpair() deletes the request queue before the response
queue. qla25xx_delete_req_que() frees the request queue memory
(kfree(req) in qla25xx_free_req_que()), but the response-queue MSI-X is
only released later, in qla25xx_free_rsp_que(). In that window the
response interrupt can still fire, qla2xxx_msix_rsp_q() queues
qpair->q_work, and qla_do_work() -> qla24xx_process_response_queue()
dereferences the now-freed rsp->req (LOGINOUT/CT/ELS entries and the
status path), a use-after-free.
The cancel_work_sync() added for the qpair teardown lives in the
response free path, which runs after the request queue is already freed,
so it does not protect rsp->req.
Release the response-queue interrupt and flush qpair->q_work before
deleting the request queue, so no late completion can reach the freed
request queue. Clearing have_irq makes the subsequent
qla25xx_free_rsp_que() skip its free_irq(), and the firmware
queue-delete order (request then response) is preserved; the
request-delete mailbox completes on the default vector and is unaffected
by dropping the qpair response interrupt early.
Fixes: d74595278f4a ("scsi: qla2xxx: Add multiple queue pair functionality.")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-dev@google.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://patch.msgid.link/20260730155838.2119230-18-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_init.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -9853,11 +9853,28 @@ int qla2xxx_delete_qpair(struct scsi_qla
{
int ret = QLA_FUNCTION_FAILED;
struct qla_hw_data *ha = qpair->hw;
+ struct rsp_que *rsp = qpair->rsp;
qpair->delete_in_progress = 1;
qla_free_buf_pool(qpair);
+ /*
+ * The response-queue interrupt schedules qla_do_work(), which
+ * dereferences qpair->rsp->req. Release the interrupt and flush
+ * any pending work before the request queue is freed below so a
+ * late completion cannot touch the freed request queue. The
+ * firmware queue-delete order (request then response) is kept.
+ */
+ if (rsp && rsp->msix && rsp->msix->have_irq) {
+ free_irq(rsp->msix->vector, rsp->msix->handle);
+ rsp->msix->have_irq = 0;
+ rsp->msix->in_use = 0;
+ rsp->msix->handle = NULL;
+ }
+ if (rsp && ha->wq)
+ cancel_work_sync(&qpair->q_work);
+
ret = qla25xx_delete_req_que(vha, qpair->req);
if (ret != QLA_SUCCESS)
goto fail;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0239/1376] scsi: qla2xxx: Avoid double completion in async IOCB timeout
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (237 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0238/1376] scsi: qla2xxx: Quiesce response IRQ before freeing request queue Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0240/1376] scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read Greg Kroah-Hartman
` (759 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Nilesh Javali,
Martin K. Petersen (Oracle)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilesh Javali <njavali@marvell.com>
commit bb45bc4bd53c95a7bf6f782577b5ede94c0f8aa8 upstream.
qla2x00_async_iocb_timeout() tries to abort a timed-out async IOCB. When
qla24xx_async_abort_cmd() fails, both the SRB_LOGIN_CMD path and the
SRB_CTRL_VP/default path scan outstanding_cmds[] for the SRB and then
call sp->done(sp, QLA_FUNCTION_TIMEOUT) unconditionally, without checking
whether the SRB was actually found and removed.
If the response ISR completes the same handle first, it removes the SRB
under qp_lock_ptr and runs sp->done() -> complete(sp->comp). The
submitter qla24xx_control_vp() wakes from wait_for_completion(), clears
sp->comp, drops its reference and returns, reclaiming the on-stack
completion. The timer reference keeps the SRB alive across the timeout
handler, but not the submitter's stack. The timeout then issues a second
sp->done() -> qla_ctrlvp_sp_done(), which evaluates "if (sp->comp)
complete(sp->comp)"; with the pointer loaded before the submitter's NULL
store, complete() writes into the freed stack frame, a use-after-free.
Track whether this path removed the SRB from outstanding_cmds and only
call sp->done() when it did, so the command is completed exactly once by
whichever path owns it. This mirrors the sp_found guard already used in
qla24xx_abort_iocb_timeout().
Fixes: f6145e86d21f ("scsi: qla2xxx: Fix race between switch cmd completion and timeout")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-dev@google.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://patch.msgid.link/20260730155838.2119230-21-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_init.c | 24 +++++++++++++++++++++---
1 file changed, 21 insertions(+), 3 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -228,7 +228,7 @@ qla2x00_async_iocb_timeout(void *data)
srb_t *sp = data;
fc_port_t *fcport = sp->fcport;
struct srb_iocb *lio = &sp->u.iocb_cmd;
- int rc, h;
+ int rc, h, found;
unsigned long flags;
if (fcport) {
@@ -251,6 +251,7 @@ qla2x00_async_iocb_timeout(void *data)
lio->u.logio.data[1] =
lio->u.logio.flags & SRB_LOGIN_RETRIED ?
QLA_LOGIO_LOGIN_RETRIED : 0;
+ found = 0;
spin_lock_irqsave(sp->qpair->qp_lock_ptr, flags);
for (h = 1; h < sp->qpair->req->num_outstanding_cmds;
h++) {
@@ -258,11 +259,19 @@ qla2x00_async_iocb_timeout(void *data)
sp) {
sp->qpair->req->outstanding_cmds[h] =
NULL;
+ found = 1;
break;
}
}
spin_unlock_irqrestore(sp->qpair->qp_lock_ptr, flags);
- sp->done(sp, QLA_FUNCTION_TIMEOUT);
+ /*
+ * Only complete the command if this path removed it
+ * from outstanding_cmds. Otherwise the ISR already
+ * completed it and a second sp->done() would race the
+ * submitter's freeing of the on-stack completion.
+ */
+ if (found)
+ sp->done(sp, QLA_FUNCTION_TIMEOUT);
}
break;
case SRB_LOGOUT_CMD:
@@ -275,6 +284,7 @@ qla2x00_async_iocb_timeout(void *data)
default:
rc = qla24xx_async_abort_cmd(sp, false);
if (rc) {
+ found = 0;
spin_lock_irqsave(sp->qpair->qp_lock_ptr, flags);
for (h = 1; h < sp->qpair->req->num_outstanding_cmds;
h++) {
@@ -282,11 +292,19 @@ qla2x00_async_iocb_timeout(void *data)
sp) {
sp->qpair->req->outstanding_cmds[h] =
NULL;
+ found = 1;
break;
}
}
spin_unlock_irqrestore(sp->qpair->qp_lock_ptr, flags);
- sp->done(sp, QLA_FUNCTION_TIMEOUT);
+ /*
+ * Only complete the command if this path removed it
+ * from outstanding_cmds. Otherwise the ISR already
+ * completed it and a second sp->done() would race the
+ * submitter's freeing of the on-stack completion.
+ */
+ if (found)
+ sp->done(sp, QLA_FUNCTION_TIMEOUT);
}
break;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0240/1376] scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (238 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0239/1376] scsi: qla2xxx: Avoid double completion in async IOCB timeout Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0241/1376] scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() Greg Kroah-Hartman
` (758 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Nilesh Javali,
Martin K. Petersen (Oracle)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilesh Javali <njavali@marvell.com>
commit ca6d880d6c70cb7946e7b3e05d7285f271b6d99e upstream.
In qla2x00_status_entry(), the FWI2 status path advances sense_data and
shrinks par_sense_len by rsp_info_len:
if (IS_FWI2_CAPABLE(ha)) {
sense_data += rsp_info_len;
par_sense_len -= rsp_info_len;
}
rsp_info_len is a 32-bit value taken directly from the target's FCP
response (sf.rsp_data_len), while par_sense_len is the IOCB data area
size (28 bytes for 24xx, 60 bytes for 29xx). A hostile or buggy target
reporting an rsp_info_len larger than par_sense_len makes the unsigned
subtraction underflow to a huge value and advances sense_data out of
bounds.
The underflowed par_sense_len then defeats the cap in
qla2x00_handle_sense():
if (sense_len > par_sense_len)
sense_len = par_sense_len;
memcpy(cp->sense_buffer, sense_data, sense_len);
so the memcpy reads up to SCSI_SENSE_BUFFERSIZE bytes from the
out-of-bounds sense_data pointer, leaking adjacent response-ring/heap
memory into the command's sense buffer.
Clamp rsp_info_len to par_sense_len before the subtraction so
par_sense_len can never underflow and sense_data stays within the IOCB
data area. The fix sits before the comp_status switch, covering both
qla2x00_handle_sense() call sites.
Fixes: 5544213be7b4 ("[SCSI] qla2xxx: Correct extended sense-data handling.")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-dev@google.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://patch.msgid.link/20260730155838.2119230-16-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_isr.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -3482,6 +3482,18 @@ qla2x00_status_entry(scsi_qla_host_t *vh
if (scsi_status & SS_RESPONSE_INFO_LEN_VALID) {
/* Sense data lies beyond any FCP RESPONSE data. */
if (IS_FWI2_CAPABLE(ha)) {
+ /*
+ * A hostile or buggy target may report an
+ * rsp_info_len larger than the IOCB data area.
+ * Clamp it so the par_sense_len subtraction cannot
+ * underflow and walk sense_data out of bounds.
+ */
+ if (rsp_info_len > par_sense_len) {
+ ql_log(ql_log_warn, fcport->vha, 0x3107,
+ "Truncating bogus rsp_info_len 0x%x to 0x%x.\n",
+ rsp_info_len, par_sense_len);
+ rsp_info_len = par_sense_len;
+ }
sense_data += rsp_info_len;
par_sense_len -= rsp_info_len;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0241/1376] scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (239 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0240/1376] scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0242/1376] scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort Greg Kroah-Hartman
` (757 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Nilesh Javali,
Martin K. Petersen (Oracle)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilesh Javali <njavali@marvell.com>
commit deb8abde83a799d2501f3977f6d6051000253f5e upstream.
qla2x00_error_entry() reads ha->req_q_map[que] twice: once for the NULL
check and again when assigning it to req. The map slot is cleared by
qla25xx_free_req_que() (ha->req_q_map[que_id] = NULL under mq_lock)
during queue teardown, while the response-queue interrupt that drives
qla2x00_error_entry() is still registered (the IRQ is released later in
qla25xx_free_rsp_que()). If the slot is set to NULL between the two
reads, req becomes NULL and is dereferenced.
Read the slot once into req and NULL-check the local before use. mq_lock
is a mutex and cannot be taken from interrupt context, so the single
read plus local check is the appropriate fix for the reported NULL
dereference.
Fixes: a6fe35c052c4 ("[SCSI] qla2xxx: Avoid invalid request queue dereference for bad response packets.")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-dev@google.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://patch.msgid.link/20260730155838.2119230-17-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_isr.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -3809,10 +3809,12 @@ qla2x00_error_entry(scsi_qla_host_t *vha
"iocb type %xh with error status %xh, handle %xh, rspq id %d\n",
pkt->entry_type, pkt->entry_status, pkt->handle, rsp->id);
- if (que >= ha->max_req_queues || !ha->req_q_map[que])
+ if (que >= ha->max_req_queues)
goto fatal;
req = ha->req_q_map[que];
+ if (!req)
+ goto fatal;
if (pkt->entry_status & RF_BUSY)
res = DID_BUS_BUSY << 16;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0242/1376] scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (240 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0241/1376] scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0243/1376] scsi: qla2xxx: Drop vport reference under lock in report ID acquisition Greg Kroah-Hartman
` (756 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Nilesh Javali,
Martin K. Petersen (Oracle)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilesh Javali <njavali@marvell.com>
commit 06b5b2a5d499323f1c3256ead35798e8e3d15e60 upstream.
qla_nvme_ls_abort() and qla_nvme_fcp_abort() take a command reference with
kref_get_unless_zero() and then call schedule_work() on priv->abort_work,
ignoring its return value. qla_nvme_abort_work() runs once and drops
exactly one reference via kref_put(&sp->cmd_kref, sp->put_fn).
Since the per-abort INIT_WORK() was moved to submission time,
schedule_work() now returns false when the work is already pending, for
example on a concurrent transport teardown and timeout-driven abort of
the same command. In that case the reference taken for the second abort
is never released because the work still executes only once, leaking a
reference. The command is then never returned to the NVMe-FC transport,
which can hang the port.
Drop the reference when schedule_work() returns false, so each
kref_get_unless_zero() is balanced regardless of whether the work was
newly queued. The held reference keeps priv->sp valid for the put.
Fixes: 7e85f6dbc856 ("scsi: qla2xxx: Initialize NVMe abort_work once at submission")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-dev@google.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://patch.msgid.link/20260730155838.2119230-25-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_nvme.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_nvme.c
+++ b/drivers/scsi/qla2xxx/qla_nvme.c
@@ -466,7 +466,8 @@ static void qla_nvme_ls_abort(struct nvm
}
spin_unlock_irqrestore(&priv->cmd_lock, flags);
- schedule_work(&priv->abort_work);
+ if (!schedule_work(&priv->abort_work))
+ kref_put(&priv->sp->cmd_kref, priv->sp->put_fn);
}
static int qla_nvme_ls_req(struct nvme_fc_local_port *lport,
@@ -548,7 +549,8 @@ static void qla_nvme_fcp_abort(struct nv
}
spin_unlock_irqrestore(&priv->cmd_lock, flags);
- schedule_work(&priv->abort_work);
+ if (!schedule_work(&priv->abort_work))
+ kref_put(&priv->sp->cmd_kref, priv->sp->put_fn);
}
static inline int qla2x00_start_nvme_mq(srb_t *sp)
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0243/1376] scsi: qla2xxx: Drop vport reference under lock in report ID acquisition
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (241 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0242/1376] scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0244/1376] scsi: qla2xxx: Hold vport_slock for host map update " Greg Kroah-Hartman
` (755 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Nilesh Javali,
Martin K. Petersen (Oracle)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilesh Javali <njavali@marvell.com>
commit 1154b16439ffc562f9461494c4508c63446eb684 upstream.
qla24xx_report_id_acquisition() format-1 handling takes the vport
reference under vport_slock but drops it outside the lock, after setting
vp->vp_flags and vp->dpc_flags:
set_bit(VP_IDX_ACQUIRED, &vp->vp_flags);
set_bit(REGISTER_FC4_NEEDED, &vp->dpc_flags);
set_bit(REGISTER_FDMI_NEEDED, &vp->dpc_flags);
atomic_dec(&vp->vref_count);
Neither set_bit() nor atomic_dec() imply a memory barrier, so on a weakly
ordered architecture the decrement can become visible before the flag
stores. qla24xx_deallocate_vp_id() polls vref_count under vport_slock and
unlinks the vport once it reads zero, after which qla24xx_vport_delete()
frees it via scsi_host_put(). The poller could therefore observe
vref_count == 0 early and tear the vport down while the pending vp_flags/
dpc_flags stores land on freed memory.
Drop the reference under vport_slock, as is done for the matching
increment and by every other vref_count user. The unlock release pairs
with the deallocate poller's lock acquire so the flag stores are ordered
before vref_count == 0 can be observed.
Fixes: 793cedee296f ("scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-dev@google.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://patch.msgid.link/20260730155838.2119230-23-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_mbx.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -4167,7 +4167,9 @@ qla24xx_report_id_acquisition(scsi_qla_h
set_bit(REGISTER_FC4_NEEDED, &vp->dpc_flags);
set_bit(REGISTER_FDMI_NEEDED, &vp->dpc_flags);
+ spin_lock_irqsave(&ha->vport_slock, flags);
atomic_dec(&vp->vref_count);
+ spin_unlock_irqrestore(&ha->vport_slock, flags);
}
set_bit(VP_DPC_NEEDED, &vha->dpc_flags);
qla2xxx_wake_dpc(vha);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0244/1376] scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (242 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0243/1376] scsi: qla2xxx: Drop vport reference under lock in report ID acquisition Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0245/1376] scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics Greg Kroah-Hartman
` (754 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Nilesh Javali,
Martin K. Petersen (Oracle)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilesh Javali <njavali@marvell.com>
commit 7944039ba9cb5c3a935d17c91004e3b8649ff58e upstream.
qla24xx_report_id_acquisition() format-1 handling drops vport_slock after
taking the vport reference and then calls qla_update_host_map() without
the lock. That reaches qla_update_vp_map(), which mutates the ha->host_map
btree via btree_insert32()/btree_update32()/btree_remove32() and is
documented to require vport_slock to be held by the caller. Running it
unlocked can race concurrent host_map updates and corrupt the btree.
The format-2 path in the same function already wraps its host_map update
(SET_AL_PA) in vport_slock; the format-1 path is the lone outlier.
Hold vport_slock across the format-1 qla_update_host_map() call to honor
the documented locking contract. The vref_count taken in the loop keeps
the vport valid, so this only adds the missing host_map serialization.
Fixes: 430eef03a763 ("scsi: qla2xxx: Relocate/rename vp map")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-dev@google.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://patch.msgid.link/20260730155838.2119230-24-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_mbx.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -4157,7 +4157,9 @@ qla24xx_report_id_acquisition(scsi_qla_h
if (!found)
return;
+ spin_lock_irqsave(&ha->vport_slock, flags);
qla_update_host_map(vp, id);
+ spin_unlock_irqrestore(&ha->vport_slock, flags);
/*
* Cannot configure here as we are still sitting on the
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0245/1376] scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (243 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0244/1376] scsi: qla2xxx: Hold vport_slock for host map update " Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0246/1376] scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak Greg Kroah-Hartman
` (753 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Nilesh Javali,
Martin K. Petersen (Oracle)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilesh Javali <njavali@marvell.com>
commit 7c4f3f50d83af4545efaa99b3d0d46fb8d52031e upstream.
qla26xx_dport_diagnostics() streaming-maps the caller's result buffer with
dma_map_single(). The bsg path passes &dd->buf from the __packed struct
qla_dport_diag, where buf lands at a 2-byte offset and shares cachelines
with the surrounding options/unused fields. Mapping such a misaligned
sub-buffer violates the DMA API requirement that streaming buffers be
cacheline aligned and not share a cacheline with other data, and can
corrupt data on non-DMA-coherent architectures.
Allocate a dedicated DMA-coherent buffer inside qla26xx_dport_diagnostics()
for the mailbox command and copy the result back into the caller's buffer.
This removes the streaming map of the misaligned sub-buffer entirely; the
caller's buffer is now only a plain CPU buffer, so its packing no longer
matters.
Fixes: ec89146215d1 ("qla2xxx: Add bsg interface to support D_Port Diagnostics.")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-dev@google.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://patch.msgid.link/20260730155838.2119230-29-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_mbx.c | 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -6442,6 +6442,7 @@ qla26xx_dport_diagnostics(scsi_qla_host_
mbx_cmd_t mc;
mbx_cmd_t *mcp = &mc;
dma_addr_t dd_dma;
+ void *dd;
if (!IS_QLA83XX(vha->hw) && !IS_QLA27XX(vha->hw) &&
!IS_QLA28XX(vha->hw))
@@ -6450,15 +6451,12 @@ qla26xx_dport_diagnostics(scsi_qla_host_
ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x119f,
"Entered %s.\n", __func__);
- dd_dma = dma_map_single(&vha->hw->pdev->dev,
- dd_buf, size, DMA_FROM_DEVICE);
- if (dma_mapping_error(&vha->hw->pdev->dev, dd_dma)) {
- ql_log(ql_log_warn, vha, 0x1194, "Failed to map dma buffer.\n");
+ dd = dma_alloc_coherent(&vha->hw->pdev->dev, size, &dd_dma, GFP_KERNEL);
+ if (!dd) {
+ ql_log(ql_log_warn, vha, 0x1194, "Failed to allocate dma buffer.\n");
return QLA_MEMORY_ALLOC_FAILED;
}
- memset(dd_buf, 0, size);
-
mcp->mb[0] = MBC_DPORT_DIAGNOSTICS;
mcp->mb[1] = options;
mcp->mb[2] = MSW(LSD(dd_dma));
@@ -6480,8 +6478,9 @@ qla26xx_dport_diagnostics(scsi_qla_host_
"Done %s.\n", __func__);
}
- dma_unmap_single(&vha->hw->pdev->dev, dd_dma,
- size, DMA_FROM_DEVICE);
+ memcpy(dd_buf, dd, size);
+
+ dma_free_coherent(&vha->hw->pdev->dev, size, dd, dd_dma);
return rval;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0246/1376] scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (244 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0245/1376] scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0247/1376] scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started Greg Kroah-Hartman
` (752 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Nilesh Javali,
Martin K. Petersen (Oracle)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilesh Javali <njavali@marvell.com>
commit b93d3bb3afe1b44489927de1eb4e66e8536a5935 upstream.
Several bsg handlers stage their request/reply in an uninitialized 256-byte
on-stack buffer (uint8_t bsg[DMA_POOL_SIZE]) and fill it via
sg_copy_to_buffer(), which only copies as many bytes as the user-supplied
request payload. When the request is shorter than the structure, the
remainder of the buffer is left holding stale stack data.
qla2x00_read_fru_status() and qla2x00_read_i2c() then copy the full
structure back to the reply payload with sg_copy_from_buffer(), leaking the
uninitialized stack bytes to user space. The write/update paths do not copy
the buffer back, but can feed uninitialized fields to the device.
Zero the stack buffer at declaration in all five handlers, mirroring the
heap kzalloc() approach, so short requests can no longer expose stale
memory.
Fixes: 697a4bc69159 ("[SCSI] qla2xxx: Provide method for updating I2C attached VPD.")
Fixes: 9ebb5d9c69f1 ("[SCSI] qla2xxx: Add I2C BSG interface.")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-dev@google.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://patch.msgid.link/20260730155838.2119230-30-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_bsg.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_bsg.c
+++ b/drivers/scsi/qla2xxx/qla_bsg.c
@@ -1560,7 +1560,7 @@ qla2x00_update_fru_versions(struct bsg_j
scsi_qla_host_t *vha = shost_priv(host);
struct qla_hw_data *ha = vha->hw;
int rval = 0;
- uint8_t bsg[DMA_POOL_SIZE];
+ uint8_t bsg[DMA_POOL_SIZE] = {};
struct qla_image_version_list *list = (void *)bsg;
struct qla_image_version *image;
uint32_t count;
@@ -1620,7 +1620,7 @@ qla2x00_read_fru_status(struct bsg_job *
scsi_qla_host_t *vha = shost_priv(host);
struct qla_hw_data *ha = vha->hw;
int rval = 0;
- uint8_t bsg[DMA_POOL_SIZE];
+ uint8_t bsg[DMA_POOL_SIZE] = {};
struct qla_status_reg *sr = (void *)bsg;
dma_addr_t sfp_dma;
uint8_t *sfp = dma_pool_zalloc(ha->s_dma_pool, GFP_KERNEL, &sfp_dma);
@@ -1671,7 +1671,7 @@ qla2x00_write_fru_status(struct bsg_job
scsi_qla_host_t *vha = shost_priv(host);
struct qla_hw_data *ha = vha->hw;
int rval = 0;
- uint8_t bsg[DMA_POOL_SIZE];
+ uint8_t bsg[DMA_POOL_SIZE] = {};
struct qla_status_reg *sr = (void *)bsg;
dma_addr_t sfp_dma;
uint8_t *sfp = dma_pool_zalloc(ha->s_dma_pool, GFP_KERNEL, &sfp_dma);
@@ -1718,7 +1718,7 @@ qla2x00_write_i2c(struct bsg_job *bsg_jo
scsi_qla_host_t *vha = shost_priv(host);
struct qla_hw_data *ha = vha->hw;
int rval = 0;
- uint8_t bsg[DMA_POOL_SIZE];
+ uint8_t bsg[DMA_POOL_SIZE] = {};
struct qla_i2c_access *i2c = (void *)bsg;
dma_addr_t sfp_dma;
uint8_t *sfp = dma_pool_zalloc(ha->s_dma_pool, GFP_KERNEL, &sfp_dma);
@@ -1770,7 +1770,7 @@ qla2x00_read_i2c(struct bsg_job *bsg_job
scsi_qla_host_t *vha = shost_priv(host);
struct qla_hw_data *ha = vha->hw;
int rval = 0;
- uint8_t bsg[DMA_POOL_SIZE];
+ uint8_t bsg[DMA_POOL_SIZE] = {};
struct qla_i2c_access *i2c = (void *)bsg;
dma_addr_t sfp_dma;
uint8_t *sfp = dma_pool_zalloc(ha->s_dma_pool, GFP_KERNEL, &sfp_dma);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0247/1376] scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (245 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0246/1376] scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0248/1376] f2fs: return symlink writeback errors Greg Kroah-Hartman
` (751 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Nilesh Javali,
Martin K. Petersen (Oracle)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilesh Javali <njavali@marvell.com>
commit f7e46ebffc5781aab3f1f5a5d4350addbb5833f4 upstream.
qla_nvme_xmt_ls_rsp() bails out to the out: label when firmware is not
started (!ha->flags.fw_started), but the out: path unconditionally calls
qla_nvme_ls_reject_iocb(), which ends in qla2x00_start_iocbs() and an
unconditional doorbell write to the request queue in-pointer register.
This rings the firmware doorbell and queues an IOCB that stopped or
resetting firmware cannot consume, and touches MMIO during the reset/EEH
window where fw_started is also clear.
Only emit the LS reject IOCB (and ring the doorbell) when fw_started is
set; otherwise just clean up and return. The post-allocation failure
cases (SRB alloc / qla2x00_start_sp() failure) run with firmware started
and still send the reject. Apply the same guard to the reject emission
in qla2xxx_process_purls_pkt().
Fixes: 875386b98857 ("scsi: qla2xxx: Add Unsolicited LS Request and Response Support for NVMe")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-dev@google.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://patch.msgid.link/20260730155838.2119230-26-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_nvme.c | 19 +++++++++++++------
1 file changed, 13 insertions(+), 6 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_nvme.c
+++ b/drivers/scsi/qla2xxx/qla_nvme.c
@@ -441,9 +441,11 @@ out:
a.vp_idx = vha->vp_idx;
a.nport_handle = uctx->nport_handle;
a.xchg_address = uctx->exchange_address;
- spin_lock_irqsave(ha->base_qpair->qp_lock_ptr, flags);
- qla_nvme_ls_reject_iocb(vha, ha->base_qpair, &a, true);
- spin_unlock_irqrestore(ha->base_qpair->qp_lock_ptr, flags);
+ if (ha->flags.fw_started) {
+ spin_lock_irqsave(ha->base_qpair->qp_lock_ptr, flags);
+ qla_nvme_ls_reject_iocb(vha, ha->base_qpair, &a, true);
+ spin_unlock_irqrestore(ha->base_qpair->qp_lock_ptr, flags);
+ }
kfree(uctx);
return rval;
}
@@ -1205,9 +1207,14 @@ qla2xxx_process_purls_pkt(struct scsi_ql
a.vp_idx = vha->vp_idx;
a.nport_handle = uctx->nport_handle;
a.xchg_address = uctx->exchange_address;
- spin_lock_irqsave(vha->hw->base_qpair->qp_lock_ptr, flags);
- qla_nvme_ls_reject_iocb(vha, vha->hw->base_qpair, &a, true);
- spin_unlock_irqrestore(vha->hw->base_qpair->qp_lock_ptr, flags);
+ if (vha->hw->flags.fw_started) {
+ spin_lock_irqsave(vha->hw->base_qpair->qp_lock_ptr,
+ flags);
+ qla_nvme_ls_reject_iocb(vha, vha->hw->base_qpair, &a,
+ true);
+ spin_unlock_irqrestore(vha->hw->base_qpair->qp_lock_ptr,
+ flags);
+ }
list_del(&uctx->elem);
kfree(uctx);
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0248/1376] f2fs: return symlink writeback errors
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (246 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0247/1376] scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0249/1376] f2fs: reject overlapping move range after len expansion Greg Kroah-Hartman
` (750 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Wenjie Qi, Chao Yu,
Jaegeuk Kim
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenjie Qi <qwjhust@gmail.com>
commit a2c73a7a677afdaa8b16d775188f9ef5cfbfd8b2 upstream.
F2FS writes long symlink data with page_symlink() and then flushes the
symlink mapping to reduce the chance of exposing a broken symlink.
That flush result is currently ignored. If the writeback fails, symlink()
still returns success even though the symlink is not durable and the same
operation can already surface -EIO through syncfs().
Return the writeback error to userspace and skip the dirsync flush once the
symlink data flush has failed.
Fixes: d0cae97cb600 ("f2fs: flush symlink path to avoid broken symlink after POR")
Cc: stable@kernel.org
Signed-off-by: Wenjie Qi <qiwenjie@xiaomi.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/namei.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
--- a/fs/f2fs/namei.c
+++ b/fs/f2fs/namei.c
@@ -672,15 +672,16 @@ err_out:
* performance regression.
*/
if (!err) {
- filemap_write_and_wait_range(inode->i_mapping, 0,
- disk_link.len - 1);
+ err = filemap_write_and_wait_range(inode->i_mapping, 0,
+ disk_link.len - 1);
- if (IS_DIRSYNC(dir))
+ if (!err && IS_DIRSYNC(dir))
f2fs_sync_fs(sbi->sb, 1);
- } else {
- f2fs_unlink(dir, dentry);
}
+ if (err)
+ f2fs_unlink(dir, dentry);
+
f2fs_balance_fs(sbi, true);
goto out_free_encrypted_link;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0249/1376] f2fs: reject overlapping move range after len expansion
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (247 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0248/1376] f2fs: return symlink writeback errors Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0250/1376] f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set() Greg Kroah-Hartman
` (749 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hao-Qun Huang, Chao Yu, Jaegeuk Kim
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao-Qun Huang <alvinhuang0603@gmail.com>
commit 28c1ef094e7c86977d9bf570dc0362fc54e36437 upstream.
F2FS_IOC_MOVE_RANGE treats a zero length as a request to move data
from pos_in to EOF. However, the same-file overlap check runs before
that expansion, so a request with len == 0 bypasses the overlap
rejection added for same-file moves.
For example, with a four-block file, moving from block 0 to block 1
with len == 0 is accepted by the old check because pos_in + len is
still pos_in at that point. The code then expands len to cover the
rest of the file and calls __exchange_data_block() on overlapping
source and destination ranges in the same inode, which is the
data-corruption case the overlap check was meant to reject.
Move the overlap check after the source range has been validated and
len == 0 has been expanded, so it sees the effective length. This is a
no-op for non-zero len (the value is unchanged there) and keeps the
existing early return for identical positions.
Fixes: d95fd91c1ac1 ("f2fs: exclude special cases for f2fs_move_file_range")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5
Signed-off-by: Hao-Qun Huang <alvinhuang0603@gmail.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/file.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -3053,8 +3053,6 @@ static int f2fs_move_file_range(struct f
if (src == dst) {
if (pos_in == pos_out)
return 0;
- if (pos_out > pos_in && pos_out < pos_in + len)
- return -EINVAL;
}
inode_lock(src);
@@ -3080,6 +3078,8 @@ static int f2fs_move_file_range(struct f
goto out_unlock;
if (len == 0)
olen = len = src->i_size - pos_in;
+ if (src == dst && pos_out > pos_in && pos_out < pos_in + len)
+ goto out_unlock;
if (pos_in + len == src->i_size)
len = ALIGN(src->i_size, F2FS_BLKSIZE) - pos_in;
if (len == 0) {
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0250/1376] f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (248 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0249/1376] f2fs: reject overlapping move range after len expansion Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0251/1376] f2fs: return writeback error from collapse range Greg Kroah-Hartman
` (748 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhan Xusheng, Chao Yu, Jaegeuk Kim
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhan Xusheng <zhanxusheng1024@gmail.com>
commit a54ffce4637acb0db8e695188a6c7f99f14c3576 upstream.
f2fs_xattr_advise_set() calls inode_owner_or_capable() with &nop_mnt_idmap
before allowing the "system.advise" xattr to be set, instead of the idmap
that the VFS passes to the ->set() handler.
f2fs supports idmapped mounts, so on such a mount this checks the caller's
fsuid against the unmapped on-disk owner rather than the mapped owner: the
actual owner can be wrongly denied with -EPERM and an unrelated caller
wrongly allowed. Pass the handler's idmap instead.
Fixes: 01beba7957a2 ("fs: port inode_owner_or_capable() to mnt_idmap")
Cc: stable@vger.kernel.org
Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Acked-by: Christian Brauner (Amutable) <braurg>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/xattr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/f2fs/xattr.c
+++ b/fs/f2fs/xattr.c
@@ -118,7 +118,7 @@ static int f2fs_xattr_advise_set(const s
unsigned char old_advise = F2FS_I(inode)->i_advise;
unsigned char new_advise;
- if (!inode_owner_or_capable(&nop_mnt_idmap, inode))
+ if (!inode_owner_or_capable(idmap, inode))
return -EPERM;
if (value == NULL)
return -EINVAL;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0251/1376] f2fs: return writeback error from collapse range
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (249 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0250/1376] f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set() Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0252/1376] f2fs: avoid NULL checkpoint thread access in sysfs Greg Kroah-Hartman
` (747 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Wenjie Qi, Chao Yu,
Jaegeuk Kim
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenjie Qi <qwjhust@gmail.com>
commit f8a4108800254d6f7b2755515fbbd9d0caac561e upstream.
f2fs_collapse_range() writes back pages moved by f2fs_do_collapse(),
but ignores the return value. If writeback fails, the ioctl can still
truncate page cache, shrink blocks, and report success.
Return the error before truncating page cache or updating the file size.
Fixes: b4ace3370324 ("f2fs: support FALLOC_FL_COLLAPSE_RANGE")
Cc: stable@kernel.org
Assisted-by: Codex:gpt-5.5
Signed-off-by: Wenjie Qi <qiwenjie@xiaomi.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/file.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -1542,11 +1542,14 @@ static int f2fs_collapse_range(struct in
/* write out all moved pages, if possible */
filemap_invalidate_lock(inode->i_mapping);
- filemap_write_and_wait_range(inode->i_mapping, offset, LLONG_MAX);
+ ret = filemap_write_and_wait_range(inode->i_mapping, offset, LLONG_MAX);
+ if (ret)
+ goto out_unlock;
truncate_pagecache(inode, offset);
new_size = i_size_read(inode) - len;
ret = f2fs_truncate_blocks(inode, new_size, true);
+out_unlock:
filemap_invalidate_unlock(inode->i_mapping);
if (!ret)
f2fs_i_size_write(inode, new_size);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0252/1376] f2fs: avoid NULL checkpoint thread access in sysfs
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (250 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0251/1376] f2fs: return writeback error from collapse range Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0253/1376] f2fs: fix to migrate all curseg types during free_segment_range Greg Kroah-Hartman
` (746 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Wenjie Qi, Chao Yu,
Jaegeuk Kim
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenjie Qi <qwjhust@gmail.com>
commit 5cb33b00c8fbb6e8f1fa3d281c3036d5f7c7c41f upstream.
checkpoint_merge can be enabled even when no checkpoint merge thread is
running. A read-only mount is one case: f2fs does not start
f2fs_issue_ckpt there, but ckpt_thread_ioprio is still writable through
sysfs.
The ckpt_thread_ioprio store path updates the saved ioprio value and,
when checkpoint_merge is enabled, calls set_task_ioprio() for the
checkpoint thread. If cprc->f2fs_issue_ckpt is NULL, that dereferences a
NULL task pointer.
Protect ckpt_thread_ioprio sysfs writes with s_umount as well, so the
checkpoint thread cannot disappear under the store path while updating
its ioprio.
Fixes: e65920661708 ("f2fs: add ckpt_thread_ioprio sysfs node")
Cc: stable@kernel.org
Signed-off-by: Wenjie Qi <qiwenjie@xiaomi.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/sysfs.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/fs/f2fs/sysfs.c
+++ b/fs/f2fs/sysfs.c
@@ -528,7 +528,7 @@ out:
return -EINVAL;
cprc->ckpt_thread_ioprio = IOPRIO_PRIO_VALUE(class, level);
- if (test_opt(sbi, MERGE_CHECKPOINT)) {
+ if (cprc->f2fs_issue_ckpt) {
ret = set_task_ioprio(cprc->f2fs_issue_ckpt,
cprc->ckpt_thread_ioprio);
if (ret)
@@ -924,13 +924,14 @@ static ssize_t f2fs_sbi_store(struct f2f
ssize_t ret;
bool gc_entry = (!strcmp(a->attr.name, "gc_urgent") ||
a->struct_type == GC_THREAD);
+ bool thread_entry = !strcmp(a->attr.name, "ckpt_thread_ioprio");
- if (gc_entry) {
+ if (gc_entry || thread_entry) {
if (!down_read_trylock(&sbi->sb->s_umount))
return -EAGAIN;
}
ret = __sbi_store(a, sbi, buf, count);
- if (gc_entry)
+ if (gc_entry || thread_entry)
up_read(&sbi->sb->s_umount);
return ret;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0253/1376] f2fs: fix to migrate all curseg types during free_segment_range
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (251 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0252/1376] f2fs: avoid NULL checkpoint thread access in sysfs Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0254/1376] f2fs: fix i_size when pinned fallocate partially fails Greg Kroah-Hartman
` (745 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daeho Jeong, Sunmin Jeong, Chao Yu,
Jaegeuk Kim
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daeho Jeong <daehojeong@google.com>
commit 8ec06f50ddd8d201bd7e55b896ae28ed9d4cb7d1 upstream.
In free_segment_range(), the curseg evacuation loop only iterates up to
NR_CURSEG_PERSIST_TYPE (0..5), missing non-persistent in-memory curseg
types such as CURSEG_COLD_DATA_PINNED and CURSEG_ALL_DATA_ATGC.
Even though these in-memory curseg types are not saved in the on-disk
checkpoint header, they still occupy active physical segments at runtime.
If an active in-memory curseg happens to be allocated within the segment
range being truncated during filesystem shrink, failing to evacuate it
will cause subsequent writes to the curseg attempting out-of-bounds I/O
on the truncated storage range.
Fix this by expanding the curseg evacuation loop upper bound to
NR_CURSEG_TYPE to ensure all active curseg types are safely migrated
out of the target range.
Fixes: d0b9e42ab615 ("f2fs: introduce inmem curseg")
Cc: stable@vger.kernel.org
Signed-off-by: Daeho Jeong <daehojeong@google.com>
Signed-off-by: Sunmin Jeong <s_min.jeong@samsung.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/gc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/f2fs/gc.c
+++ b/fs/f2fs/gc.c
@@ -2171,7 +2171,7 @@ static int free_segment_range(struct f2f
mutex_unlock(&DIRTY_I(sbi)->seglist_lock);
/* Move out cursegs from the target range */
- for (type = CURSEG_HOT_DATA; type < NR_CURSEG_PERSIST_TYPE; type++) {
+ for (type = CURSEG_HOT_DATA; type < NR_CURSEG_TYPE; type++) {
err = f2fs_allocate_segment_for_resize(sbi, type, start, end);
if (err)
goto out;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0254/1376] f2fs: fix i_size when pinned fallocate partially fails
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (252 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0253/1376] f2fs: fix to migrate all curseg types during free_segment_range Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0255/1376] f2fs: fix to off-by-one issue in f2fs_zero_post_eof_page() Greg Kroah-Hartman
` (744 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhan Xusheng, Chao Yu, Jaegeuk Kim
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhan Xusheng <zhanxusheng1024@gmail.com>
commit 0f448bb3767ef6119f5cdeabcae3f10d6e75aed6 upstream.
From: Zhan Xusheng <zhanxusheng@xiaomi.com>
Commit 4275b59673eb ("f2fs: fix to round down start offset of fallocate
for pin file") moved the allocation loop's start down to a section
boundary, but the error path still converts @expanded against @pg_start,
which holds the unrounded start.
@pg_start exists for that conversion: commit 88f2cfc5fa90 ("f2fs: fix to
update last i_size if fallocate partially succeeds") added it as an
immutable base because map.m_lblk moves every round. Each round now maps
exactly sec_blks blocks starting from rounddown(pg_start, sec_blks), so
pg_start + expanded overshoots the last allocated block by
pg_start % sec_blks, and a partial failure leaves i_size covering a tail
that was never allocated. Nothing corrects that afterwards either, since
file_dont_truncate() has already cleared FADVISE_TRUNC_BIT.
It needs a start offset that is not section aligned plus a fallocate that
hits ENOSPC partway, so the error path runs with expanded > 0. On an
80 MiB image with 2 MiB sections:
truncate -s 80M img
mkfs.f2fs -s 1 -f img
mount -o loop img /mnt
touch /mnt/pinned
f2fs_io pinfile set /mnt/pinned
# 2093056 = block 511, so pg_start % sec_blks = 511
f2fs_io fallocate 0 2093056 536870912 /mnt/pinned
stat -c %s /mnt/pinned
filefrag -v /mnt/pinned
The last extent ends at block 10737 either way. Before, i_size is
46075904, block 11249, so 511 blocks of it were never allocated, and
filefrag does not mark the last extent eof. After, i_size is 43982848,
block 10738, and eof is back. A kernel from before that commit also
shows no overshoot.
Keep @pg_start pointing at where allocation actually begins.
Fixes: 4275b59673eb ("f2fs: fix to round down start offset of fallocate for pin file")
Cc: stable@vger.kernel.org
Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/file.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -1844,8 +1844,9 @@ static int f2fs_expand_inode_data(struct
block_t sec_len;
if (map.m_lblk % sec_blks) {
- map.m_lblk = rounddown(map.m_lblk, sec_blks);
- map.m_len = pg_end - map.m_lblk;
+ pg_start = rounddown(map.m_lblk, sec_blks);
+ map.m_lblk = pg_start;
+ map.m_len = pg_end - pg_start;
if (off_end)
map.m_len++;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0255/1376] f2fs: fix to off-by-one issue in f2fs_zero_post_eof_page()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (253 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0254/1376] f2fs: fix i_size when pinned fallocate partially fails Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0256/1376] f2fs: fix valid block count leak on data block allocation failure Greg Kroah-Hartman
` (743 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Chao Yu, Jaegeuk Kim
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <chao@kernel.org>
commit b2205d3cfd6c76fd5c5443ee9fdb498cfb0e1c66 upstream.
Otherwise, it will drop one more page after new_size which is not
necessary.
Cc: stable@kernel.org
Fixes: ba8dac350faf ("f2fs: fix to zero post-eof page")
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/file.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -49,7 +49,7 @@ static void f2fs_zero_post_eof_page(stru
if (lock)
filemap_invalidate_lock(inode->i_mapping);
/* zero or drop pages only in range of [old_size, new_size] */
- truncate_inode_pages_range(inode->i_mapping, old_size, new_size);
+ truncate_inode_pages_range(inode->i_mapping, old_size, new_size - 1);
if (lock)
filemap_invalidate_unlock(inode->i_mapping);
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0256/1376] f2fs: fix valid block count leak on data block allocation failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (254 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0255/1376] f2fs: fix to off-by-one issue in f2fs_zero_post_eof_page() Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0257/1376] f2fs: fix to zero post-EOF data when extending file size Greg Kroah-Hartman
` (742 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chao Yu, Chen Changcheng,
Jaegeuk Kim
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Changcheng <chenchangcheng@kylinos.cn>
commit 0f9af07ecc1ab486038373db6ae0436c5d674b19 upstream.
In __allocate_data_block(), when allocating a new data block
(dn->data_blkaddr == NULL_ADDR), inc_valid_block_count() is
called first to increment total_valid_block_count and i_blocks.
If the subsequent f2fs_allocate_data_block() fails, the function
returns the error directly without rolling back the
already-incremented block counts, causing a permanent leak.
Fix this by calling dec_valid_block_count() to undo the
increment before returning the error. The condition
old_blkaddr == NULL_ADDR precisely identifies the case where
inc_valid_block_count() was called.
Fixes: 7d009e048d7c ("f2fs: fix to handle segment allocation failure correctly")
Cc: <stable@vger.kernel.org>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Chen Changcheng <chenchangcheng@kylinos.cn>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/data.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -1454,8 +1454,11 @@ static int __allocate_data_block(struct
old_blkaddr = dn->data_blkaddr;
err = f2fs_allocate_data_block(sbi, NULL, old_blkaddr,
&dn->data_blkaddr, &sum, seg_type, NULL);
- if (err)
+ if (err) {
+ if (old_blkaddr == NULL_ADDR)
+ dec_valid_block_count(sbi, dn->inode, count);
return err;
+ }
if (GET_SEGNO(sbi, old_blkaddr) != NULL_SEGNO)
f2fs_invalidate_internal_cache(sbi, old_blkaddr);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0257/1376] f2fs: fix to zero post-EOF data when extending file size
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (255 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0256/1376] f2fs: fix valid block count leak on data block allocation failure Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0258/1376] drm/panthor: fix firmware control interface bounds checks Greg Kroah-Hartman
` (741 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Chao Yu, Jaegeuk Kim
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <chao@kernel.org>
commit 5eced87b7d19dbc76ebdddaf322046f9ac582fcb upstream.
generic/794 4s ... - output mismatch (see /share/git/fstests/results//generic/794.out.bad)
# --- tests/generic/794.out 2026-06-12 08:46:32.766426241 +0800
# +++ /share/git/fstests/results//generic/794.out.bad 2026-07-05 18:32:55.000000000 +0800
# @@ -1,4 +1,16 @@
# QA output created by 794
# append_write
# +FAIL: non-zero data in gap [4080,4096) after shutdown+remount
# +000000 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a >ZZZZZZZZZZZZZZZZ<
# +*
# +001000
# truncate_up
# ...
# (Run 'diff -u /share/git/fstests/tests/generic/794.out /share/git/fstests/results//generic/794.out.bad' to see the entire diff)
Ran: generic/794
Failures: generic/794
Failed 1 of 1 tests
Steps of generic/794:
1. write 4096 bytes to file w/ 0x5a
2. use fiemap to get PBA of first block in file
3. truncate file to 4080
4. umount; write 4096 bytes to file w/ 0x5a directly via PBA; mount
5. extend filesize via
a) append 4096 from offset 4096, or
b) truncate 8192, or
c) fallocate 4096 from offset 4096
6. verify the gap is zeroed in memory [4080,4096)
7. sync range 4096 from offset 4096; shutdown -f (flush meta before shutdown)
8. umount; mount; verify [4080,4096) is zeroed or not.
When extending file size (e.g. via truncate, fallocate, or write) across an
unaligned EOF boundary, we need to ensure that post-EOF data in the partial
page is zeroed out in pagecache and marked dirty, then writeback the cache to
persist zeroed data before committing inode w/ updated i_size.
This help to prevent stale disk data beyond the previous EOF from being exposed
after remounting or crash recovery.
Since f2fs is a LFS filesystem, we only support direct write via PBA in pinfile,
and pinfile has section-aligned filesize, so in Android, there should no problem,
but for other usage in different environment, let's fix this w/ fsync_mode=strict
mount option.
Cc: stable@kernel.org
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/file.c | 100 +++++++++++++++++++++++++++++++++++++++++++++++----------
1 file changed, 84 insertions(+), 16 deletions(-)
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -35,16 +35,52 @@
#include <trace/events/f2fs.h>
#include <uapi/linux/f2fs.h>
-static void f2fs_zero_post_eof_page(struct inode *inode,
- loff_t new_size, bool lock)
+static int fill_zero(struct inode *inode, pgoff_t index,
+ loff_t start, loff_t len);
+
+static int do_zero_post_eof_page(struct inode *inode, loff_t new_size)
+{
+ loff_t old_size = i_size_read(inode);
+ unsigned int offset, len;
+ pgoff_t index;
+ int err;
+
+ offset = old_size & (PAGE_SIZE - 1);
+
+ if (!offset)
+ return 0;
+
+ len = min_t(loff_t, PAGE_SIZE - offset, new_size - old_size);
+ index = old_size >> PAGE_SHIFT;
+
+ if (f2fs_has_inline_data(inode)) {
+ /* data post eof should be always zero */
+ if (new_size <= MAX_INLINE_DATA(inode))
+ return 0;
+ err = f2fs_convert_inline_inode(inode);
+ if (err)
+ return err;
+ }
+
+ err = fill_zero(inode, index, offset, len);
+ if (err)
+ return err;
+ return filemap_write_and_wait_range(inode->i_mapping,
+ old_size, old_size + len - 1);
+}
+
+static int f2fs_zero_post_eof_page(struct inode *inode,
+ loff_t new_size, bool lock, bool writeback)
{
loff_t old_size = i_size_read(inode);
+ bool strict =
+ F2FS_OPTION(F2FS_I_SB(inode)).fsync_mode == FSYNC_MODE_STRICT;
if (old_size >= new_size)
- return;
+ return 0;
- if (mapping_empty(inode->i_mapping))
- return;
+ if (!strict && mapping_empty(inode->i_mapping))
+ return 0;
if (lock)
filemap_invalidate_lock(inode->i_mapping);
@@ -52,6 +88,16 @@ static void f2fs_zero_post_eof_page(stru
truncate_inode_pages_range(inode->i_mapping, old_size, new_size - 1);
if (lock)
filemap_invalidate_unlock(inode->i_mapping);
+
+ if (!writeback || !strict)
+ return 0;
+ /*
+ * In fsync_mode=strict, when we expand an unaligned EOF size, we
+ * should zero post EOF data and writeback the data immediately,
+ * so that it can avoid exposing stale data after metadata flush
+ * and POR.
+ */
+ return do_zero_post_eof_page(inode, new_size);
}
static vm_fault_t f2fs_filemap_fault(struct vm_fault *vmf)
@@ -122,7 +168,10 @@ static vm_fault_t f2fs_vm_page_mkwrite(s
f2fs_bug_on(sbi, f2fs_has_inline_data(inode));
- f2fs_zero_post_eof_page(inode, (folio->index + 1) << PAGE_SHIFT, true);
+ err = f2fs_zero_post_eof_page(inode,
+ (folio->index + 1) << PAGE_SHIFT, true, false);
+ if (err)
+ goto out_pagefault;
file_update_time(vmf->vma->vm_file);
filemap_invalidate_lock_shared(inode->i_mapping);
@@ -179,7 +228,7 @@ static vm_fault_t f2fs_vm_page_mkwrite(s
out_sem:
filemap_invalidate_unlock_shared(inode->i_mapping);
-
+out_pagefault:
sb_end_pagefault(inode->i_sb);
out:
ret = vmf_fs_error(err);
@@ -1097,8 +1146,12 @@ int f2fs_setattr(struct mnt_idmap *idmap
f2fs_down_write(&fi->i_gc_rwsem[WRITE]);
filemap_invalidate_lock(inode->i_mapping);
- if (attr->ia_size > old_size)
- f2fs_zero_post_eof_page(inode, attr->ia_size, false);
+ if (attr->ia_size > old_size) {
+ err = f2fs_zero_post_eof_page(inode,
+ attr->ia_size, false, true);
+ if (err)
+ goto err_out;
+ }
truncate_setsize(inode, attr->ia_size);
if (attr->ia_size <= old_size)
@@ -1107,6 +1160,7 @@ int f2fs_setattr(struct mnt_idmap *idmap
* do not trim all blocks after i_size if target size is
* larger than i_size.
*/
+err_out:
filemap_invalidate_unlock(inode->i_mapping);
f2fs_up_write(&fi->i_gc_rwsem[WRITE]);
if (err)
@@ -1217,7 +1271,9 @@ static int f2fs_punch_hole(struct inode
if (ret)
return ret;
- f2fs_zero_post_eof_page(inode, offset + len, true);
+ ret = f2fs_zero_post_eof_page(inode, offset + len, true, false);
+ if (ret)
+ return ret;
pg_start = ((unsigned long long) offset) >> PAGE_SHIFT;
pg_end = ((unsigned long long) offset + len) >> PAGE_SHIFT;
@@ -1502,7 +1558,9 @@ static int f2fs_do_collapse(struct inode
f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
filemap_invalidate_lock(inode->i_mapping);
- f2fs_zero_post_eof_page(inode, offset + len, false);
+ ret = f2fs_zero_post_eof_page(inode, offset + len, false, false);
+ if (ret)
+ goto out_unlock;
f2fs_lock_op(sbi);
f2fs_drop_extent_tree(inode);
@@ -1510,6 +1568,7 @@ static int f2fs_do_collapse(struct inode
ret = __exchange_data_block(inode, inode, end, start, nrpages - end, true);
f2fs_unlock_op(sbi);
+out_unlock:
filemap_invalidate_unlock(inode->i_mapping);
f2fs_up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
return ret;
@@ -1631,7 +1690,9 @@ static int f2fs_zero_range(struct inode
if (ret)
return ret;
- f2fs_zero_post_eof_page(inode, offset + len, true);
+ ret = f2fs_zero_post_eof_page(inode, offset + len, true, false);
+ if (ret)
+ return ret;
pg_start = ((unsigned long long) offset) >> PAGE_SHIFT;
pg_end = ((unsigned long long) offset + len) >> PAGE_SHIFT;
@@ -1765,7 +1826,9 @@ static int f2fs_insert_range(struct inod
f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
filemap_invalidate_lock(mapping);
- f2fs_zero_post_eof_page(inode, offset + len, false);
+ ret = f2fs_zero_post_eof_page(inode, offset + len, false, false);
+ if (ret)
+ goto out_unlock;
truncate_pagecache(inode, offset);
while (!ret && idx > pg_start) {
@@ -1781,6 +1844,7 @@ static int f2fs_insert_range(struct inod
idx + delta, nr, false);
f2fs_unlock_op(sbi);
}
+out_unlock:
filemap_invalidate_unlock(mapping);
f2fs_up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
if (ret)
@@ -1823,7 +1887,9 @@ static int f2fs_expand_inode_data(struct
if (err)
return err;
- f2fs_zero_post_eof_page(inode, offset + len, true);
+ err = f2fs_zero_post_eof_page(inode, offset + len, true, true);
+ if (err)
+ return err;
f2fs_balance_fs(sbi, true);
@@ -4839,8 +4905,10 @@ static ssize_t f2fs_write_checks(struct
if (err)
return err;
- f2fs_zero_post_eof_page(inode,
- iocb->ki_pos + iov_iter_count(from), true);
+ err = f2fs_zero_post_eof_page(inode,
+ iocb->ki_pos + iov_iter_count(from), true, true);
+ if (err)
+ return err;
return count;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0258/1376] drm/panthor: fix firmware control interface bounds checks
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (256 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0257/1376] f2fs: fix to zero post-EOF data when extending file size Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0259/1376] drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure Greg Kroah-Hartman
` (740 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Osama Abdelkader, Steven Price,
Liviu Dudau
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Osama Abdelkader <osama.abdelkader@gmail.com>
commit 6a47f9fd2d970674ed9dedc52fc7ab76fd015785 upstream.
panthor_init_cs_iface() and panthor_init_csg_iface() validate firmware
control interface offsets with 32-bit arithmetic and the size of the host
wrapper structures. The offsets are derived from firmware-provided strides,
so the arithmetic can wrap before the bounds check, and the host wrapper
size is not the size of the firmware control interface being mapped.
Use 64-bit arithmetic for the computed offsets and validate against the
actual firmware control interface structure sizes with subtraction-based
bounds checks. Also validate that the shared section is large enough for
the global control interface before using it.
Fixes: 2718d91816ee ("drm/panthor: Add the FW logical block")
Cc: stable@vger.kernel.org
Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
Link: https://patch.msgid.link/20260720134435.13377-1-osama.abdelkader@gmail.com
Signed-off-by: Steven Price <steven.price@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/panthor/panthor_fw.c | 19 +++++++++++++------
1 file changed, 13 insertions(+), 6 deletions(-)
--- a/drivers/gpu/drm/panthor/panthor_fw.c
+++ b/drivers/gpu/drm/panthor/panthor_fw.c
@@ -797,14 +797,15 @@ static int panthor_init_cs_iface(struct
struct panthor_fw_csg_iface *csg_iface = panthor_fw_get_csg_iface(ptdev, csg_idx);
struct panthor_fw_cs_iface *cs_iface = &ptdev->fw->iface.streams[csg_idx][cs_idx];
u64 shared_section_sz = panthor_kernel_bo_size(ptdev->fw->shared_section->mem);
- u32 iface_offset = CSF_GROUP_CONTROL_OFFSET +
- (csg_idx * glb_iface->control->group_stride) +
+ u64 iface_offset = CSF_GROUP_CONTROL_OFFSET +
+ ((u64)csg_idx * glb_iface->control->group_stride) +
CSF_STREAM_CONTROL_OFFSET +
- (cs_idx * csg_iface->control->stream_stride);
+ ((u64)cs_idx * csg_iface->control->stream_stride);
struct panthor_fw_cs_iface *first_cs_iface =
panthor_fw_get_cs_iface(ptdev, 0, 0);
- if (iface_offset + sizeof(*cs_iface) >= shared_section_sz)
+ if (iface_offset > shared_section_sz ||
+ sizeof(*cs_iface->control) > shared_section_sz - iface_offset)
return -EINVAL;
spin_lock_init(&cs_iface->lock);
@@ -854,10 +855,12 @@ static int panthor_init_csg_iface(struct
struct panthor_fw_global_iface *glb_iface = panthor_fw_get_glb_iface(ptdev);
struct panthor_fw_csg_iface *csg_iface = &ptdev->fw->iface.groups[csg_idx];
u64 shared_section_sz = panthor_kernel_bo_size(ptdev->fw->shared_section->mem);
- u32 iface_offset = CSF_GROUP_CONTROL_OFFSET + (csg_idx * glb_iface->control->group_stride);
+ u64 iface_offset = CSF_GROUP_CONTROL_OFFSET +
+ ((u64)csg_idx * glb_iface->control->group_stride);
unsigned int i;
- if (iface_offset + sizeof(*csg_iface) >= shared_section_sz)
+ if (iface_offset > shared_section_sz ||
+ sizeof(*csg_iface->control) > shared_section_sz - iface_offset)
return -EINVAL;
spin_lock_init(&csg_iface->lock);
@@ -909,11 +912,15 @@ static u32 panthor_get_instr_features(st
static int panthor_fw_init_ifaces(struct panthor_device *ptdev)
{
struct panthor_fw_global_iface *glb_iface = &ptdev->fw->iface.global;
+ u64 shared_section_sz = panthor_kernel_bo_size(ptdev->fw->shared_section->mem);
unsigned int i;
if (!ptdev->fw->shared_section->mem->kmap)
return -EINVAL;
+ if (sizeof(*glb_iface->control) > shared_section_sz)
+ return -EINVAL;
+
spin_lock_init(&glb_iface->lock);
glb_iface->control = ptdev->fw->shared_section->mem->kmap;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0259/1376] drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (257 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0258/1376] drm/panthor: fix firmware control interface bounds checks Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0260/1376] drm/panel-edp: " Greg Kroah-Hartman
` (739 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Johan Hovold,
Luca Ceresoli, Laurent Pinchart
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 09b195a7bb23df56269cd2a95d01ba3a5533af13 upstream.
Make sure to drop the i2c adapter device and module references before
returning when detecting a malformed devicetree during probe.
Fixes: 80e2f97968b5 ("drm: bridge: dw-hdmi: Switch to regmap for register access")
Cc: stable@vger.kernel.org # 4.12
Cc: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Link: https://patch.msgid.link/20260717090819.1630965-1-johan@kernel.org
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
+++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
@@ -3383,7 +3383,8 @@ struct dw_hdmi *dw_hdmi_probe(struct pla
break;
default:
dev_err(dev, "reg-io-width must be 1 or 4\n");
- return ERR_PTR(-EINVAL);
+ ret = -EINVAL;
+ goto err_res;
}
iores = platform_get_resource(pdev, IORESOURCE_MEM, 0);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0260/1376] drm/panel-edp: fix i2c adapter leak on probe failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (258 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0259/1376] drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0261/1376] drm: fix race between partial drm_dev_register() failure and ioctl Greg Kroah-Hartman
` (738 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Douglas Anderson, Johan Hovold
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit e2a9e291275a74e309a21cbb1def6296a72d6aed upstream.
Make sure to drop the i2c adapter reference on probe failure (e.g.
probe deferral) and on driver unbind also if a devicetree redundantly
uses the 'ddc-i2c-bus' property to point to the aux ddc bus.
Fixes: cc5a3fc041f0 ("drm/panel: panel-simple: Stash DP AUX bus; allow using it for DDC")
Cc: stable@vger.kernel.org # 5.15
Reported-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/CAD=FV=VZPhzHU+Pet2m3L+Pqc7mOPfZC-f5p0OuNL79wNZPxRg@mail.gmail.com
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://patch.msgid.link/20260717143119.1815106-2-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/panel/panel-edp.c | 19 +++++++++++++------
1 file changed, 13 insertions(+), 6 deletions(-)
--- a/drivers/gpu/drm/panel/panel-edp.c
+++ b/drivers/gpu/drm/panel/panel-edp.c
@@ -831,6 +831,13 @@ exit:
return 0;
}
+static void panel_edp_put_adapter(void *_adap)
+{
+ struct i2c_adapter *adap = _adap;
+
+ put_device(&adap->dev);
+}
+
static int panel_edp_probe(struct device *dev, const struct panel_desc *desc,
struct drm_dp_aux *aux)
{
@@ -877,6 +884,11 @@ static int panel_edp_probe(struct device
if (!panel->ddc)
return -EPROBE_DEFER;
+
+ err = devm_add_action_or_reset(dev, panel_edp_put_adapter,
+ panel->ddc);
+ if (err)
+ return err;
} else if (aux) {
panel->ddc = &aux->ddc;
}
@@ -890,7 +902,7 @@ static int panel_edp_probe(struct device
err = drm_panel_of_backlight(&panel->base);
if (err)
- goto err_finished_ddc_init;
+ return err;
/*
* We use runtime PM for prepare / unprepare since those power the panel
@@ -937,9 +949,6 @@ static int panel_edp_probe(struct device
err_finished_pm_runtime:
pm_runtime_dont_use_autosuspend(dev);
pm_runtime_disable(dev);
-err_finished_ddc_init:
- if (panel->ddc && (!panel->aux || panel->ddc != &panel->aux->ddc))
- put_device(&panel->ddc->dev);
return err;
}
@@ -983,8 +992,6 @@ static void panel_edp_remove(struct devi
pm_runtime_dont_use_autosuspend(dev);
pm_runtime_disable(dev);
- if (panel->ddc && (!panel->aux || panel->ddc != &panel->aux->ddc))
- put_device(&panel->ddc->dev);
drm_edid_free(panel->drm_edid);
panel->drm_edid = NULL;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0261/1376] drm: fix race between partial drm_dev_register() failure and ioctl
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (259 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0260/1376] drm/panel-edp: " Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0262/1376] drm/i915: Guard against NULL driver_data in i915_pci_probe() Greg Kroah-Hartman
` (737 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Alexandre Courbot,
Lyude Paul, Deborah Brouwer, Danilo Krummrich
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danilo Krummrich <dakr@kernel.org>
commit eb197f7d60f00d0f5b1b3505dfc86a7e36045a3e upstream.
If drm_dev_register() fails after registering a minor (e.g. render minor
registered, primary minor fails), userspace could have opened the first
minor and entered a drm_dev_enter() critical section. Since the
unplugged flag was never set, the ioctl proceeds while the error path
tears down device resources.
Fix this by introducing drm_dev_synchronize_unplug(), which sets the
unplugged flag and waits for the SRCU barrier, ensuring all in-flight
drm_dev_enter() critical sections complete before cleanup proceeds; call
it on the error path of drm_dev_register().
Fixes: bee330f3d672 ("drm: Use srcu to protect drm_device.unplugged")
Cc: stable@vger.kernel.org
Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/all/20260620190648.2E9F61F000E9@smtp.kernel.org/
Reviewed-by: Alexandre Courbot <acourbot@nvidia.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Tested-by: Deborah Brouwer <deborah.brouwer@collabora.com>
Link: https://patch.msgid.link/20260628145406.2107056-17-dakr@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_drv.c | 34 +++++++++++++++++++++++++---------
1 file changed, 25 insertions(+), 9 deletions(-)
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -469,6 +469,22 @@ void drm_dev_exit(int idx)
}
EXPORT_SYMBOL(drm_dev_exit);
+/*
+ * Mark the device as unplugged and wait for any in-flight drm_dev_enter()
+ * critical sections to complete.
+ */
+static void drm_dev_synchronize_unplug(struct drm_device *dev)
+{
+ /*
+ * After synchronizing any critical read section is guaranteed to see
+ * the new value of ->unplugged, and any critical section which might
+ * still have seen the old value of ->unplugged is guaranteed to have
+ * finished.
+ */
+ dev->unplugged = true;
+ synchronize_srcu(&drm_unplug_srcu);
+}
+
/**
* drm_dev_unplug - unplug a DRM device
* @dev: DRM device
@@ -481,15 +497,7 @@ EXPORT_SYMBOL(drm_dev_exit);
*/
void drm_dev_unplug(struct drm_device *dev)
{
- /*
- * After synchronizing any critical read section is guaranteed to see
- * the new value of ->unplugged, and any critical section which might
- * still have seen the old value of ->unplugged is guaranteed to have
- * finished.
- */
- dev->unplugged = true;
- synchronize_srcu(&drm_unplug_srcu);
-
+ drm_dev_synchronize_unplug(dev);
drm_dev_unregister(dev);
/* Clear all CPU mappings pointing to this device */
@@ -931,6 +939,7 @@ int drm_dev_register(struct drm_device *
goto err_minors;
dev->registered = true;
+ dev->unplugged = false;
if (driver->load) {
ret = driver->load(dev, flags);
@@ -957,6 +966,13 @@ err_unload:
if (dev->driver->unload)
dev->driver->unload(dev);
err_minors:
+ /*
+ * If a minor was registered before the failure, userspace could have
+ * opened it and entered a drm_dev_enter() critical section. Ensure all
+ * such sections complete before we clean up.
+ */
+ drm_dev_synchronize_unplug(dev);
+
remove_compat_control_link(dev);
drm_minor_unregister(dev, DRM_MINOR_ACCEL);
drm_minor_unregister(dev, DRM_MINOR_PRIMARY);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0262/1376] drm/i915: Guard against NULL driver_data in i915_pci_probe()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (260 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0261/1376] drm: fix race between partial drm_dev_register() failure and ioctl Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0263/1376] drm/ssd130x: fix column and row end address in partial updates for ssd132x Greg Kroah-Hartman
` (736 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+db96c5ff032f4292a8dc,
Deepanshu Kartikey, Jani Nikula
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <kartikey406@gmail.com>
commit 3785d40831ba5601296283e0197e10e089392757 upstream.
pci_match_device() can return the dummy pci_device_id_any entry
when a device is force-bound via sysfs driver_override, in which
case ->driver_data is unset (NULL). i915_pci_probe() casts it to
struct intel_device_info * unconditionally and dereferences
intel_info->require_force_probe, causing a NULL-ptr-deref.
Reported-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=db96c5ff032f4292a8dc
Tested-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Link: https://patch.msgid.link/20260813064902.367504-1-kartikey406@gmail.com
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
(cherry picked from commit 2727922084672cc274ecea726ea00363c2893731)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/i915_pci.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/gpu/drm/i915/i915_pci.c
+++ b/drivers/gpu/drm/i915/i915_pci.c
@@ -961,6 +961,9 @@ static int i915_pci_probe(struct pci_dev
(struct intel_device_info *) ent->driver_data;
int err;
+ if (!intel_info)
+ return -ENODEV;
+
if (intel_info->require_force_probe && !id_forced(pdev->device)) {
dev_info(&pdev->dev,
"Your graphics device %04x is not properly supported by i915 in this\n"
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0263/1376] drm/ssd130x: fix column and row end address in partial updates for ssd132x
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (261 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0262/1376] drm/i915: Guard against NULL driver_data in i915_pci_probe() Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0264/1376] drm/sun4i: fix refcount leak in sun4i_backend_init_sat() Greg Kroah-Hartman
` (735 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Amit Barzilai,
Javier Martinez Canillas
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amit Barzilai <amit.barzilai22@gmail.com>
commit 99e9c09358195454ecd200b9c6aba6b7d209fad4 upstream.
On partial screen updates, SSD132X controllers expect to get the
rectangle addresses as arguments of the "Set Column Address" and "Set
Row Address" commands. Each command expects the start address and end
address of the row/column in absolute format, however the end
addresses were being sent in a relative format (relative to the start
address).
The relative end addresses work only when the start address is 0. In
those situations, there is no value difference between relative and
absolute addresses.
Fixes: fdd591e00a9c9 ("drm/ssd130x: Add support for the SSD132x OLED controller family")
Cc: stable@vger.kernel.org
Signed-off-by: Amit Barzilai <amit.barzilai22@gmail.com>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Link: https://patch.msgid.link/20260622122604.32500-2-amit.barzilai22@gmail.com
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/solomon/ssd130x.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/solomon/ssd130x.c
+++ b/drivers/gpu/drm/solomon/ssd130x.c
@@ -863,12 +863,13 @@ static int ssd132x_update_rect(struct ss
*/
/* Set column start and end */
- ret = ssd130x_write_cmd(ssd130x, 3, SSD132X_SET_COL_RANGE, x / segment_width, columns - 1);
+ ret = ssd130x_write_cmd(ssd130x, 3, SSD132X_SET_COL_RANGE, x / segment_width,
+ x / segment_width + columns - 1);
if (ret < 0)
return ret;
/* Set row start and end */
- ret = ssd130x_write_cmd(ssd130x, 3, SSD132X_SET_ROW_RANGE, y, rows - 1);
+ ret = ssd130x_write_cmd(ssd130x, 3, SSD132X_SET_ROW_RANGE, y, y + rows - 1);
if (ret < 0)
return ret;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0264/1376] drm/sun4i: fix refcount leak in sun4i_backend_init_sat()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (262 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0263/1376] drm/ssd130x: fix column and row end address in partial updates for ssd132x Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0265/1376] drm/ssd130x: fix column and row end address in partial updates in ssd133x Greg Kroah-Hartman
` (734 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Jernej Skrabec,
Chen-Yu Tsai
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
commit f7a56ff6240e6fd0cb36a3c0a911a1cd54789ce2 upstream.
When sun4i_backend_init_sat() calls reset_control_deassert() it
increments the deassert_count of the reset controller, and must
pair that with a reset_control_assert() call to decrement it.
In the error path where clk_prepare_enable() fails, the function
returns immediately without calling reset_control_assert(), leaking
the reference count. Other error paths, like the devm_clk_get()
failure, correctly jump to the err_assert_reset label which performs
the missing assert.
Fix the leak by using the existing err_assert_reset label in the
clk_prepare_enable error path instead of returning directly.
Cc: stable@vger.kernel.org
Fixes: 440d2c7b127a ("drm/sun4i: backend: Handle the SAT")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Link: https://patch.msgid.link/20260607030950.83636-1-vulab@iscas.ac.cn
Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/sun4i/sun4i_backend.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/sun4i/sun4i_backend.c
+++ b/drivers/gpu/drm/sun4i/sun4i_backend.c
@@ -685,7 +685,7 @@ static int sun4i_backend_init_sat(struct
ret = clk_prepare_enable(backend->sat_clk);
if (ret) {
dev_err(dev, "Couldn't enable the SAT clock\n");
- return ret;
+ goto err_assert_reset;
}
return 0;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0265/1376] drm/ssd130x: fix column and row end address in partial updates in ssd133x
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (263 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0264/1376] drm/sun4i: fix refcount leak in sun4i_backend_init_sat() Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0266/1376] drm/hibmc: Fix list of formats on the primary plane Greg Kroah-Hartman
` (733 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Amit Barzilai,
Javier Martinez Canillas
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amit Barzilai <amit.barzilai22@gmail.com>
commit b7fcb70162acd7f15ed20bc64a14c150db34256f upstream.
On partial screen updates, SSD133X controllers expect to get the
rectangle addresses as arguments of the "Set Column Address" and "Set
Row Address" commands. Each command expects the start address and end
address of the row/column in absolute format, however the end
addresses were being sent in a relative format (relative to the start
address).
The relative end addresses work only when the start address is 0. In
those situations, there is no value difference between relative and
absolute addresses.
Fixes: b4299c936d8fd ("drm/ssd130x: Add support for the SSD133x OLED controller family")
Cc: stable@vger.kernel.org
Signed-off-by: Amit Barzilai <amit.barzilai22@gmail.com>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Link: https://patch.msgid.link/20260622122604.32500-4-amit.barzilai22@gmail.com
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/solomon/ssd130x.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/solomon/ssd130x.c
+++ b/drivers/gpu/drm/solomon/ssd130x.c
@@ -915,12 +915,12 @@ static int ssd133x_update_rect(struct ss
*/
/* Set column start and end */
- ret = ssd130x_write_cmd(ssd130x, 3, SSD133X_SET_COL_RANGE, x, columns - 1);
+ ret = ssd130x_write_cmd(ssd130x, 3, SSD133X_SET_COL_RANGE, x, x + columns - 1);
if (ret < 0)
return ret;
/* Set row start and end */
- ret = ssd130x_write_cmd(ssd130x, 3, SSD133X_SET_ROW_RANGE, y, rows - 1);
+ ret = ssd130x_write_cmd(ssd130x, 3, SSD133X_SET_ROW_RANGE, y, y + rows - 1);
if (ret < 0)
return ret;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0266/1376] drm/hibmc: Fix list of formats on the primary plane
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (264 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0265/1376] drm/ssd130x: fix column and row end address in partial updates in ssd133x Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0267/1376] drm/hibmc: Use drm_atomic_helper_check_plane_state() Greg Kroah-Hartman
` (732 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Zimmermann, Yongbang Shi,
Rongrong Zou, Sean Paul, Xinliang Liu, Dmitry Baryshkov,
Baihan Li
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <tzimmermann@suse.de>
commit 0e682e136c466ae37c62f18099f591c096260ee0 upstream.
Remove all formats from the primary plane that are unsupported for
various reasons.
* Formats with alpha channel: planes should not announce alpha channels
unless they support transparency. There's no transparency support in
the primary plane's implementation.
* Formats with BGR order. The common format is in RGB channel order.
There's no BGR support in the primary plane's implementation.
* RGB888: atomic_update programs the format from cpp[0] * 8 / 16. For
RGB888's cpp value of 3 this returns 1.5; rounded to 1. Programming
the value of 1 to HIBMC_CRT_DISP_CTL_FORMAT sets up RGB565. Hence, the
output is distorted. This can be tested by booting with video=1024x768-24.
Removing all unsupported formats leaves XRGB8888 and RGB565. Both of
which are supported and work correctly.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: da52605eea8f ("drm/hisilicon/hibmc: Add support for display engine")
Reviewed-by: Yongbang Shi <shiyongbang@huawei.com>
Cc: Rongrong Zou <zourongrong@gmail.com>
Cc: Sean Paul <seanpaul@chromium.org>
Cc: Xinliang Liu <xinliang.liu@linaro.org>
Cc: Dmitry Baryshkov <lumag@kernel.org>
Cc: Yongbang Shi <shiyongbang@huawei.com>
Cc: Baihan Li <libaihan@huawei.com>
Cc: <stable@vger.kernel.org> # v4.10+
Link: https://patch.msgid.link/20260618123142.92298-3-tzimmermann@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
--- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c
+++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c
@@ -153,10 +153,8 @@ static void hibmc_plane_atomic_update(st
}
static const u32 channel_formats1[] = {
- DRM_FORMAT_RGB565, DRM_FORMAT_BGR565, DRM_FORMAT_RGB888,
- DRM_FORMAT_BGR888, DRM_FORMAT_XRGB8888, DRM_FORMAT_XBGR8888,
- DRM_FORMAT_RGBA8888, DRM_FORMAT_BGRA8888, DRM_FORMAT_ARGB8888,
- DRM_FORMAT_ABGR8888
+ DRM_FORMAT_XRGB8888,
+ DRM_FORMAT_RGB565,
};
static const struct drm_plane_funcs hibmc_plane_funcs = {
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0267/1376] drm/hibmc: Use drm_atomic_helper_check_plane_state()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (265 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0266/1376] drm/hibmc: Fix list of formats on the primary plane Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0268/1376] drm/amd/display: avoid divide-by-zero in __is_lut_linear() Greg Kroah-Hartman
` (731 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Zimmermann, Yongbang Shi,
Rongrong Zou, Sean Paul, Xinliang Liu, Dmitry Baryshkov,
Baihan Li
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <tzimmermann@suse.de>
commit 715c5db68bdbd4a524b79ebf20fb61e880fffea0 upstream.
Call drm_atomic_helper_check_plane_state() from the primary plane's
atomic-check helper and replace the custom implementation.
All plane's implementations of atomic_check should call the shared
_check_plane_state() helper first. It adjusts the plane state for
correct positioning, rotation and scaling of the plane. Do this
even if the plane's CRTC has been disabled by setting the parameter
can_update_disabled. The original code returned early in this case,
but it's safe to so and cleaner to have all plane state initialized.
As we don't set can_position, drm_atomic_helper_check_plane_state()'s
visibility check tests if the plane covers all of the CRTC. This is
a small change from the original code, which tested if the plane is
exactly the size of the CRTC. With the new test, the plane still has
to cover all of the CRTC, but can be larger than the CRTC's size. A
later patch can fully implement this feature in hibmc.
If the plane is disabled, the helper clears the visibility flag in the
plane state. On errors or if the plane is not visible, the atomic-check
helper can return early. Implement all this in hibmc and drop the custom
code that does some of it.
v2:
- extend the commit description (Yongbang)
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: da52605eea8f ("drm/hisilicon/hibmc: Add support for display engine")
Reviewed-by: Yongbang Shi <shiyongbang@huawei.com>
Cc: Rongrong Zou <zourongrong@gmail.com>
Cc: Sean Paul <seanpaul@chromium.org>
Cc: Xinliang Liu <xinliang.liu@linaro.org>
Cc: Dmitry Baryshkov <lumag@kernel.org>
Cc: Baihan Li <libaihan@huawei.com>
Cc: Yongbang Shi <shiyongbang@huawei.com>
Cc: <stable@vger.kernel.org> # v4.10+
Link: https://patch.msgid.link/20260618123142.92298-2-tzimmermann@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c | 50 ++++++++-----------------
1 file changed, 16 insertions(+), 34 deletions(-)
--- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c
+++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c
@@ -72,46 +72,28 @@ static int hibmc_get_best_clock_idx(cons
static int hibmc_plane_atomic_check(struct drm_plane *plane,
struct drm_atomic_state *state)
{
- struct drm_plane_state *new_plane_state = drm_atomic_get_new_plane_state(state,
- plane);
- struct drm_framebuffer *fb = new_plane_state->fb;
- struct drm_crtc *crtc = new_plane_state->crtc;
- struct drm_crtc_state *crtc_state;
- u32 src_w = new_plane_state->src_w >> 16;
- u32 src_h = new_plane_state->src_h >> 16;
-
- if (!crtc || !fb)
- return 0;
-
- crtc_state = drm_atomic_get_crtc_state(state, crtc);
- if (IS_ERR(crtc_state))
- return PTR_ERR(crtc_state);
-
- if (src_w != new_plane_state->crtc_w || src_h != new_plane_state->crtc_h) {
- drm_dbg_atomic(plane->dev, "scale not support\n");
- return -EINVAL;
- }
-
- if (new_plane_state->crtc_x < 0 || new_plane_state->crtc_y < 0) {
- drm_dbg_atomic(plane->dev, "crtc_x/y of drm_plane state is invalid\n");
- return -EINVAL;
- }
-
- if (!crtc_state->enable)
+ struct drm_plane_state *new_plane_state =
+ drm_atomic_get_new_plane_state(state, plane);
+ struct drm_crtc_state *new_crtc_state = NULL;
+ int ret;
+
+ if (new_plane_state->crtc)
+ new_crtc_state = drm_atomic_get_new_crtc_state(state, new_plane_state->crtc);
+
+ ret = drm_atomic_helper_check_plane_state(new_plane_state, new_crtc_state,
+ DRM_PLANE_NO_SCALING,
+ DRM_PLANE_NO_SCALING,
+ false, true);
+ if (ret)
+ return ret;
+ else if (!new_plane_state->visible)
return 0;
- if (new_plane_state->crtc_x + new_plane_state->crtc_w >
- crtc_state->adjusted_mode.hdisplay ||
- new_plane_state->crtc_y + new_plane_state->crtc_h >
- crtc_state->adjusted_mode.vdisplay) {
- drm_dbg_atomic(plane->dev, "visible portion of plane is invalid\n");
- return -EINVAL;
- }
-
if (new_plane_state->fb->pitches[0] % 128 != 0) {
drm_dbg_atomic(plane->dev, "wrong stride with 128-byte aligned\n");
return -EINVAL;
}
+
return 0;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0268/1376] drm/amd/display: avoid divide-by-zero in __is_lut_linear()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (266 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0267/1376] drm/hibmc: Use drm_atomic_helper_check_plane_state() Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0269/1376] drm/amd/display: validate plane degamma LUT size for private color prop Greg Kroah-Hartman
` (730 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Harry Wentland, Melissa Wen,
Daniel Wheeler, Alex Deucher
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harry Wentland <harry.wentland@amd.com>
commit 4f40873f8a4107df2b9c8e68c947c4fd0cd519d2 upstream.
__is_lut_linear() computes the expected value of each entry with
expected = i * MAX_DRM_LUT_VALUE / (size - 1);
If it is ever called with a single-entry LUT, size - 1 is zero and the
kernel takes a divide error (#DE). A LUT with fewer than two entries
cannot describe a linear mapping anyway, so return false early instead
of dividing by zero.
Fixes: 086247a4b2fb ("drm/amd/display: Use 4096 lut entries")
Cc: stable@vger.kernel.org
Signed-off-by: Harry Wentland <harry.wentland@amd.com>
Reviewed-by: Melissa Wen <mwen@igalia.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c
@@ -360,6 +360,12 @@ static bool __is_lut_linear(const struct
uint32_t expected;
int delta;
+ /* A LUT with fewer than two entries can't be interpolated and would
+ * divide by zero below (size - 1); it can't be treated as linear.
+ */
+ if (size < 2)
+ return false;
+
for (i = 0; i < size; i++) {
/* All color values should equal */
if ((lut[i].red != lut[i].green) || (lut[i].green != lut[i].blue))
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0269/1376] drm/amd/display: validate plane degamma LUT size for private color prop
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (267 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0268/1376] drm/amd/display: avoid divide-by-zero in __is_lut_linear() Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0270/1376] drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check Greg Kroah-Hartman
` (729 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Harry Wentland, Melissa Wen,
Daniel Wheeler, Alex Deucher
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harry Wentland <harry.wentland@amd.com>
commit e4c3ab59021e7c146a84b6671f0d530972bd58b4 upstream.
Unlike the CRTC degamma path, which is guarded by
amdgpu_dm_verify_lut_sizes(), the per-plane degamma LUT size was never
validated before use. __set_dm_plane_degamma() passed the user-supplied
size straight into __is_lut_linear() and, for a non-linear LUT, into
__set_input_tf() -> __drm_lut_to_dc_gamma(), the latter always iterating
MAX_COLOR_LUT_ENTRIES entries regardless of the actual LUT size.
A malformed AMD_PLANE_DEGAMMA_LUT blob (e.g. a single entry) could thus
trigger a divide-by-zero in __is_lut_linear() or an out-of-bounds read in
__drm_lut_to_dc_gamma(). Reject any plane degamma LUT whose size does not
match MAX_COLOR_LUT_ENTRIES, mirroring the invariant the code already
asserts a few lines below (and which the CRTC path enforces).
The AMD_PLANE_DEGAMMA_LUT property is only exposed on builds with
AMD_PRIVATE_COLOR defined.
Fixes: 980f8710075a ("drm/amd/display: add plane degamma TF and LUT support")
Cc: stable@vger.kernel.org
Signed-off-by: Harry Wentland <harry.wentland@amd.com>
Reviewed-by: Melissa Wen <mwen@igalia.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c
@@ -1149,6 +1149,13 @@ __set_dm_plane_degamma(struct drm_plane_
degamma_lut = __extract_blob_lut(dm_plane_state->degamma_lut,
°amma_size);
+ if (degamma_lut && degamma_size != MAX_COLOR_LUT_ENTRIES) {
+ drm_dbg(plane_state->state->dev,
+ "Invalid Plane Degamma LUT size. Should be %u but got %u.\n",
+ MAX_COLOR_LUT_ENTRIES, degamma_size);
+ return -EINVAL;
+ }
+
has_degamma_lut = degamma_lut &&
!__is_lut_linear(degamma_lut, degamma_size);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0270/1376] drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (268 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0269/1376] drm/amd/display: validate plane degamma LUT size for private color prop Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0271/1376] drm/gud: NUL-terminate TV mode names read from the device Greg Kroah-Hartman
` (728 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David (Ming Qiang) Wu, Leo Liu,
Alex Deucher
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David (Ming Qiang) Wu <David.Wu3@amd.com>
commit 4d7390530853eb7befda9cc786e4c86e8ad7ac9e upstream.
If the supplied msg[2] (num_buffers) is 0x3FFFFFFF, the expression
6 + num_buffers * 4 wraps to 2 and the bounds check passes, letting
the parser loop far past the end of the message BO. Triggering it
additionally requires a ~4GiB mapping so that msg[1] survives the
earlier "header does not fit in BO" check.
Rewrite the test in division form, which is overflow-free by
construction. Also update the message to reflect that msg is invalid.
Fixes: b193019860d6 ("drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg")
Fixes: 0a78f2bac142 ("drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg")
Cc: stable@vger.kernel.org
Signed-off-by: David (Ming Qiang) Wu <David.Wu3@amd.com>
Reviewed-by: Leo Liu <leo.liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 10 +++++++---
drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 10 +++++++---
2 files changed, 14 insertions(+), 6 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
@@ -1898,9 +1898,13 @@ static int vcn_v3_0_dec_msg(struct amdgp
len_dw = msg[1] / 4;
num_buffers = msg[2];
- /* Verify that all indices fit within the claimed length. Each index is 4 DWORDs */
- if (num_buffers > len_dw || 6 + num_buffers * 4 > len_dw) {
- DRM_ERROR("VCN message has too many buffers!\n");
+ /* Verify that all indices fit within the claimed length.
+ * There are 6 dwords in the header before the first buffer.
+ * Each buffer has 4 dwords. Any trailing dwords after the
+ * last buffer are ignored.
+ */
+ if (len_dw < 6 || num_buffers > (len_dw - 6) / 4) {
+ DRM_ERROR("Invalid VCN message!\n");
r = -EINVAL;
goto out;
}
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
@@ -1821,9 +1821,13 @@ static int vcn_v4_0_dec_msg(struct amdgp
len_dw = msg[1] / 4;
num_buffers = msg[2];
- /* Verify that all indices fit within the claimed length. Each index is 4 DWORDs */
- if (num_buffers > len_dw || 6 + num_buffers * 4 > len_dw) {
- DRM_ERROR("VCN message has too many buffers!\n");
+ /* Verify that all indices fit within the claimed length.
+ * There are 6 dwords in the header before the first buffer.
+ * Each buffer has 4 dwords. Any trailing dwords after the
+ * last buffer are ignored.
+ */
+ if (len_dw < 6 || num_buffers > (len_dw - 6) / 4) {
+ DRM_ERROR("Invalid VCN message!\n");
r = -EINVAL;
goto out;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0271/1376] drm/gud: NUL-terminate TV mode names read from the device
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (269 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0270/1376] drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0272/1376] drm/gud: validate TV mode names before creating enum property Greg Kroah-Hartman
` (727 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+916c888ba5f1a54c9526,
Deepanshu Kartikey, Ruben Wauters
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <kartikey406@gmail.com>
commit 500cb24cd61bad8a2747ddfc49b7034899c82d94 upstream.
gud_connector_add_tv_mode() reads a buffer of fixed-size mode names from
the USB device and passes pointers into it to
drm_mode_create_tv_properties_legacy(), which calls strlen() on each one.
Nothing guarantees the device NUL-terminates a name, so strlen() can run
past the end of a slot and, for the last mode, past the end of the
allocation.
Terminate each name at the end of its slot before use.
Fixes: 40e1a70b4aed ("drm: Add GUD USB Display driver")
Reported-by: syzbot+916c888ba5f1a54c9526@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=916c888ba5f1a54c9526
Tested-by: syzbot+916c888ba5f1a54c9526@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Acked-by: Ruben Wauters <rubenru09@aol.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Ruben Wauters <rubenru09@aol.com>
Link: https://patch.msgid.link/20260816085234.22053-1-kartikey406@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/gud/gud_connector.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/gud/gud_connector.c
+++ b/drivers/gpu/drm/gud/gud_connector.c
@@ -397,8 +397,13 @@ static int gud_connector_add_tv_mode(str
}
num_modes = ret / GUD_CONNECTOR_TV_MODE_NAME_LEN;
- for (i = 0; i < num_modes; i++)
- modes[i] = &buf[i * GUD_CONNECTOR_TV_MODE_NAME_LEN];
+ for (i = 0; i < num_modes; i++) {
+ char *mode = &buf[i * GUD_CONNECTOR_TV_MODE_NAME_LEN];
+
+ /* The device is not trusted to NUL-terminate the name */
+ mode[GUD_CONNECTOR_TV_MODE_NAME_LEN - 1] = '\0';
+ modes[i] = mode;
+ }
ret = drm_mode_create_tv_properties_legacy(connector->dev, num_modes, modes);
free:
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0272/1376] drm/gud: validate TV mode names before creating enum property
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (270 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0271/1376] drm/gud: NUL-terminate TV mode names read from the device Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0273/1376] drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value Greg Kroah-Hartman
` (726 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+9ae8e7884e451eaed5b4, Tao Yu,
Ruben Wauters
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tao Yu <tao1.yu@intel.com>
commit da1ea35fea67ad841f4ada28dd61b41be65e5437 upstream.
The GUD protocol returns TV mode names as fixed-size
GUD_CONNECTOR_TV_MODE_NAME_LEN entries and requires each name to be
NUL-terminated.
gud_connector_add_tv_mode() currently passes each fixed-size entry
directly to drm_mode_create_tv_properties_legacy(), which eventually
reaches drm_property_add_enum() and strlen(). If a device returns an
entry without a terminating NUL byte, strlen() reads past the end of
the slot and can run beyond the allocated buffer, triggering an
out-of-bounds read.
Validate that each returned TV mode name contains a NUL terminator
within its fixed-size slot before passing it to the DRM property code.
If a malformed entry is found, reject the device response with -EIO.
This fixes the out-of-bounds read without changing the handling of
valid devices, and avoids silently truncating malformed protocol data.
Reported-by: syzbot+9ae8e7884e451eaed5b4@syzkaller.appspotmail.com
Fixes: 40e1a70b4aed ("drm: Add GUD USB Display driver")
Signed-off-by: Tao Yu <tao1.yu@intel.com>
Reviewed-by: Ruben Wauters <rubenru09@aol.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Ruben Wauters <rubenru09@aol.com>
Link: https://patch.msgid.link/20260819072835.4074130-1-tao1.yu@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/gud/gud_connector.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/gud/gud_connector.c
+++ b/drivers/gpu/drm/gud/gud_connector.c
@@ -400,8 +400,11 @@ static int gud_connector_add_tv_mode(str
for (i = 0; i < num_modes; i++) {
char *mode = &buf[i * GUD_CONNECTOR_TV_MODE_NAME_LEN];
- /* The device is not trusted to NUL-terminate the name */
- mode[GUD_CONNECTOR_TV_MODE_NAME_LEN - 1] = '\0';
+ if (!memchr(mode, '\0', GUD_CONNECTOR_TV_MODE_NAME_LEN)) {
+ ret = -EIO;
+ goto free;
+ }
+
modes[i] = mode;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0273/1376] drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (271 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0272/1376] drm/gud: validate TV mode names before creating enum property Greg Kroah-Hartman
@ 2026-09-12 6:44 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0274/1376] drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used Greg Kroah-Hartman
` (725 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:44 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Mack, Kavan Smith,
Dmitry Baryshkov
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kavan Smith <kavansmith82@gmail.com>
commit 6cd33b6f4155efc20485929fd0b56bb704641db9 upstream.
MSM8916 runtime DSI commands still go through
msm_dsi_host_xfer_prepare(), which re-applies the link clock rate before
enabling the link clocks. That is fine in principle, but on DSI 6G the
requested byte clock rate often does not exactly match the DSI PHY PLL's
realizable rate. For example, the driver can request 56250000 Hz while the
PLL actually runs at 56246337 Hz.
Because the requested and actual rates differ slightly, every later
link_clk_set_rate() call is treated as a real clock change and re-locks
the PLL. On a video-mode panel without an internal timing generator, such
as samsung,s6d7aa0 / lsl080al03 on MSM8916, that live-clock glitch makes
the panel lose pixel lock and visibly corrupts scanout on each runtime DCS
command, including backlight writes.
Fix this by rounding the computed 6G byte clock rate up front, before it is
stored in msm_host->byte_clk_rate and reused by later transfers. Once the
host carries the PLL-achievable rate instead of the idealized one,
repeated link_clk_set_rate() calls become no-ops in the common clock
framework and no longer re-lock the PLL.
This keeps the normal transfer callback sequencing intact, preserves the
OPP vote path in link_clk_set_rate(), and matches the fix direction
suggested in the original 2018 discussion.
Reported-by: Daniel Mack <daniel@zonque.org>
Closes: https://lore.kernel.org/all/1a682c5b-7fc9-3aaa-120b-64b239a355a3@zonque.org/
Fixes: 6b16f05aa39f ("drm/msm/dsi: Split clk rate setting and enable")
Cc: stable@vger.kernel.org
Signed-off-by: Kavan Smith <kavansmith82@gmail.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/738234/
Link: https://lore.kernel.org/r/20260707013240.681012-1-kavansmith82@gmail.com
[DB: dropped extra chunk from the patch]
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/msm/dsi/dsi_host.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
+++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
@@ -621,12 +621,24 @@ static void dsi_calc_pclk(struct msm_dsi
int dsi_calc_clk_rate_6g(struct msm_dsi_host *msm_host, bool is_bonded_dsi)
{
+ long rounded_byte_clk_rate;
+
if (!msm_host->mode) {
pr_err("%s: mode not set\n", __func__);
return -EINVAL;
}
dsi_calc_pclk(msm_host, is_bonded_dsi);
+
+ rounded_byte_clk_rate = clk_round_rate(msm_host->byte_clk,
+ msm_host->byte_clk_rate);
+ if (rounded_byte_clk_rate < 0) {
+ pr_err("%s: failed to round byte clock rate, %ld\n",
+ __func__, rounded_byte_clk_rate);
+ return rounded_byte_clk_rate;
+ }
+
+ msm_host->byte_clk_rate = rounded_byte_clk_rate;
msm_host->esc_clk_rate = clk_get_rate(msm_host->esc_clk);
return 0;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0274/1376] drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (272 preceding siblings ...)
2026-09-12 6:44 ` [PATCH 6.12 0273/1376] drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0275/1376] drm/amdgpu: check thunderbolt before switcheroo registration Greg Kroah-Hartman
` (724 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thadeu Lima de Souza Cascardo,
Melissa Wen
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
commit 4d4be202165e832d74849b4a68e289a2a377039c upstream.
Commit 1c6ceeee6ebb ("drm/atomic: Fix memleak on ERESTARTSYS during
non-blocking commits") fixed a very similar issue when the event was
allocated by drm_atomic_helper_setup_commit() itself.
However, if the event is allocated in prepare_signaling(), it will also be
set to NULL in complete_signaling(), which prevents drm_crtc_commit from
being put in __drm_atomic_helper_crtc_destroy_state().
Dropping the reference when the event is set to NULL at
complete_signaling() fixes the leak.
The leak can be reproduced by sending a signal to the thread using
DRM_MODE_PAGE_FLIP_EVENT and using a sw_sync fence to cause the atomic
ioctl to block at drm_atomic_helper_wait_for_fences(). It happened both
with amdgpu and vkms.
Fixes: 24835e442f28 ("drm: reference count event->completion")
Cc: stable@vger.kernel.org
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
Reviewed-by: Melissa Wen <mwen@igalia.com>
Signed-off-by: Melissa Wen <mwen@igalia.com>
Link: https://patch.msgid.link/20260727-drm_crtc_atomic_commit_leak-v1-1-23d9948a9d7c@igalia.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_atomic_uapi.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/gpu/drm/drm_atomic_uapi.c
+++ b/drivers/gpu/drm/drm_atomic_uapi.c
@@ -1327,6 +1327,8 @@ static void complete_signaling(struct dr
* to prevent a double free in drm_atomic_state_clear.
*/
if (event && (event->base.fence || event->base.file_priv)) {
+ if (crtc_state->commit && crtc_state->commit->abort_completion)
+ drm_crtc_commit_put(crtc_state->commit);
drm_event_cancel_free(dev, &event->base);
crtc_state->event = NULL;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0275/1376] drm/amdgpu: check thunderbolt before switcheroo registration
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (273 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0274/1376] drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0276/1376] drm/amdgpu: fix autosuspend cleanup during removal Greg Kroah-Hartman
` (723 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yang Wang, Kenneth Feng,
Alex Deucher
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Wang <kevinyang.wang@amd.com>
commit 8587d48d694da5aca580f92461658ec14470592b upstream.
Introduce a helper to consolidate the vga_switcheroo registration condition
used by the init and fini paths.
Keep the explicit pci_is_thunderbolt_attached() check, as dev_is_removable()
does not provide equivalent coverage for Thunderbolt-attached GPUs.
This ensures such devices remain excluded from switcheroo registration while
preserving the existing PX and Apple gmux handling.
Cc: stable@vger.kernel.org
Signed-off-by: Yang Wang <kevinyang.wang@amd.com>
Reviewed-by: Kenneth Feng <kenneth.feng@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -4168,6 +4168,14 @@ static void amdgpu_device_set_mcbp(struc
DRM_INFO("MCBP is enabled\n");
}
+static bool
+amdgpu_device_should_register_switcheroo(struct amdgpu_device *adev, bool px)
+{
+ return !pci_is_thunderbolt_attached(adev->pdev) &&
+ (px || (!dev_is_removable(&adev->pdev->dev) &&
+ apple_gmux_detect(NULL, NULL)));
+}
+
/**
* amdgpu_device_init - initialize the driver
*
@@ -4628,8 +4636,7 @@ fence_driver_init:
px = amdgpu_device_supports_px(ddev);
- if (px || (!dev_is_removable(&adev->pdev->dev) &&
- apple_gmux_detect(NULL, NULL)))
+ if (amdgpu_device_should_register_switcheroo(adev, px))
vga_switcheroo_register_client(adev->pdev,
&amdgpu_switcheroo_ops, px);
@@ -4798,8 +4805,7 @@ void amdgpu_device_fini_sw(struct amdgpu
px = amdgpu_device_supports_px(adev_to_drm(adev));
- if (px || (!dev_is_removable(&adev->pdev->dev) &&
- apple_gmux_detect(NULL, NULL)))
+ if (amdgpu_device_should_register_switcheroo(adev, px))
vga_switcheroo_unregister_client(adev->pdev);
if (px)
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0276/1376] drm/amdgpu: fix autosuspend cleanup during removal
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (274 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0275/1376] drm/amdgpu: check thunderbolt before switcheroo registration Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0277/1376] drm/amdgpu: Skip accessing psp rum time db for APUs Greg Kroah-Hartman
` (722 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li,
Mario Limonciello (AMD), Mario Limonciello, Alex Deucher
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
commit ef5fcf2a6c320676bf8be2dadac93d9023b468b7 upstream.
amdgpu_pci_probe() calls pm_runtime_use_autosuspend(), but
amdgpu_pci_remove() does not call the matching
pm_runtime_dont_use_autosuspend().
If the autosuspend delay is set to a negative value while autosuspend
is enabled, the runtime PM core increments usage_count to prevent
runtime suspend. Without calling pm_runtime_dont_use_autosuspend()
during teardown, this reference is not dropped and usage_count remains
unbalanced.
The documentation for pm_runtime_use_autosuspend() also notes that it
is important to undo it with pm_runtime_dont_use_autosuspend() at
driver exit time, unless runtime PM was initially enabled with
devm_pm_runtime_enable().
Add the missing pm_runtime_dont_use_autosuspend() call to the remove
path.
This issue was found by manual code inspection.
Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Link: https://patch.msgid.link/20260808120934.2813010-1-lgs201920130244@gmail.com
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -2461,6 +2461,7 @@ amdgpu_pci_remove(struct pci_dev *pdev)
if (adev->pm.rpm_mode != AMDGPU_RUNPM_NONE) {
pm_runtime_get_sync(dev->dev);
pm_runtime_forbid(dev->dev);
+ pm_runtime_dont_use_autosuspend(dev->dev);
}
amdgpu_driver_unload_kms(dev);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0277/1376] drm/amdgpu: Skip accessing psp rum time db for APUs
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (275 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0276/1376] drm/amdgpu: fix autosuspend cleanup during removal Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0278/1376] drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT Greg Kroah-Hartman
` (721 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kanala Ramalingeswara Reddy,
Alex Deucher
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kanala Ramalingeswara Reddy <Kanala.RamalingeswaraReddy@amd.com>
commit a26301203a196a991527f7b1ab884d4dd0e7c95e upstream.
Psp runtime DB is for dGPUs only.
Signed-off-by: Kanala Ramalingeswara Reddy <Kanala.RamalingeswaraReddy@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit dce8195027f146467c9378efb2bb1b0859cb735e)
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
@@ -358,6 +358,12 @@ static bool psp_get_runtime_db_entry(str
bool ret = false;
int i;
+ /*
+ * Runtime DB is for dGPUs only.
+ */
+ if (adev->flags & AMD_IS_APU)
+ return false;
+
if (amdgpu_ip_version(adev, MP0_HWIP, 0) == IP_VERSION(13, 0, 6) ||
amdgpu_ip_version(adev, MP0_HWIP, 0) == IP_VERSION(13, 0, 14))
return false;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0278/1376] drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (276 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0277/1376] drm/amdgpu: Skip accessing psp rum time db for APUs Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0279/1376] drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore Greg Kroah-Hartman
` (720 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sunil Khatri, Alex Deucher
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sunil Khatri <sunil.khatri@amd.com>
commit d6e16df7df4d2c39e2b04b355d0434fb90e2d62c upstream.
For different address types the variable PAGE_SHIFT might
not work well and it's better to use the GPU specific one
Signed-off-by: Sunil Khatri <sunil.khatri@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 3494b77d10375e0f9ab784e9b20763339844b55b)
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -1933,7 +1933,7 @@ int amdgpu_vm_bo_clear_mappings(struct a
after->start = eaddr + 1;
after->last = tmp->last;
after->offset = tmp->offset;
- after->offset += (after->start - tmp->start) << PAGE_SHIFT;
+ after->offset += (after->start - tmp->start) << AMDGPU_GPU_PAGE_SHIFT;
after->flags = tmp->flags;
after->bo_va = tmp->bo_va;
list_add(&after->list, &tmp->bo_va->invalids);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0279/1376] drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (277 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0278/1376] drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0280/1376] drm/amdkfd: Reject zero-sized AQL queue allocations after size halving Greg Kroah-Hartman
` (719 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Vladimir Marioukhine, Alex Deucher
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Marioukhine <Vladimir.Marioukhine@amd.com>
commit 6aa530642f95d5c48aa336416f94a35e7949b647 upstream.
Both create_queue_cpsch() and create_queue_nocpsch() unconditionally
call mqd_mgr->restore_mqd() when a CRIU restore is in progress
(qd != NULL), with no NULL guard. On any system where restore_mqd is
not implemented for the given queue type, a user holding
CAP_CHECKPOINT_RESTORE can trigger a kernel NULL pointer dereference
and panic the machine by issuing KFD_IOC_CRIU_OP_RESTORE with a
crafted queue restore object. Note that checkpoint_mqd is likewise
unimplemented on GFX12, so no legitimate CRIU image can reach this
path — only a hand-crafted restore payload.
Add a NULL guard for restore_mqd immediately after mqd_mgr is
resolved, unwinding via the existing error labels and returning
-EOPNOTSUPP if the callback is not implemented. This mirrors the
existing checkpoint_mqd guard in checkpoint_mqd().
Fixes: 48f0bdf4e38e ("drm/amdkfd: Added MQD manager files for GFX12.")
Cc: stable@vger.kernel.org
Signed-off-by: Vladimir Marioukhine <Vladimir.Marioukhine@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -617,6 +617,11 @@ static int create_queue_nocpsch(struct d
mqd_mgr = dqm->mqd_mgrs[get_mqd_type_from_queue_type(
q->properties.type)];
+ if (qd && !mqd_mgr->restore_mqd) {
+ pr_debug("restore_mqd not implemented for this GPU\n");
+ retval = -EOPNOTSUPP;
+ goto deallocate_vmid;
+ }
if (q->properties.type == KFD_QUEUE_TYPE_COMPUTE) {
retval = allocate_hqd(dqm, q);
if (retval)
@@ -1967,6 +1972,11 @@ static int create_queue_cpsch(struct dev
mqd_mgr = dqm->mqd_mgrs[get_mqd_type_from_queue_type(
q->properties.type)];
+ if (qd && !mqd_mgr->restore_mqd) {
+ pr_debug("restore_mqd not implemented for this GPU\n");
+ retval = -EOPNOTSUPP;
+ goto out_deallocate_doorbell;
+ }
if (q->properties.type == KFD_QUEUE_TYPE_SDMA ||
q->properties.type == KFD_QUEUE_TYPE_SDMA_XGMI)
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0280/1376] drm/amdkfd: Reject zero-sized AQL queue allocations after size halving
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (278 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0279/1376] drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0281/1376] drm/nouveau: unsubscribe the channel-kill event before the fence context Greg Kroah-Hartman
` (718 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sunday Clement, Alex Deucher,
Alex Deucher
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sunday Clement <Sunday.Clement@amd.com>
commit 40ba09e11188d1b7f79d51fc28aca5ea45e0c138 upstream.
KFD_IOC_ALLOC_MEMORY_OF_GPU with flag
KFD_IOC_ALLOC_MEM_FLAGS_AQL_QUEUE_MEM and size=1 triggers the AQL
wraparound workaround (size >>= 1), reducing size to 0. The resulting
zero passes through PAGE_ALIGN(0) = 0 without validation, bypassing the
per-process VRAM quota check in reserve_mem_limit()
(vram_used + 0 > vram_available is always false).
The fix adds post-halving zero-size validation in the primary
allocation path (amdgpu_amdkfd_gpuvm.c). The check happens after size
halving but before reserve_mem_limit(), and uses err_alignment_size
error path to properly clean up the allocated kgd_mem structure and
mutex.
Cc: stable@vger.kernel.org
Signed-off-by: Sunday Clement <Sunday.Clement@amd.com>
Reviewed-by: Alex Deucher <Alexander.Deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 7 +++++++
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 3 ++-
2 files changed, 9 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
@@ -1797,6 +1797,12 @@ int amdgpu_amdkfd_gpuvm_alloc_memory_of_
size >>= 1;
aligned_size = PAGE_ALIGN(size);
+ /* reject AQL queue with size < 2 */
+ if (!aligned_size) {
+ ret = -EINVAL;
+ goto err_alignment_size;
+ }
+
(*mem)->alloc_flags = flags;
amdgpu_sync_create(&(*mem)->sync);
@@ -1888,6 +1894,7 @@ err_bo_create:
amdgpu_amdkfd_unreserve_mem_limit(adev, aligned_size, flags, xcp_id);
err_reserve_limit:
amdgpu_sync_free(&(*mem)->sync);
+err_alignment_size:
mutex_destroy(&(*mem)->lock);
if (gobj)
drm_gem_object_put(gobj);
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -1167,7 +1167,8 @@ static int kfd_ioctl_alloc_memory_of_gpu
if (flags & KFD_IOC_ALLOC_MEM_FLAGS_AQL_QUEUE_MEM)
size >>= 1;
- atomic64_add(PAGE_ALIGN(size), &pdd->vram_usage);
+ size = PAGE_ALIGN(size);
+ atomic64_add(size, &pdd->vram_usage);
}
mutex_unlock(&p->mutex);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0281/1376] drm/nouveau: unsubscribe the channel-kill event before the fence context
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (279 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0280/1376] drm/amdkfd: Reject zero-sized AQL queue allocations after size halving Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0282/1376] drm/nouveau: Use write-combined maps for coherent Greg Kroah-Hartman
` (717 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marek Czernohous, Lyude Paul
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Czernohous <marek@czernohous.de>
commit 511585987d27d8cb668acebd399fc4deda23404c upstream.
nouveau_channel_del() tears the fence context down first and only drops
the channel-kill subscription later, in the middle of the nvif object
teardown:
if (chan->fence)
nouveau_fence(chan->cli->drm)->context_del(chan);
...
nvif_object_dtor(&chan->vram);
nvif_event_dtor(&chan->kill);
The subscribed handler is nouveau_channel_killed(), which calls
nouveau_channel_kill() and from there nouveau_fence_context_kill() on
chan->fence. A kill event delivered in that window takes fctx->lock and
walks fctx->pending on a fence context that context_del() has already
freed.
Nothing reaches this below Fermi today, because the subscription is
gated on FERMI_CHANNEL_GPFIFO and nothing kills a channel there. On
Fermi and newer the window is real but narrow, since a kill has to land
exactly while the channel is being destroyed. That is reason enough on
its own, which is why this carries a Fixes: tag. The last patch in this
series subscribes Tesla channels as well; nothing kills those today, so
it does not widen the exposure now, but it is the groundwork for a
recovery path that would, and the ordering is better fixed before that
lands than alongside it.
Drop the subscription before anything it depends on is torn down.
Fixes: ea13e5abf807 ("drm/nouveau: signal pending fences when channel has been killed")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Marek Czernohous <marek@czernohous.de>
Fixes: ea13e5abf807 ("drm/nouveau: signal pending fences when channel has been killed")
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patch.msgid.link/20260812231330.705425-2-mczernohous@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nouveau_chan.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/nouveau/nouveau_chan.c
+++ b/drivers/gpu/drm/nouveau/nouveau_chan.c
@@ -90,6 +90,14 @@ nouveau_channel_del(struct nouveau_chann
{
struct nouveau_channel *chan = *pchan;
if (chan) {
+ /*
+ * Drop the kill-event subscription first. Its handler
+ * dereferences chan->fence, which the fence context teardown
+ * below frees, so leaving it armed across the teardown leaves
+ * a window for a use-after-free.
+ */
+ nvif_event_dtor(&chan->kill);
+
if (chan->fence)
nouveau_fence(chan->cli->drm)->context_del(chan);
@@ -100,7 +108,6 @@ nouveau_channel_del(struct nouveau_chann
nvif_object_dtor(&chan->nvsw);
nvif_object_dtor(&chan->gart);
nvif_object_dtor(&chan->vram);
- nvif_event_dtor(&chan->kill);
nvif_object_dtor(&chan->user);
nvif_mem_dtor(&chan->mem_userd);
nvif_object_dtor(&chan->push.ctxdma);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0282/1376] drm/nouveau: Use write-combined maps for coherent
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (280 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0281/1376] drm/nouveau: unsubscribe the channel-kill event before the fence context Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0283/1376] drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op Greg Kroah-Hartman
` (716 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Faith Ekstrand, Aaron Kling,
Danilo Krummrich
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Faith Ekstrand <faith.ekstrand@collabora.com>
commit 774b73428e6eabb4f0382aeeb76e569c7b106a29 upstream.
On Tegra devices, uncached maps translate to device memory, causing
unaligned accesses by userspace resulting in a SIGBUS. Instead, use
write-combined maps to ensure proper access.
This would also affect discrete cards on any Arm device. It was
determined that discrete cards regardless of cpu arch should use
write-combined maps for coherent anyways. Thus this change is made for
all gpu types.
Cc: stable@vger.kernel.org
Signed-off-by: Faith Ekstrand <faith.ekstrand@collabora.com>
Co-developed-by: Aaron Kling <webgeek1234@gmail.com>
Signed-off-by: Aaron Kling <webgeek1234@gmail.com>
Fixes: 1b4ea4c5980f ("drm/ttm: set the tt caching state at creation time")
Link: https://patch.msgid.link/20260821-tegra-coherent-wc-v2-1-2b1ddb67bf18@gmail.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nouveau_sgdma.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/drivers/gpu/drm/nouveau/nouveau_sgdma.c
+++ b/drivers/gpu/drm/nouveau/nouveau_sgdma.c
@@ -72,9 +72,7 @@ nouveau_sgdma_create_ttm(struct ttm_buff
struct nouveau_sgdma_be *nvbe;
enum ttm_caching caching;
- if (nvbo->force_coherent)
- caching = ttm_uncached;
- else if (drm->agp.bridge)
+ if (nvbo->force_coherent || drm->agp.bridge)
caching = ttm_write_combined;
else
caching = ttm_cached;
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0283/1376] drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (281 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0282/1376] drm/nouveau: Use write-combined maps for coherent Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0284/1376] drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE Greg Kroah-Hartman
` (715 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Zhenhao Wan, Lyude Paul,
Danilo Krummrich
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhenhao Wan <whi4ed0g@gmail.com>
commit 412a6ceb56d501ef2f8202e26ab4b5d4dfbca566 upstream.
Each bind_job_op is zeroed by kzalloc_obj() in bind_job_op_from_uop(),
and the OP_MAP_SPARSE case in nouveau_uvmm_bind_job_submit() only creates
a region, so op->ops stays NULL for a successfully processed sparse map.
If a later op in the same job fails, the reverse unwind loop revisits that
op and calls drm_gpuva_ops_free(&uvmm->base, op->ops) unconditionally.
drm_gpuva_ops_free() dereferences its argument right away
(list_for_each_entry_safe on &ops->list), so a NULL op->ops oopses. The
path is reachable by any render-node fd holder, since NOUVEAU_VM_BIND is
DRM_RENDER_ALLOW.
Guard the free with IS_ERR_OR_NULL(), as nouveau_uvmm_bind_job_cleanup()
already does for the identical free.
Fixes: b88baab82871 ("drm/nouveau: implement new VM_BIND uAPI")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Signed-off-by: Zhenhao Wan <whi4ed0g@gmail.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Link: https://patch.msgid.link/20260811-nouveau-uvmm-vmbind-fixes-v2-1-aaee4b395d04@gmail.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nouveau_uvmm.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/nouveau/nouveau_uvmm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_uvmm.c
@@ -1418,7 +1418,8 @@ unwind:
break;
}
- drm_gpuva_ops_free(&uvmm->base, op->ops);
+ if (!IS_ERR_OR_NULL(op->ops))
+ drm_gpuva_ops_free(&uvmm->base, op->ops);
op->ops = NULL;
op->reg = NULL;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0284/1376] drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (282 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0283/1376] drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0285/1376] drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE Greg Kroah-Hartman
` (714 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Zhenhao Wan, Lyude Paul,
Danilo Krummrich
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhenhao Wan <whi4ed0g@gmail.com>
commit ccf930812f23b8259ef64fd3394d53b093e4651a upstream.
In nouveau_uvmm_bind_job_submit()'s OP_UNMAP_SPARSE arm, op->reg is set
from nouveau_uvma_region_find(), which only looks the region up and takes
no reference; a region's sole reference is its membership in
uvmm->region_mt. Two failure paths leave op->reg set: the -ENOENT check
when the region is busy, and the drm_gpuvm_sm_unmap_ops_create() failure.
The sibling nouveau_uvmm_sm_unmap_prepare() failure just below clears
op->reg; these two do not.
unwind_continue steps back one op, so the failing op is skipped by the
unwind loop and its op->reg stays set. nouveau_uvmm_bind_job_cleanup()
then enters its if (op->reg) branch and calls nouveau_uvma_region_remove()
and nouveau_uvma_region_put() on it, dropping the tree's sole reference
and freeing a region this job never created. The comment above the
cleanup loop documents the broken invariant: op->reg must be NULL on
submit failure.
This frees a live region on an unrelated failure, reachable single-job
when drm_gpuvm_sm_unmap_ops_create() returns -ENOMEM; if another job owns
the same region, its cleanup then removes and puts the freed region, a
use-after-free. Clear op->reg on both failure paths.
Fixes: b88baab82871 ("drm/nouveau: implement new VM_BIND uAPI")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Signed-off-by: Zhenhao Wan <whi4ed0g@gmail.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Link: https://patch.msgid.link/20260811-nouveau-uvmm-vmbind-fixes-v2-2-aaee4b395d04@gmail.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nouveau_uvmm.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/gpu/drm/nouveau/nouveau_uvmm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_uvmm.c
@@ -1251,6 +1251,7 @@ nouveau_uvmm_bind_job_submit(struct nouv
op->va.range);
if (!op->reg || op->reg->dirty) {
ret = -ENOENT;
+ op->reg = NULL;
goto unwind_continue;
}
@@ -1259,6 +1260,7 @@ nouveau_uvmm_bind_job_submit(struct nouv
op->va.range);
if (IS_ERR(op->ops)) {
ret = PTR_ERR(op->ops);
+ op->reg = NULL;
goto unwind_continue;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0285/1376] drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (283 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0284/1376] drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0286/1376] afs: Fix leak of ungot volume Greg Kroah-Hartman
` (713 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Zhenhao Wan, Lyude Paul,
Danilo Krummrich
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhenhao Wan <whi4ed0g@gmail.com>
commit 38a62306c4266bcb3cd89e33c7111ee33096ebb3 upstream.
A successful OP_UNMAP_SPARSE marks its region dirty with
nouveau_uvma_region_dirty() and defers the teardown to
nouveau_uvmm_bind_job_cleanup(); it does not remove the region from
uvmm->region_mt.
If a later op in the job fails, the unwind path never clears reg->dirty
(set in one place, cleared nowhere) and sets op->reg = NULL, so cleanup
skips the teardown. The region is left in the tree with dirty set and its
completion never signalled. Later binds over that range then fail
permanently -- -ENOENT or -EINVAL from the dirty checks, or an unkillable
wait_for_completion() in bind_validate_region() -- for the lifetime of
the uvmm.
Clear reg->dirty when the unwind reverts the sparse unmap, restoring the
region to the state it was found in.
Fixes: b88baab82871 ("drm/nouveau: implement new VM_BIND uAPI")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Signed-off-by: Zhenhao Wan <whi4ed0g@gmail.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Link: https://patch.msgid.link/20260811-nouveau-uvmm-vmbind-fixes-v2-3-aaee4b395d04@gmail.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nouveau_uvmm.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/nouveau/nouveau_uvmm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_uvmm.c
@@ -1404,6 +1404,7 @@ unwind:
op->va.range);
break;
case OP_UNMAP_SPARSE:
+ op->reg->dirty = false;
__nouveau_uvma_region_insert(uvmm, op->reg);
nouveau_uvmm_sm_unmap_prepare_unwind(uvmm, &op->new,
op->ops);
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0286/1376] afs: Fix leak of ungot volume
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (284 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0285/1376] drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0287/1376] xhci: fix lost bounce buffers on TDs spanning several ring segments Greg Kroah-Hartman
` (712 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Howells, Marc Dionne,
Deepakkumar Karn, linux-afs, Christian Brauner (Amutable),
Alexander Martyniuk
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
commit d672c276f685a540ed2b2a8bafaed4650a89022c upstream.
Fix afs_lookup_volume_rcu() so that it doesn't leak a dying volume if
afs_try_get_volume() fails.
Fixes: 32222f09782f ("afs: Apply server breaks to mmap'd files in the call processor")
Closes: https://sashiko.dev/#/patchset/20260609081738.770127-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://patch.msgid.link/20260622090856.2746629-17-dhowells@redhat.com
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Deepakkumar Karn <dkarn@redhat.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Alexander Martyniuk <alexevgmart@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/afs/callback.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/afs/callback.c
+++ b/fs/afs/callback.c
@@ -138,6 +138,7 @@ static struct afs_volume *afs_lookup_vol
if (volume && afs_try_get_volume(volume, afs_volume_trace_get_callback))
break;
+ volume = NULL;
if (!need_seqretry(&cell->volume_lock, seq))
break;
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0287/1376] xhci: fix lost bounce buffers on TDs spanning several ring segments
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (285 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0286/1376] afs: Fix leak of ungot volume Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0288/1376] ksmbd: zero pipe read compound padding Greg Kroah-Hartman
` (711 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michal Pecio, Arthur Gautier,
Mathias Nyman
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arthur Gautier <baloo@superbaloo.net>
commit ff44dfb03a293bf30e31f98772a1dd316a6071d1 upstream.
When a TD reaches a link TRB with data that is not aligned to the
endpoint's wMaxPacketSize, xhci_align_td() stages the unalignable tail
through the bounce buffer of the ring segment holding that link TRB.
xhci_unmap_td_bounce_buffer() later unmaps it and, for IN transfers,
copies the data back into the URB's buffer.
The enqueue path records the segment that was bounced in td->bounce_seg,
under the assumption that a TD never spans more than two ring segments.
That assumption does not hold: a TD large enough to span three or more
segments crosses several link TRBs and can be bounced at each of them.
Only the last one survives in td->bounce_seg, so every earlier bounce
buffer is neither copied back nor DMA unmapped.
The URB still completes with actual_length equal to the requested length
and no error, so the transfer looks successful while a wMaxPacketSize
sized hole in the destination buffer silently keeps its previous
contents. It also leaks a DMA mapping per dropped bounce.
Any sufficiently large and fragmented bulk transfer can hit this. It was
found with a USB mass storage device behind xHCI backing a dm-verity
target with 512 byte hash blocks, where the stale data is detected rather
than silently consumed. The device enumerates as SuperSpeed, so
wMaxPacketSize is 1024, while dm-bufio issues one 512 byte bio per hash
block. verity_prefetch_io() makes the block layer merge hundreds of them
into a single request of up to 512 scatterlist entries of 512 bytes each.
At 256 TRBs per ring segment such a TD spans three segments, and every
segment boundary falls on an odd multiple of 512, i.e. unaligned to
wMaxPacketSize. dm-bufio then caches a hash block holding stale data and
dm-verity declares the metadata block corrupted:
device-mapper: verity: 8:2: metadata block 10850 is corrupted
A reproducer running this under qemu is available at
https://github.com/baloo/xhci-verity
The bounce state (bounce_buf, bounce_dma, bounce_len, bounce_offs)
already lives on the ring segment, so there is nothing extra to track.
Keep recording the last bounced segment in td->bounce_seg and, on
completion, walk the segments from td->start_seg up to it, unmapping
every segment that still has a pending bounce.
Stopping at td->bounce_seg rather than td->end_seg matters: a bounce
implies the TD continues past that segment's link TRB, so bounce_seg is
always strictly before end_seg, and a later TD may already have started
in end_seg and been bounced there. Walking that far would copy a foreign
bounce buffer into this URB and unmap it twice. It also keeps the walk
correct if a TD ever wraps the whole ring so that end_seg == start_seg.
[mn: Add ring->num_segs check to prevent unlikely infinite for loop.]
Fixes: f9c589e142d0 ("xhci: TD-fragment, align the unsplittable case with a bounce buffer")
Cc: stable@vger.kernel.org
Suggested-by: Michal Pecio <michal.pecio@gmail.com>
Signed-off-by: Arthur Gautier <baloo@superbaloo.net>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://patch.msgid.link/20260831090448.95644-4-mathias.nyman@linux.intel.com
[Michal: solved context conflict due to xhci_td_cleanup() type]
Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-ring.c | 32 ++++++++++++++++++++++++--------
1 file changed, 24 insertions(+), 8 deletions(-)
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -781,21 +781,18 @@ static void xhci_giveback_urb_in_irq(str
usb_hcd_giveback_urb(hcd, urb, status);
}
-static void xhci_unmap_td_bounce_buffer(struct xhci_hcd *xhci,
- struct xhci_ring *ring, struct xhci_td *td)
+static void xhci_unmap_one_bounce_buffer(struct xhci_hcd *xhci,
+ struct xhci_ring *ring, struct xhci_td *td,
+ struct xhci_segment *seg)
{
struct device *dev = xhci_to_hcd(xhci)->self.sysdev;
- struct xhci_segment *seg = td->bounce_seg;
struct urb *urb = td->urb;
size_t len;
- if (!ring || !seg || !urb)
- return;
-
if (usb_urb_dir_out(urb)) {
dma_unmap_single(dev, seg->bounce_dma, ring->bounce_buf_len,
DMA_TO_DEVICE);
- return;
+ goto done;
}
dma_unmap_single(dev, seg->bounce_dma, ring->bounce_buf_len,
@@ -811,10 +808,29 @@ static void xhci_unmap_td_bounce_buffer(
memcpy(urb->transfer_buffer + seg->bounce_offs, seg->bounce_buf,
seg->bounce_len);
}
+done:
seg->bounce_len = 0;
seg->bounce_offs = 0;
}
+static void xhci_unmap_td_bounce_buffer(struct xhci_hcd *xhci,
+ struct xhci_ring *ring, struct xhci_td *td)
+{
+ struct xhci_segment *seg;
+ int i = 0;
+
+ if (!td->bounce_seg || !ring || !td->urb)
+ return;
+
+ /* td->bounce_seg is the last one bounced, unmap them all */
+ for (seg = td->start_seg; i++ < ring->num_segs; seg = seg->next) {
+ if (seg->bounce_len)
+ xhci_unmap_one_bounce_buffer(xhci, ring, td, seg);
+ if (seg == td->bounce_seg)
+ break;
+ }
+}
+
static int xhci_td_cleanup(struct xhci_hcd *xhci, struct xhci_td *td,
struct xhci_ring *ep_ring, int status)
{
@@ -3725,7 +3741,7 @@ int xhci_queue_bulk_tx(struct xhci_hcd *
&trb_buff_len,
ring->enq_seg)) {
send_addr = ring->enq_seg->bounce_dma;
- /* assuming TD won't span 2 segs */
+ /* TD bounced at least, and last on this seg */
td->bounce_seg = ring->enq_seg;
}
}
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0288/1376] ksmbd: zero pipe read compound padding
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (286 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0287/1376] xhci: fix lost bounce buffers on TDs spanning several ring segments Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0289/1376] net/mlx5e: xsk: Fix unlocked writing to ICOSQ Greg Kroah-Hartman
` (710 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cheryl Babcock, Namjae Jeon
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <linkinjeon@kernel.org>
commit 73f860489e3be2245598d1819226304fc5b87291 upstream.
Compound response handling extends the last response iov to an eight-byte
boundary.
smb2_read_pipe() allocates only the payload size, so the alignment padding
can expose up to seven bytes of uninitialized kernel heap memory.
Allocate the aligned size and clear the unused tail before pinning the
response buffer.
Fixes: e2b76ab8b5c9 ("ksmbd: add support for read compound")
Reported-by: Cheryl Babcock <cheryl@renat.io>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/smb2pdu.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -6739,13 +6739,18 @@ static noinline int smb2_read_pipe(struc
}
aux_payload_buf =
- kvmalloc(rpc_resp->payload_sz, KSMBD_DEFAULT_GFP);
+ kvmalloc(ALIGN(rpc_resp->payload_sz, 8),
+ KSMBD_DEFAULT_GFP);
if (!aux_payload_buf) {
err = -ENOMEM;
goto out;
}
memcpy(aux_payload_buf, rpc_resp->payload, rpc_resp->payload_sz);
+ if (rpc_resp->payload_sz & 7)
+ memset(aux_payload_buf + rpc_resp->payload_sz, 0,
+ ALIGN(rpc_resp->payload_sz, 8) -
+ rpc_resp->payload_sz);
nbytes = rpc_resp->payload_sz;
err = ksmbd_iov_pin_rsp_read(work, (void *)rsp,
^ permalink raw reply [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0289/1376] net/mlx5e: xsk: Fix unlocked writing to ICOSQ
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (287 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0288/1376] ksmbd: zero pipe read compound padding Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0290/1376] nvmet-auth: Synchronize timeout work during SQ teardown Greg Kroah-Hartman
` (709 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul Saab, Dragos Tatulea,
Tariq Toukan, Simon Horman, Jakub Kicinski, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dragos Tatulea <dtatulea@nvidia.com>
commit c326f9c68921e2f14dfcecb2f6b4216313d50248 upstream.
During napi poll, when the affinity changes and there's still XSK work
to be done, we trigger an ICOSQ interrupt on the new CPU. However, this
triggering on the ICOSQ is done unprotected.
There are 2 such races:
A) mlx5e_trigger_irq() is called while mlx5e_xsk_alloc_rx_mpwqe() is
running from a different CPU due to affinity change. This can happen
because IRQ triggering is done after napi_complete_done(). At this point
the NAPI can be scheduled on a different CPU. Like this:
CPU A (old affinity, NAPI tail) CPU B (new affinity, fresh NAPI)
------------------------------- --------------------------------
napi_complete_done() clears SCHED
mlx5e_cq_arm(...)
napi_schedule_prep() sets SCHED
mlx5e_napi_poll()
mlx5e_xsk_alloc_rx_mpwqe()
mlx5e_icosq_sync_lock() // noop
memcpy 640 B UMR body
advance sq->pc by 10
mlx5e_trigger_irq(&c->icosq)
wqe_info[pi] = {NOP, 1}
mlx5e_post_nop() advances sq->pc
B) mlx5e_trigger_irq() is called on the ICOSQ when
mlx5e_trigger_napi_icosq() is running.
The obvious fix would be to lock the ICOSQ. But ICOSQ has an optimized
locking scheme that doesn't work for this scenario. Kick the async ICOSQ
instead which is always locked.
This issue was noticed in the wild with the following splat:
netdevice: ge-0-0-1: Bad OP in ICOSQ CQE: 0xd
WARNING: drivers/net/ethernet/mellanox/mlx5/core/en_rx.c:826 [...]
[...]
Call Trace:
<IRQ>
mlx5e_napi_poll+0x11d/0x7f0 [mlx5_core]
__napi_poll+0x30/0x200
? skb_defer_free_flush+0x9c/0xc0
net_rx_action+0x2fe/0x3f0
handle_softirqs+0xd8/0x340
__irq_exit_rcu+0xbc/0xe0
common_interrupt+0x85/0xa0
</IRQ>
<TASK>
asm_common_interrupt+0x26/0x40
[...]
---[ end trace 0000000000000000 ]---
mlx5_core 0000:08:00.0 ge-0-0-1: Error cqe on cqn 0x548, ci 0x2022, qn 0x8f4,
opcode 0xd, syndrome 0x2, vendor syndrome 0x68
00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000030: 00 00 00 00 01 00 68 02 01 00 08 f4 de 14 59 d2
WQE DUMP: WQ size 16384 WQ cur size 0, WQE index 0x1e14, len: 64
00000000: 00 00 00 01 d9 ed 80 02 00 00 00 01 d9 ed 90 02
00000010: 00 00 00 01 d9 ed a0 02 00 00 00 01 d9 ed b0 02
00000020: 00 00 00 01 d9 ed c0 02 00 00 00 01 d9 ed d0 02
00000030: 00 00 00 01 d9 ed e0 02 00 00 00 01 d9 ed f0 02
mlx5_core 0000:08:00.0 ge-0-0-1: Error cqe on cqn 0x548, ci 0x2023, qn 0x8f4,
opcode 0xd, syndrome 0x5, vendor syndrome 0xf9
00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000030: 00 00 00 00 01 00 f9 05 01 00 08 f4 de 15 cf d2
[ Backport to 6.18.y and older: upstream commit calls
mlx5e_trigger_napi_async_icosq(), which was introduced by commit
0da1dba72616 ("net/mlx5e: XSK, Fix unintended ICOSQ change") and is not
present here. In these trees mlx5e_trigger_napi_icosq() is the
equivalent helper: it takes c->async_icosq_lock and triggers
c->async_icosq, which is unconditionally opened, activated, polled and
armed for every channel. Race B does not apply, as it concerns the
sync-ICOSQ variant of mlx5e_trigger_napi_icosq() that only exists
upstream, and mlx5e_icosq_sync_lock() in the race A diagram has no
equivalent here. ]
Fixes: db05815b36cb ("net/mlx5e: Add XSK zero-copy support")
Reported-by: Paul Saab <ps@mu.org>
Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260513064613.334602-1-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c
index 5873fde65c2e3..e9912369e361b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c
@@ -245,7 +245,7 @@ int mlx5e_napi_poll(struct napi_struct *napi, int budget)
}
if (unlikely(aff_change && busy_xsk)) {
- mlx5e_trigger_irq(&c->icosq);
+ mlx5e_trigger_napi_icosq(c);
ch_stats->force_irq++;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0290/1376] nvmet-auth: Synchronize timeout work during SQ teardown
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (288 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0289/1376] net/mlx5e: xsk: Fix unlocked writing to ICOSQ Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0291/1376] mm/damon/vaddr: drop last same folio access check optimization Greg Kroah-Hartman
` (708 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kazuki Hanai, Sagi Grimberg,
Christoph Hellwig, Keith Busch, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kazuki Hanai <hnkz.64@gmail.com>
[ Upstream commit eaa948c0e19b1bb2d93262207bca0c3d19cc3406 ]
nvmet_auth_sq_free() cancels auth_expired_work with
cancel_delayed_work(). If the work has already started, cancellation does
not wait for the callback. Transport teardown can consequently free or
reuse the queue containing struct nvmet_sq while
nvmet_auth_expired_work() still accesses that SQ.
Add a teardown-specific helper that synchronously drains the delayed work
before freeing authentication state, and use it from nvmet_sq_destroy().
Keep the non-synchronous helper for in-band authentication state cleanup,
where the SQ owner remains alive.
Fixes: 1a70200f404a ("nvmet-auth: expire authentication sessions")
Cc: stable@vger.kernel.org
Signed-off-by: Kazuki Hanai <hnkz.64@gmail.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Kazuki Hanai <hnkz.64@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/auth.c | 6 ++++++
drivers/nvme/target/core.c | 2 +-
drivers/nvme/target/nvmet.h | 2 ++
3 files changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/nvme/target/auth.c b/drivers/nvme/target/auth.c
index b47d675232d2d..38d1ced21f532 100644
--- a/drivers/nvme/target/auth.c
+++ b/drivers/nvme/target/auth.c
@@ -241,6 +241,12 @@ void nvmet_auth_sq_free(struct nvmet_sq *sq)
sq->dhchap_skey = NULL;
}
+void nvmet_auth_sq_destroy(struct nvmet_sq *sq)
+{
+ cancel_delayed_work_sync(&sq->auth_expired_work);
+ nvmet_auth_sq_free(sq);
+}
+
void nvmet_destroy_auth(struct nvmet_ctrl *ctrl)
{
ctrl->shash_id = 0;
diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index ce85b57832603..6267c6d576db9 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -812,7 +812,7 @@ void nvmet_sq_destroy(struct nvmet_sq *sq)
wait_for_completion(&sq->confirm_done);
wait_for_completion(&sq->free_done);
percpu_ref_exit(&sq->ref);
- nvmet_auth_sq_free(sq);
+ nvmet_auth_sq_destroy(sq);
/*
* we must reference the ctrl again after waiting for inflight IO
diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h
index 17a63bc7d80c0..25bba2d097626 100644
--- a/drivers/nvme/target/nvmet.h
+++ b/drivers/nvme/target/nvmet.h
@@ -737,6 +737,7 @@ u8 nvmet_setup_auth(struct nvmet_ctrl *ctrl);
void nvmet_auth_sq_init(struct nvmet_sq *sq);
void nvmet_destroy_auth(struct nvmet_ctrl *ctrl);
void nvmet_auth_sq_free(struct nvmet_sq *sq);
+void nvmet_auth_sq_destroy(struct nvmet_sq *sq);
int nvmet_setup_dhgroup(struct nvmet_ctrl *ctrl, u8 dhgroup_id);
bool nvmet_check_auth_status(struct nvmet_req *req);
int nvmet_auth_host_hash(struct nvmet_req *req, u8 *response,
@@ -761,6 +762,7 @@ static inline void nvmet_auth_sq_init(struct nvmet_sq *sq)
}
static inline void nvmet_destroy_auth(struct nvmet_ctrl *ctrl) {};
static inline void nvmet_auth_sq_free(struct nvmet_sq *sq) {};
+static inline void nvmet_auth_sq_destroy(struct nvmet_sq *sq) {};
static inline bool nvmet_check_auth_status(struct nvmet_req *req)
{
return true;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0291/1376] mm/damon/vaddr: drop last same folio access check optimization
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (289 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0290/1376] nvmet-auth: Synchronize timeout work during SQ teardown Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0292/1376] mm/damon/ops-common: use nr_accesses moving sum for quota score Greg Kroah-Hartman
` (707 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, SJ Park, Andrew Morton, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
[ Upstream commit 831846078caa14b7d00b2ccca8b8fe522afe3204 ]
The optimization can race when multiple kdamonds are running. Meanwhile,
the impact of the optimization is quite doubtful. Just remove it.
The user impact of the issue should be quite trivial. After all, the race
can happen only when the user intentionally setup DAMON in the way. Even
if it happens, it would be rare and only degrade the best-effort
monitoring results. No critical consequences like kernel panic or memory
corruption happen.
The race possibility was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260715031002.108504-4-sj@kernel.org
Link: https://lore.kernel.org/20260621204050.10993-1-sj@kernel.org [1]
Fixes: 3f49584b262c ("mm/damon: implement primitives for the virtual memory address spaces")
Signed-off-by: SJ Park <sj@kernel.org>
Cc: <stable@vger.kernel.org> # 5.15.x
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/vaddr.c | 34 ++++++----------------------------
1 file changed, 6 insertions(+), 28 deletions(-)
diff --git a/mm/damon/vaddr.c b/mm/damon/vaddr.c
index 52e5c244bd021..089ee23e07de7 100644
--- a/mm/damon/vaddr.c
+++ b/mm/damon/vaddr.c
@@ -429,8 +429,6 @@ static void damon_va_prepare_access_checks(struct damon_ctx *ctx)
}
struct damon_young_walk_private {
- /* size of the folio for the access checked virtual memory address */
- unsigned long *folio_sz;
bool young;
};
@@ -466,7 +464,6 @@ static int damon_young_pmd_entry(pmd_t *pmd, unsigned long addr,
mmu_notifier_test_young(walk->mm,
addr))
priv->young = true;
- *priv->folio_sz = HPAGE_PMD_SIZE;
folio_put(folio);
huge_out:
spin_unlock(ptl);
@@ -488,7 +485,6 @@ static int damon_young_pmd_entry(pmd_t *pmd, unsigned long addr,
if (pte_young(ptent) || !folio_test_idle(folio) ||
mmu_notifier_test_young(walk->mm, addr))
priv->young = true;
- *priv->folio_sz = folio_size(folio);
folio_put(folio);
out:
pte_unmap_unlock(pte, ptl);
@@ -517,7 +513,6 @@ static int damon_young_hugetlb_entry(pte_t *pte, unsigned long hmask,
if (pte_young(entry) || !folio_test_idle(folio) ||
mmu_notifier_test_young(walk->mm, addr))
priv->young = true;
- *priv->folio_sz = huge_page_size(h);
folio_put(folio);
@@ -535,11 +530,9 @@ static const struct mm_walk_ops damon_young_ops = {
.walk_lock = PGWALK_RDLOCK,
};
-static bool damon_va_young(struct mm_struct *mm, unsigned long addr,
- unsigned long *folio_sz)
+static bool damon_va_young(struct mm_struct *mm, unsigned long addr)
{
struct damon_young_walk_private arg = {
- .folio_sz = folio_sz,
.young = false,
};
@@ -556,29 +549,18 @@ static bool damon_va_young(struct mm_struct *mm, unsigned long addr,
* r the region to be checked
*/
static void __damon_va_check_access(struct mm_struct *mm,
- struct damon_region *r, bool same_target,
+ struct damon_region *r,
struct damon_attrs *attrs)
{
- static unsigned long last_addr;
- static unsigned long last_folio_sz = PAGE_SIZE;
- static bool last_accessed;
+ bool accessed;
if (!mm) {
damon_update_region_access_rate(r, false, attrs);
return;
}
- /* If the region is in the last checked page, reuse the result */
- if (same_target && (ALIGN_DOWN(last_addr, last_folio_sz) ==
- ALIGN_DOWN(r->sampling_addr, last_folio_sz))) {
- damon_update_region_access_rate(r, last_accessed, attrs);
- return;
- }
-
- last_accessed = damon_va_young(mm, r->sampling_addr, &last_folio_sz);
- damon_update_region_access_rate(r, last_accessed, attrs);
-
- last_addr = r->sampling_addr;
+ accessed = damon_va_young(mm, r->sampling_addr);
+ damon_update_region_access_rate(r, accessed, attrs);
}
static unsigned int damon_va_check_accesses(struct damon_ctx *ctx)
@@ -587,16 +569,12 @@ static unsigned int damon_va_check_accesses(struct damon_ctx *ctx)
struct mm_struct *mm;
struct damon_region *r;
unsigned int max_nr_accesses = 0;
- bool same_target;
damon_for_each_target(t, ctx) {
mm = damon_get_mm(t);
- same_target = false;
damon_for_each_region(r, t) {
- __damon_va_check_access(mm, r, same_target,
- &ctx->attrs);
+ __damon_va_check_access(mm, r, &ctx->attrs);
max_nr_accesses = max(r->nr_accesses, max_nr_accesses);
- same_target = true;
}
if (mm)
mmput(mm);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0292/1376] mm/damon/ops-common: use nr_accesses moving sum for quota score
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (290 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0291/1376] mm/damon/vaddr: drop last same folio access check optimization Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0293/1376] mm/damon/paddr: drop last same folio access check reuse optimization Greg Kroah-Hartman
` (706 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, SJ Park, Andrew Morton, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
[ Upstream commit 6c25083f7ae7e2660d766169e5b4d3e96010503f ]
Since commit 42f994b71404 ("mm/damon/core: implement scheme-specific apply
interval"), DAMOS scheme can be applied at any time. At that time,
nr_accesses may not be fully aggregated. But the quota prioritization
score is calculated using the not fully aggregated count. As a result,
the performance of DAMOS could be degraded. Fix by using
damon_nr_accesses_mvsum() instead.
The user impact of the issue is suboptimum DAMOS performance under certain
setups. Nonetheless, the bug was there from the beginning of the setup
availability. In other words, the suboptimum performance is the baseline
of the setup and hence it didn't cause regression. Also the extent of the
suboptimality was not big enough to be found from users and testers.
Still, this is a clear bug that is better to be fixed, and can be easily
fixed.
Link: https://lore.kernel.org/20260719161136.90191-1-sj@kernel.org
Fixes: 42f994b71404 ("mm/damon/core: implement scheme-specific apply interval")
Signed-off-by: SJ Park <sj@kernel.org>
Cc: <stable@vger.kernel.org> # 6.7.x
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/ops-common.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/mm/damon/ops-common.c b/mm/damon/ops-common.c
index 4b5638bbe0614..dea662a6747ce 100644
--- a/mm/damon/ops-common.c
+++ b/mm/damon/ops-common.c
@@ -80,8 +80,9 @@ int damon_hot_score(struct damon_ctx *c, struct damon_region *r,
unsigned int age_weight = s->quota.weight_age;
int hotness;
- freq_subscore = r->nr_accesses * DAMON_MAX_SUBSCORE /
- damon_max_nr_accesses(&c->attrs);
+ freq_subscore = mult_frac(r->nr_accesses_bp / 10000,
+ DAMON_MAX_SUBSCORE,
+ damon_max_nr_accesses(&c->attrs));
age_in_sec = (unsigned long)r->age * c->attrs.aggr_interval / 1000000;
for (age_in_log = 0; age_in_log < DAMON_MAX_AGE_IN_LOG && age_in_sec;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0293/1376] mm/damon/paddr: drop last same folio access check reuse optimization
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (291 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0292/1376] mm/damon/ops-common: use nr_accesses moving sum for quota score Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0294/1376] mm/damon/vaddr-kunit: check region count in three_regions test Greg Kroah-Hartman
` (705 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, SJ Park, Andrew Morton, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
[ Upstream commit f23f0aa62b2f32c2b12f95959fc4603ef81678b2 ]
It can race when multiple kdamonds are being used. The problem from the
race is doubtful, but the gain from the optimization is also doubtful.
Simply drop the optimization in favor of code simplicity.
The user impact is doubtfully trivial. After all, this kind of
interference can happen only by intentional user setup. Even if it
happens, it will be rare, and the consequence is degradation of the
best-effort monitoring results. No critical consequences like kernel
panic or memory corruption happen.
The race was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260715031002.108504-5-sj@kernel.org
Link: https://lore.kernel.org/20260621204050.10993-1-sj@kernel.org [1]
Fixes: a28397beb55b ("mm/damon: implement primitives for physical address space monitoring")
Signed-off-by: SJ Park <sj@kernel.org>
Cc: <stable@vger.kernel.org> # 5.16.x
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/paddr.c | 20 ++++----------------
1 file changed, 4 insertions(+), 16 deletions(-)
diff --git a/mm/damon/paddr.c b/mm/damon/paddr.c
index d4a4d51750f5f..a6b1de97b1e8a 100644
--- a/mm/damon/paddr.c
+++ b/mm/damon/paddr.c
@@ -148,7 +148,7 @@ static bool damon_folio_young(struct folio *folio)
return accessed;
}
-static bool damon_pa_young(unsigned long paddr, unsigned long *folio_sz)
+static bool damon_pa_young(unsigned long paddr)
{
struct folio *folio = damon_get_folio(PHYS_PFN(paddr));
bool accessed;
@@ -157,7 +157,6 @@ static bool damon_pa_young(unsigned long paddr, unsigned long *folio_sz)
return false;
accessed = damon_folio_young(folio);
- *folio_sz = folio_size(folio);
folio_put(folio);
return accessed;
}
@@ -165,21 +164,10 @@ static bool damon_pa_young(unsigned long paddr, unsigned long *folio_sz)
static void __damon_pa_check_access(struct damon_region *r,
struct damon_attrs *attrs)
{
- static unsigned long last_addr;
- static unsigned long last_folio_sz = PAGE_SIZE;
- static bool last_accessed;
-
- /* If the region is in the last checked page, reuse the result */
- if (ALIGN_DOWN(last_addr, last_folio_sz) ==
- ALIGN_DOWN(r->sampling_addr, last_folio_sz)) {
- damon_update_region_access_rate(r, last_accessed, attrs);
- return;
- }
-
- last_accessed = damon_pa_young(r->sampling_addr, &last_folio_sz);
- damon_update_region_access_rate(r, last_accessed, attrs);
+ bool accessed;
- last_addr = r->sampling_addr;
+ accessed = damon_pa_young(r->sampling_addr);
+ damon_update_region_access_rate(r, accessed, attrs);
}
static unsigned int damon_pa_check_accesses(struct damon_ctx *ctx)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0294/1376] mm/damon/vaddr-kunit: check region count in three_regions test
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (292 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0293/1376] mm/damon/paddr: drop last same folio access check reuse optimization Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0295/1376] mm/damon/core-kunit: handle region split failure in filter_out() Greg Kroah-Hartman
` (704 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, SJ Park, Brendan Higgins,
Andrew Morton, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
[ Upstream commit 5fea07e460874c8c7cf00f728efbe22abc62c8d8 ]
damon_do_test_apply_three_regions() iterates regions after
damon_set_regions() call assuming the function would succeed at setting
the number of regions the same to the expected one. It might have failed.
In this case, __nth_region_of() in the iteration could return NULL and
NULL dereference can happen in the test.
The consequent user impact (NULL dereference) is quite bad. The realistic
user impact would be limited, though. It would affect only test run
setups.
Fix it by testing if the number of regions was also changed as expected
and exit early for the failure.
The issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260718001442.87129-4-sj@kernel.org
Link: https://lore.kernel.org/20260713144757.39740-1-sj@kernel.org [1]
Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests")
Signed-off-by: SJ Park <sj@kernel.org>
Cc: Brendan Higgins <brendan.higgins@linux.dev>
Cc: <stable@vger.kernel.org> # 5.15.x
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/tests/vaddr-kunit.h | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/mm/damon/tests/vaddr-kunit.h b/mm/damon/tests/vaddr-kunit.h
index ed2845d9f9a95..9eead9882dcce 100644
--- a/mm/damon/tests/vaddr-kunit.h
+++ b/mm/damon/tests/vaddr-kunit.h
@@ -149,12 +149,17 @@ static void damon_do_test_apply_three_regions(struct kunit *test,
damon_set_regions(t, three_regions, 3);
+ KUNIT_EXPECT_EQ(test, damon_nr_regions(t), nr_expected / 2);
+ if (damon_nr_regions(t) != nr_expected / 2)
+ goto out;
+
for (i = 0; i < nr_expected / 2; i++) {
r = __nth_region_of(t, i);
KUNIT_EXPECT_EQ(test, r->ar.start, expected[i * 2]);
KUNIT_EXPECT_EQ(test, r->ar.end, expected[i * 2 + 1]);
}
+out:
damon_destroy_target(t);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0295/1376] mm/damon/core-kunit: handle region split failure in filter_out()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (293 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0294/1376] mm/damon/vaddr-kunit: check region count in three_regions test Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0296/1376] mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of() Greg Kroah-Hartman
` (703 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, SJ Park, Brendan Higgins,
Andrew Morton, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
[ Upstream commit 3423fe70395210e2f0cd795270292f6a27cd57b5 ]
damos_test_filter_out() test checks if damos_filter_match() of an address
filter splits the region as expected under a given condition. But, the
test continued regardless of the split successes. As a result, the later
part of the test could dereference invalid pointers that returned from
damon_next_region(). Further, it could corrupt memory from
damon_destroy_region().
The consequent user impact (memory corruption) is quite bad. The
realistic user impact would be limited, though. It would affect only test
run setups.
Fix it by exiting early for the number of regions test failure.
The issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260718001442.87129-5-sj@kernel.org
Link: https://lore.kernel.org/20260714142352.100478-1-sj@kernel.org [1]
Fixes: 26713c890875 ("mm/damon/core-test: add a unit test for __damos_filter_out()")
Signed-off-by: SJ Park <sj@kernel.org>
Cc: Brendan Higgins <brendan.higgins@linux.dev>
Cc: <stable@vger.kernel.org> # 6.6.x
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/tests/core-kunit.h | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h
index 998c7585dada2..04abee653ca27 100644
--- a/mm/damon/tests/core-kunit.h
+++ b/mm/damon/tests/core-kunit.h
@@ -557,6 +557,8 @@ static void damos_test_filter_out(struct kunit *test)
KUNIT_EXPECT_EQ(test, r->ar.start, DAMON_MIN_REGION * 1);
KUNIT_EXPECT_EQ(test, r->ar.end, DAMON_MIN_REGION * 2);
KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 2);
+ if (damon_nr_regions(t) != 2)
+ goto out;
r2 = damon_next_region(r);
KUNIT_EXPECT_EQ(test, r2->ar.start, DAMON_MIN_REGION * 2);
KUNIT_EXPECT_EQ(test, r2->ar.end, DAMON_MIN_REGION * 4);
@@ -570,11 +572,14 @@ static void damos_test_filter_out(struct kunit *test)
KUNIT_EXPECT_EQ(test, r->ar.start, DAMON_MIN_REGION * 2);
KUNIT_EXPECT_EQ(test, r->ar.end, DAMON_MIN_REGION * 6);
KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 2);
+ if (damon_nr_regions(t) != 2)
+ goto out;
r2 = damon_next_region(r);
KUNIT_EXPECT_EQ(test, r2->ar.start, DAMON_MIN_REGION * 6);
KUNIT_EXPECT_EQ(test, r2->ar.end, DAMON_MIN_REGION * 8);
damon_destroy_region(r2, t);
+out:
damon_free_target(t);
damos_free_filter(f);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0296/1376] mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (294 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0295/1376] mm/damon/core-kunit: handle region split failure in filter_out() Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0297/1376] of: unittest: Fix memory leak in unittest_data_add() Greg Kroah-Hartman
` (702 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, SJ Park, Andrew Morton, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
[ Upstream commit b640708929aa956235866bf7717d89018c661083 ]
KUNIT_EXPECT_EQ() does not abort the execution of test code when the
expectation is not met. But damon_test_merge_regions_of() code after its
initial KUNIT_EXPECT_EQ() call assumes the expectation is met. It does a
per-region test with a hard-coded number of regions that is correct only
if the expectation was met. As a result, __nth_region_of() could return
NULL, and the test code can dereference NULL pointers. Fix the issue by
catching the expectation failure and skip the per-region tests.
The user impact on realistic setups should be negligible, as it is a unit
test.
The issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260715031002.108504-3-sj@kernel.org
Link: https://lore.kernel.org/20260710144937.26981-1-sj@kernel.org [1]
Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests")
Signed-off-by: SJ Park <sj@kernel.org>
Cc: <stable@vger.kernel.org> # 5.15.x
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/tests/core-kunit.h | 3 +++
1 file changed, 3 insertions(+)
diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h
index 04abee653ca27..1039d2f793b9b 100644
--- a/mm/damon/tests/core-kunit.h
+++ b/mm/damon/tests/core-kunit.h
@@ -269,11 +269,14 @@ static void damon_test_merge_regions_of(struct kunit *test)
damon_merge_regions_of(t, 9, 9999);
/* 0-112, 114-130, 130-156, 156-170 */
KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 5u);
+ if (damon_nr_regions(t) != 5)
+ goto out;
for (i = 0; i < 5; i++) {
r = __nth_region_of(t, i);
KUNIT_EXPECT_EQ(test, r->ar.start, saddrs[i]);
KUNIT_EXPECT_EQ(test, r->ar.end, eaddrs[i]);
}
+out:
damon_free_target(t);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0297/1376] of: unittest: Fix memory leak in unittest_data_add()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (295 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0296/1376] mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of() Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0298/1376] ksmbd: fix use-after-free in smb2_open during durable reconnect Greg Kroah-Hartman
` (701 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rob Herring, Jianhao Xu, Zilin Guan,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <zilin@seu.edu.cn>
[ Upstream commit 235a1eb8d2dcc49a6cf0a5ee1aa85544a5d0054b ]
In unittest_data_add(), if of_resolve_phandles() fails, the allocated
unittest_data is not freed, leading to a memory leak.
Fix this by using scope-based cleanup helper __free(kfree) for automatic
resource cleanup. This ensures unittest_data is automatically freed when
it goes out of scope in error paths.
For the success path, use retain_and_null_ptr() to transfer ownership
of the memory to the device tree and prevent double freeing.
Fixes: 2eb46da2a760 ("of/selftest: Use the resolver to fixup phandles")
Suggested-by: Rob Herring <robh@kernel.org>
Co-developed-by: Jianhao Xu <jianhao.xu@seu.edu.cn>
Signed-off-by: Jianhao Xu <jianhao.xu@seu.edu.cn>
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Link: https://patch.msgid.link/20251231114915.234638-1-zilin@seu.edu.cn
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/of/unittest.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
index 96d2e7b63db38..bed3f7538aa99 100644
--- a/drivers/of/unittest.c
+++ b/drivers/of/unittest.c
@@ -1871,7 +1871,6 @@ static void attach_node_and_children(struct device_node *np)
*/
static int __init unittest_data_add(void)
{
- void *unittest_data;
void *unittest_data_align;
struct device_node *unittest_data_node = NULL, *np;
/*
@@ -1890,7 +1889,7 @@ static int __init unittest_data_add(void)
}
/* creating copy */
- unittest_data = kmalloc(size + FDT_ALIGN_SIZE, GFP_KERNEL);
+ void *unittest_data __free(kfree) = kmalloc(size + FDT_ALIGN_SIZE, GFP_KERNEL);
if (!unittest_data)
return -ENOMEM;
@@ -1900,12 +1899,10 @@ static int __init unittest_data_add(void)
ret = of_fdt_unflatten_tree(unittest_data_align, NULL, &unittest_data_node);
if (!ret) {
pr_warn("%s: unflatten testcases tree failed\n", __func__);
- kfree(unittest_data);
return -ENODATA;
}
if (!unittest_data_node) {
pr_warn("%s: testcases tree is empty\n", __func__);
- kfree(unittest_data);
return -ENODATA;
}
@@ -1924,7 +1921,6 @@ static int __init unittest_data_add(void)
/* attach the sub-tree to live tree */
if (!of_root) {
pr_warn("%s: no live tree to attach sub-tree\n", __func__);
- kfree(unittest_data);
rc = -ENODEV;
goto unlock;
}
@@ -1945,6 +1941,8 @@ static int __init unittest_data_add(void)
EXPECT_END(KERN_INFO,
"Duplicate name in testcase-data, renamed to \"duplicate-name#1\"");
+ retain_and_null_ptr(unittest_data);
+
unlock:
of_overlay_mutex_unlock();
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0298/1376] ksmbd: fix use-after-free in smb2_open during durable reconnect
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (296 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0297/1376] of: unittest: Fix memory leak in unittest_data_add() Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0299/1376] ksmbd: fix durable reconnect error path file lifetime Greg Kroah-Hartman
` (700 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Akif, Namjae Jeon, Steve French,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akif <akif.sait111@gmail.com>
[ Upstream commit 1baff47b81f94f9231c91236aa511420d0e266b9 ]
In smb2_open, the call to ksmbd_put_durable_fd(fp) drops the reference
to the durable file descriptor early during the durable reconnect
process. If an error occurs subsequently (eg, ksmbd_iov_pin_rsp fails)
or a scavenger accesses the file, it leads to a use-after-free when
accessing fp properties (eg fp->create_time).
Move the single put to the end of the function below err_out2 so fp
stays valid until smb2_open returns.
Fixes: c8efcc786146 ("ksmbd: add support for durable handles v1/v2")
Signed-off-by: Akif <akif.sait111@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/server/smb2pdu.c | 13 +++++--------
1 file changed, 5 insertions(+), 8 deletions(-)
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 1dee4b59a22f7..1fa6e701f817f 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -3018,29 +3018,23 @@ int smb2_open(struct ksmbd_work *work)
if (dh_info.reconnected == true) {
rc = smb2_check_durable_oplock(conn, share, dh_info.fp,
lc, sess->user, name);
- if (rc) {
- ksmbd_put_durable_fd(dh_info.fp);
+ if (rc)
goto err_out2;
- }
rc = ksmbd_reopen_durable_fd(work, dh_info.fp);
- if (rc) {
- ksmbd_put_durable_fd(dh_info.fp);
+ if (rc)
goto err_out2;
- }
fp = dh_info.fp;
if (ksmbd_override_fsids(work)) {
rc = -ENOMEM;
- ksmbd_put_durable_fd(dh_info.fp);
goto err_out2;
}
file_info = FILE_OPENED;
rc = ksmbd_vfs_getattr(&fp->filp->f_path, &stat);
- ksmbd_put_durable_fd(fp);
if (rc)
goto err_out2;
@@ -3810,6 +3804,9 @@ int smb2_open(struct ksmbd_work *work)
ksmbd_debug(SMB, "Error response: %x\n", rsp->hdr.Status);
}
+ if (dh_info.reconnected)
+ ksmbd_put_durable_fd(dh_info.fp);
+
kfree(name);
kfree(lc);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0299/1376] ksmbd: fix durable reconnect error path file lifetime
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (297 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0298/1376] ksmbd: fix use-after-free in smb2_open during durable reconnect Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0300/1376] ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE Greg Kroah-Hartman
` (699 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Junyi Liu, Namjae Jeon, Steve French,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junyi Liu <moss80199@gmail.com>
[ Upstream commit 3515503322f4819277091839eed46b695096aca5 ]
After a durable reconnect succeeds, ksmbd_reopen_durable_fd() republishes
the same ksmbd_file into the session volatile-id table. If smb2_open()
then takes a later error path, cleanup first calls ksmbd_fd_put(work, fp)
and then unconditionally calls ksmbd_put_durable_fd(dh_info.fp).
In this case fp and dh_info.fp are the same object. The first put drops the
reconnect lookup reference, but the final durable put can run
__ksmbd_close_fd(NULL, fp). Because the final close is not session-aware,
it can free the file object without removing the volatile-id entry that was
just published into the session table.
Use the session-aware put for the final reconnect drop when the reconnect
had already succeeded and the error path is cleaning up the republished
file. Earlier reconnect failures, before fp is assigned to dh_info.fp, keep
using the durable-only put path.
Fixes: 1baff47b81f9 ("ksmbd: fix use-after-free in smb2_open during durable reconnect")
Signed-off-by: Junyi Liu <moss80199@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/server/smb2pdu.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 1fa6e701f817f..a8970ec45dab9 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -3804,8 +3804,19 @@ int smb2_open(struct ksmbd_work *work)
ksmbd_debug(SMB, "Error response: %x\n", rsp->hdr.Status);
}
- if (dh_info.reconnected)
- ksmbd_put_durable_fd(dh_info.fp);
+ if (dh_info.reconnected) {
+ /*
+ * If reconnect succeeded, fp was republished in the
+ * session file table. On a later error, ksmbd_fd_put()
+ * above drops the session reference; drop the durable
+ * lookup reference through the same session-aware path so
+ * final close removes the volatile id before freeing fp.
+ */
+ if (rc && fp == dh_info.fp)
+ ksmbd_fd_put(work, dh_info.fp);
+ else
+ ksmbd_put_durable_fd(dh_info.fp);
+ }
kfree(name);
kfree(lc);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0300/1376] ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (298 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0299/1376] ksmbd: fix durable reconnect error path file lifetime Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0301/1376] batman-adv: dat: atomically update mac addresses Greg Kroah-Hartman
` (698 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Namjae Jeon, Sergey Senozhatsky,
Steve French, Sean Shen, Steve French, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Shen <grayhat@foxmail.com>
[ Upstream commit cc57232cae23c0df91b4a59d0f519141ce9b5b02 ]
FSCTL_SET_SPARSE in fsctl_set_sparse() modifies the file's sparse
attribute and saves it through xattr without any permission checks.
This exposes two issues:
1) A client on a read-only share can change the sparse attribute
on files it opened, even though the share is read-only.
Other FSCTL write operations already check
test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE),
but FSCTL_SET_SPARSE does not.
2) Even on writable shares, clients without FILE_WRITE_DATA or
FILE_WRITE_ATTRIBUTES access should not modify the sparse
attribute. Similar handle-level checks exist in other functions
but are missing here.
Add both share-level writable check and per-handle access check.
Use goto out on error to avoid leaking file references.
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Cc: Steve French <smfrench@gmail.com>
Signed-off-by: Sean Shen <grayhat@foxmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/server/smb2pdu.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index a8970ec45dab9..7e4473ddba022 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -8206,9 +8206,20 @@ static inline int fsctl_set_sparse(struct ksmbd_work *work, u64 id,
int ret = 0;
__le32 old_fattr;
+ if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) {
+ ksmbd_debug(SMB, "User does not have write permission\n");
+ return -EACCES;
+ }
+
fp = ksmbd_lookup_fd_fast(work, id);
if (!fp)
return -ENOENT;
+
+ if (!(fp->daccess & (FILE_WRITE_DATA_LE | FILE_WRITE_ATTRIBUTES_LE))) {
+ ret = -EACCES;
+ goto out;
+ }
+
idmap = file_mnt_idmap(fp->filp);
old_fattr = fp->f_ci->m_fattr;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0301/1376] batman-adv: dat: atomically update mac addresses
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (299 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0300/1376] ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0302/1376] batman-adv: bla: avoid CRC corruption due to parallel claim add Greg Kroah-Hartman
` (697 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Sven Eckelmann, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit e6de568d3eda3e3c01c868fabd7a9535d5ee4a73 upstream.
When a MAC address is updated in batadv_dat_entry_add(), it is done using a
simple copy function. A parallel reader might only see parts of this
update. In worst case, the reader is transporting the half updated MAC
address over the network or is creating an ARP response using it -
poisoning the ARP cache.
atomic64_t can be used to store the 48 bit of a mac address. A reader will
then either see the old mac address or the new one - never a mixture of
both.
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: 2f1dfbe18507 ("batman-adv: Distributed ARP Table - implement local storage")
[ Context ]
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/batman-adv/distributed-arp-table.c | 58 +++++++++++++++++---------
net/batman-adv/types.h | 2 +-
2 files changed, 40 insertions(+), 20 deletions(-)
diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
index 83a439394a5d8..45e58b348bd77 100644
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -376,18 +376,19 @@ batadv_dat_entry_hash_find(struct batadv_priv *bat_priv, __be32 ip,
static void batadv_dat_entry_add(struct batadv_priv *bat_priv, __be32 ip,
u8 *mac_addr, unsigned short vid)
{
+ u64 u64_mac = ether_addr_to_u64(mac_addr);
struct batadv_dat_entry *dat_entry;
int hash_added;
dat_entry = batadv_dat_entry_hash_find(bat_priv, ip, vid);
/* if this entry is already known, just update it */
if (dat_entry) {
- if (!batadv_compare_eth(dat_entry->mac_addr, mac_addr))
- ether_addr_copy(dat_entry->mac_addr, mac_addr);
+ atomic64_set(&dat_entry->mac_addr, u64_mac);
+
dat_entry->last_update = jiffies;
batadv_dbg(BATADV_DBG_DAT, bat_priv,
"Entry updated: %pI4 %pM (vid: %d)\n",
- &dat_entry->ip, dat_entry->mac_addr,
+ &dat_entry->ip, mac_addr,
batadv_print_vid(vid));
goto out;
}
@@ -398,7 +399,7 @@ static void batadv_dat_entry_add(struct batadv_priv *bat_priv, __be32 ip,
dat_entry->ip = ip;
dat_entry->vid = vid;
- ether_addr_copy(dat_entry->mac_addr, mac_addr);
+ atomic64_set(&dat_entry->mac_addr, u64_mac);
dat_entry->last_update = jiffies;
kref_init(&dat_entry->refcount);
@@ -414,7 +415,7 @@ static void batadv_dat_entry_add(struct batadv_priv *bat_priv, __be32 ip,
}
batadv_dbg(BATADV_DBG_DAT, bat_priv, "New entry added: %pI4 %pM (vid: %d)\n",
- &dat_entry->ip, dat_entry->mac_addr, batadv_print_vid(vid));
+ &dat_entry->ip, mac_addr, batadv_print_vid(vid));
out:
batadv_dat_entry_put(dat_entry);
@@ -869,6 +870,8 @@ batadv_dat_cache_dump_entry(struct sk_buff *msg, u32 portid,
struct netlink_callback *cb,
struct batadv_dat_entry *dat_entry)
{
+ u8 mac[ETH_ALEN];
+ u64 u64_mac;
int msecs;
void *hdr;
@@ -881,11 +884,12 @@ batadv_dat_cache_dump_entry(struct sk_buff *msg, u32 portid,
genl_dump_check_consistent(cb, hdr);
msecs = jiffies_to_msecs(jiffies - dat_entry->last_update);
+ u64_mac = atomic64_read(&dat_entry->mac_addr);
+ u64_to_ether_addr(u64_mac, mac);
if (nla_put_in_addr(msg, BATADV_ATTR_DAT_CACHE_IP4ADDRESS,
dat_entry->ip) ||
- nla_put(msg, BATADV_ATTR_DAT_CACHE_HWADDRESS, ETH_ALEN,
- dat_entry->mac_addr) ||
+ nla_put(msg, BATADV_ATTR_DAT_CACHE_HWADDRESS, ETH_ALEN, mac) ||
nla_put_u16(msg, BATADV_ATTR_DAT_CACHE_VID, dat_entry->vid) ||
nla_put_u32(msg, BATADV_ATTR_LAST_SEEN_MSECS, msecs)) {
genlmsg_cancel(msg, hdr);
@@ -1161,6 +1165,8 @@ bool batadv_dat_snoop_outgoing_arp_request(struct batadv_priv *bat_priv,
struct net_device *soft_iface = bat_priv->soft_iface;
int hdr_size = 0;
unsigned short vid;
+ u8 mac[ETH_ALEN];
+ u64 u64_mac;
if (!atomic_read(&bat_priv->distributed_arp_table))
goto out;
@@ -1188,6 +1194,9 @@ bool batadv_dat_snoop_outgoing_arp_request(struct batadv_priv *bat_priv,
dat_entry = batadv_dat_entry_hash_find(bat_priv, ip_dst, vid);
if (dat_entry) {
+ u64_mac = atomic64_read(&dat_entry->mac_addr);
+ u64_to_ether_addr(u64_mac, mac);
+
/* If the ARP request is destined for a local client the local
* client will answer itself. DAT would only generate a
* duplicate packet.
@@ -1196,7 +1205,7 @@ bool batadv_dat_snoop_outgoing_arp_request(struct batadv_priv *bat_priv,
* additional DAT answer may trigger kernel warnings about
* a packet coming from the wrong port.
*/
- if (batadv_is_my_client(bat_priv, dat_entry->mac_addr, vid)) {
+ if (batadv_is_my_client(bat_priv, mac, vid)) {
ret = true;
goto out;
}
@@ -1206,18 +1215,16 @@ bool batadv_dat_snoop_outgoing_arp_request(struct batadv_priv *bat_priv,
* the backbone gws belonging to our backbone has claimed the
* destination.
*/
- if (!batadv_bla_check_claim(bat_priv,
- dat_entry->mac_addr, vid)) {
+ if (!batadv_bla_check_claim(bat_priv, mac, vid)) {
batadv_dbg(BATADV_DBG_DAT, bat_priv,
"Device %pM claimed by another backbone gw. Don't send ARP reply!",
- dat_entry->mac_addr);
+ mac);
ret = true;
goto out;
}
skb_new = batadv_dat_arp_create_reply(bat_priv, ip_dst, ip_src,
- dat_entry->mac_addr,
- hw_src, vid);
+ mac, hw_src, vid);
if (!skb_new)
goto out;
@@ -1259,6 +1266,8 @@ bool batadv_dat_snoop_incoming_arp_request(struct batadv_priv *bat_priv,
struct batadv_dat_entry *dat_entry = NULL;
bool ret = false;
unsigned short vid;
+ u8 mac[ETH_ALEN];
+ u64 u64_mac;
int err;
if (!atomic_read(&bat_priv->distributed_arp_table))
@@ -1286,8 +1295,11 @@ bool batadv_dat_snoop_incoming_arp_request(struct batadv_priv *bat_priv,
if (!dat_entry)
goto out;
+ u64_mac = atomic64_read(&dat_entry->mac_addr);
+ u64_to_ether_addr(u64_mac, mac);
+
skb_new = batadv_dat_arp_create_reply(bat_priv, ip_dst, ip_src,
- dat_entry->mac_addr, hw_src, vid);
+ mac, hw_src, vid);
if (!skb_new)
goto out;
@@ -1378,6 +1390,8 @@ bool batadv_dat_snoop_incoming_arp_reply(struct batadv_priv *bat_priv,
u8 *hw_src, *hw_dst;
bool dropped = false;
unsigned short vid;
+ u8 mac[ETH_ALEN];
+ u64 u64_mac;
if (!atomic_read(&bat_priv->distributed_arp_table))
goto out;
@@ -1406,11 +1420,17 @@ bool batadv_dat_snoop_incoming_arp_reply(struct batadv_priv *bat_priv,
* this frame would lead to doubled receive of an ARP reply.
*/
dat_entry = batadv_dat_entry_hash_find(bat_priv, ip_src, vid);
- if (dat_entry && batadv_compare_eth(hw_src, dat_entry->mac_addr)) {
- batadv_dbg(BATADV_DBG_DAT, bat_priv, "Doubled ARP reply removed: ARP MSG = [src: %pM-%pI4 dst: %pM-%pI4]; dat_entry: %pM-%pI4\n",
- hw_src, &ip_src, hw_dst, &ip_dst,
- dat_entry->mac_addr, &dat_entry->ip);
- dropped = true;
+ if (dat_entry) {
+ u64_mac = atomic64_read(&dat_entry->mac_addr);
+ u64_to_ether_addr(u64_mac, mac);
+
+ if (batadv_compare_eth(hw_src, mac)) {
+ batadv_dbg(BATADV_DBG_DAT, bat_priv,
+ "Doubled ARP reply removed: ARP MSG = [src: %pM-%pI4 dst: %pM-%pI4]; dat_entry: %pM-%pI4\n",
+ hw_src, &ip_src, hw_dst, &ip_dst,
+ mac, &dat_entry->ip);
+ dropped = true;
+ }
}
/* Update our internal cache with both the IP addresses the node got
diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
index 0022bee14574d..1b8ab18dcf2c5 100644
--- a/net/batman-adv/types.h
+++ b/net/batman-adv/types.h
@@ -2365,7 +2365,7 @@ struct batadv_dat_entry {
__be32 ip;
/** @mac_addr: the MAC address associated to the stored IPv4 */
- u8 mac_addr[ETH_ALEN];
+ atomic64_t mac_addr;
/** @vid: the vlan ID associated to this entry */
unsigned short vid;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0302/1376] batman-adv: bla: avoid CRC corruption due to parallel claim add
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (300 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0301/1376] batman-adv: dat: atomically update mac addresses Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0303/1376] perf sched: Fix register_pid() overflow, strcpy, and BUG_ON Greg Kroah-Hartman
` (696 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Sven Eckelmann, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit 08645ab95768b88e2ff85a89211994651710465b upstream.
batadv_bla_add_claim() is used to add claims and modify the backbone of
claims for CLAIM frames from remote backbones and local packets. When it
handles a claim, it needs to either
* add the new claim's CRC to the backbone CRC
* remove the already existing claim's CRC from the old backbone and add it
to the new backbone
But when the "new" claim code was running in parallel to the "change
backbone" code, it can happen that the CRC was invalid because the
backbone_gw of the claim was changed twice in the "new" claim code path:
* CPU0 creates the claim for gateway A and publishes it in the claim
hash. The crc16 of the address has not yet been added to A's crc at
this point.
* CPU1 processes a claim frame of gateway B for the same client, finds
the just published claim, and performs the ownership change: it
switches the pointer to B, removes the crc16 from A's crc - which
never contained it - and adds it to B's crc.
* CPU0 continues behind the creation branch, unconditionally switches
the pointer back to A without compensating B's crc (its remove_crc
is false for the creation path), and finally adds the crc16 to A's
crc
The CRC is then wrong for both:
* claim belongs to A: but CRC is not part of backbone A's CRC
* claim doesn't belong to B: CRC is still part of backbone B's CRC
This wrong CRC is never recomputated from the stored claims. For local
backbone claims, this can also not recovered using syncs.
To avoid this, split the functionality in clear separate parts:
* new claim which always adds claim CRC to the backbone CRC (but never
changes the already set backbone_gw of the claim back)
* update of existing claim which automatically changes the backbone_gw
entry and only updates both backbone CRCs when there was an actual change
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: 23721387c409 ("batman-adv: add basic bridge loop avoidance code")
[ Context ]
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/batman-adv/bridge_loop_avoidance.c | 63 ++++++++++++++++----------
1 file changed, 39 insertions(+), 24 deletions(-)
diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
index 2b1ed895958b8..8942fbdf98b3f 100644
--- a/net/batman-adv/bridge_loop_avoidance.c
+++ b/net/batman-adv/bridge_loop_avoidance.c
@@ -693,12 +693,14 @@ static void batadv_bla_add_claim(struct batadv_priv *bat_priv,
struct batadv_bla_backbone_gw *old_backbone_gw;
struct batadv_bla_claim *claim;
struct batadv_bla_claim search_claim;
- bool remove_crc = false;
int hash_added;
+ u16 claim_crc;
+ bool changed;
ether_addr_copy(search_claim.addr, mac);
search_claim.vid = vid;
claim = batadv_claim_hash_find(bat_priv, &search_claim);
+ claim_crc = crc16(0, mac, ETH_ALEN);
/* create a new claim entry if it does not exist yet. */
if (!claim) {
@@ -730,43 +732,56 @@ static void batadv_bla_add_claim(struct batadv_priv *bat_priv,
kfree(claim);
return;
}
+
+ spin_lock_bh(&backbone_gw->crc_lock);
+ backbone_gw->crc ^= claim_crc;
+ spin_unlock_bh(&backbone_gw->crc_lock);
+
+ WRITE_ONCE(backbone_gw->lasttime, jiffies);
+
+ batadv_claim_put(claim);
+ return;
+ }
+
+ WRITE_ONCE(claim->lasttime, jiffies);
+
+ /* replace backbone_gw atomically and adjust reference counters */
+ spin_lock_bh(&claim->backbone_lock);
+ if (claim->backbone_gw != backbone_gw) {
+ changed = true;
+
+ old_backbone_gw = claim->backbone_gw;
+ kref_get(&backbone_gw->refcount);
+ claim->backbone_gw = backbone_gw;
} else {
- WRITE_ONCE(claim->lasttime, jiffies);
- if (claim->backbone_gw == backbone_gw)
- /* no need to register a new backbone */
- goto claim_free_ref;
+ old_backbone_gw = NULL;
+ changed = false;
+ }
+ spin_unlock_bh(&claim->backbone_lock);
+ if (changed) {
batadv_dbg(BATADV_DBG_BLA, bat_priv,
"%s(): changing ownership for %pM, vid %d to gw %pM\n",
__func__, mac, batadv_print_vid(vid),
backbone_gw->orig);
- remove_crc = true;
- }
+ /* add claim address to new backbone_gw */
+ spin_lock_bh(&backbone_gw->crc_lock);
+ backbone_gw->crc ^= claim_crc;
+ spin_unlock_bh(&backbone_gw->crc_lock);
- /* replace backbone_gw atomically and adjust reference counters */
- spin_lock_bh(&claim->backbone_lock);
- old_backbone_gw = claim->backbone_gw;
- kref_get(&backbone_gw->refcount);
- claim->backbone_gw = backbone_gw;
- spin_unlock_bh(&claim->backbone_lock);
+ WRITE_ONCE(backbone_gw->lasttime, jiffies);
+ }
- if (remove_crc) {
+ if (old_backbone_gw) {
/* remove claim address from old backbone_gw */
spin_lock_bh(&old_backbone_gw->crc_lock);
- old_backbone_gw->crc ^= crc16(0, claim->addr, ETH_ALEN);
+ old_backbone_gw->crc ^= claim_crc;
spin_unlock_bh(&old_backbone_gw->crc_lock);
- }
-
- batadv_backbone_gw_put(old_backbone_gw);
- /* add claim address to new backbone_gw */
- spin_lock_bh(&backbone_gw->crc_lock);
- backbone_gw->crc ^= crc16(0, claim->addr, ETH_ALEN);
- spin_unlock_bh(&backbone_gw->crc_lock);
- WRITE_ONCE(backbone_gw->lasttime, jiffies);
+ batadv_backbone_gw_put(old_backbone_gw);
+ }
-claim_free_ref:
batadv_claim_put(claim);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0303/1376] perf sched: Fix register_pid() overflow, strcpy, and BUG_ON
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (301 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0302/1376] batman-adv: bla: avoid CRC corruption due to parallel claim add Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0304/1376] clk: meson: align gxbb_32k_clk_sel number of parents with actual count Greg Kroah-Hartman
` (695 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Ingo Molnar,
Arnaldo Carvalho de Melo, Bjoern Doebel, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
commit 5949d339f5ec98752d56dcd4e36f619a59d513a5 upstream.
register_pid() has several issues when processing untrusted perf.data:
1. Integer overflow: (pid + 1) * sizeof(struct task_desc *) can wrap
to a small value on 32-bit systems when pid is large (e.g.
0x40000000), causing realloc to return a tiny buffer followed by
out-of-bounds writes in the initialization loop.
2. Heap buffer overflow: strcpy(task->comm, comm) copies the
untrusted comm string into a fixed 20-byte COMM_LEN buffer with
no length check.
3. BUG_ON on allocation failure: perf.data is untrusted input, so
allocation failures should be handled gracefully rather than
killing the process.
4. Realloc of sched->tasks assigned directly back, leaking the old
pointer on failure; nr_tasks incremented before the realloc,
leaving corrupted state on failure.
Cap pid at PID_MAX_LIMIT (4194304, matching the kernel's maximum
on 64-bit), replace strcpy with strlcpy, guard against NULL comm,
replace BUG_ON with NULL returns using safe realloc patterns, and
add NULL checks in callers that dereference the result.
Fixes: ec156764d424 ("perf sched: Import schedbench.c")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Ingo Molnar <mingo@elte.hu>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
[doebel: cherry-pick for 6.12]
Signed-off-by: Bjoern Doebel <doebel@amazon.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/builtin-sched.c | 40 ++++++++++++++++++++++++++++----------
1 file changed, 30 insertions(+), 10 deletions(-)
diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c
index 64bf3ac237f2e..57ef161e9b525 100644
--- a/tools/perf/builtin-sched.c
+++ b/tools/perf/builtin-sched.c
@@ -51,6 +51,7 @@
#define COMM_LEN 20
#define SYM_LEN 129
#define MAX_PID 1024000
+#define PID_MAX_LIMIT 4194304 /* kernel limit on 64-bit */
#define MAX_PRIO 140
static const char *cpu_list;
@@ -440,17 +441,28 @@ static void add_sched_event_sleep(struct perf_sched *sched, struct task_desc *ta
static struct task_desc *register_pid(struct perf_sched *sched,
unsigned long pid, const char *comm)
{
- struct task_desc *task;
+ struct task_desc *task, **tasks_p;
static int pid_max;
+ /* perf.data is untrusted — cap pid to prevent overflow in size calculations */
+ if (pid >= PID_MAX_LIMIT) {
+ pr_err("pid %lu exceeds limit %d, skipping\n", pid, PID_MAX_LIMIT);
+ return NULL;
+ }
+
if (sched->pid_to_task == NULL) {
if (sysctl__read_int("kernel/pid_max", &pid_max) < 0)
pid_max = MAX_PID;
- BUG_ON((sched->pid_to_task = calloc(pid_max, sizeof(struct task_desc *))) == NULL);
+ sched->pid_to_task = calloc(pid_max, sizeof(struct task_desc *));
+ if (sched->pid_to_task == NULL)
+ return NULL;
}
if (pid >= (unsigned long)pid_max) {
- BUG_ON((sched->pid_to_task = realloc(sched->pid_to_task, (pid + 1) *
- sizeof(struct task_desc *))) == NULL);
+ void *p = realloc(sched->pid_to_task, (pid + 1) * sizeof(struct task_desc *));
+
+ if (p == NULL)
+ return NULL;
+ sched->pid_to_task = p;
while (pid >= (unsigned long)pid_max)
sched->pid_to_task[pid_max++] = NULL;
}
@@ -461,9 +473,11 @@ static struct task_desc *register_pid(struct perf_sched *sched,
return task;
task = zalloc(sizeof(*task));
+ if (task == NULL)
+ return NULL;
task->pid = pid;
- task->nr = sched->nr_tasks;
- strcpy(task->comm, comm);
+ if (comm)
+ strlcpy(task->comm, comm, sizeof(task->comm));
/*
* every task starts in sleeping state - this gets ignored
* if there's no wakeup pointing to this sleep state:
@@ -471,10 +485,12 @@ static struct task_desc *register_pid(struct perf_sched *sched,
add_sched_event_sleep(sched, task, 0, 0);
sched->pid_to_task[pid] = task;
- sched->nr_tasks++;
- sched->tasks = realloc(sched->tasks, sched->nr_tasks * sizeof(struct task_desc *));
- BUG_ON(!sched->tasks);
- sched->tasks[task->nr] = task;
+ tasks_p = realloc(sched->tasks, (sched->nr_tasks + 1) * sizeof(struct task_desc *));
+ if (!tasks_p)
+ return NULL;
+ sched->tasks = tasks_p;
+ sched->tasks[sched->nr_tasks] = task;
+ task->nr = sched->nr_tasks++;
if (verbose > 0)
printf("registered task #%ld, PID %ld (%s)\n", sched->nr_tasks, pid, comm);
@@ -838,6 +854,8 @@ replay_wakeup_event(struct perf_sched *sched,
waker = register_pid(sched, sample->tid, "<unknown>");
wakee = register_pid(sched, pid, comm);
+ if (waker == NULL || wakee == NULL)
+ return -1;
add_sched_event_wakeup(sched, waker, sample->time, wakee);
return 0;
@@ -880,6 +898,8 @@ static int replay_switch_event(struct perf_sched *sched,
prev = register_pid(sched, prev_pid, prev_comm);
next = register_pid(sched, next_pid, next_comm);
+ if (prev == NULL || next == NULL)
+ return -1;
sched->cpu_last_switched[cpu] = timestamp;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0304/1376] clk: meson: align gxbb_32k_clk_sel number of parents with actual count
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (302 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0303/1376] perf sched: Fix register_pid() overflow, strcpy, and BUG_ON Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0305/1376] batman-adv: fix TX priority extraction for BATADV_FORW_MCAST Greg Kroah-Hartman
` (694 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Hewitt,
Martin Blumenstingl, Jerome Brunet, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
[ Upstream commit 628b6fee9fca292f12d07f0f1bcf1edefa949d81 ]
The following out-of-bounds read has been observed by Christian on a
GXBB WeTek Hub:
==================================================================
BUG: KASAN: global-out-of-bounds in __clk_register+0x1b70/0x2418
Read of size 8 at addr ffffd66320cf88e0 by task swapper/0/1
CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 7.0.0-rc5 #1 PREEMPT
Hardware name: WeTek Hub (DT)
Call trace:
show_stack+0x14/0x20 (C)
dump_stack_lvl+0x74/0x94
print_report+0x164/0x4b0
kasan_report+0x98/0xd8
__asan_report_load8_noabort+0x1c/0x24
__clk_register+0x1b70/0x2418
devm_clk_hw_register+0x74/0x15c
meson_clkc_init+0xd4/0x20c
meson_clkc_syscon_probe+0x5c/0x94
platform_probe+0xbc/0x17c
really_probe+0x184/0x844
__driver_probe_device+0x154/0x35c
driver_probe_device+0x60/0x188
__driver_attach+0x168/0x4a0
bus_for_each_dev+0xec/0x180
driver_attach+0x38/0x58
bus_add_driver+0x238/0x4c0
driver_register+0x150/0x388
__platform_driver_register+0x54/0x7c
gxbb_clkc_driver_init+0x18/0x20
do_one_initcall+0xb8/0x340
kernel_init_freeable+0x49c/0x52c
kernel_init+0x24/0x148
ret_from_fork+0x10/0x20
The buggy address belongs to the variable:
gxbb_32k_clk_parents+0x60/0x400
The buggy address belongs to a vmalloc virtual mapping
The buggy address belongs to the physical page:
Memory state around the buggy address:
ffffd66320cf8780: 00 00 00 00 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9
ffffd66320cf8800: 00 04 f9 f9 f9 f9 f9 f9 00 04 f9 f9 f9 f9 f9 f9
>ffffd66320cf8880: 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9
^
ffffd66320cf8900: 00 01 f9 f9 f9 f9 f9 f9 00 06 f9 f9 f9 f9 f9 f9
ffffd66320cf8980: 00 00 02 f9 f9 f9 f9 f9 00 00 02 f9 f9 f9 f9 f9
==================================================================
Commit 7915d7d5407c ("clk: amlogic: gxbb: drop non existing 32k clock
parent") dropped a non-existing clock parent from the gxbb_32k_clk_sel
mux but didn't adjust the hard-coded num_parents field. Fix the actual
number of parents of that mux by using ARRAY_SIZE instead (avoiding
similar problems in future).
Fixes: 7915d7d5407c ("clk: amlogic: gxbb: drop non existing 32k clock parent")
Reported-by: Christian Hewitt <christianshewitt@gmail.com>
Cc: stable@vger.kernel.org
Tested-by: Christian Hewitt <christianshewitt@gmail.com>
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Link: https://patch.msgid.link/20260623201956.1324992-1-martin.blumenstingl@googlemail.com
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/meson/gxbb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c
index 2bfb0ab9c93cc..39a6a31e796fa 100644
--- a/drivers/clk/meson/gxbb.c
+++ b/drivers/clk/meson/gxbb.c
@@ -1305,7 +1305,7 @@ static struct clk_regmap gxbb_32k_clk_sel = {
.name = "32k_clk_sel",
.ops = &clk_regmap_mux_ops,
.parent_data = gxbb_32k_clk_parent_data,
- .num_parents = 4,
+ .num_parents = ARRAY_SIZE(gxbb_32k_clk_parent_data),
.flags = CLK_SET_RATE_PARENT,
},
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0305/1376] batman-adv: fix TX priority extraction for BATADV_FORW_MCAST
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (303 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0304/1376] clk: meson: align gxbb_32k_clk_sel number of parents with actual count Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0306/1376] mm/damon/core: skip aging from repeated aggressive merging Greg Kroah-Hartman
` (693 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sven Eckelmann, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit 7aedb59b80993c912ab45ce24386a2775150962b upstream.
batadv_mcast_forw_mode_by_count() pushs the skb->data for BATADV_FORW_MCAST
forwarding via batadv_mcast_forw_mcsend(). But the
batadv_skb_set_priority() expects the ethernet header directly before
(skb->data + offset). With the moved skb->data, just some random data would
be accessed to get the priority data.
Move the batadv_skb_set_priority() before the decision about the handling
multicast packets and potential header modifications.
Cc: stable@vger.kernel.org
Fixes: 90039133221e ("batman-adv: mcast: implement multicast packet generation")
[ Context ]
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/batman-adv/soft-interface.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index aaebe74c1bc0a..47715a612320a 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -271,6 +271,8 @@ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb,
if (batadv_compare_eth(ethhdr->h_dest, ectp_addr))
goto dropped;
+ batadv_skb_set_priority(skb, 0);
+
gw_mode = atomic_read(&bat_priv->gw.mode);
if (is_multicast_ether_addr(ethhdr->h_dest)) {
/* if gw mode is off, broadcast every packet */
@@ -304,6 +306,9 @@ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb,
send:
if (do_bcast && !is_broadcast_ether_addr(ethhdr->h_dest)) {
+ /* WARNING batadv_mcast_forw_mode might add more headers
+ * in front of the skb. and might even reallocate the skb
+ */
forw_mode = batadv_mcast_forw_mode(bat_priv, skb, vid,
&mcast_is_routable);
switch (forw_mode) {
@@ -321,8 +326,6 @@ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb,
}
}
- batadv_skb_set_priority(skb, 0);
-
/* ethernet packet should be broadcasted */
if (do_bcast) {
primary_if = batadv_primary_if_get_selected(bat_priv);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0306/1376] mm/damon/core: skip aging from repeated aggressive merging
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (304 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0305/1376] batman-adv: fix TX priority extraction for BATADV_FORW_MCAST Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0307/1376] Smack: Fix error in capability bypass Greg Kroah-Hartman
` (692 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, SJ Park, Andrew Morton, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: SJ Park <sj@kernel.org>
[ Upstream commit 0250dbe08c730d003ef9f484da56ae09a1ea0c4c ]
The number of DAMON regions could temporarily exceed the user-defined
maximum number of regions limit for corner cases. For example, users
could lower the limit via runtime parameters update. For such a case,
kdamond_merge_regions() repeats merging regions in the case doubling the
merge threshold. The repeated merge operation could update the age of
regions multiple times. This corrupts the monitoring results. Fix the
issue by asking the merge operation to skip aging for the corner case.
The user impact is degradation of the monitoring quality. The impact
should be mild, since the degradation is only temporal, and it is not
common to happen in realistic setups.
The issue was discovered [1,2] by Sashiko.
Link: https://lore.kernel.org/20260712165432.87609-1-sj@kernel.org
Link: https://lore.kernel.org/20260621203548.10718-1-sj@kernel.org [1]
Link: https://lore.kernel.org/20260709145425.96247-1-sj@kernel.org [2]
Fixes: 310d6c15e910 ("mm/damon/core: merge regions aggressively when max_nr_regions is unmet")
Signed-off-by: SJ Park <sj@kernel.org>
Cc: <stable@vger.kernel.org> # 6.10
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/damon/core.c | 17 +++++++++++------
mm/damon/tests/core-kunit.h | 2 +-
2 files changed, 12 insertions(+), 7 deletions(-)
diff --git a/mm/damon/core.c b/mm/damon/core.c
index 71264018cf2d1..8901a80c8a21f 100644
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -1786,15 +1786,17 @@ static void damon_merge_two_regions(struct damon_target *t,
* sz_limit size upper limit of each region
*/
static void damon_merge_regions_of(struct damon_target *t, unsigned int thres,
- unsigned long sz_limit)
+ unsigned long sz_limit, bool count_age)
{
struct damon_region *r, *prev = NULL, *next;
damon_for_each_region_safe(r, next, t) {
- if (abs(r->nr_accesses - r->last_nr_accesses) > thres)
- r->age = 0;
- else
- r->age++;
+ if (count_age) {
+ if (abs(r->nr_accesses - r->last_nr_accesses) > thres)
+ r->age = 0;
+ else
+ r->age++;
+ }
if (prev && prev->ar.end == r->ar.start &&
abs(prev->nr_accesses - r->nr_accesses) <= thres &&
@@ -1828,15 +1830,18 @@ static void kdamond_merge_regions(struct damon_ctx *c, unsigned int threshold,
struct damon_target *t;
unsigned int nr_regions;
unsigned int max_thres;
+ bool count_age = true;
max_thres = c->attrs.aggr_interval /
(c->attrs.sample_interval ? c->attrs.sample_interval : 1);
do {
nr_regions = 0;
damon_for_each_target(t, c) {
- damon_merge_regions_of(t, threshold, sz_limit);
+ damon_merge_regions_of(t, threshold, sz_limit,
+ count_age);
nr_regions += damon_nr_regions(t);
}
+ count_age = false;
threshold = max(1, threshold * 2);
} while (nr_regions > c->attrs.max_nr_regions &&
threshold / 2 < max_thres);
diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h
index 1039d2f793b9b..ff9f73579f7b3 100644
--- a/mm/damon/tests/core-kunit.h
+++ b/mm/damon/tests/core-kunit.h
@@ -266,7 +266,7 @@ static void damon_test_merge_regions_of(struct kunit *test)
damon_add_region(r, t);
}
- damon_merge_regions_of(t, 9, 9999);
+ damon_merge_regions_of(t, 9, 9999, true);
/* 0-112, 114-130, 130-156, 156-170 */
KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 5u);
if (damon_nr_regions(t) != 5)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0307/1376] Smack: Fix error in capability bypass
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (305 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0306/1376] mm/damon/core: skip aging from repeated aggressive merging Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0308/1376] drm: Remove unused header in drm_dumb_buffers.c Greg Kroah-Hartman
` (691 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bumjin Im, Casey Schaufler,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Casey Schaufler <casey@schaufler-ca.com>
[ Upstream commit b2faddc13112489f8f11eb40b9456db8c1b58362 ]
A bug in smack_inode_xattr_skipcap() was introduced in the inode
capability handling. The strncmp guard at the top of the function
is coded backwards, resulting in consistently incorrect results.
Correct the check, and the code functions as it should. The error
manifests as requiring CAP_SYS_ADMIN as well as CAP_MAC_ADMIN to
change an inode's MAC attributes.
Fixes: 61df7b828204 ("lsm: fixup the inode xattr capability handling")
Reported-by: Bumjin Im <imbumjin@gmail.com>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/smack/smack_lsm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 7a9b20a576c62..cc1f0014a10f1 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1329,7 +1329,7 @@ static int smack_inode_getattr(const struct path *path)
*/
static int smack_inode_xattr_skipcap(const char *name)
{
- if (strncmp(name, XATTR_SMACK_SUFFIX, strlen(XATTR_SMACK_SUFFIX)))
+ if (strncmp(name, XATTR_SMACK_SUFFIX, strlen(XATTR_SMACK_SUFFIX)) == 0)
return 0;
if (strcmp(name, XATTR_NAME_SMACK) == 0 ||
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0308/1376] drm: Remove unused header in drm_dumb_buffers.c
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (306 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0307/1376] Smack: Fix error in capability bypass Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0309/1376] drm: lcdif: Wait for vblank before disabling DMA Greg Kroah-Hartman
` (690 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yicong Hui, Thomas Zimmermann,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yicong Hui <yiconghui@gmail.com>
[ Upstream commit 38b4ce17ef3421fb0e5e6dbdab1974282bde1165 ]
Remove the header #include "drm_internal.h" from drm_dumb_buffers.c,
which is included but not used.
Header was introduced in commit 47f10854ca89 ("drm: Don't export the
drm_gem_dumb_destroy() function") when moving functions, but was not
removed in commit 96a7b60f6ddb ("drm: remove dumb_destroy callback")
when the drm_gem_dumb_destroy function was removed.
Compiles successfully with DRM enabled, pass kunit tests and
IGT-tests in a vng virtual machine.
Fixes: 96a7b60f6ddb ("drm: remove dumb_destroy callback")
Signed-off-by: Yicong Hui <yiconghui@gmail.com>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patch.msgid.link/20260409154826.8955-1-yiconghui@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_dumb_buffers.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_dumb_buffers.c b/drivers/gpu/drm/drm_dumb_buffers.c
index 70032bba1c97e..7b4ba9fab299a 100644
--- a/drivers/gpu/drm/drm_dumb_buffers.c
+++ b/drivers/gpu/drm/drm_dumb_buffers.c
@@ -29,7 +29,6 @@
#include <drm/drm_mode.h>
#include "drm_crtc_internal.h"
-#include "drm_internal.h"
/**
* DOC: overview
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0309/1376] drm: lcdif: Wait for vblank before disabling DMA
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (307 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0308/1376] drm: Remove unused header in drm_dumb_buffers.c Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0310/1376] drm/v3d: Replace a global spinlock with a per-queue spinlock Greg Kroah-Hartman
` (689 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul Kocialkowski, Frieder Schrempf,
Liu Ying, Lucas Stach, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Kocialkowski <paulk@sys-base.io>
[ Upstream commit 351af554edd994898db12217c3be39979e168d35 ]
It is necessary to wait for the full frame to finish streaming
through the DMA engine before we can safely disable it by removing
the DISP_PARA_DISP_ON bit. Disabling it in-flight can leave the
hardware confused and unable to resume streaming for the next frame.
This causes the FIFO underrun and empty status bits to be set and
a single solid color to be shown on the display, coming from one of
the pixels of the previous frame. The issue occurs sporadically when
a new mode is set, which triggers the crtc disable and enable paths.
Setting the shadow load bit and waiting for it to be cleared by the
DMA engine allows waiting for completion.
The NXP BSP driver addresses this issue with a hardcoded 25 ms sleep.
Fixes: 9db35bb349a0 ("drm: lcdif: Add support for i.MX8MP LCDIF variant")
Signed-off-by: Paul Kocialkowski <paulk@sys-base.io>
Co-developed-by: Lucas Stach <l.stach@pengutronix.de>
Reviewed-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Tested-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Acked-by: Liu Ying <victor.liu@nxp.com>
Link: https://patch.msgid.link/20260402183351.3281123-3-paulk@sys-base.io
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/mxsfb/lcdif_kms.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/mxsfb/lcdif_kms.c b/drivers/gpu/drm/mxsfb/lcdif_kms.c
index dbd42cc1da87f..19884359ce1d1 100644
--- a/drivers/gpu/drm/mxsfb/lcdif_kms.c
+++ b/drivers/gpu/drm/mxsfb/lcdif_kms.c
@@ -373,14 +373,23 @@ static void lcdif_disable_controller(struct lcdif_drm_private *lcdif)
int ret;
reg = readl(lcdif->base + LCDC_V8_CTRLDESCL0_5);
+ /* Disable the layer for DMA. */
reg &= ~CTRLDESCL0_5_EN;
+ /*
+ * It is necessary to wait for the full frame to finish streaming
+ * through the DMA engine before we can safely disable it by removing
+ * the DISP_PARA_DISP_ON bit. Disabling it in-flight can leave the
+ * hardware confused and unable to resume streaming for the next frame.
+ */
+ reg |= CTRLDESCL0_5_SHADOW_LOAD_EN;
writel(reg, lcdif->base + LCDC_V8_CTRLDESCL0_5);
+ /* Wait for the frame to finish or timeout after 50 ms. */
ret = readl_poll_timeout(lcdif->base + LCDC_V8_CTRLDESCL0_5,
- reg, !(reg & CTRLDESCL0_5_EN),
- 0, 36000); /* Wait ~2 frame times max */
+ reg, !(reg & CTRLDESCL0_5_SHADOW_LOAD_EN),
+ 200, 50000);
if (ret)
- drm_err(lcdif->drm, "Failed to disable controller!\n");
+ drm_err(lcdif->drm, "Timed out waiting for final vblank!\n");
reg = readl(lcdif->base + LCDC_V8_DISP_PARA);
reg &= ~DISP_PARA_DISP_ON;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0310/1376] drm/v3d: Replace a global spinlock with a per-queue spinlock
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (308 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0309/1376] drm: lcdif: Wait for vblank before disabling DMA Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0311/1376] drm/v3d: Clear queue->active_job when v3d_fence_create() fails Greg Kroah-Hartman
` (688 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Iago Toral Quiroga, Melissa Wen,
Maíra Canal, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maíra Canal <mcanal@igalia.com>
[ Upstream commit e9d8e027483267a9505f5b6b7f0476b5299743af ]
Each V3D queue works independently and all the dependencies between the
jobs are handled through the DRM scheduler. Therefore, there is no need
to use one single lock for all queues. Using it, creates unnecessary
contention between different queues that can operate independently.
Replace the global spinlock with per-queue locks to improve parallelism
and reduce contention between different V3D queues (BIN, RENDER, TFU,
CSD). This allows independent queues to operate concurrently while
maintaining proper synchronization within each queue.
Reviewed-by: Iago Toral Quiroga <itoral@igalia.com>
Reviewed-by: Melissa Wen <mwen@igalia.com>
Link: https://lore.kernel.org/r/20250826-v3d-queue-lock-v3-3-979efc43e490@igalia.com
Signed-off-by: Maíra Canal <mcanal@igalia.com>
Stable-dep-of: 25a166990751 ("drm/v3d: Clear queue->active_job when v3d_fence_create() fails")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/v3d/v3d_drv.h | 8 ++------
drivers/gpu/drm/v3d/v3d_fence.c | 11 ++++++-----
drivers/gpu/drm/v3d/v3d_gem.c | 3 ++-
drivers/gpu/drm/v3d/v3d_irq.c | 6 +++---
drivers/gpu/drm/v3d/v3d_sched.c | 13 +++++++------
5 files changed, 20 insertions(+), 21 deletions(-)
diff --git a/drivers/gpu/drm/v3d/v3d_drv.h b/drivers/gpu/drm/v3d/v3d_drv.h
index b6e11968fba47..a15a17a4dbc6e 100644
--- a/drivers/gpu/drm/v3d/v3d_drv.h
+++ b/drivers/gpu/drm/v3d/v3d_drv.h
@@ -62,6 +62,7 @@ struct v3d_queue_state {
/* Currently active job for this queue */
struct v3d_job *active_job;
+ spinlock_t queue_lock;
};
/* Performance monitor object. The perform lifetime is controlled by userspace
@@ -154,11 +155,6 @@ struct v3d_dev {
struct v3d_queue_state queue[V3D_MAX_QUEUES];
- /* Spinlock used to synchronize the overflow memory
- * management against bin job submission.
- */
- spinlock_t job_lock;
-
/* Used to track the active perfmon if any. */
struct v3d_perfmon *active_perfmon;
@@ -532,7 +528,7 @@ void v3d_get_stats(const struct v3d_stats *stats, u64 timestamp,
/* v3d_fence.c */
extern const struct dma_fence_ops v3d_fence_ops;
-struct dma_fence *v3d_fence_create(struct v3d_dev *v3d, enum v3d_queue queue);
+struct dma_fence *v3d_fence_create(struct v3d_dev *v3d, enum v3d_queue q);
/* v3d_gem.c */
int v3d_gem_init(struct drm_device *dev);
diff --git a/drivers/gpu/drm/v3d/v3d_fence.c b/drivers/gpu/drm/v3d/v3d_fence.c
index 89840ed212c06..8f8471adae34a 100644
--- a/drivers/gpu/drm/v3d/v3d_fence.c
+++ b/drivers/gpu/drm/v3d/v3d_fence.c
@@ -3,8 +3,9 @@
#include "v3d_drv.h"
-struct dma_fence *v3d_fence_create(struct v3d_dev *v3d, enum v3d_queue queue)
+struct dma_fence *v3d_fence_create(struct v3d_dev *v3d, enum v3d_queue q)
{
+ struct v3d_queue_state *queue = &v3d->queue[q];
struct v3d_fence *fence;
fence = kzalloc(sizeof(*fence), GFP_KERNEL);
@@ -12,10 +13,10 @@ struct dma_fence *v3d_fence_create(struct v3d_dev *v3d, enum v3d_queue queue)
return ERR_PTR(-ENOMEM);
fence->dev = &v3d->drm;
- fence->queue = queue;
- fence->seqno = ++v3d->queue[queue].emit_seqno;
- dma_fence_init(&fence->base, &v3d_fence_ops, &v3d->job_lock,
- v3d->queue[queue].fence_context, fence->seqno);
+ fence->queue = q;
+ fence->seqno = ++queue->emit_seqno;
+ dma_fence_init(&fence->base, &v3d_fence_ops, &queue->queue_lock,
+ queue->fence_context, fence->seqno);
return &fence->base;
}
diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c
index cf3b93101429c..175304977daf3 100644
--- a/drivers/gpu/drm/v3d/v3d_gem.c
+++ b/drivers/gpu/drm/v3d/v3d_gem.c
@@ -254,10 +254,11 @@ v3d_gem_init(struct drm_device *dev)
queue->fence_context = dma_fence_context_alloc(1);
memset(&queue->stats, 0, sizeof(queue->stats));
seqcount_init(&queue->stats.lock);
+
+ spin_lock_init(&queue->queue_lock);
}
spin_lock_init(&v3d->mm_lock);
- spin_lock_init(&v3d->job_lock);
ret = drmm_mutex_init(dev, &v3d->bo_lock);
if (ret)
return ret;
diff --git a/drivers/gpu/drm/v3d/v3d_irq.c b/drivers/gpu/drm/v3d/v3d_irq.c
index 2464ea4d935d0..6831eeccac37c 100644
--- a/drivers/gpu/drm/v3d/v3d_irq.c
+++ b/drivers/gpu/drm/v3d/v3d_irq.c
@@ -62,17 +62,17 @@ v3d_overflow_mem_work(struct work_struct *work)
* bin job got scheduled, that's fine. We'll just give them
* some binner pool anyway.
*/
- spin_lock_irqsave(&v3d->job_lock, irqflags);
+ spin_lock_irqsave(&queue->queue_lock, irqflags);
bin_job = (struct v3d_bin_job *)queue->active_job;
if (!bin_job) {
- spin_unlock_irqrestore(&v3d->job_lock, irqflags);
+ spin_unlock_irqrestore(&queue->queue_lock, irqflags);
goto out;
}
drm_gem_object_get(obj);
list_add_tail(&bo->unref_head, &bin_job->render->unref_list);
- spin_unlock_irqrestore(&v3d->job_lock, irqflags);
+ spin_unlock_irqrestore(&queue->queue_lock, irqflags);
v3d_mmu_flush_all(v3d);
diff --git a/drivers/gpu/drm/v3d/v3d_sched.c b/drivers/gpu/drm/v3d/v3d_sched.c
index f2bac920af899..c20e69a2a3dbf 100644
--- a/drivers/gpu/drm/v3d/v3d_sched.c
+++ b/drivers/gpu/drm/v3d/v3d_sched.c
@@ -204,27 +204,28 @@ static struct dma_fence *v3d_bin_job_run(struct drm_sched_job *sched_job)
{
struct v3d_bin_job *job = to_bin_job(sched_job);
struct v3d_dev *v3d = job->base.v3d;
+ struct v3d_queue_state *queue = &v3d->queue[V3D_BIN];
struct drm_device *dev = &v3d->drm;
struct dma_fence *fence;
unsigned long irqflags;
if (unlikely(job->base.base.s_fence->finished.error)) {
- spin_lock_irqsave(&v3d->job_lock, irqflags);
- v3d->queue[V3D_BIN].active_job = NULL;
- spin_unlock_irqrestore(&v3d->job_lock, irqflags);
+ spin_lock_irqsave(&queue->queue_lock, irqflags);
+ queue->active_job = NULL;
+ spin_unlock_irqrestore(&queue->queue_lock, irqflags);
return NULL;
}
/* Lock required around bin_job update vs
* v3d_overflow_mem_work().
*/
- spin_lock_irqsave(&v3d->job_lock, irqflags);
- v3d->queue[V3D_BIN].active_job = &job->base;
+ spin_lock_irqsave(&queue->queue_lock, irqflags);
+ queue->active_job = &job->base;
/* Clear out the overflow allocation, so we don't
* reuse the overflow attached to a previous job.
*/
V3D_CORE_WRITE(0, V3D_PTB_BPOS, 0);
- spin_unlock_irqrestore(&v3d->job_lock, irqflags);
+ spin_unlock_irqrestore(&queue->queue_lock, irqflags);
v3d_invalidate_caches(v3d);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0311/1376] drm/v3d: Clear queue->active_job when v3d_fence_create() fails
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (309 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0310/1376] drm/v3d: Replace a global spinlock with a per-queue spinlock Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0312/1376] drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format Greg Kroah-Hartman
` (687 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tvrtko Ursulin, Maíra Canal,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maíra Canal <mcanal@igalia.com>
[ Upstream commit 25a1669907512e927fab9ad4d4fb74ff57f63cd9 ]
The run_job() callbacks for BIN, RENDER, TFU and CSD assign the incoming
job to queue->active_job before calling v3d_fence_create(). If
v3d_fence_create() fails, the callback returns NULL without clearing
active_job, leaving a dangling pointer.
Create a failure path in all run_job() callbacks that clears the active
job before returning NULL. The BIN path takes queue->queue_lock around the
clear as it races against v3d_overflow_mem_work(); RENDER, TFU and CSD
paths have no concurrent reader, so the clear is lock-free.
Fixes: a783a09ee76d ("drm/v3d: Refactor job management.")
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Link: https://patch.msgid.link/20260604-v3d-sched-misc-fixes-v4-2-c068f5bf5ccf@igalia.com
Signed-off-by: Maíra Canal <mcanal@igalia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/v3d/v3d_sched.c | 60 +++++++++++++++++++--------------
1 file changed, 34 insertions(+), 26 deletions(-)
diff --git a/drivers/gpu/drm/v3d/v3d_sched.c b/drivers/gpu/drm/v3d/v3d_sched.c
index c20e69a2a3dbf..5bc656509ee90 100644
--- a/drivers/gpu/drm/v3d/v3d_sched.c
+++ b/drivers/gpu/drm/v3d/v3d_sched.c
@@ -206,15 +206,11 @@ static struct dma_fence *v3d_bin_job_run(struct drm_sched_job *sched_job)
struct v3d_dev *v3d = job->base.v3d;
struct v3d_queue_state *queue = &v3d->queue[V3D_BIN];
struct drm_device *dev = &v3d->drm;
- struct dma_fence *fence;
+ struct dma_fence *fence = NULL;
unsigned long irqflags;
- if (unlikely(job->base.base.s_fence->finished.error)) {
- spin_lock_irqsave(&queue->queue_lock, irqflags);
- queue->active_job = NULL;
- spin_unlock_irqrestore(&queue->queue_lock, irqflags);
- return NULL;
- }
+ if (unlikely(job->base.base.s_fence->finished.error))
+ goto out_clean_job;
/* Lock required around bin_job update vs
* v3d_overflow_mem_work().
@@ -231,7 +227,7 @@ static struct dma_fence *v3d_bin_job_run(struct drm_sched_job *sched_job)
fence = v3d_fence_create(v3d, V3D_BIN);
if (IS_ERR(fence))
- return NULL;
+ goto out_clean_job;
if (job->base.irq_fence)
dma_fence_put(job->base.irq_fence);
@@ -259,6 +255,12 @@ static struct dma_fence *v3d_bin_job_run(struct drm_sched_job *sched_job)
V3D_CORE_WRITE(0, V3D_CLE_CT0QEA, job->end);
return fence;
+
+out_clean_job:
+ spin_lock_irqsave(&queue->queue_lock, irqflags);
+ queue->active_job = NULL;
+ spin_unlock_irqrestore(&queue->queue_lock, irqflags);
+ return fence;
}
static struct dma_fence *v3d_render_job_run(struct drm_sched_job *sched_job)
@@ -266,12 +268,10 @@ static struct dma_fence *v3d_render_job_run(struct drm_sched_job *sched_job)
struct v3d_render_job *job = to_render_job(sched_job);
struct v3d_dev *v3d = job->base.v3d;
struct drm_device *dev = &v3d->drm;
- struct dma_fence *fence;
+ struct dma_fence *fence = NULL;
- if (unlikely(job->base.base.s_fence->finished.error)) {
- v3d->queue[V3D_RENDER].active_job = NULL;
- return NULL;
- }
+ if (unlikely(job->base.base.s_fence->finished.error))
+ goto out_clean_job;
v3d->queue[V3D_RENDER].active_job = &job->base;
@@ -285,7 +285,7 @@ static struct dma_fence *v3d_render_job_run(struct drm_sched_job *sched_job)
fence = v3d_fence_create(v3d, V3D_RENDER);
if (IS_ERR(fence))
- return NULL;
+ goto out_clean_job;
if (job->base.irq_fence)
dma_fence_put(job->base.irq_fence);
@@ -306,6 +306,10 @@ static struct dma_fence *v3d_render_job_run(struct drm_sched_job *sched_job)
V3D_CORE_WRITE(0, V3D_CLE_CT1QEA, job->end);
return fence;
+
+out_clean_job:
+ v3d->queue[V3D_RENDER].active_job = NULL;
+ return fence;
}
static struct dma_fence *
@@ -314,18 +318,16 @@ v3d_tfu_job_run(struct drm_sched_job *sched_job)
struct v3d_tfu_job *job = to_tfu_job(sched_job);
struct v3d_dev *v3d = job->base.v3d;
struct drm_device *dev = &v3d->drm;
- struct dma_fence *fence;
+ struct dma_fence *fence = NULL;
- if (unlikely(job->base.base.s_fence->finished.error)) {
- v3d->queue[V3D_TFU].active_job = NULL;
- return NULL;
- }
+ if (unlikely(job->base.base.s_fence->finished.error))
+ goto out_clean_job;
v3d->queue[V3D_TFU].active_job = &job->base;
fence = v3d_fence_create(v3d, V3D_TFU);
if (IS_ERR(fence))
- return NULL;
+ goto out_clean_job;
if (job->base.irq_fence)
dma_fence_put(job->base.irq_fence);
@@ -353,6 +355,10 @@ v3d_tfu_job_run(struct drm_sched_job *sched_job)
V3D_WRITE(V3D_TFU_ICFG(v3d->ver), job->args.icfg | V3D_TFU_ICFG_IOC);
return fence;
+
+out_clean_job:
+ v3d->queue[V3D_TFU].active_job = NULL;
+ return fence;
}
static struct dma_fence *
@@ -361,13 +367,11 @@ v3d_csd_job_run(struct drm_sched_job *sched_job)
struct v3d_csd_job *job = to_csd_job(sched_job);
struct v3d_dev *v3d = job->base.v3d;
struct drm_device *dev = &v3d->drm;
- struct dma_fence *fence;
+ struct dma_fence *fence = NULL;
int i, csd_cfg0_reg;
- if (unlikely(job->base.base.s_fence->finished.error)) {
- v3d->queue[V3D_CSD].active_job = NULL;
- return NULL;
- }
+ if (unlikely(job->base.base.s_fence->finished.error))
+ goto out_clean_job;
/* The HW interprets a workgroup size of 0 as 65536; however, the
* user-space driver exposes a maximum of 65535. Therefore, a 0 in
@@ -385,7 +389,7 @@ v3d_csd_job_run(struct drm_sched_job *sched_job)
fence = v3d_fence_create(v3d, V3D_CSD);
if (IS_ERR(fence))
- return NULL;
+ goto out_clean_job;
if (job->base.irq_fence)
dma_fence_put(job->base.irq_fence);
@@ -412,6 +416,10 @@ v3d_csd_job_run(struct drm_sched_job *sched_job)
V3D_CORE_WRITE(0, csd_cfg0_reg, job->args.cfg[0]);
return fence;
+
+out_clean_job:
+ v3d->queue[V3D_CSD].active_job = NULL;
+ return fence;
}
static void
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0312/1376] drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (310 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0311/1376] drm/v3d: Clear queue->active_job when v3d_fence_create() fails Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0313/1376] drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure Greg Kroah-Hartman
` (686 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cristian Ciocaltea, Daniel Stone,
Nicolas Frattaroli, Daniel Stone, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
[ Upstream commit c1bfe8dac0a79d47eed313b9bcaa2658898684ec ]
The Rockchip VOP2 video output driver has a "is_yuv_output" function,
which returns true when a given bus format is a YUV format, and false
otherwise.
This switch statement is lacking the bus format used for YUV422 10-bit.
Add the two component orderings of the YUV422 10-bit bus formats to the
switch statement.
Fixes: 604be85547ce ("drm/rockchip: Add VOP2 driver")
Reviewed-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
Signed-off-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
Link: https://patch.msgid.link/20260609-color-format-v17-13-35739b5782cc@collabora.com
Signed-off-by: Daniel Stone <daniels@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
index a551458ad4340..42521bd2ac16f 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
@@ -514,6 +514,8 @@ static bool is_yuv_output(u32 bus_format)
switch (bus_format) {
case MEDIA_BUS_FMT_YUV8_1X24:
case MEDIA_BUS_FMT_YUV10_1X30:
+ case MEDIA_BUS_FMT_YUYV10_1X20:
+ case MEDIA_BUS_FMT_UYVY10_1X20:
case MEDIA_BUS_FMT_UYYVYY8_0_5X24:
case MEDIA_BUS_FMT_UYYVYY10_0_5X30:
case MEDIA_BUS_FMT_YUYV8_2X8:
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0313/1376] drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (311 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0312/1376] drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0314/1376] smack: fix incorrect task context in smack_msg_queue_msgrcv Greg Kroah-Hartman
` (685 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Zimmermann, Luca Ceresoli,
Maxime Ripard, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxime Ripard <mripard@kernel.org>
[ Upstream commit 30ac1d403438a6c6039f0af5bb2df3d021f96036 ]
The drm_bridge_funcs.atomic_reset documentation states that the hook
must return either a valid drm_bridge_state object or an ERR_PTR().
The cdns_mhdp_bridge_atomic_reset() callback returns NULL when the
allocation of its state fails, violating this contract.
Return ERR_PTR(-ENOMEM) instead.
Fixes: fb43aa0acdfd ("drm: bridge: Add support for Cadence MHDP8546 DPI/DP bridge")
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com> # imx8mp + sn65dsi84 + bridge hotplug
Link: https://patch.msgid.link/20260619-drm-no-more-bridge-reset-v3-2-ff399263111b@kernel.org
Signed-off-by: Maxime Ripard <mripard@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
index 3c4ea9bdefbea..322794eef41ae 100644
--- a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
+++ b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
@@ -2158,7 +2158,7 @@ cdns_mhdp_bridge_atomic_reset(struct drm_bridge *bridge)
cdns_mhdp_state = kzalloc(sizeof(*cdns_mhdp_state), GFP_KERNEL);
if (!cdns_mhdp_state)
- return NULL;
+ return ERR_PTR(-ENOMEM);
__drm_atomic_helper_bridge_reset(bridge, &cdns_mhdp_state->base);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0314/1376] smack: fix incorrect task context in smack_msg_queue_msgrcv
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (312 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0313/1376] drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0315/1376] smack: simplify write handlers of sysfs entries Greg Kroah-Hartman
` (684 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konstantin Andreev, Casey Schaufler,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Andreev <andreev@swemel.ru>
[ Upstream commit fba3d32825f4bbc8e20f0cdc3b14df57965b8fe5 ]
The smack_msg_queue_msgrcv() function incorrectly checks
the permissions of the 'current' task instead of the
'target' task.
In the msgsnd() syscall path, if a receiver is already waiting,
the pipelined_send() optimization is used to push the message
directly to the receiver task:
ipc/msg.c`pipelined_send():
` smp_store_release(&msr->r_msg, msg)
In this case, the 'sender' (current) task performs the check
on behalf of the 'receiver' task (msr->r_tsk, passed as the
'target' parameter):
ipc/msg.c`pipelined_send():
` security_msg_queue_msgrcv(,, target := msr->r_tsk,,)
However, smack_msg_queue_msgrcv() ignores the 'target' and
checks 'current':
smack_msg_queue_msgrcv(…)
` smk_curacc_msq(isp, MAY_READWRITE); // current task
'current' MAY satisfy smack_msg_queue_msgrcv r/w requirement,
but 'target' (the receiver task) might NOT;
as a result, an unauthorized receiver gets the message,
violating MAC policy.
Test:
1) create a sysv message queue with label “foo”
2) echo "bar foo r" >/smack/load2
3) msgrcv(,,,0,MSG_NOERROR) in "bar"-labeled task.
The task is waiting for the messages ...
4) msgsnd() from a "foo"-labeled task:
"bar"-labeled task gets the message.
This patch fixes the issue by checking permission on the
'target' task instead of 'current'.
(2008-02-04, Casey Schaufler)
Fixes: e114e473771c ("Smack: Simplified Mandatory Access Control Kernel")
Signed-off-by: Konstantin Andreev <andreev@swemel.ru>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/smack/smack_lsm.c | 65 +++++++++++++++++++++++++++-----------
1 file changed, 47 insertions(+), 18 deletions(-)
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index cc1f0014a10f1..c1c7b1409bf4c 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -147,12 +147,13 @@ static int smk_bu_note(char *note, struct smack_known *sskp,
#define smk_bu_note(note, sskp, oskp, mode, RC) (RC)
#endif
-#ifdef CONFIG_SECURITY_SMACK_BRINGUP
-static int smk_bu_current(char *note, struct smack_known *oskp,
- int mode, int rc)
+static int
+smk_bu_tsk_to_obj(struct task_struct *tsk, const struct task_smack *tsp,
+ char *note, struct smack_known *oskp, int mode, int rc)
{
- struct task_smack *tsp = smack_cred(current_cred());
+#ifdef CONFIG_SECURITY_SMACK_BRINGUP
char acc[SMK_NUM_ACCESS_TYPE + 1];
+ char comm[TASK_COMM_LEN];
if (rc <= 0)
return rc;
@@ -160,14 +161,22 @@ static int smk_bu_current(char *note, struct smack_known *oskp,
rc = 0;
smk_bu_mode(mode, acc);
+
pr_info("Smack %s: (%s %s %s) %s %s\n", smk_bu_mess[rc],
- tsp->smk_task->smk_known, oskp->smk_known,
- acc, current->comm, note);
+ smk_of_task(tsp)->smk_known, oskp->smk_known,
+ acc, get_task_comm(comm, tsk), note);
return 0;
-}
#else
-#define smk_bu_current(note, oskp, mode, RC) (RC)
+ return rc;
#endif
+}
+
+static int smk_bu_current(char *note, struct smack_known *oskp,
+ int mode, int rc)
+{
+ return smk_bu_tsk_to_obj(current, smack_cred(current_cred()),
+ note, oskp, mode, rc);
+}
#ifdef CONFIG_SECURITY_SMACK_BRINGUP
static int smk_bu_task(struct task_struct *otp, int mode, int rc)
@@ -3360,14 +3369,20 @@ static int smack_sem_semop(struct kern_ipc_perm *isp, struct sembuf *sops,
}
/**
- * smk_curacc_msq : helper to check if current has access on msq
- * @isp : the msq
+ * smk_tskacc_msq : helper to check if tsk has access on msq
+ * @tsk: the task that requests access
+ * @isp : the sysv msg queue permissions
* @access : access requested
*
- * return 0 if current has access, error otherwise
+ * return 0 if tsk has access, error otherwise
*/
-static int smk_curacc_msq(struct kern_ipc_perm *isp, int access)
+static int
+smk_tskacc_msq(struct task_struct *tsk, struct kern_ipc_perm *isp, int access)
{
+ const bool tsk_is_current = (tsk == current);
+ const struct cred * const tsk_cred =
+ (tsk_is_current ? current_cred() : get_task_cred(tsk));
+ struct task_smack * const tsp = smack_cred(tsk_cred);
struct smack_known *msp = smack_of_ipc(isp);
struct smk_audit_info ad;
int rc;
@@ -3376,11 +3391,25 @@ static int smk_curacc_msq(struct kern_ipc_perm *isp, int access)
smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
ad.a.u.ipc_id = isp->id;
#endif
- rc = smk_curacc(msp, access, &ad);
- rc = smk_bu_current("msq", msp, access, rc);
+ rc = smk_tskacc(tsp, msp, access, &ad);
+ rc = smk_bu_tsk_to_obj(tsk, tsp, "msq", msp, access, rc);
+ if (!tsk_is_current)
+ put_cred(tsk_cred);
return rc;
}
+/**
+ * smk_curacc_msq : helper to check if current has access on msq
+ * @isp : the sysv msg queue permissions
+ * @access : access requested
+ *
+ * return 0 if current has access, error otherwise
+ */
+static int smk_curacc_msq(struct kern_ipc_perm *isp, int access)
+{
+ return smk_tskacc_msq(current, isp, access);
+}
+
/**
* smack_msg_queue_associate - Smack access check for msg_queue
* @isp: the object
@@ -3448,21 +3477,21 @@ static int smack_msg_queue_msgsnd(struct kern_ipc_perm *isp, struct msg_msg *msg
}
/**
- * smack_msg_queue_msgrcv - Smack access check for msg_queue
+ * smack_msg_queue_msgrcv - check it target has r/w access to msg_queue
* @isp: the object
* @msg: unused
- * @target: unused
+ * @target: the task that msgrcv() from the queue
* @type: unused
* @mode: unused
*
- * Returns 0 if current has read and write access, error code otherwise
+ * Returns 0 if target has read and write access, error code otherwise
*/
static int smack_msg_queue_msgrcv(struct kern_ipc_perm *isp,
struct msg_msg *msg,
struct task_struct *target, long type,
int mode)
{
- return smk_curacc_msq(isp, MAY_READWRITE);
+ return smk_tskacc_msq(target, isp, MAY_READWRITE);
}
/**
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0315/1376] smack: simplify write handlers of sysfs entries
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (313 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0314/1376] smack: fix incorrect task context in smack_msg_queue_msgrcv Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0316/1376] smack: deduplicate smackfs/{direct,mapped} file_operations Greg Kroah-Hartman
` (683 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Antipov, Casey Schaufler,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <dmantipov@yandex.ru>
[ Upstream commit b78fede1c69a090d377bf80417ce1f7f7f314534 ]
Use the convenient 'kstrto{u,s}32_from_user()' to simplify write
handlers of /smack/{doi,direct,mapped,logging,ptrace} sysfs entries.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Stable-dep-of: 577dc3b6a8cf ("smack: deduplicate smackfs/{direct,mapped} file_operations")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/smack/smackfs.c | 81 +++++++++++-----------------------------
1 file changed, 22 insertions(+), 59 deletions(-)
diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index 109ad155ffc2a..dd44d254c300c 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -1616,24 +1616,17 @@ static ssize_t smk_read_doi(struct file *filp, char __user *buf,
static ssize_t smk_write_doi(struct file *file, const char __user *buf,
size_t count, loff_t *ppos)
{
- char temp[80];
- unsigned long u;
+ int ret;
+ u32 u;
if (!smack_privileged(CAP_MAC_ADMIN))
return -EPERM;
- if (count >= sizeof(temp) || count == 0)
- return -EINVAL;
-
- if (copy_from_user(temp, buf, count) != 0)
- return -EFAULT;
-
- temp[count] = '\0';
+ ret = kstrtou32_from_user(buf, count, 10, &u);
+ if (unlikely(ret))
+ return ret;
- if (kstrtoul(temp, 10, &u))
- return -EINVAL;
-
- if (u == CIPSO_V4_DOI_UNKNOWN || u > U32_MAX)
+ if (u == CIPSO_V4_DOI_UNKNOWN)
return -EINVAL;
return smk_cipso_doi(u, GFP_KERNEL) ? : count;
@@ -1682,22 +1675,14 @@ static ssize_t smk_write_direct(struct file *file, const char __user *buf,
size_t count, loff_t *ppos)
{
struct smack_known *skp;
- char temp[80];
- int i;
+ int i, ret;
if (!smack_privileged(CAP_MAC_ADMIN))
return -EPERM;
- if (count >= sizeof(temp) || count == 0)
- return -EINVAL;
-
- if (copy_from_user(temp, buf, count) != 0)
- return -EFAULT;
-
- temp[count] = '\0';
-
- if (sscanf(temp, "%d", &i) != 1)
- return -EINVAL;
+ ret = kstrtos32_from_user(buf, count, 10, &i);
+ if (unlikely(ret))
+ return ret;
/*
* Don't do anything if the value hasn't actually changed.
@@ -1760,22 +1745,14 @@ static ssize_t smk_write_mapped(struct file *file, const char __user *buf,
size_t count, loff_t *ppos)
{
struct smack_known *skp;
- char temp[80];
- int i;
+ int i, ret;
if (!smack_privileged(CAP_MAC_ADMIN))
return -EPERM;
- if (count >= sizeof(temp) || count == 0)
- return -EINVAL;
-
- if (copy_from_user(temp, buf, count) != 0)
- return -EFAULT;
-
- temp[count] = '\0';
-
- if (sscanf(temp, "%d", &i) != 1)
- return -EINVAL;
+ ret = kstrtos32_from_user(buf, count, 10, &i);
+ if (unlikely(ret))
+ return ret;
/*
* Don't do anything if the value hasn't actually changed.
@@ -2196,22 +2173,15 @@ static ssize_t smk_read_logging(struct file *filp, char __user *buf,
static ssize_t smk_write_logging(struct file *file, const char __user *buf,
size_t count, loff_t *ppos)
{
- char temp[32];
- int i;
+ int i, ret;
if (!smack_privileged(CAP_MAC_ADMIN))
return -EPERM;
- if (count >= sizeof(temp) || count == 0)
- return -EINVAL;
-
- if (copy_from_user(temp, buf, count) != 0)
- return -EFAULT;
+ ret = kstrtos32_from_user(buf, count, 10, &i);
+ if (unlikely(ret))
+ return ret;
- temp[count] = '\0';
-
- if (sscanf(temp, "%d", &i) != 1)
- return -EINVAL;
if (i < 0 || i > 3)
return -EINVAL;
log_policy = i;
@@ -2854,22 +2824,15 @@ static ssize_t smk_read_ptrace(struct file *filp, char __user *buf,
static ssize_t smk_write_ptrace(struct file *file, const char __user *buf,
size_t count, loff_t *ppos)
{
- char temp[32];
- int i;
+ int i, ret;
if (!smack_privileged(CAP_MAC_ADMIN))
return -EPERM;
- if (*ppos != 0 || count >= sizeof(temp) || count == 0)
- return -EINVAL;
-
- if (copy_from_user(temp, buf, count) != 0)
- return -EFAULT;
+ ret = kstrtos32_from_user(buf, count, 10, &i);
+ if (unlikely(ret))
+ return ret;
- temp[count] = '\0';
-
- if (sscanf(temp, "%d", &i) != 1)
- return -EINVAL;
if (i < SMACK_PTRACE_DEFAULT || i > SMACK_PTRACE_MAX)
return -EINVAL;
smack_ptrace_rule = i;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0316/1376] smack: deduplicate smackfs/{direct,mapped} file_operations
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (314 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0315/1376] smack: simplify write handlers of sysfs entries Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0317/1376] smack: restrict smackfs/{direct,mapped} values to 0-255 Greg Kroah-Hartman
` (682 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konstantin Andreev, Casey Schaufler,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Andreev <andreev@swemel.ru>
[ Upstream commit 577dc3b6a8cf200e6e27b2d9967cac14a1fed2f3 ]
The file_operations for smackfs/direct and smackfs/mapped are
identical up to a textual replacement of "direct" with "mapped"
This patch combines two instances of file_operations into one,
handling both files.
Fixes: f7112e6c9abf ("Smack: allow for significantly longer Smack labels v4")
Signed-off-by: Konstantin Andreev <andreev@swemel.ru>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/smack/smack.h | 5 +-
security/smack/smackfs.c | 133 ++++++++++++---------------------------
2 files changed, 42 insertions(+), 96 deletions(-)
diff --git a/security/smack/smack.h b/security/smack/smack.h
index deb2ef31b63a4..26b3fa0d3e463 100644
--- a/security/smack/smack.h
+++ b/security/smack/smack.h
@@ -302,8 +302,9 @@ int smack_populate_secattr(struct smack_known *skp);
* Shared data.
*/
extern int smack_enabled __initdata;
-extern int smack_cipso_direct;
-extern int smack_cipso_mapped;
+extern int smack_cipso_auto_level[2];
+#define smack_cipso_direct (+smack_cipso_auto_level[0])
+#define smack_cipso_mapped (+smack_cipso_auto_level[1])
extern struct smack_known *smack_net_ambient;
extern struct smack_known *smack_syslog_label;
#ifdef CONFIG_SECURITY_SMACK_BRINGUP
diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index dd44d254c300c..ab472058d2e43 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -81,18 +81,27 @@ static DEFINE_MUTEX(smk_net6addr_lock);
struct smack_known *smack_net_ambient;
/*
- * This is the level in a CIPSO header that indicates a
+ * Sensitivity levels for automatically created CIPSO labels.
+ * See smack_access.c`smack_populate_secattr()
+ *
+ * [0] "direct" labeling, label length < SMK_CIPSOLEN(24):
* smack label is contained directly in the category set.
* It can be reset via smackfs/direct
- */
-int smack_cipso_direct = SMACK_CIPSO_DIRECT_DEFAULT;
-
-/*
- * This is the level in a CIPSO header that indicates a
+ *
+ * [1] "mapped" labeling, label length >= SMK_CIPSOLEN(24):
* secid is contained directly in the category set.
* It can be reset via smackfs/mapped
*/
-int smack_cipso_mapped = SMACK_CIPSO_MAPPED_DEFAULT;
+int smack_cipso_auto_level[2] = {
+ SMACK_CIPSO_DIRECT_DEFAULT,
+ SMACK_CIPSO_MAPPED_DEFAULT,
+};
+
+static int
+smk_cipso_auto_level_idx(const struct file *file)
+{
+ return (file_inode(file)->i_ino != SMK_DIRECT);
+}
#ifdef CONFIG_SECURITY_SMACK_BRINGUP
/*
@@ -1639,15 +1648,15 @@ static const struct file_operations smk_doi_ops = {
};
/**
- * smk_read_direct - read() for /smack/direct
- * @filp: file pointer, not actually used
+ * smk_read_cipso_auto_level - read() for smackfs/direct and smackfs/mapped
+ * @filp: file pointer
* @buf: where to put the result
* @count: maximum to send along
* @ppos: where to start
*
* Returns number of bytes read or error code, as appropriate
*/
-static ssize_t smk_read_direct(struct file *filp, char __user *buf,
+static ssize_t smk_read_cipso_auto_level(struct file *filp, char __user *buf,
size_t count, loff_t *ppos)
{
char temp[80];
@@ -1656,26 +1665,28 @@ static ssize_t smk_read_direct(struct file *filp, char __user *buf,
if (*ppos != 0)
return 0;
- sprintf(temp, "%d", smack_cipso_direct);
+ sprintf(temp, "%d", smack_cipso_auto_level[
+ smk_cipso_auto_level_idx(filp)]);
rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
return rc;
}
/**
- * smk_write_direct - write() for /smack/direct
- * @file: file pointer, not actually used
+ * smk_write_cipso_auto_level - write() for smackfs/direct and smackfs/mapped
+ * @filp: file pointer
* @buf: where to get the data from
* @count: bytes sent
* @ppos: where to start
*
* Returns number of bytes written or error code, as appropriate
*/
-static ssize_t smk_write_direct(struct file *file, const char __user *buf,
- size_t count, loff_t *ppos)
+static ssize_t
+smk_write_cipso_auto_level(struct file *filp, const char __user *buf,
+ size_t count, loff_t *ppos)
{
struct smack_known *skp;
- int i, ret;
+ int i, ret, idx, old_lvl;
if (!smack_privileged(CAP_MAC_ADMIN))
return -EPERM;
@@ -1687,94 +1698,28 @@ static ssize_t smk_write_direct(struct file *file, const char __user *buf,
/*
* Don't do anything if the value hasn't actually changed.
* If it is changing reset the level on entries that were
- * set up to be direct when they were created.
+ * set up to be "auto" level when they were created.
*/
- if (smack_cipso_direct != i) {
- mutex_lock(&smack_known_lock);
- list_for_each_entry_rcu(skp, &smack_known_list, list)
- if (skp->smk_netlabel.attr.mls.lvl ==
- smack_cipso_direct)
- skp->smk_netlabel.attr.mls.lvl = i;
- smack_cipso_direct = i;
- mutex_unlock(&smack_known_lock);
- }
-
- return count;
-}
+ idx = smk_cipso_auto_level_idx(filp);
+ old_lvl = smack_cipso_auto_level[idx];
-static const struct file_operations smk_direct_ops = {
- .read = smk_read_direct,
- .write = smk_write_direct,
- .llseek = default_llseek,
-};
-
-/**
- * smk_read_mapped - read() for /smack/mapped
- * @filp: file pointer, not actually used
- * @buf: where to put the result
- * @count: maximum to send along
- * @ppos: where to start
- *
- * Returns number of bytes read or error code, as appropriate
- */
-static ssize_t smk_read_mapped(struct file *filp, char __user *buf,
- size_t count, loff_t *ppos)
-{
- char temp[80];
- ssize_t rc;
-
- if (*ppos != 0)
- return 0;
-
- sprintf(temp, "%d", smack_cipso_mapped);
- rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
-
- return rc;
-}
-
-/**
- * smk_write_mapped - write() for /smack/mapped
- * @file: file pointer, not actually used
- * @buf: where to get the data from
- * @count: bytes sent
- * @ppos: where to start
- *
- * Returns number of bytes written or error code, as appropriate
- */
-static ssize_t smk_write_mapped(struct file *file, const char __user *buf,
- size_t count, loff_t *ppos)
-{
- struct smack_known *skp;
- int i, ret;
-
- if (!smack_privileged(CAP_MAC_ADMIN))
- return -EPERM;
-
- ret = kstrtos32_from_user(buf, count, 10, &i);
- if (unlikely(ret))
- return ret;
-
- /*
- * Don't do anything if the value hasn't actually changed.
- * If it is changing reset the level on entries that were
- * set up to be mapped when they were created.
- */
- if (smack_cipso_mapped != i) {
+ if (old_lvl != i) {
mutex_lock(&smack_known_lock);
list_for_each_entry_rcu(skp, &smack_known_list, list)
if (skp->smk_netlabel.attr.mls.lvl ==
- smack_cipso_mapped)
+ old_lvl)
skp->smk_netlabel.attr.mls.lvl = i;
- smack_cipso_mapped = i;
+ smack_cipso_auto_level[idx] = i;
mutex_unlock(&smack_known_lock);
}
return count;
}
-static const struct file_operations smk_mapped_ops = {
- .read = smk_read_mapped,
- .write = smk_write_mapped,
+static const struct file_operations
+smk_cipso_auto_level_ops = {
+ .read = smk_read_cipso_auto_level,
+ .write = smk_write_cipso_auto_level,
.llseek = default_llseek,
};
@@ -2867,7 +2812,7 @@ static int smk_fill_super(struct super_block *sb, struct fs_context *fc)
[SMK_DOI] = {
"doi", &smk_doi_ops, S_IRUGO|S_IWUSR},
[SMK_DIRECT] = {
- "direct", &smk_direct_ops, S_IRUGO|S_IWUSR},
+ "direct", &smk_cipso_auto_level_ops, 0644},
[SMK_AMBIENT] = {
"ambient", &smk_ambient_ops, S_IRUGO|S_IWUSR},
[SMK_NET4ADDR] = {
@@ -2881,7 +2826,7 @@ static int smk_fill_super(struct super_block *sb, struct fs_context *fc)
[SMK_ACCESSES] = {
"access", &smk_access_ops, S_IRUGO|S_IWUGO},
[SMK_MAPPED] = {
- "mapped", &smk_mapped_ops, S_IRUGO|S_IWUSR},
+ "mapped", &smk_cipso_auto_level_ops, 0644},
[SMK_LOAD2] = {
"load2", &smk_load2_ops, S_IRUGO|S_IWUSR},
[SMK_LOAD_SELF2] = {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0317/1376] smack: restrict smackfs/{direct,mapped} values to 0-255
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (315 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0316/1376] smack: deduplicate smackfs/{direct,mapped} file_operations Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0318/1376] sched_ext/scx_flatcg: Fix cvtime_delta race and add hweight scaling to bypass charging Greg Kroah-Hartman
` (681 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konstantin Andreev, Casey Schaufler,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Andreev <andreev@swemel.ru>
[ Upstream commit a7c44fd9f80e37763acf9cd3c87a58058d206427 ]
Both smackfs/direct and smackfs/mapped incorrectly accept
the full range of integer values. For example:
# cd /sys/fs/smackfs/
# cat direct ; echo
250
# cat cipso2
@ 250/2
_ 250/2,4,5,6,7,8
* 250/3,5,7
^ 250/2,4,5,6,7
? 250/3,4,5,6,7,8
# echo -1234 >direct ; cat direct ; echo
-1234
# cat cipso2
@ -1234/2
_ -1234/2,4,5,6,7,8
* -1234/3,5,7
^ -1234/2,4,5,6,7
? -1234/3,4,5,6,7,8
#
I noticed two things regarding this:
1) sensitivity levels are truncated to 8 bits when labeling
outgoing packets (0x2e = 46 for the -1234 example above)
2) the reverse process fails: incoming packets with sensitivity
level 46 do not match these smackfs/cipso2 entries.
Even observation (1) on its own warrants a fix.
This patch restricts smackfs/direct and smackfs/mapped
accepted values to the 0-255 range.
Fixes: e114e473771c ("Smack: Simplified Mandatory Access Control Kernel")
Signed-off-by: Konstantin Andreev <andreev@swemel.ru>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/smack/smack.h | 2 +-
security/smack/smackfs.c | 26 ++++++++++++++------------
2 files changed, 15 insertions(+), 13 deletions(-)
diff --git a/security/smack/smack.h b/security/smack/smack.h
index 26b3fa0d3e463..f1eda7f269f58 100644
--- a/security/smack/smack.h
+++ b/security/smack/smack.h
@@ -302,7 +302,7 @@ int smack_populate_secattr(struct smack_known *skp);
* Shared data.
*/
extern int smack_enabled __initdata;
-extern int smack_cipso_auto_level[2];
+extern u8 smack_cipso_auto_level[2];
#define smack_cipso_direct (+smack_cipso_auto_level[0])
#define smack_cipso_mapped (+smack_cipso_auto_level[1])
extern struct smack_known *smack_net_ambient;
diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index ab472058d2e43..0f304667d8578 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -92,7 +92,7 @@ struct smack_known *smack_net_ambient;
* secid is contained directly in the category set.
* It can be reset via smackfs/mapped
*/
-int smack_cipso_auto_level[2] = {
+u8 smack_cipso_auto_level[2] = {
SMACK_CIPSO_DIRECT_DEFAULT,
SMACK_CIPSO_MAPPED_DEFAULT,
};
@@ -1659,17 +1659,15 @@ static const struct file_operations smk_doi_ops = {
static ssize_t smk_read_cipso_auto_level(struct file *filp, char __user *buf,
size_t count, loff_t *ppos)
{
- char temp[80];
- ssize_t rc;
+ char temp[sizeof "255"];
+ int n;
if (*ppos != 0)
return 0;
- sprintf(temp, "%d", smack_cipso_auto_level[
- smk_cipso_auto_level_idx(filp)]);
- rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
-
- return rc;
+ n = sprintf(temp, "%u", (unsigned int)smack_cipso_auto_level[
+ smk_cipso_auto_level_idx(filp)]);
+ return simple_read_from_buffer(buf, count, ppos, temp, n);
}
/**
@@ -1685,13 +1683,16 @@ static ssize_t
smk_write_cipso_auto_level(struct file *filp, const char __user *buf,
size_t count, loff_t *ppos)
{
- struct smack_known *skp;
- int i, ret, idx, old_lvl;
+ int ret, idx;
+ u8 i, old_lvl;
if (!smack_privileged(CAP_MAC_ADMIN))
return -EPERM;
-
- ret = kstrtos32_from_user(buf, count, 10, &i);
+ /*
+ * draft-ietf-cipso-ipsecurity-01 (CIPSO 2.2), 3.4.2.4:
+ * "Sensitivity Level is 1 octet in length. Its value is from 0 to 255"
+ */
+ ret = kstrtou8_from_user(buf, count, 10, &i);
if (unlikely(ret))
return ret;
@@ -1704,6 +1705,7 @@ smk_write_cipso_auto_level(struct file *filp, const char __user *buf,
old_lvl = smack_cipso_auto_level[idx];
if (old_lvl != i) {
+ struct smack_known *skp;
mutex_lock(&smack_known_lock);
list_for_each_entry_rcu(skp, &smack_known_list, list)
if (skp->smk_netlabel.attr.mls.lvl ==
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0318/1376] sched_ext/scx_flatcg: Fix cvtime_delta race and add hweight scaling to bypass charging
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (316 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0317/1376] smack: restrict smackfs/{direct,mapped} values to 0-255 Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0319/1376] x86/cfi: Use symmetric SYM_START and SYM_END in __CFI_TYPE() Greg Kroah-Hartman
` (680 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wanwu Li, Andrea Righi, Tejun Heo,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wanwu Li <liwanwu@kylinos.cn>
[ Upstream commit a5cc43414b38decd50bdd447e558358a6fbd5864 ]
1. cgrp_cap_budget() used __sync_fetch_and_sub(&cgc->cvtime_delta,
cgc->cvtime_delta) to atomically read and clear cvtime_delta. However,
this is not a true atomic read-clear operation: the second argument
(cgc->cvtime_delta) is evaluated as a normal read before the atomic
fetch_and_sub executes. If a concurrent __sync_fetch_and_add() happens
between the read and the sub, the added value gets included in the
returned delta AND remains in cvtime_delta, causing double charging.
Example:
CPU 0 runs cgrp_cap_budget(), CPU 1 runs fcg_stopping().
Assume cvtime_delta = 100 initially.
T1 CPU 0: sub_val = cvtime_delta = 100 cvtime_delta = 100
T2 CPU 1: __sync_fetch_and_add(&cvtime_delta, 10) cvtime_delta = 110
T3 CPU 0: __sync_fetch_and_sub(&cvtime_delta, sub_val) cvtime_delta = 10
returns old=110
delta = 110 (includes the 10 from CPU 1), but cvtime_delta = 10
(the 10 also remains). The 10 is charged twice: once in delta
(applied to cgv_node->cvtime) and once in the residual cvtime_delta
(fetched again next time).
Fix by using __sync_fetch_and_and(&cgc->cvtime_delta, 0).
Disassembly comparison:
(1) delta = __sync_fetch_and_sub(&cgc->cvtime_delta, cgc->cvtime_delta);
228: (79) r7 = *(u64 *)(r9 +40)
229: (87) r7 = -r7
230: (db) r7 = atomic64_fetch_add((u64 *)(r9 +40), r7) //r9 may be changed
(2) delta = __sync_fetch_and_and(&cgc->cvtime_delta, 0);
228: (b7) r8 = 0
229: (db) r8 = atomic64_xchg((u64 *)(r9 +40), r8)
2. The bypass charging path in fcg_stopping() charges raw execution time
to cvtime_delta without scaling by the inverse of the cgroup hweight.
Since cvtime_delta is eventually applied to cgv_node->cvtime which is
in vtime space (weight-scaled), the bypass path should also scale by
FCG_HWEIGHT_ONE / hweight to match the units used by the dispatch path.
Fixes: a4103eacc2ab ("sched_ext: Add a cgroup scheduler which uses flattened hierarchy")
Signed-off-by: Wanwu Li <liwanwu@kylinos.cn>
Reviewed-by: Andrea Righi <arighi@nvidia.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/sched_ext/scx_flatcg.bpf.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/tools/sched_ext/scx_flatcg.bpf.c b/tools/sched_ext/scx_flatcg.bpf.c
index b722baf6da4b9..17897fc765571 100644
--- a/tools/sched_ext/scx_flatcg.bpf.c
+++ b/tools/sched_ext/scx_flatcg.bpf.c
@@ -261,7 +261,7 @@ static void cgrp_cap_budget(struct cgv_node *cgv_node, struct fcg_cgrp_ctx *cgc)
* and thus can't be updated and repositioned. Instead, we collect the
* vtime deltas separately and apply it asynchronously here.
*/
- delta = __sync_fetch_and_sub(&cgc->cvtime_delta, cgc->cvtime_delta);
+ delta = __sync_fetch_and_and(&cgc->cvtime_delta, 0);
cvtime = cgv_node->cvtime + delta;
/*
@@ -571,7 +571,8 @@ void BPF_STRUCT_OPS(fcg_stopping, struct task_struct *p, bool runnable)
cgc = find_cgrp_ctx(cgrp);
if (cgc) {
__sync_fetch_and_add(&cgc->cvtime_delta,
- p->se.sum_exec_runtime - taskc->bypassed_at);
+ (p->se.sum_exec_runtime - taskc->bypassed_at) *
+ FCG_HWEIGHT_ONE / (cgc->hweight ?: 1));
taskc->bypassed_at = 0;
}
bpf_cgroup_release(cgrp);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0319/1376] x86/cfi: Use symmetric SYM_START and SYM_END in __CFI_TYPE()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (317 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0318/1376] sched_ext/scx_flatcg: Fix cvtime_delta race and add hweight scaling to bypass charging Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0320/1376] platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count Greg Kroah-Hartman
` (679 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Jens Remus,
Borislav Petkov (AMD), Nathan Chancellor, Peter Zijlstra (Intel),
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Remus <jremus@linux.ibm.com>
[ Upstream commit 0cfdf974f133e0ff17ed80e7895adbe7889d9522 ]
Commit
ccace936eec7 ("x86: Add types to indirectly called assembly functions")
introduced a x86-specific implementation of __CFI_TYPE() using an asymmetric
combination of SYM_START() and SYM_FUNC_END() to add a symbol to the KCFI type
identifier that precedes a function.
This asymmetric combination is an issue if SYM_FUNC_END() ever gets extended
in a way that requires it to be used symmetrically with SYM_FUNC_START*().
For instance to emit DWARF CFI directives that denote the start/end of
a function. [1]
Use SYM_END() with SYM_T_FUNC instead. No functional change, as the generic
implementation of SYM_FUNC_END(name) expands into SYM_END(name, SYM_T_FUNC).
Fixes: ccace936eec7 ("x86: Add types to indirectly called assembly functions")
Closes: https://sashiko.dev/#/patchset/20260522110427.2816637-1-jremus@linux.ibm.com?part=3 [1]
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Jens Remus <jremus@linux.ibm.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20260611155716.830563-1-jremus@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/include/asm/linkage.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/include/asm/linkage.h b/arch/x86/include/asm/linkage.h
index dc31b13b87a0d..e9daba8961115 100644
--- a/arch/x86/include/asm/linkage.h
+++ b/arch/x86/include/asm/linkage.h
@@ -103,7 +103,7 @@
.byte 0xb8 ASM_NL \
.long __kcfi_typeid_##name ASM_NL \
CFI_POST_PADDING \
- SYM_FUNC_END(__cfi_##name)
+ SYM_END(__cfi_##name, SYM_T_FUNC)
/* UML needs to be able to override memcpy() and friends for KASAN. */
#ifdef CONFIG_UML
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0320/1376] platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (318 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0319/1376] x86/cfi: Use symmetric SYM_START and SYM_END in __CFI_TYPE() Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0321/1376] HID: core: quiesce input in hid_hw_stop() to prevent use-after-free Greg Kroah-Hartman
` (678 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrei Kuchynski, Kaixuan Li,
Maoyi Xie, Benson Leung, Tzung-Bi Shih, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <maoyixie.tju@gmail.com>
[ Upstream commit a0a8cd9fc9c48b95095bcec4b146f7a99486f58e ]
cros_typec_register_partner_pdos() copies the partner PDOs from the EC
TYPEC_STATUS response into the fixed caps_desc.pdo[PDO_MAX_OBJECTS] array.
memcpy(caps_desc.pdo, resp->source_cap_pdos,
sizeof(u32) * resp->source_cap_count);
...
memcpy(caps_desc.pdo, resp->sink_cap_pdos,
sizeof(u32) * resp->sink_cap_count);
PDO_MAX_OBJECTS is 7. source_cap_count and sink_cap_count are u8 fields
from the EC. The only check is that they are not both zero. If either is
larger than 7, the memcpy writes past the end of the array on the stack.
A count of 255 overflows it by about 1 KB. The EC source arrays are only
seven entries wide. A larger count reads past them too.
The ChromeOS EC firmware caps these counts today, so a compliant setup
does not hit this. The kernel should still validate these values rather
than trust them.
Validate the counts in cros_typec_register_partner_pdos() next to the
memcpy. Skip the PDO registration if either count is above PDO_MAX_OBJECTS.
The rest of cros_typec_handle_status() still runs so events are handled
and cleared.
Fixes: 348a2e8c93d3 ("platform/chrome: cros_ec_typec: Register partner PDOs")
Suggested-by: Andrei Kuchynski <akuchynski@chromium.org>
Co-developed-by: Kaixuan Li <kaixuan.li@ntu.edu.sg>
Signed-off-by: Kaixuan Li <kaixuan.li@ntu.edu.sg>
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Reviewed-by: Benson Leung <bleung@chromium.org>
Reviewed-by: Andrei Kuchynski <akuchynski@chromium.org>
Link: https://lore.kernel.org/r/20260625130056.3378097-1-maoyixie.tju@gmail.com
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/chrome/cros_ec_typec.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/platform/chrome/cros_ec_typec.c b/drivers/platform/chrome/cros_ec_typec.c
index ca665b901010e..8c0b814973c04 100644
--- a/drivers/platform/chrome/cros_ec_typec.c
+++ b/drivers/platform/chrome/cros_ec_typec.c
@@ -989,6 +989,12 @@ static void cros_typec_register_partner_pdos(struct cros_typec_data *typec,
if (!resp->source_cap_count && !resp->sink_cap_count)
return;
+ if (resp->source_cap_count > PDO_MAX_OBJECTS ||
+ resp->sink_cap_count > PDO_MAX_OBJECTS) {
+ dev_warn(typec->dev, "Invalid PDO count from EC, port: %d\n", port_num);
+ return;
+ }
+
port->partner_pd = typec_partner_usb_power_delivery_register(port->partner, &desc);
if (IS_ERR(port->partner_pd)) {
dev_warn(typec->dev, "Failed to register partner PD device, port: %d\n", port_num);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0321/1376] HID: core: quiesce input in hid_hw_stop() to prevent use-after-free
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (319 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0320/1376] platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0322/1376] HID: nintendo: Fix imu_timestamp_us double increment per report Greg Kroah-Hartman
` (677 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+9eebf5f6544c5e873858,
Philipp Weber, Jiri Kosina, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philipp Weber <kernel@phwe.de>
[ Upstream commit a4bc41504690b7d7064931909874f5b98cd148b6 ]
A driver's probe calls hid_device_io_start() to enable input delivery,
then fails at a later initialization step and unwinds via hid_hw_stop().
The unwind frees struct hidraw via hidraw_disconnect() while in-flight
HID reports may still be running on another CPU, dereferencing the
freed object through hidraw_report_event(). syzbot reports the
resulting use-after-free for the corsair-psu HID driver.
Edward Adam Davis posted a per-driver fix for corsair-psu that adds
an explicit hid_device_io_stop() before hid_hw_stop() in the probe
error path ("hwmon: prevent packets from going to driver for probe",
2026-04-28). Auditing the tree shows 15 drivers call
hid_device_io_start(); 7 also call hid_device_io_stop() and 8 do not:
drivers calling hid_device_io_start() without a matching
hid_device_io_stop() before hid_hw_stop():
drivers/hwmon/corsair-psu.c (fix posted by Edward)
drivers/hwmon/corsair-cpro.c
drivers/hwmon/nzxt-kraken3.c
drivers/hwmon/nzxt-smart2.c
drivers/hwmon/gigabyte_waterforce.c
drivers/hid/hid-logitech-dj.c
drivers/hid/hid-nintendo.c
drivers/hid/hid-mcp2221.c
Roughly half of all callers of the API are exposed. Centralize the
quiesce in hid_hw_stop() so callers do not have to remember the
matching stop: if a driver has left hdev->io_started true on entry,
call hid_device_io_stop() before hid_disconnect().
For the 7 drivers that already call hid_device_io_stop() correctly,
hdev->io_started is false on entry, the guard short-circuits, and
behavior is unchanged.
No Fixes: tag because the affected drivers gained their
hid_device_io_start() calls independently over years; the bug is a
class-wide API misuse rather than a regression from one commit.
Reported-by: syzbot+9eebf5f6544c5e873858@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9eebf5f6544c5e873858
Signed-off-by: Philipp Weber <kernel@phwe.de>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-core.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index d44b43e2438af..5c33e1a0aef3c 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -2423,9 +2423,16 @@ EXPORT_SYMBOL_GPL(hid_hw_start);
*
* This is usually called from remove function or from probe when something
* failed and hid_hw_start was called already.
+ *
+ * If the caller enabled HID input via hid_device_io_start() and is unwinding
+ * without an explicit hid_device_io_stop(), quiesce input first so that
+ * in-flight reports cannot reach handlers (e.g. hidraw_report_event) whose
+ * backing objects hid_disconnect() is about to free.
*/
void hid_hw_stop(struct hid_device *hdev)
{
+ if (hdev->io_started)
+ hid_device_io_stop(hdev);
hid_disconnect(hdev);
hdev->ll_driver->stop(hdev);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0322/1376] HID: nintendo: Fix imu_timestamp_us double increment per report
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (320 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0321/1376] HID: core: quiesce input in hid_hw_stop() to prevent use-after-free Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0323/1376] HID: roccat: bound device-supplied profile index Greg Kroah-Hartman
` (676 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christos Maragkos, Jiri Kosina,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christos Maragkos <whitetowersoftware@gmail.com>
[ Upstream commit 1f9b25d3fb65b9384dec16d9db13a3e71abd9145 ]
Previously, the imu_timestamp_us variable was incremented twice per
report, causing it to advance by two times the desired amount.
This resulted in incorrect jumps in IMU timestamps reported using
MSC_TIMESTAMP, so userspace applications saw corrupted timing on
functions such as gyroscope-based aim and motion controls.
This is fixed by removing the redundant increment at the start of the
report handling so the remaining can account for the full report
interval.
Fixes: 4ff5b10840a88 ("HID: nintendo: add IMU support")
Signed-off-by: Christos Maragkos <whitetowersoftware@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-nintendo.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/hid/hid-nintendo.c b/drivers/hid/hid-nintendo.c
index 54a8bdcc0ef72..ea7751b3555c0 100644
--- a/drivers/hid/hid-nintendo.c
+++ b/drivers/hid/hid-nintendo.c
@@ -1457,7 +1457,6 @@ static void joycon_parse_imu_report(struct joycon_ctlr *ctlr,
dropped_threshold = ctlr->imu_avg_delta_ms * 3 / 2;
dropped_pkts = (delta - min(delta, dropped_threshold)) /
ctlr->imu_avg_delta_ms;
- ctlr->imu_timestamp_us += 1000 * ctlr->imu_avg_delta_ms;
if (dropped_pkts > JC_IMU_DROPPED_PKT_WARNING) {
hid_warn(ctlr->hdev,
"compensating for %u dropped IMU reports\n",
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0323/1376] HID: roccat: bound device-supplied profile index
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (321 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0322/1376] HID: nintendo: Fix imu_timestamp_us double increment per report Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0324/1376] soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() Greg Kroah-Hartman
` (675 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Bommarito, Jiri Kosina,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
[ Upstream commit 43fae42628a8c10fa8981773d7ec9f1a367821a7 ]
kone_keep_values_up_to_date() and kone_profile_activated() use an
8-bit, device-supplied profile value as an index into the 5-element
kone->profiles[] array without a range check. A malicious USB device
claiming the Roccat Kone id can send a switch-profile event (or a
startup_profile read at probe) with an out-of-range value and make the
driver read out of bounds; the result is exposed via the actual_dpi
sysfs attribute.
Reject out-of-range indices in both paths.
This was found with static analysis and confirmed with the KUnit test
added in the following patch (KASAN: slab-out-of-bounds).
Fixes: 14bf62cde7942 ("HID: add driver for Roccat Kone gaming mouse")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-roccat-kone.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/hid/hid-roccat-kone.c b/drivers/hid/hid-roccat-kone.c
index 3f8f459edcf3c..dd206531fc79f 100644
--- a/drivers/hid/hid-roccat-kone.c
+++ b/drivers/hid/hid-roccat-kone.c
@@ -36,6 +36,8 @@ static uint profile_numbers[5] = {0, 1, 2, 3, 4};
static void kone_profile_activated(struct kone_device *kone, uint new_profile)
{
+ if (new_profile < 1 || new_profile > ARRAY_SIZE(kone->profiles))
+ new_profile = 1;
kone->actual_profile = new_profile;
kone->actual_dpi = kone->profiles[new_profile - 1].startup_dpi;
}
@@ -793,8 +795,10 @@ static void kone_keep_values_up_to_date(struct kone_device *kone,
{
switch (event->event) {
case kone_mouse_event_switch_profile:
- kone->actual_dpi = kone->profiles[event->value - 1].
- startup_dpi;
+ if (event->value >= 1 &&
+ event->value <= ARRAY_SIZE(kone->profiles))
+ kone->actual_dpi =
+ kone->profiles[event->value - 1].startup_dpi;
fallthrough;
case kone_mouse_event_osd_profile:
kone->actual_profile = event->value;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0324/1376] soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (322 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0323/1376] HID: roccat: bound device-supplied profile index Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0325/1376] media: cec-pin: Fix event FIFO ordering Greg Kroah-Hartman
` (674 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weigang He, Krzysztof Kozlowski,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weigang He <geoffreyhe2@gmail.com>
[ Upstream commit fa476d53edd24e8105faace04e881b9c4179738f ]
exynos_get_pmu_regmap() obtains a device_node via of_find_matching_node()
and passes it to exynos_get_pmu_regmap_by_phandle(np, NULL). With
propname == NULL the callee uses np directly and does not drop a
reference, so the reference taken by of_find_matching_node() is leaked on
every call -- including on each -EPROBE_DEFER retry of the only in-tree
caller, exynos_retention_init() in the Exynos pinctrl driver.
Annotate np with the __free(device_node) cleanup attribute so the
reference is released when the function returns.
Found by static analysis tool CodeQL.
Fixes: 76640b84bd7a ("soc: samsung: pmu: Provide global function to get PMU regmap")
Signed-off-by: Weigang He <geoffreyhe2@gmail.com>
Link: https://patch.msgid.link/20260609143852.1783558-1-geoffreyhe2@gmail.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/samsung/exynos-pmu.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/soc/samsung/exynos-pmu.c b/drivers/soc/samsung/exynos-pmu.c
index 7291c2fb14d70..a294018ed7584 100644
--- a/drivers/soc/samsung/exynos-pmu.c
+++ b/drivers/soc/samsung/exynos-pmu.c
@@ -276,8 +276,8 @@ static const struct mfd_cell exynos_pmu_devs[] = {
*/
struct regmap *exynos_get_pmu_regmap(void)
{
- struct device_node *np = of_find_matching_node(NULL,
- exynos_pmu_of_device_ids);
+ struct device_node *np __free(device_node) =
+ of_find_matching_node(NULL, exynos_pmu_of_device_ids);
if (np)
return exynos_get_pmu_regmap_by_phandle(np, NULL);
return ERR_PTR(-ENODEV);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0325/1376] media: cec-pin: Fix event FIFO ordering
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (323 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0324/1376] soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0326/1376] cxl: Refactor user ioctl command path from mds to mailbox Greg Kroah-Hartman
` (673 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gui-Dong Han, Hans Verkuil,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gui-Dong Han <hanguidong02@gmail.com>
[ Upstream commit a1d83d1b810665bd53ce8a7b7867e054d68676c7 ]
cec_pin_update() fills work_pin_events[] and work_pin_ts[], then
increments work_pin_num_events. cec_pin_thread_func() uses that counter
to decide when to read the FIFO entries.
Do not let the counter update be observed without the event update. Also
do not let a freed slot be reused before the thread has finished reading
it. Use release operations when publishing an entry and releasing a slot,
and acquire operations when consuming those counter updates.
Leave the other work_pin_num_events users as they do not participate in
this FIFO publication path.
Fixes: ea5c8ef29668 ("media: cec-pin: add low-level pin hardware support")
Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/cec/core/cec-pin.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/media/cec/core/cec-pin.c b/drivers/media/cec/core/cec-pin.c
index 330d5d5d86aba..4c91f96351cad 100644
--- a/drivers/media/cec/core/cec-pin.c
+++ b/drivers/media/cec/core/cec-pin.c
@@ -114,7 +114,7 @@ static void cec_pin_update(struct cec_pin *pin, bool v, bool force)
return;
pin->adap->cec_pin_is_high = v;
- if (atomic_read(&pin->work_pin_num_events) < CEC_NUM_PIN_EVENTS) {
+ if (atomic_read_acquire(&pin->work_pin_num_events) < CEC_NUM_PIN_EVENTS) {
u8 ev = v;
if (pin->work_pin_events_dropped) {
@@ -125,7 +125,7 @@ static void cec_pin_update(struct cec_pin *pin, bool v, bool force)
pin->work_pin_ts[pin->work_pin_events_wr] = ktime_get();
pin->work_pin_events_wr =
(pin->work_pin_events_wr + 1) % CEC_NUM_PIN_EVENTS;
- atomic_inc(&pin->work_pin_num_events);
+ atomic_inc_return_release(&pin->work_pin_num_events);
} else {
pin->work_pin_events_dropped = true;
pin->work_pin_events_dropped_cnt++;
@@ -1074,7 +1074,7 @@ static int cec_pin_thread_func(void *_adap)
pin->work_tx_ts);
}
- while (atomic_read(&pin->work_pin_num_events)) {
+ while (atomic_read_acquire(&pin->work_pin_num_events)) {
unsigned int idx = pin->work_pin_events_rd;
u8 v = pin->work_pin_events[idx];
@@ -1083,7 +1083,7 @@ static int cec_pin_thread_func(void *_adap)
v & CEC_PIN_EVENT_FL_DROPPED,
pin->work_pin_ts[idx]);
pin->work_pin_events_rd = (idx + 1) % CEC_NUM_PIN_EVENTS;
- atomic_dec(&pin->work_pin_num_events);
+ atomic_dec_return_release(&pin->work_pin_num_events);
}
switch (atomic_xchg(&pin->work_irq_change,
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0326/1376] cxl: Refactor user ioctl command path from mds to mailbox
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (324 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0325/1376] media: cec-pin: Fix event FIFO ordering Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0327/1376] cxl/mbox: Clamp mailbox output allocation to the payload size Greg Kroah-Hartman
` (672 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jonathan Cameron, Dan Williams,
Dave Jiang, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Jiang <dave.jiang@intel.com>
[ Upstream commit 5666a7e7da2f003a8fc327d3c0cce0b506193d86 ]
With 'struct cxl_mailbox' context introduced, the helper functions
cxl_query_cmd() and cxl_send_cmd() can take a cxl_mailbox directly
rather than a cxl_memdev parameter. Refactor to use cxl_mailbox
directly.
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Dan Williams <dan.j.williams@intel.com>
Link: https://patch.msgid.link/20250204220430.4146187-2-dave.jiang@intel.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Stable-dep-of: 8a13db9f899d ("cxl/mbox: Clamp mailbox output allocation to the payload size")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cxl/core/core.h | 6 ++-
drivers/cxl/core/mbox.c | 88 +++++++++++++++++++--------------------
drivers/cxl/core/memdev.c | 22 ++++++----
drivers/cxl/cxlmem.h | 40 ------------------
include/cxl/mailbox.h | 41 +++++++++++++++++-
5 files changed, 101 insertions(+), 96 deletions(-)
diff --git a/drivers/cxl/core/core.h b/drivers/cxl/core/core.h
index 0c62b4069ba00..2433deaf08f1b 100644
--- a/drivers/cxl/core/core.h
+++ b/drivers/cxl/core/core.h
@@ -4,6 +4,8 @@
#ifndef __CXL_CORE_H__
#define __CXL_CORE_H__
+#include <cxl/mailbox.h>
+
extern const struct device_type cxl_nvdimm_bridge_type;
extern const struct device_type cxl_nvdimm_type;
extern const struct device_type cxl_pmu_type;
@@ -65,9 +67,9 @@ static inline void cxl_region_exit(void)
struct cxl_send_command;
struct cxl_mem_query_commands;
-int cxl_query_cmd(struct cxl_memdev *cxlmd,
+int cxl_query_cmd(struct cxl_mailbox *cxl_mbox,
struct cxl_mem_query_commands __user *q);
-int cxl_send_cmd(struct cxl_memdev *cxlmd, struct cxl_send_command __user *s);
+int cxl_send_cmd(struct cxl_mailbox *cxl_mbox, struct cxl_send_command __user *s);
void __iomem *devm_cxl_iomap_block(struct device *dev, resource_size_t addr,
resource_size_t length);
diff --git a/drivers/cxl/core/mbox.c b/drivers/cxl/core/mbox.c
index 5175138c4fb73..1ba8199d0de3b 100644
--- a/drivers/cxl/core/mbox.c
+++ b/drivers/cxl/core/mbox.c
@@ -349,40 +349,39 @@ static bool cxl_payload_from_user_allowed(u16 opcode, void *payload_in)
return true;
}
-static int cxl_mbox_cmd_ctor(struct cxl_mbox_cmd *mbox,
- struct cxl_memdev_state *mds, u16 opcode,
+static int cxl_mbox_cmd_ctor(struct cxl_mbox_cmd *mbox_cmd,
+ struct cxl_mailbox *cxl_mbox, u16 opcode,
size_t in_size, size_t out_size, u64 in_payload)
{
- struct cxl_mailbox *cxl_mbox = &mds->cxlds.cxl_mbox;
- *mbox = (struct cxl_mbox_cmd) {
+ *mbox_cmd = (struct cxl_mbox_cmd) {
.opcode = opcode,
.size_in = in_size,
};
if (in_size) {
- mbox->payload_in = vmemdup_user(u64_to_user_ptr(in_payload),
- in_size);
- if (IS_ERR(mbox->payload_in))
- return PTR_ERR(mbox->payload_in);
+ mbox_cmd->payload_in = vmemdup_user(u64_to_user_ptr(in_payload),
+ in_size);
+ if (IS_ERR(mbox_cmd->payload_in))
+ return PTR_ERR(mbox_cmd->payload_in);
- if (!cxl_payload_from_user_allowed(opcode, mbox->payload_in)) {
- dev_dbg(mds->cxlds.dev, "%s: input payload not allowed\n",
+ if (!cxl_payload_from_user_allowed(opcode, mbox_cmd->payload_in)) {
+ dev_dbg(cxl_mbox->host, "%s: input payload not allowed\n",
cxl_mem_opcode_to_name(opcode));
- kvfree(mbox->payload_in);
+ kvfree(mbox_cmd->payload_in);
return -EBUSY;
}
}
/* Prepare to handle a full payload for variable sized output */
if (out_size == CXL_VARIABLE_PAYLOAD)
- mbox->size_out = cxl_mbox->payload_size;
+ mbox_cmd->size_out = cxl_mbox->payload_size;
else
- mbox->size_out = out_size;
+ mbox_cmd->size_out = out_size;
- if (mbox->size_out) {
- mbox->payload_out = kvzalloc(mbox->size_out, GFP_KERNEL);
- if (!mbox->payload_out) {
- kvfree(mbox->payload_in);
+ if (mbox_cmd->size_out) {
+ mbox_cmd->payload_out = kvzalloc(mbox_cmd->size_out, GFP_KERNEL);
+ if (!mbox_cmd->payload_out) {
+ kvfree(mbox_cmd->payload_in);
return -ENOMEM;
}
}
@@ -397,10 +396,8 @@ static void cxl_mbox_cmd_dtor(struct cxl_mbox_cmd *mbox)
static int cxl_to_mem_cmd_raw(struct cxl_mem_command *mem_cmd,
const struct cxl_send_command *send_cmd,
- struct cxl_memdev_state *mds)
+ struct cxl_mailbox *cxl_mbox)
{
- struct cxl_mailbox *cxl_mbox = &mds->cxlds.cxl_mbox;
-
if (send_cmd->raw.rsvd)
return -EINVAL;
@@ -415,7 +412,7 @@ static int cxl_to_mem_cmd_raw(struct cxl_mem_command *mem_cmd,
if (!cxl_mem_raw_command_allowed(send_cmd->raw.opcode))
return -EPERM;
- dev_WARN_ONCE(mds->cxlds.dev, true, "raw command path used\n");
+ dev_WARN_ONCE(cxl_mbox->host, true, "raw command path used\n");
*mem_cmd = (struct cxl_mem_command) {
.info = {
@@ -431,7 +428,7 @@ static int cxl_to_mem_cmd_raw(struct cxl_mem_command *mem_cmd,
static int cxl_to_mem_cmd(struct cxl_mem_command *mem_cmd,
const struct cxl_send_command *send_cmd,
- struct cxl_memdev_state *mds)
+ struct cxl_mailbox *cxl_mbox)
{
struct cxl_mem_command *c = &cxl_mem_commands[send_cmd->id];
const struct cxl_command_info *info = &c->info;
@@ -446,11 +443,11 @@ static int cxl_to_mem_cmd(struct cxl_mem_command *mem_cmd,
return -EINVAL;
/* Check that the command is enabled for hardware */
- if (!test_bit(info->id, mds->enabled_cmds))
+ if (!test_bit(info->id, cxl_mbox->enabled_cmds))
return -ENOTTY;
/* Check that the command is not claimed for exclusive kernel use */
- if (test_bit(info->id, mds->exclusive_cmds))
+ if (test_bit(info->id, cxl_mbox->exclusive_cmds))
return -EBUSY;
/* Check the input buffer is the expected size */
@@ -479,7 +476,7 @@ static int cxl_to_mem_cmd(struct cxl_mem_command *mem_cmd,
/**
* cxl_validate_cmd_from_user() - Check fields for CXL_MEM_SEND_COMMAND.
* @mbox_cmd: Sanitized and populated &struct cxl_mbox_cmd.
- * @mds: The driver data for the operation
+ * @cxl_mbox: CXL mailbox context
* @send_cmd: &struct cxl_send_command copied in from userspace.
*
* Return:
@@ -494,10 +491,9 @@ static int cxl_to_mem_cmd(struct cxl_mem_command *mem_cmd,
* safe to send to the hardware.
*/
static int cxl_validate_cmd_from_user(struct cxl_mbox_cmd *mbox_cmd,
- struct cxl_memdev_state *mds,
+ struct cxl_mailbox *cxl_mbox,
const struct cxl_send_command *send_cmd)
{
- struct cxl_mailbox *cxl_mbox = &mds->cxlds.cxl_mbox;
struct cxl_mem_command mem_cmd;
int rc;
@@ -514,24 +510,23 @@ static int cxl_validate_cmd_from_user(struct cxl_mbox_cmd *mbox_cmd,
/* Sanitize and construct a cxl_mem_command */
if (send_cmd->id == CXL_MEM_COMMAND_ID_RAW)
- rc = cxl_to_mem_cmd_raw(&mem_cmd, send_cmd, mds);
+ rc = cxl_to_mem_cmd_raw(&mem_cmd, send_cmd, cxl_mbox);
else
- rc = cxl_to_mem_cmd(&mem_cmd, send_cmd, mds);
+ rc = cxl_to_mem_cmd(&mem_cmd, send_cmd, cxl_mbox);
if (rc)
return rc;
/* Sanitize and construct a cxl_mbox_cmd */
- return cxl_mbox_cmd_ctor(mbox_cmd, mds, mem_cmd.opcode,
+ return cxl_mbox_cmd_ctor(mbox_cmd, cxl_mbox, mem_cmd.opcode,
mem_cmd.info.size_in, mem_cmd.info.size_out,
send_cmd->in.payload);
}
-int cxl_query_cmd(struct cxl_memdev *cxlmd,
+int cxl_query_cmd(struct cxl_mailbox *cxl_mbox,
struct cxl_mem_query_commands __user *q)
{
- struct cxl_memdev_state *mds = to_cxl_memdev_state(cxlmd->cxlds);
- struct device *dev = &cxlmd->dev;
+ struct device *dev = cxl_mbox->host;
struct cxl_mem_command *cmd;
u32 n_commands;
int j = 0;
@@ -552,9 +547,9 @@ int cxl_query_cmd(struct cxl_memdev *cxlmd,
cxl_for_each_cmd(cmd) {
struct cxl_command_info info = cmd->info;
- if (test_bit(info.id, mds->enabled_cmds))
+ if (test_bit(info.id, cxl_mbox->enabled_cmds))
info.flags |= CXL_MEM_COMMAND_FLAG_ENABLED;
- if (test_bit(info.id, mds->exclusive_cmds))
+ if (test_bit(info.id, cxl_mbox->exclusive_cmds))
info.flags |= CXL_MEM_COMMAND_FLAG_EXCLUSIVE;
if (copy_to_user(&q->commands[j++], &info, sizeof(info)))
@@ -569,7 +564,7 @@ int cxl_query_cmd(struct cxl_memdev *cxlmd,
/**
* handle_mailbox_cmd_from_user() - Dispatch a mailbox command for userspace.
- * @mds: The driver data for the operation
+ * @cxl_mbox: The mailbox context for the operation.
* @mbox_cmd: The validated mailbox command.
* @out_payload: Pointer to userspace's output payload.
* @size_out: (Input) Max payload size to copy out.
@@ -590,13 +585,12 @@ int cxl_query_cmd(struct cxl_memdev *cxlmd,
*
* See cxl_send_cmd().
*/
-static int handle_mailbox_cmd_from_user(struct cxl_memdev_state *mds,
+static int handle_mailbox_cmd_from_user(struct cxl_mailbox *cxl_mbox,
struct cxl_mbox_cmd *mbox_cmd,
u64 out_payload, s32 *size_out,
u32 *retval)
{
- struct cxl_mailbox *cxl_mbox = &mds->cxlds.cxl_mbox;
- struct device *dev = mds->cxlds.dev;
+ struct device *dev = cxl_mbox->host;
int rc;
dev_dbg(dev,
@@ -633,10 +627,9 @@ static int handle_mailbox_cmd_from_user(struct cxl_memdev_state *mds,
return rc;
}
-int cxl_send_cmd(struct cxl_memdev *cxlmd, struct cxl_send_command __user *s)
+int cxl_send_cmd(struct cxl_mailbox *cxl_mbox, struct cxl_send_command __user *s)
{
- struct cxl_memdev_state *mds = to_cxl_memdev_state(cxlmd->cxlds);
- struct device *dev = &cxlmd->dev;
+ struct device *dev = cxl_mbox->host;
struct cxl_send_command send;
struct cxl_mbox_cmd mbox_cmd;
int rc;
@@ -646,11 +639,11 @@ int cxl_send_cmd(struct cxl_memdev *cxlmd, struct cxl_send_command __user *s)
if (copy_from_user(&send, s, sizeof(send)))
return -EFAULT;
- rc = cxl_validate_cmd_from_user(&mbox_cmd, mds, &send);
+ rc = cxl_validate_cmd_from_user(&mbox_cmd, cxl_mbox, &send);
if (rc)
return rc;
- rc = handle_mailbox_cmd_from_user(mds, &mbox_cmd, send.out.payload,
+ rc = handle_mailbox_cmd_from_user(cxl_mbox, &mbox_cmd, send.out.payload,
&send.out.size, &send.retval);
if (rc)
return rc;
@@ -724,6 +717,7 @@ static int cxl_xfer_log(struct cxl_memdev_state *mds, uuid_t *uuid,
*/
static void cxl_walk_cel(struct cxl_memdev_state *mds, size_t size, u8 *cel)
{
+ struct cxl_mailbox *cxl_mbox = &mds->cxlds.cxl_mbox;
struct cxl_cel_entry *cel_entry;
const int cel_entries = size / sizeof(*cel_entry);
struct device *dev = mds->cxlds.dev;
@@ -737,7 +731,7 @@ static void cxl_walk_cel(struct cxl_memdev_state *mds, size_t size, u8 *cel)
int enabled = 0;
if (cmd) {
- set_bit(cmd->info.id, mds->enabled_cmds);
+ set_bit(cmd->info.id, cxl_mbox->enabled_cmds);
enabled++;
}
@@ -807,6 +801,7 @@ static const uuid_t log_uuid[] = {
*/
int cxl_enumerate_cmds(struct cxl_memdev_state *mds)
{
+ struct cxl_mailbox *cxl_mbox = &mds->cxlds.cxl_mbox;
struct cxl_mbox_get_supported_logs *gsl;
struct device *dev = mds->cxlds.dev;
struct cxl_mem_command *cmd;
@@ -845,7 +840,7 @@ int cxl_enumerate_cmds(struct cxl_memdev_state *mds)
/* In case CEL was bogus, enable some default commands. */
cxl_for_each_cmd(cmd)
if (cmd->flags & CXL_CMD_FLAG_FORCE_ENABLE)
- set_bit(cmd->info.id, mds->enabled_cmds);
+ set_bit(cmd->info.id, cxl_mbox->enabled_cmds);
/* Found the required CEL */
rc = 0;
@@ -1448,6 +1443,7 @@ struct cxl_memdev_state *cxl_memdev_state_create(struct device *dev)
mutex_init(&mds->event.log_lock);
mds->cxlds.dev = dev;
mds->cxlds.reg_map.host = dev;
+ mds->cxlds.cxl_mbox.host = dev;
mds->cxlds.reg_map.resource = CXL_RESOURCE_NONE;
mds->cxlds.type = CXL_DEVTYPE_CLASSMEM;
mds->ram_perf.qos_class = CXL_QOS_CLASS_INVALID;
diff --git a/drivers/cxl/core/memdev.c b/drivers/cxl/core/memdev.c
index 84fefb76dafab..4d544a55ac3e8 100644
--- a/drivers/cxl/core/memdev.c
+++ b/drivers/cxl/core/memdev.c
@@ -564,9 +564,11 @@ EXPORT_SYMBOL_NS_GPL(is_cxl_memdev, CXL);
void set_exclusive_cxl_commands(struct cxl_memdev_state *mds,
unsigned long *cmds)
{
+ struct cxl_mailbox *cxl_mbox = &mds->cxlds.cxl_mbox;
+
down_write(&cxl_memdev_rwsem);
- bitmap_or(mds->exclusive_cmds, mds->exclusive_cmds, cmds,
- CXL_MEM_COMMAND_ID_MAX);
+ bitmap_or(cxl_mbox->exclusive_cmds, cxl_mbox->exclusive_cmds,
+ cmds, CXL_MEM_COMMAND_ID_MAX);
up_write(&cxl_memdev_rwsem);
}
EXPORT_SYMBOL_NS_GPL(set_exclusive_cxl_commands, CXL);
@@ -579,9 +581,11 @@ EXPORT_SYMBOL_NS_GPL(set_exclusive_cxl_commands, CXL);
void clear_exclusive_cxl_commands(struct cxl_memdev_state *mds,
unsigned long *cmds)
{
+ struct cxl_mailbox *cxl_mbox = &mds->cxlds.cxl_mbox;
+
down_write(&cxl_memdev_rwsem);
- bitmap_andnot(mds->exclusive_cmds, mds->exclusive_cmds, cmds,
- CXL_MEM_COMMAND_ID_MAX);
+ bitmap_andnot(cxl_mbox->exclusive_cmds, cxl_mbox->exclusive_cmds,
+ cmds, CXL_MEM_COMMAND_ID_MAX);
up_write(&cxl_memdev_rwsem);
}
EXPORT_SYMBOL_NS_GPL(clear_exclusive_cxl_commands, CXL);
@@ -656,11 +660,14 @@ static struct cxl_memdev *cxl_memdev_alloc(struct cxl_dev_state *cxlds,
static long __cxl_memdev_ioctl(struct cxl_memdev *cxlmd, unsigned int cmd,
unsigned long arg)
{
+ struct cxl_memdev_state *mds = to_cxl_memdev_state(cxlmd->cxlds);
+ struct cxl_mailbox *cxl_mbox = &mds->cxlds.cxl_mbox;
+
switch (cmd) {
case CXL_MEM_QUERY_COMMANDS:
- return cxl_query_cmd(cxlmd, (void __user *)arg);
+ return cxl_query_cmd(cxl_mbox, (void __user *)arg);
case CXL_MEM_SEND_COMMAND:
- return cxl_send_cmd(cxlmd, (void __user *)arg);
+ return cxl_send_cmd(cxl_mbox, (void __user *)arg);
default:
return -ENOTTY;
}
@@ -994,10 +1001,11 @@ static void cxl_remove_fw_upload(void *fwl)
int devm_cxl_setup_fw_upload(struct device *host, struct cxl_memdev_state *mds)
{
struct cxl_dev_state *cxlds = &mds->cxlds;
+ struct cxl_mailbox *cxl_mbox = &cxlds->cxl_mbox;
struct device *dev = &cxlds->cxlmd->dev;
struct fw_upload *fwl;
- if (!test_bit(CXL_MEM_COMMAND_ID_GET_FW_INFO, mds->enabled_cmds))
+ if (!test_bit(CXL_MEM_COMMAND_ID_GET_FW_INFO, cxl_mbox->enabled_cmds))
return 0;
fwl = firmware_upload_register(THIS_MODULE, dev, dev_name(dev),
diff --git a/drivers/cxl/cxlmem.h b/drivers/cxl/cxlmem.h
index 2a25d1957ddb9..a0a49809cd76c 100644
--- a/drivers/cxl/cxlmem.h
+++ b/drivers/cxl/cxlmem.h
@@ -106,42 +106,6 @@ static inline struct cxl_ep *cxl_ep_load(struct cxl_port *port,
return xa_load(&port->endpoints, (unsigned long)&cxlmd->dev);
}
-/**
- * struct cxl_mbox_cmd - A command to be submitted to hardware.
- * @opcode: (input) The command set and command submitted to hardware.
- * @payload_in: (input) Pointer to the input payload.
- * @payload_out: (output) Pointer to the output payload. Must be allocated by
- * the caller.
- * @size_in: (input) Number of bytes to load from @payload_in.
- * @size_out: (input) Max number of bytes loaded into @payload_out.
- * (output) Number of bytes generated by the device. For fixed size
- * outputs commands this is always expected to be deterministic. For
- * variable sized output commands, it tells the exact number of bytes
- * written.
- * @min_out: (input) internal command output payload size validation
- * @poll_count: (input) Number of timeouts to attempt.
- * @poll_interval_ms: (input) Time between mailbox background command polling
- * interval timeouts.
- * @return_code: (output) Error code returned from hardware.
- *
- * This is the primary mechanism used to send commands to the hardware.
- * All the fields except @payload_* correspond exactly to the fields described in
- * Command Register section of the CXL 2.0 8.2.8.4.5. @payload_in and
- * @payload_out are written to, and read from the Command Payload Registers
- * defined in CXL 2.0 8.2.8.4.8.
- */
-struct cxl_mbox_cmd {
- u16 opcode;
- void *payload_in;
- void *payload_out;
- size_t size_in;
- size_t size_out;
- size_t min_out;
- int poll_count;
- int poll_interval_ms;
- u16 return_code;
-};
-
/*
* Per CXL 3.0 Section 8.2.8.4.5.1
*/
@@ -461,8 +425,6 @@ static inline struct cxl_dev_state *mbox_to_cxlds(struct cxl_mailbox *cxl_mbox)
* @lsa_size: Size of Label Storage Area
* (CXL 2.0 8.2.9.5.1.1 Identify Memory Device)
* @firmware_version: Firmware version for the memory device.
- * @enabled_cmds: Hardware commands found enabled in CEL.
- * @exclusive_cmds: Commands that are kernel-internal only
* @total_bytes: sum of all possible capacities
* @volatile_only_bytes: hard volatile capacity
* @persistent_only_bytes: hard persistent capacity
@@ -485,8 +447,6 @@ struct cxl_memdev_state {
struct cxl_dev_state cxlds;
size_t lsa_size;
char firmware_version[0x10];
- DECLARE_BITMAP(enabled_cmds, CXL_MEM_COMMAND_ID_MAX);
- DECLARE_BITMAP(exclusive_cmds, CXL_MEM_COMMAND_ID_MAX);
u64 total_bytes;
u64 volatile_only_bytes;
u64 persistent_only_bytes;
diff --git a/include/cxl/mailbox.h b/include/cxl/mailbox.h
index bacd111e75f11..cc894f07a4351 100644
--- a/include/cxl/mailbox.h
+++ b/include/cxl/mailbox.h
@@ -3,12 +3,49 @@
#ifndef __CXL_MBOX_H__
#define __CXL_MBOX_H__
#include <linux/rcuwait.h>
+#include <uapi/linux/cxl_mem.h>
-struct cxl_mbox_cmd;
+/**
+ * struct cxl_mbox_cmd - A command to be submitted to hardware.
+ * @opcode: (input) The command set and command submitted to hardware.
+ * @payload_in: (input) Pointer to the input payload.
+ * @payload_out: (output) Pointer to the output payload. Must be allocated by
+ * the caller.
+ * @size_in: (input) Number of bytes to load from @payload_in.
+ * @size_out: (input) Max number of bytes loaded into @payload_out.
+ * (output) Number of bytes generated by the device. For fixed size
+ * outputs commands this is always expected to be deterministic. For
+ * variable sized output commands, it tells the exact number of bytes
+ * written.
+ * @min_out: (input) internal command output payload size validation
+ * @poll_count: (input) Number of timeouts to attempt.
+ * @poll_interval_ms: (input) Time between mailbox background command polling
+ * interval timeouts.
+ * @return_code: (output) Error code returned from hardware.
+ *
+ * This is the primary mechanism used to send commands to the hardware.
+ * All the fields except @payload_* correspond exactly to the fields described in
+ * Command Register section of the CXL 2.0 8.2.8.4.5. @payload_in and
+ * @payload_out are written to, and read from the Command Payload Registers
+ * defined in CXL 2.0 8.2.8.4.8.
+ */
+struct cxl_mbox_cmd {
+ u16 opcode;
+ void *payload_in;
+ void *payload_out;
+ size_t size_in;
+ size_t size_out;
+ size_t min_out;
+ int poll_count;
+ int poll_interval_ms;
+ u16 return_code;
+};
/**
* struct cxl_mailbox - context for CXL mailbox operations
* @host: device that hosts the mailbox
+ * @enabled_cmds: mailbox commands that are enabled by the driver
+ * @exclusive_cmds: mailbox commands that are exclusive to the kernel
* @payload_size: Size of space for payload
* (CXL 3.1 8.2.8.4.3 Mailbox Capabilities Register)
* @mbox_mutex: mutex protects device mailbox and firmware
@@ -17,6 +54,8 @@ struct cxl_mbox_cmd;
*/
struct cxl_mailbox {
struct device *host;
+ DECLARE_BITMAP(enabled_cmds, CXL_MEM_COMMAND_ID_MAX);
+ DECLARE_BITMAP(exclusive_cmds, CXL_MEM_COMMAND_ID_MAX);
size_t payload_size;
struct mutex mbox_mutex; /* lock to protect mailbox context */
struct rcuwait mbox_wait;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0327/1376] cxl/mbox: Clamp mailbox output allocation to the payload size
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (325 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0326/1376] cxl: Refactor user ioctl command path from mds to mailbox Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0328/1376] cxl/pci: Remove incorrect mbox.valid check in cxl_pci_type3_init_mailbox() Greg Kroah-Hartman
` (671 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kai-Heng Feng, Koba Ko, Dave Jiang,
Davidlohr Bueso, Richard Cheng, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Cheng <icheng@nvidia.com>
[ Upstream commit 8a13db9f899d149c3aab24abcb668121cfda5a4f ]
CXL_MEM_SEND_COMMAND bounds the user's in.size to the mailbox payload
size but leaves out.size unbounded, then cxl_mbox_cmd_ctor() calls
kvzalloc(out.size). A large out.size drives a huge allocation, above
INT_MAX it WARNs and taints, and with panic_on_warn=1 it panics.
The transport __cxl_pci_mbox_send_cmd() already clamps the response copy
to min(out.size, payload_size, device len), so the output buffer is
never written beyond payload_size. Clamp the allocation to payload_size
too, matching the RAW path.
Fixes: 583fa5e71cae ("cxl/mem: Add basic IOCTL interface")
Reviewed-by: Kai-Heng Feng <kaihengf@nvidia.com>
Reviewed-by: Koba Ko <kobak@nvidia.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Davidlohr Bueso <dave@stgolabs.net>
Signed-off-by: Richard Cheng <icheng@nvidia.com>
Link: https://patch.msgid.link/20260624144147.53997-1-icheng@nvidia.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cxl/core/mbox.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/drivers/cxl/core/mbox.c b/drivers/cxl/core/mbox.c
index 1ba8199d0de3b..9b178abd1528e 100644
--- a/drivers/cxl/core/mbox.c
+++ b/drivers/cxl/core/mbox.c
@@ -372,11 +372,7 @@ static int cxl_mbox_cmd_ctor(struct cxl_mbox_cmd *mbox_cmd,
}
}
- /* Prepare to handle a full payload for variable sized output */
- if (out_size == CXL_VARIABLE_PAYLOAD)
- mbox_cmd->size_out = cxl_mbox->payload_size;
- else
- mbox_cmd->size_out = out_size;
+ mbox_cmd->size_out = min_t(size_t, out_size, cxl_mbox->payload_size);
if (mbox_cmd->size_out) {
mbox_cmd->payload_out = kvzalloc(mbox_cmd->size_out, GFP_KERNEL);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0328/1376] cxl/pci: Remove incorrect mbox.valid check in cxl_pci_type3_init_mailbox()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (326 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0327/1376] cxl/mbox: Clamp mailbox output allocation to the payload size Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0329/1376] clk: versaclock7: Fix APLL clock leak on probe failure Greg Kroah-Hartman
` (670 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Richard Cheng, Wei Hou, Li Ming,
Dave Jiang, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Hou <wei.hou@scaleflux.com>
[ Upstream commit d79b81893d0cc93737e811a465b9ef9a00156fd5 ]
The driver's design intent is that missing or malformed component
registers should not prevent mailbox initialization. cxl_pci_probe()
already reflects this: the CXL_REGLOC_RBI_COMPONENT setup path only
emits a dev_warn() and continues when component registers are absent,
rather than returning an error.
The check 'if (!cxlds->reg_map.device_map.mbox.valid)' violates this
intent and is also technically incorrect for two reasons:
1. Wrong struct: the MEMDEV register block is enumerated into a local
variable 'map', not into 'cxlds->reg_map'. The device_map.mbox.valid
field inside cxlds->reg_map is never written by the MEMDEV probe and
will always read as zero regardless of actual hardware capability.
2. Already validated: cxl_pci_setup_regs(CXL_REGLOC_RBI_MEMDEV) calls
cxl_probe_regs() which explicitly checks mbox.valid and returns
-ENXIO if the mailbox is absent. If that check passes, the mailbox is
guaranteed to be present by the time cxl_pci_type3_init_mailbox() is
called.
The value that the check actually reads is component_map.ras.valid,
which aliases device_map.mbox.valid in the union. This is populated by
the COMPONENT probe, not the MEMDEV probe. On devices where the
component register BAR does not implement a CXL Component Capability
Array (e.g. certain DCD devices), cxl_probe_component_regs() returns
early leaving ras.valid=false. Through the union, this makes mbox.valid
read as false, causing cxl_pci_type3_init_mailbox() to return -ENODEV
(-19) even though the mailbox hardware is fully functional.
Remove the check. Mailbox presence has already been validated by
cxl_pci_setup_regs(CXL_REGLOC_RBI_MEMDEV). The presence or absence of
component registers is irrelevant to mailbox initialization.
Fixes: 8d8081cecfb9 ("cxl: Move mailbox related bits to the same context")
Reviewed-by: Richard Cheng <icheng@nvidia.com>
Signed-off-by: Wei Hou <wei.hou@scaleflux.com>
Reviewed-by: Li Ming <ming.li@zohomail.com>
Link: https://patch.msgid.link/20260628155857.239866-1-wei.hou@scaleflux.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cxl/pci.c | 6 ------
1 file changed, 6 deletions(-)
diff --git a/drivers/cxl/pci.c b/drivers/cxl/pci.c
index 09a2bc817d645..02040b51f44ec 100644
--- a/drivers/cxl/pci.c
+++ b/drivers/cxl/pci.c
@@ -794,12 +794,6 @@ static int cxl_pci_type3_init_mailbox(struct cxl_dev_state *cxlds)
{
int rc;
- /*
- * Fail the init if there's no mailbox. For a type3 this is out of spec.
- */
- if (!cxlds->reg_map.device_map.mbox.valid)
- return -ENODEV;
-
rc = cxl_mailbox_init(&cxlds->cxl_mbox, cxlds->dev);
if (rc)
return rc;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0329/1376] clk: versaclock7: Fix APLL clock leak on probe failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (327 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0328/1376] cxl/pci: Remove incorrect mbox.valid check in cxl_pci_type3_init_mailbox() Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0330/1376] clk: moxart: remove unused variables, fix refcount leak Greg Kroah-Hartman
` (669 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Brian Masney, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit e25d8d35e8cbc1a4c04a8b86eed6aa7229f6449e ]
vc7_probe() registers the APLL with clk_register_fixed_rate(), which is
not devm-managed and must be explicitly unregistered on probe failure.
Most later errors already unwind through err_clk, but a failure from
vc7_get_bank_clk() in the output registration loop returned directly.
That skipped clk_unregister_fixed_rate() and leaked the APLL clock.
Route that error through the existing err_clk label so the fixed-rate
clock is released consistently with the other probe failure paths.
This issue was identified during our ongoing static-analysis research while
reviewing kernel code.
Fixes: 48c5e98fedd9 ("clk: Renesas versaclock7 ccf device driver")
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/clk-versaclock7.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clk/clk-versaclock7.c b/drivers/clk/clk-versaclock7.c
index f323263e32c38..e1d6d88b6635f 100644
--- a/drivers/clk/clk-versaclock7.c
+++ b/drivers/clk/clk-versaclock7.c
@@ -1191,7 +1191,7 @@ static int vc7_probe(struct i2c_client *client)
if (ret) {
dev_err_probe(&client->dev, ret,
"unable to register output %d\n", i);
- return ret;
+ goto err_clk;
}
switch (bank_src_map.type) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0330/1376] clk: moxart: remove unused variables, fix refcount leak
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (328 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0329/1376] clk: versaclock7: Fix APLL clock leak on probe failure Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0331/1376] clk: nuvoton: ma35d1: fix ignored div_u64 return values in PLL freq calculation Greg Kroah-Hartman
` (668 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander A. Klimov, Brian Masney,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander A. Klimov <grandmaster@al2klimov.de>
[ Upstream commit 9f275f2ee9ca60ea4c092bdc0195987945ad8ad8 ]
Not only these error checks are redundand,
those of_clk_get() return values weren't cleaned up via clk_put().
Fixes: c7bb4fc16ead ("clk: add MOXA ART SoCs clock driver")
Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/clk-moxart.c | 14 --------------
1 file changed, 14 deletions(-)
diff --git a/drivers/clk/clk-moxart.c b/drivers/clk/clk-moxart.c
index 3786a0153ad17..40663ef3ef0ae 100644
--- a/drivers/clk/clk-moxart.c
+++ b/drivers/clk/clk-moxart.c
@@ -17,7 +17,6 @@ static void __init moxart_of_pll_clk_init(struct device_node *node)
{
void __iomem *base;
struct clk_hw *hw;
- struct clk *ref_clk;
unsigned int mul;
const char *name = node->name;
const char *parent_name;
@@ -34,12 +33,6 @@ static void __init moxart_of_pll_clk_init(struct device_node *node)
mul = readl(base + 0x30) >> 3 & 0x3f;
iounmap(base);
- ref_clk = of_clk_get(node, 0);
- if (IS_ERR(ref_clk)) {
- pr_err("%pOF: of_clk_get failed\n", node);
- return;
- }
-
hw = clk_hw_register_fixed_factor(NULL, name, parent_name, 0, mul, 1);
if (IS_ERR(hw)) {
pr_err("%pOF: failed to register clock\n", node);
@@ -56,7 +49,6 @@ static void __init moxart_of_apb_clk_init(struct device_node *node)
{
void __iomem *base;
struct clk_hw *hw;
- struct clk *pll_clk;
unsigned int div, val;
unsigned int div_idx[] = { 2, 3, 4, 6, 8};
const char *name = node->name;
@@ -78,12 +70,6 @@ static void __init moxart_of_apb_clk_init(struct device_node *node)
val = 0;
div = div_idx[val] * 2;
- pll_clk = of_clk_get(node, 0);
- if (IS_ERR(pll_clk)) {
- pr_err("%pOF: of_clk_get failed\n", node);
- return;
- }
-
hw = clk_hw_register_fixed_factor(NULL, name, parent_name, 0, 1, div);
if (IS_ERR(hw)) {
pr_err("%pOF: failed to register clock\n", node);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0331/1376] clk: nuvoton: ma35d1: fix ignored div_u64 return values in PLL freq calculation
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (329 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0330/1376] clk: moxart: remove unused variables, fix refcount leak Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0332/1376] clk: nuvoton: ma35d1: fix PLL_CTL1_FRAC bit field width and fractional calc Greg Kroah-Hartman
` (667 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Brian Masney, Joey Lu, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joey Lu <a0987203069@gmail.com>
[ Upstream commit b3a2223a7805c7e6759a32a5d6ca574ad07e2710 ]
div_u64() does not modify its argument in place; the return value must
be assigned. Both ma35d1_calc_smic_pll_freq() and ma35d1_calc_pll_freq()
called div_u64() and discarded the result, leaving pll_freq holding the
undivided product and thus returning a frequency orders of magnitude too
high.
Fixes: 691521a367cf ("clk: nuvoton: Add clock driver for ma35d1 clock controller")
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Joey Lu <a0987203069@gmail.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/nuvoton/clk-ma35d1-pll.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/clk/nuvoton/clk-ma35d1-pll.c b/drivers/clk/nuvoton/clk-ma35d1-pll.c
index ff3fb8b87c24b..9bb18fc371d17 100644
--- a/drivers/clk/nuvoton/clk-ma35d1-pll.c
+++ b/drivers/clk/nuvoton/clk-ma35d1-pll.c
@@ -92,7 +92,7 @@ static unsigned long ma35d1_calc_smic_pll_freq(u32 pll0_ctl0,
p = FIELD_GET(SPLL0_CTL0_OUTDIV, pll0_ctl0);
outdiv = 1 << p;
pll_freq = (u64)parent_rate * n;
- div_u64(pll_freq, m * outdiv);
+ pll_freq = div_u64(pll_freq, m * outdiv);
return pll_freq;
}
@@ -110,7 +110,7 @@ static unsigned long ma35d1_calc_pll_freq(u8 mode, u32 *reg_ctl, unsigned long p
if (mode == PLL_MODE_INT) {
pll_freq = (u64)parent_rate * n;
- div_u64(pll_freq, m * p);
+ pll_freq = div_u64(pll_freq, m * p);
} else {
x = FIELD_GET(PLL_CTL1_FRAC, reg_ctl[1]);
/* 2 decimal places floating to integer (ex. 1.23 to 123) */
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0332/1376] clk: nuvoton: ma35d1: fix PLL_CTL1_FRAC bit field width and fractional calc
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (330 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0331/1376] clk: nuvoton: ma35d1: fix ignored div_u64 return values in PLL freq calculation Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0333/1376] clk: nuvoton: ma35d1-pll: convert from round_rate() to determine_rate() Greg Kroah-Hartman
` (666 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Joey Lu, Brian Masney, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joey Lu <a0987203069@gmail.com>
[ Upstream commit 26de5aed72d80bd8aec2583134aca3597c64fda9 ]
PLL_CTL1_FRAC was defined as GENMASK(31, 24), covering only 8 bits.
The hardware fractional field occupies bits [31:8] (24 bits), so the
mask must be GENMASK(31, 8).
The previous fractional-mode calculation used FIELD_MAX(PLL_CTL1_FRAC)
as the denominator to obtain 2 decimal places. With the corrected 24-bit
mask the old divisor is wrong; replace the arithmetic with a proper
24-bit fixed-point rounding to 3 decimal places using the kernel's
DIV_ROUND_CLOSEST_ULL helper:
n_frac = n * 1000 + DIV_ROUND_CLOSEST_ULL(x * 1000, 1 << 24)
Fixes: 691521a367cf ("clk: nuvoton: Add clock driver for ma35d1 clock controller")
Signed-off-by: Joey Lu <a0987203069@gmail.com>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/nuvoton/clk-ma35d1-pll.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/clk/nuvoton/clk-ma35d1-pll.c b/drivers/clk/nuvoton/clk-ma35d1-pll.c
index 9bb18fc371d17..64f473fd770bc 100644
--- a/drivers/clk/nuvoton/clk-ma35d1-pll.c
+++ b/drivers/clk/nuvoton/clk-ma35d1-pll.c
@@ -48,7 +48,7 @@
#define PLL_CTL1_PD BIT(0)
#define PLL_CTL1_BP BIT(1)
#define PLL_CTL1_OUTDIV GENMASK(6, 4)
-#define PLL_CTL1_FRAC GENMASK(31, 24)
+#define PLL_CTL1_FRAC GENMASK(31, 8)
#define PLL_CTL2_SLOPE GENMASK(23, 0)
#define INDIV_MIN 1
@@ -113,9 +113,9 @@ static unsigned long ma35d1_calc_pll_freq(u8 mode, u32 *reg_ctl, unsigned long p
pll_freq = div_u64(pll_freq, m * p);
} else {
x = FIELD_GET(PLL_CTL1_FRAC, reg_ctl[1]);
- /* 2 decimal places floating to integer (ex. 1.23 to 123) */
- n = n * 100 + ((x * 100) / FIELD_MAX(PLL_CTL1_FRAC));
- pll_freq = div_u64(parent_rate * n, 100 * m * p);
+ /* convert 24-bit fraction to 3 decimal digits, rounding to closest */
+ n = n * 1000 + DIV_ROUND_CLOSEST_ULL((u64)x * 1000, 1ULL << 24);
+ pll_freq = div_u64((u64)parent_rate * n, 1000 * m * p);
}
return pll_freq;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0333/1376] clk: nuvoton: ma35d1-pll: convert from round_rate() to determine_rate()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (331 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0332/1376] clk: nuvoton: ma35d1: fix PLL_CTL1_FRAC bit field width and fractional calc Greg Kroah-Hartman
@ 2026-09-12 6:45 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0334/1376] clk: nuvoton: ma35d1: fix ma35d1_clk_pll_determine_rate logic Greg Kroah-Hartman
` (665 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Brian Masney, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Masney <bmasney@redhat.com>
[ Upstream commit cd9e9bbfd93be277e316ee854614e2c4cd502fa8 ]
The round_rate() clk ops is deprecated, so migrate this driver from
round_rate() to determine_rate() using the Coccinelle semantic patch
on the cover letter of this series.
Signed-off-by: Brian Masney <bmasney@redhat.com>
Stable-dep-of: e1311954cb60 ("clk: nuvoton: ma35d1: fix ma35d1_clk_pll_determine_rate logic")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/nuvoton/clk-ma35d1-pll.c | 28 ++++++++++++++++++----------
1 file changed, 18 insertions(+), 10 deletions(-)
diff --git a/drivers/clk/nuvoton/clk-ma35d1-pll.c b/drivers/clk/nuvoton/clk-ma35d1-pll.c
index 64f473fd770bc..eb9d69d2077b1 100644
--- a/drivers/clk/nuvoton/clk-ma35d1-pll.c
+++ b/drivers/clk/nuvoton/clk-ma35d1-pll.c
@@ -244,35 +244,43 @@ static unsigned long ma35d1_clk_pll_recalc_rate(struct clk_hw *hw, unsigned long
return 0;
}
-static long ma35d1_clk_pll_round_rate(struct clk_hw *hw, unsigned long rate,
- unsigned long *parent_rate)
+static int ma35d1_clk_pll_determine_rate(struct clk_hw *hw,
+ struct clk_rate_request *req)
{
struct ma35d1_clk_pll *pll = to_ma35d1_clk_pll(hw);
u32 reg_ctl[3] = { 0 };
unsigned long pll_freq;
long ret;
- if (*parent_rate < PLL_FREF_MIN_FREQ || *parent_rate > PLL_FREF_MAX_FREQ)
+ if (req->best_parent_rate < PLL_FREF_MIN_FREQ || req->best_parent_rate > PLL_FREF_MAX_FREQ)
return -EINVAL;
- ret = ma35d1_pll_find_closest(pll, rate, *parent_rate, reg_ctl, &pll_freq);
+ ret = ma35d1_pll_find_closest(pll, req->rate, req->best_parent_rate,
+ reg_ctl, &pll_freq);
if (ret < 0)
return ret;
switch (pll->id) {
case CAPLL:
reg_ctl[0] = readl_relaxed(pll->ctl0_base);
- pll_freq = ma35d1_calc_smic_pll_freq(reg_ctl[0], *parent_rate);
- return pll_freq;
+ pll_freq = ma35d1_calc_smic_pll_freq(reg_ctl[0], req->best_parent_rate);
+ req->rate = pll_freq;
+
+ return 0;
case DDRPLL:
case APLL:
case EPLL:
case VPLL:
reg_ctl[0] = readl_relaxed(pll->ctl0_base);
reg_ctl[1] = readl_relaxed(pll->ctl1_base);
- pll_freq = ma35d1_calc_pll_freq(pll->mode, reg_ctl, *parent_rate);
- return pll_freq;
+ pll_freq = ma35d1_calc_pll_freq(pll->mode, reg_ctl, req->best_parent_rate);
+ req->rate = pll_freq;
+
+ return 0;
}
+
+ req->rate = 0;
+
return 0;
}
@@ -311,12 +319,12 @@ static const struct clk_ops ma35d1_clk_pll_ops = {
.unprepare = ma35d1_clk_pll_unprepare,
.set_rate = ma35d1_clk_pll_set_rate,
.recalc_rate = ma35d1_clk_pll_recalc_rate,
- .round_rate = ma35d1_clk_pll_round_rate,
+ .determine_rate = ma35d1_clk_pll_determine_rate,
};
static const struct clk_ops ma35d1_clk_fixed_pll_ops = {
.recalc_rate = ma35d1_clk_pll_recalc_rate,
- .round_rate = ma35d1_clk_pll_round_rate,
+ .determine_rate = ma35d1_clk_pll_determine_rate,
};
struct clk_hw *ma35d1_reg_clk_pll(struct device *dev, u32 id, u8 u8mode, const char *name,
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0334/1376] clk: nuvoton: ma35d1: fix ma35d1_clk_pll_determine_rate logic
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (332 preceding siblings ...)
2026-09-12 6:45 ` [PATCH 6.12 0333/1376] clk: nuvoton: ma35d1-pll: convert from round_rate() to determine_rate() Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0335/1376] ASoC: rt700-sdw: always drain jack work on remove Greg Kroah-Hartman
` (664 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Joey Lu, Brian Masney, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joey Lu <a0987203069@gmail.com>
[ Upstream commit e1311954cb600d5f95cd9e2fe9a7376edc2ac3c5 ]
ma35d1_clk_pll_determine_rate() called ma35d1_pll_find_closest()
unconditionally before the switch statement, and then every case
branch overwrote pll_freq by reading the current hardware registers.
For CAPLL and DDRPLL this means find_closest() ran unnecessarily
(and incorrectly, since those PLLs are read-only) and its result
was silently discarded.
Fix by moving the find_closest() call inside the APLL/EPLL/VPLL
branch where it belongs. Group CAPLL and DDRPLL together as
read-only PLLs that simply report their current rate; handle them
with an explicit if/else to keep the CAPLL (SMIC design) and DDRPLL
(standard design) paths distinct.
Fixes: 691521a367cf ("clk: nuvoton: Add clock driver for ma35d1 clock controller")
Signed-off-by: Joey Lu <a0987203069@gmail.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/nuvoton/clk-ma35d1-pll.c | 26 +++++++++++++-------------
1 file changed, 13 insertions(+), 13 deletions(-)
diff --git a/drivers/clk/nuvoton/clk-ma35d1-pll.c b/drivers/clk/nuvoton/clk-ma35d1-pll.c
index eb9d69d2077b1..c7c0dc91a012c 100644
--- a/drivers/clk/nuvoton/clk-ma35d1-pll.c
+++ b/drivers/clk/nuvoton/clk-ma35d1-pll.c
@@ -255,32 +255,32 @@ static int ma35d1_clk_pll_determine_rate(struct clk_hw *hw,
if (req->best_parent_rate < PLL_FREF_MIN_FREQ || req->best_parent_rate > PLL_FREF_MAX_FREQ)
return -EINVAL;
- ret = ma35d1_pll_find_closest(pll, req->rate, req->best_parent_rate,
- reg_ctl, &pll_freq);
- if (ret < 0)
- return ret;
-
switch (pll->id) {
case CAPLL:
+ case DDRPLL:
+ /* Read-only PLLs: return current rate */
reg_ctl[0] = readl_relaxed(pll->ctl0_base);
- pll_freq = ma35d1_calc_smic_pll_freq(reg_ctl[0], req->best_parent_rate);
+ if (pll->id == CAPLL) {
+ pll_freq = ma35d1_calc_smic_pll_freq(reg_ctl[0], req->best_parent_rate);
+ } else {
+ reg_ctl[1] = readl_relaxed(pll->ctl1_base);
+ pll_freq = ma35d1_calc_pll_freq(pll->mode, reg_ctl, req->best_parent_rate);
+ }
req->rate = pll_freq;
-
return 0;
- case DDRPLL:
case APLL:
case EPLL:
case VPLL:
- reg_ctl[0] = readl_relaxed(pll->ctl0_base);
- reg_ctl[1] = readl_relaxed(pll->ctl1_base);
- pll_freq = ma35d1_calc_pll_freq(pll->mode, reg_ctl, req->best_parent_rate);
+ /* Configurable PLLs: find closest achievable rate */
+ ret = ma35d1_pll_find_closest(pll, req->rate, req->best_parent_rate,
+ reg_ctl, &pll_freq);
+ if (ret < 0)
+ return ret;
req->rate = pll_freq;
-
return 0;
}
req->rate = 0;
-
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0335/1376] ASoC: rt700-sdw: always drain jack work on remove
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (333 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0334/1376] clk: nuvoton: ma35d1: fix ma35d1_clk_pll_determine_rate logic Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0336/1376] ASoC: fsl_audmix: rework runtime PM handling in probe Greg Kroah-Hartman
` (663 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Mark Brown, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit 612ccf42acd14bb2685fa60c3495ca13e63e8989 ]
rt700_sdw_remove() drains jack_detect_work and jack_btn_check_work only
when rt700->hw_init is true. That state bit is cleared by
rt700_update_status() when the SoundWire slave becomes UNATTACHED, but a
jack work item can already have been queued by rt700_interrupt_callback()
or rt700_jack_init() while the device was initialized.
Do not use hw_init as the remove-time guard for draining these work
objects. The delayed works are initialized during rt700_init(), so remove
can cancel them unconditionally and pair the object lifetime with the
codec-private data lifetime instead of a mutable hardware state bit.
This issue was found by our static analysis tool and then confirmed by
manual review of the SoundWire status, interrupt and remove paths. The
remove path should drain work based on whether the work object exists, not
on a runtime hardware state bit that can change after the work was queued.
A QEMU PoC queued jack_detect_work, simulated SDW_SLAVE_UNATTACHED, and
then entered remove. DEBUG_OBJECTS reported an active timer/work object
associated with the rt700 jack work path after remove skipped the cancel.
This is sent as an RFC because the practical trigger depends on SoundWire
core remove ordering after an UNATTACHED status update. If remove cannot
run after hw_init has been cleared while jack work is still pending, this
is a defensive lifecycle cleanup rather than a reachable race on current
systems.
Fixes: 737ee8bdf682 ("ASoC: rt700-sdw: use cancel_work_sync() in .remove as well as .suspend")
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Link: https://patch.msgid.link/20260619122325.2504287-1-runyu.xiao@seu.edu.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/rt700-sdw.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/sound/soc/codecs/rt700-sdw.c b/sound/soc/codecs/rt700-sdw.c
index 24cb895b759f3..366a09aa32ee2 100644
--- a/sound/soc/codecs/rt700-sdw.c
+++ b/sound/soc/codecs/rt700-sdw.c
@@ -459,10 +459,8 @@ static int rt700_sdw_remove(struct sdw_slave *slave)
{
struct rt700_priv *rt700 = dev_get_drvdata(&slave->dev);
- if (rt700->hw_init) {
- cancel_delayed_work_sync(&rt700->jack_detect_work);
- cancel_delayed_work_sync(&rt700->jack_btn_check_work);
- }
+ cancel_delayed_work_sync(&rt700->jack_detect_work);
+ cancel_delayed_work_sync(&rt700->jack_btn_check_work);
pm_runtime_disable(&slave->dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0336/1376] ASoC: fsl_audmix: rework runtime PM handling in probe
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (334 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0335/1376] ASoC: rt700-sdw: always drain jack work on remove Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0337/1376] clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller Greg Kroah-Hartman
` (662 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Shengjiu Wang, Mark Brown,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <shengjiu.wang@nxp.com>
[ Upstream commit 3359ba93d01a23b2e4249e9e44ccfe48eb9c5d71 ]
After pm_runtime_enable() the AUDMIX block is powered off and stays
suspended until the first runtime resume. Register writes issued between
probe() and the first resume (e.g. from DAPM or ALSA control paths)
target unpowered hardware and cause a system hang.
Fix this by calling pm_runtime_resume_and_get() immediately after
pm_runtime_enable() to power the hardware up and enable its clocks.
Release the reference afterwards with pm_runtime_put() to allow the
runtime PM framework to suspend the device and switch the regmap to
cache-only mode when idle.
When CONFIG_PM is disabled or runtime PM is not enabled, pm_runtime_*
calls are stubs that do not power up the hardware. Handle this case
explicitly by calling fsl_audmix_runtime_resume() directly so the
hardware is always initialised and its clocks are enabled, ensuring
register accesses succeed regardless of PM configuration.
Fixes: be1df61cf06ef ("ASoC: fsl: Add Audio Mixer CPU DAI driver")
Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Link: https://patch.msgid.link/20260618023818.31618-1-shengjiu.wang@oss.nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/fsl/fsl_audmix.c | 24 ++++++++++++++++++++++--
1 file changed, 22 insertions(+), 2 deletions(-)
diff --git a/sound/soc/fsl/fsl_audmix.c b/sound/soc/fsl/fsl_audmix.c
index d9b0bd61755d5..c9a7a41ef388c 100644
--- a/sound/soc/fsl/fsl_audmix.c
+++ b/sound/soc/fsl/fsl_audmix.c
@@ -454,6 +454,9 @@ static const struct of_device_id fsl_audmix_ids[] = {
};
MODULE_DEVICE_TABLE(of, fsl_audmix_ids);
+static int fsl_audmix_runtime_resume(struct device *dev);
+static int fsl_audmix_runtime_suspend(struct device *dev);
+
static int fsl_audmix_probe(struct platform_device *pdev)
{
struct device *dev = &pdev->dev;
@@ -485,13 +488,25 @@ static int fsl_audmix_probe(struct platform_device *pdev)
spin_lock_init(&priv->lock);
platform_set_drvdata(pdev, priv);
pm_runtime_enable(dev);
+ if (!pm_runtime_enabled(dev)) {
+ ret = fsl_audmix_runtime_resume(dev);
+ if (ret)
+ goto err_disable_pm;
+ }
+
+ ret = pm_runtime_resume_and_get(dev);
+ if (ret < 0)
+ goto err_pm_get_sync;
+
+ /* To enable regmap cache only when runtime PM enabled */
+ pm_runtime_put(dev);
ret = devm_snd_soc_register_component(dev, &fsl_audmix_component,
fsl_audmix_dai,
ARRAY_SIZE(fsl_audmix_dai));
if (ret) {
dev_err(dev, "failed to register ASoC DAI\n");
- goto err_disable_pm;
+ goto err_pm_get_sync;
}
/*
@@ -503,12 +518,15 @@ static int fsl_audmix_probe(struct platform_device *pdev)
if (IS_ERR(priv->pdev)) {
ret = PTR_ERR(priv->pdev);
dev_err(dev, "failed to register platform: %d\n", ret);
- goto err_disable_pm;
+ goto err_pm_get_sync;
}
}
return 0;
+err_pm_get_sync:
+ if (!pm_runtime_status_suspended(dev))
+ fsl_audmix_runtime_suspend(dev);
err_disable_pm:
pm_runtime_disable(dev);
return ret;
@@ -519,6 +537,8 @@ static void fsl_audmix_remove(struct platform_device *pdev)
struct fsl_audmix *priv = dev_get_drvdata(&pdev->dev);
pm_runtime_disable(&pdev->dev);
+ if (!pm_runtime_status_suspended(&pdev->dev))
+ fsl_audmix_runtime_suspend(&pdev->dev);
if (priv->pdev)
platform_device_unregister(priv->pdev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0337/1376] clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (335 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0336/1376] ASoC: fsl_audmix: rework runtime PM handling in probe Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0338/1376] ARM: imx: fix device_node refcount leak in imx_src_init() Greg Kroah-Hartman
` (661 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Brian Masney, Min zhang, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Min zhang <zhangmin2026@yeah.net>
[ Upstream commit a8036f4591542de4b38ec81d3e2ba47bc0b2652b ]
Using devm_kmalloc() does not zero-initialize the allocated structure.
Uninitialized members in struct hisi_reset_controller may contain garbage
data, which can cause reset_controller_register() to fail unexpectedly.
Replace devm_kmalloc() with devm_kzalloc() to ensure all structure fields
are properly zero-initialized.
Fixes: 97b7129cd2afb ("reset: hisilicon: change the definition of hisi_reset_init")
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Min zhang <zhangmin2026@yeah.net>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/hisilicon/reset.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clk/hisilicon/reset.c b/drivers/clk/hisilicon/reset.c
index 93cee17db8b16..c3b7daac93132 100644
--- a/drivers/clk/hisilicon/reset.c
+++ b/drivers/clk/hisilicon/reset.c
@@ -91,7 +91,7 @@ struct hisi_reset_controller *hisi_reset_init(struct platform_device *pdev)
{
struct hisi_reset_controller *rstc;
- rstc = devm_kmalloc(&pdev->dev, sizeof(*rstc), GFP_KERNEL);
+ rstc = devm_kzalloc(&pdev->dev, sizeof(*rstc), GFP_KERNEL);
if (!rstc)
return NULL;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0338/1376] ARM: imx: fix device_node refcount leak in imx_src_init()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (336 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0337/1376] clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0339/1376] ARM: imx: fix device_node refcount leaks in imx7_src_init() Greg Kroah-Hartman
` (660 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Weigang He, Frank Li, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weigang He <geoffreyhe2@gmail.com>
[ Upstream commit 936407c3563ac745cbbb9953c0cf2472128a22f4 ]
imx_src_init() obtains a device_node reference via
of_find_compatible_node() matching "fsl,imx51-src" and uses it only to
call of_iomap(). It never releases that reference: on the success path
the function returns at the end without of_node_put(np), leaking one
device_node refcount on every boot of an i.MX5/6 platform.
Release the reference right after of_iomap(). of_iomap() maps the
node's registers but does not retain a reference to the device_node, so
the node can be put once the mapping is done. The early return on a NULL
np needs no put.
Found by static analysis tool CodeQL.
Fixes: bd3d924d71a4 ("ARM i.MX5: Add System Reset Controller (SRC) support for i.MX51 and i.MX53")
Signed-off-by: Weigang He <geoffreyhe2@gmail.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mach-imx/src.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm/mach-imx/src.c b/arch/arm/mach-imx/src.c
index 59a8e8cc44693..f28bfb653a88f 100644
--- a/arch/arm/mach-imx/src.c
+++ b/arch/arm/mach-imx/src.c
@@ -171,6 +171,7 @@ void __init imx_src_init(void)
if (!np)
return;
src_base = of_iomap(np, 0);
+ of_node_put(np);
WARN_ON(!src_base);
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0339/1376] ARM: imx: fix device_node refcount leaks in imx7_src_init()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (337 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0338/1376] ARM: imx: fix device_node refcount leak in imx_src_init() Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0340/1376] arm64: dts: imx93-kontron: set memory node to 0x80000000/1GiB Greg Kroah-Hartman
` (659 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Weigang He, Frank Li, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weigang He <geoffreyhe2@gmail.com>
[ Upstream commit 3de939b2ac843d56d88e2ab1e1b1f667cba9e1d4 ]
imx7_src_init() obtains two device_node references via
of_find_compatible_node() - one for "fsl,imx7d-src" and one for
"fsl,imx7d-gpc" - reusing the same np variable, but never calls
of_node_put() on either. On every i.MX7D boot up to two device_node
refcounts are leaked:
- The "fsl,imx7d-src" node is leaked both when of_iomap() fails (the
early return after the mapping) and when it succeeds, because np is
then overwritten by the second of_find_compatible_node() call
without releasing the prior reference.
- The "fsl,imx7d-gpc" node is leaked on every path leaving the
function after it is acquired.
Release each reference immediately after of_iomap() consumes the node.
of_iomap() maps the node's registers but does not retain a reference to
the device_node, so it is safe to put the node once mapped; this also
drops the first reference before np is reused for the second lookup.
Found by static analysis tool CodeQL.
Fixes: e34645f45805 ("ARM: imx: add smp support for imx7d")
Signed-off-by: Weigang He <geoffreyhe2@gmail.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mach-imx/src.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/arm/mach-imx/src.c b/arch/arm/mach-imx/src.c
index f28bfb653a88f..c3c80b4c3d53b 100644
--- a/arch/arm/mach-imx/src.c
+++ b/arch/arm/mach-imx/src.c
@@ -196,6 +196,7 @@ void __init imx7_src_init(void)
return;
src_base = of_iomap(np, 0);
+ of_node_put(np);
if (!src_base)
return;
@@ -204,6 +205,7 @@ void __init imx7_src_init(void)
return;
gpc_base = of_iomap(np, 0);
+ of_node_put(np);
if (!gpc_base)
return;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0340/1376] arm64: dts: imx93-kontron: set memory node to 0x80000000/1GiB
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (338 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0339/1376] ARM: imx: fix device_node refcount leaks in imx7_src_init() Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0341/1376] clk: imx: scu: drop redundant init.ops variable assignment Greg Kroah-Hartman
` (658 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Frieder Schrempf, Frank Li,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frieder Schrempf <frieder.schrempf@kontron.de>
[ Upstream commit 9c269fe7eae8cb60d8d6c326dd8955818722fae9 ]
The start address of the DRAM area is 0x80000000. The minimal size of the
DDR on the SoM is 1 GiB.
Fixes: 2b52fd6035b7 ("arm64: dts: Add support for Kontron i.MX93 OSM-S SoM and BL carrier board")
Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/freescale/imx93-kontron-osm-s.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/freescale/imx93-kontron-osm-s.dtsi b/arch/arm64/boot/dts/freescale/imx93-kontron-osm-s.dtsi
index 47c1363a2f99a..dd5da2789bc70 100644
--- a/arch/arm64/boot/dts/freescale/imx93-kontron-osm-s.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx93-kontron-osm-s.dtsi
@@ -15,9 +15,9 @@ aliases {
rtc1 = &bbnsm_rtc;
};
- memory@40000000 {
+ memory@80000000 {
device_type = "memory";
- reg = <0x0 0x40000000 0 0x80000000>;
+ reg = <0x0 0x80000000 0 0x40000000>;
};
chosen {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0341/1376] clk: imx: scu: drop redundant init.ops variable assignment
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (339 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0340/1376] arm64: dts: imx93-kontron: set memory node to 0x80000000/1GiB Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0342/1376] drm/lima: call drm_mm_init() with a valid allocation range Greg Kroah-Hartman
` (657 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Peng Fan, Brian Masney, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Masney <bmasney@redhat.com>
[ Upstream commit 5f2db1ce201216e81333ecc2ab51494410b2fe0d ]
The init.ops is assigned a default value, however right below it is an
if, else if, and else where all of them also assign a value to init.ops.
Drop the redundant init.ops assignment at the top.
Fixes: 3b9ea606cda53 ("clk: imx: scu: add cpu frequency scaling support")
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/imx/clk-scu.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/clk/imx/clk-scu.c b/drivers/clk/imx/clk-scu.c
index 75a6d91c0711c..ffbb05fb91bc7 100644
--- a/drivers/clk/imx/clk-scu.c
+++ b/drivers/clk/imx/clk-scu.c
@@ -483,7 +483,6 @@ struct clk_hw *__imx_clk_scu(struct device *dev, const char *name,
clk->clk_type = clk_type;
init.name = name;
- init.ops = &clk_scu_ops;
if (rsrc_id == IMX_SC_R_A35 || rsrc_id == IMX_SC_R_A53 || rsrc_id == IMX_SC_R_A72)
init.ops = &clk_scu_cpu_ops;
else if (rsrc_id == IMX_SC_R_PI_0_PLL)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0342/1376] drm/lima: call drm_mm_init() with a valid allocation range
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (340 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0341/1376] clk: imx: scu: drop redundant init.ops variable assignment Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0343/1376] mm/mm_init: fix incorrect node_spanned_pages Greg Kroah-Hartman
` (656 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Henrik Grimler, Qiang Yu,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henrik Grimler <henrik.grimler@axis.com>
[ Upstream commit 3b3bce4a692ac60d9f4a341e6b597dd1fd0a28f9 ]
lima_vm_create() is currently run before va_start and va_end are set up,
meaning they are both 0. lima_vm_create() runs drm_mm_init() with them
as arguments for the allocator, and if DRM_DEBUG_MM is enabled the
DRM_MM_BUG_ON check in drm_mm_init then fires, as seen here on
exynos4412-odroid-u2:
[ 1.736297] ------------[ cut here ]------------
[ 1.740370] kernel BUG at drivers/gpu/drm/drm_mm.c:931!
[ 1.745574] Internal error: Oops - BUG: 0 [#1] SMP ARM
[ 1.750697] Modules linked in:
[ 1.753734] CPU: 0 UID: 0 PID: 41 Comm: kworker/u16:1 Not tainted 7.0.10-postmarketos-exynos4 #11 PREEMPT
[ 1.763372] Hardware name: Samsung Exynos (Flattened Device Tree)
[ 1.769446] Workqueue: events_unbound deferred_probe_work_func
[ 1.775261] PC is at drm_mm_init+0x9c/0xa4
[ 1.779339] LR is at lima_vm_create+0x144/0x17c
[ ... ]
Fix the issue by moving the lima_vm_create() call after va_start and
va_end are set up.
Fixes: a1d2a6339961 ("drm/lima: driver for ARM Mali4xx GPUs")
Signed-off-by: Henrik Grimler <henrik.grimler@axis.com>
Signed-off-by: Qiang Yu <yuq825@gmail.com>
Link: https://patch.msgid.link/20260601-lima-alloc-fix-v1-1-16d3f3b7b780@axis.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/lima/lima_device.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/lima/lima_device.c b/drivers/gpu/drm/lima/lima_device.c
index 0bf7105c8748b..7c873e62c16da 100644
--- a/drivers/gpu/drm/lima/lima_device.c
+++ b/drivers/gpu/drm/lima/lima_device.c
@@ -368,12 +368,6 @@ int lima_device_init(struct lima_device *ldev)
if (err)
goto err_out0;
- ldev->empty_vm = lima_vm_create(ldev);
- if (!ldev->empty_vm) {
- err = -ENOMEM;
- goto err_out1;
- }
-
ldev->va_start = 0;
if (ldev->id == lima_gpu_mali450) {
ldev->va_end = LIMA_VA_RESERVE_START;
@@ -387,6 +381,12 @@ int lima_device_init(struct lima_device *ldev)
} else
ldev->va_end = LIMA_VA_RESERVE_END;
+ ldev->empty_vm = lima_vm_create(ldev);
+ if (!ldev->empty_vm) {
+ err = -ENOMEM;
+ goto err_out1;
+ }
+
ldev->iomem = devm_platform_ioremap_resource(pdev, 0);
if (IS_ERR(ldev->iomem)) {
dev_err(ldev->dev, "fail to ioremap iomem\n");
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0343/1376] mm/mm_init: fix incorrect node_spanned_pages
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (341 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0342/1376] drm/lima: call drm_mm_init() with a valid allocation range Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0344/1376] sched/fair: Fix overflow in update_tg_cfs_runnable() Greg Kroah-Hartman
` (655 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wei Yang, Yuan Liu,
Mike Rapoport (Microsoft), Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Yang <richard.weiyang@gmail.com>
[ Upstream commit 7783dcd79ae9c4aa48bc47bd4275772445dc4b2a ]
Current node_spanned_pages is got as a summation of all zone's spanned page
in calculate_node_totalpages(). Generally this is good, but if we use
kernelcore=mirror, it is would be wrong.
Without kernelcore=mirror:
The test machine has below memory layout:
memory[0x0] [0x0000000000001000-0x000000000009efff], 0x000000000009e000 bytes on node 0 flags: 0x0
memory[0x1] [0x0000000000100000-0x00000000bffdefff], 0x00000000bfedf000 bytes on node 0 flags: 0x0
memory[0x2] [0x0000000100000000-0x00000001bfffffff], 0x00000000c0000000 bytes on node 0 flags: 0x0
And the Zone range is:
DMA [mem 0x0000000000001000-0x0000000000ffffff]
DMA32 [mem 0x0000000001000000-0x00000000ffffffff]
Normal [mem 0x0000000100000000-0x00000001bfffffff]
Then we see, with spanned_pages printed:
On node 0 spanned_pages: 1835007 totalpages: 1572733
With kernelcore=mirror:
The test machine has below memory layout:
memory[0x0] [0x0000000000001000-0x000000000009efff], 0x000000000009e000 bytes on node 0 flags: 0x2
memory[0x1] [0x0000000000100000-0x00000000bffdefff], 0x00000000bfedf000 bytes on node 0 flags: 0x2
memory[0x2] [0x0000000100000000-0x000000013fffffff], 0x0000000040000000 bytes on node 0 flags: 0x2
memory[0x3] [0x0000000140000000-0x00000001bfffffff], 0x0000000080000000 bytes on node 0 flags: 0x0
And the Zone range is:
DMA [mem 0x0000000000001000-0x0000000000ffffff]
DMA32 [mem 0x0000000001000000-0x00000000ffffffff]
Normal [mem 0x0000000100000000-0x00000001bfffffff]
Device empty
Movable zone start for each node
Node 0: 0x0000000140000000
Then we see, with spanned_pages printed:
On node 0 spanned_pages: 2359295 totalpages: 1572733
The total range of memory on node 0 doesn't change, but the spanned_pages
becomes much larger.
The reason is when kernelcore=mirror is specified, the range of Zone Normal
and Zone Movable would overlap. So the overlapped range would be calculated
twice.
A wrong node_spanned_pages would effect defer_init(), since each
zone_end_pfn is less than pgdat_end_pfn().
As we already passed in node_start_pfn and node_end_pfn, fix this by get it
from (node_start_pfn - node_end_pfn) directly.
Fixes: 342332e6a925 ("mm/page_alloc.c: introduce kernelcore=mirror option")
Signed-off-by: Wei Yang <richard.weiyang@gmail.com>
Cc: Yuan Liu <yuan1.liu@intel.com>
Link: https://patch.msgid.link/20260622022403.16375-1-richard.weiyang@gmail.com
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/mm_init.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/mm/mm_init.c b/mm/mm_init.c
index 21e01537c9f5f..c8ac7f206f941 100644
--- a/mm/mm_init.c
+++ b/mm/mm_init.c
@@ -1310,7 +1310,7 @@ static void __init calculate_node_totalpages(struct pglist_data *pgdat,
unsigned long node_start_pfn,
unsigned long node_end_pfn)
{
- unsigned long realtotalpages = 0, totalpages = 0;
+ unsigned long realtotalpages = 0;
enum zone_type i;
for (i = 0; i < MAX_NR_ZONES; i++) {
@@ -1340,11 +1340,10 @@ static void __init calculate_node_totalpages(struct pglist_data *pgdat,
zone->present_early_pages = real_size;
#endif
- totalpages += spanned;
realtotalpages += real_size;
}
- pgdat->node_spanned_pages = totalpages;
+ pgdat->node_spanned_pages = node_end_pfn - node_start_pfn;
pgdat->node_present_pages = realtotalpages;
pr_debug("On node %d totalpages: %lu\n", pgdat->node_id, realtotalpages);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0344/1376] sched/fair: Fix overflow in update_tg_cfs_runnable()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (342 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0343/1376] mm/mm_init: fix incorrect node_spanned_pages Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0345/1376] perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails Greg Kroah-Hartman
` (654 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chen Yu, Peter Zijlstra (Intel),
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen, Yu C <yu.c.chen@intel.com>
[ Upstream commit 4f166adb5cb0525d9e32d45729fd8f28c80acbee ]
A divide-by-zero crash is observed when running hackbench:
[14697.488452] CPU: 112 UID: 0 PID: 124791 Comm: hackbench Not tainted 7.1.0-rc2+
[14697.492627] RIP: 0010:propagate_entity_load_avg+0x35f/0x3e0
[14697.506799] <TASK>
[14697.507411] __dequeue_task+0x2b4/0xc70
[14697.508677] dequeue_task_fair+0x36/0x370
[14697.509047] dequeue_task+0x101/0x2f0
[14697.509426] __schedule+0x1b1/0x1a00
[14697.510868] anon_pipe_read+0x3da/0x450
[14697.511400] vfs_read+0x361/0x390
[14697.512053] __x64_sys_read+0x19/0x30
The divide-by-zero happens here:
if (scale_load_down(gcfs_rq->load.weight)) {
load_sum = div_u64(gcfs_rq->avg.load_sum,
scale_load_down(gcfs_rq->load.weight));
}
gcfs_rq->load.weight is an insane large value and is truncated
to the lower 32 bits by div_u64, which happen to be 0.
Using AI for investigation, the cause is a u32 overflow in
update_tg_cfs_runnable(), and flat pickup became a victim when using
tg_tasks():
u32 new_sum, divider;
...
new_sum = se->avg.runnable_avg * divider; <-- boom
The following sequence shows how this triggers the crash:
propagate_entity_load_avg()
update_tg_cfs_runnable() # u32 overflow corrupts runnable_sum
__update_load_avg_cfs_rq()
___update_load_avg() # computes insane runnable_avg
update_tg_load_avg() # propagates to tg->runnable_avg
update_cfs_group()
calc_concur_shares()
tg_tasks() # long-to-int truncation, negative nr
reweight_entity() # corrupted se->load.weight
update_load_add() # corrupted cfs_rq->load.weight
propagate_entity_load_avg()
update_tg_cfs_load()
div_u64() # divide-by-zero
Fix by widening new_sum from u32 to u64 (no need to force tg_tasks()
to return unsigned long after this fix)
Fixes: 95246d1ec80b ("sched/pelt: Relax the sync of runnable_sum with runnable_avg")
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Chen Yu <yu.c.chen@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/a22eea2b-4c4a-4623-9a44-d7b18c0c91c8@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sched/fair.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 5a09448e22c33..4be1df2b90df0 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -4416,7 +4416,8 @@ static inline void
update_tg_cfs_runnable(struct cfs_rq *cfs_rq, struct sched_entity *se, struct cfs_rq *gcfs_rq)
{
long delta_sum, delta_avg = gcfs_rq->avg.runnable_avg - se->avg.runnable_avg;
- u32 new_sum, divider;
+ u64 new_sum;
+ u32 divider;
/* Nothing to update */
if (!delta_avg)
@@ -4430,7 +4431,7 @@ update_tg_cfs_runnable(struct cfs_rq *cfs_rq, struct sched_entity *se, struct cf
/* Set new sched_entity's runnable */
se->avg.runnable_avg = gcfs_rq->avg.runnable_avg;
- new_sum = se->avg.runnable_avg * divider;
+ new_sum = (u64)se->avg.runnable_avg * divider;
delta_sum = (long)new_sum - (long)se->avg.runnable_sum;
se->avg.runnable_sum = new_sum;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0345/1376] perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (343 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0344/1376] sched/fair: Fix overflow in update_tg_cfs_runnable() Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0346/1376] pinctrl: bcm2835: Dont remove an unregistered GPIO chip Greg Kroah-Hartman
` (653 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zide Chen, Peter Zijlstra (Intel),
Ian Rogers, Dapeng Mi, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zide Chen <zide.chen@intel.com>
[ Upstream commit 3012af7df3430788eddd30b3c6654d0a0a5f06c6 ]
uncore_event_cpu_online() returns -ENOMEM early when both the MSR and
MMIO box allocations fail. This also aborts PCI uncore setup, even
though PCI PMUs are independent of the MSR/MMIO paths.
Remove the early return so PCI uncore setup always runs regardless
of whether MSR or MMIO box allocation succeeds.
Fixes: 3da04b8a00dd ("perf/x86/intel/uncore: Support MMIO type uncore blocks")
Signed-off-by: Zide Chen <zide.chen@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Ian Rogers <irogers@google.com>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://patch.msgid.link/20260611160033.66760-5-zide.chen@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/events/intel/uncore.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c
index 96607174a0a93..2736815e651c7 100644
--- a/arch/x86/events/intel/uncore.c
+++ b/arch/x86/events/intel/uncore.c
@@ -1629,8 +1629,6 @@ static int uncore_event_cpu_online(unsigned int cpu)
die = topology_logical_die_id(cpu);
msr_ret = uncore_box_ref(uncore_msr_uncores, die, cpu);
mmio_ret = uncore_box_ref(uncore_mmio_uncores, die, cpu);
- if (msr_ret && mmio_ret)
- return -ENOMEM;
/*
* Check if there is an online cpu in the package
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0346/1376] pinctrl: bcm2835: Dont remove an unregistered GPIO chip
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (344 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0345/1376] perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0347/1376] riscv: kexec_file: Split the loading of kernel and others Greg Kroah-Hartman
` (652 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel McCarthy, Linus Walleij,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel McCarthy <daniel@dragonzap.com>
[ Upstream commit 32711f77db0641e57fd96fdc013bf1286b9f2514 ]
If the devm_pinctrl_register() function fails,
bcm2835_pinctrl_probe() calls gpiochip_remove()
before gpiochip_add_data() has registered the GPIO chip.
This means that upon failure the gpio_chip.gpiodev
is NULL resulting in a null pointer dereference
inside the gpiochip_remove() function.
Remove the unnecessary function call to gpiochip_remove().
No GPIO cleanup is required because the GPIO chip
has not yet been registered. Without this change there
is potential for a kernel panic upon registration failure
Fixes: 266423e60ea1 ("pinctrl: bcm2835: Change init order for gpio hogs")
Signed-off-by: Daniel McCarthy <daniel@dragonzap.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/bcm/pinctrl-bcm2835.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
index cc1fe0555e196..5e31a5704fcc9 100644
--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
@@ -1348,7 +1348,6 @@ static int bcm2835_pinctrl_probe(struct platform_device *pdev)
pc->pctl_desc = *pdata->pctl_desc;
pc->pctl_dev = devm_pinctrl_register(dev, &pc->pctl_desc, pc);
if (IS_ERR(pc->pctl_dev)) {
- gpiochip_remove(&pc->gpio_chip);
return PTR_ERR(pc->pctl_dev);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0347/1376] riscv: kexec_file: Split the loading of kernel and others
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (345 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0346/1376] pinctrl: bcm2835: Dont remove an unregistered GPIO chip Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0348/1376] riscv: kexec_file: Fix crashk_low_res not exclude bug Greg Kroah-Hartman
` (651 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Song Shuai, Björn Töpel,
Alexandre Ghiti, Palmer Dabbelt, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Song Shuai <songshuaishuai@tinylab.org>
[ Upstream commit 1df45f8a9fea5a7513bd1bad98604ce1fbefcaaf ]
This is the preparative patch for kexec_file_load Image support.
It separates the elf_kexec_load() as two parts:
- the first part loads the vmlinux (or Image)
- the second part loads other segments (e.g. initrd,fdt,purgatory)
And the second part is exported as the load_extra_segments() function
which would be used in both kexec-elf.c and kexec-image.c.
No functional change intended.
Signed-off-by: Song Shuai <songshuaishuai@tinylab.org>
Signed-off-by: Björn Töpel <bjorn@rivosinc.com>
Link: https://lore.kernel.org/r/20250409193004.643839-2-bjorn@kernel.org
Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com>
Signed-off-by: Palmer Dabbelt <palmer@dabbelt.com>
Stable-dep-of: 5fc6e7d45373 ("riscv: kexec_file: Fix crashk_low_res not exclude bug")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/riscv/include/asm/kexec.h | 5 +
arch/riscv/kernel/Makefile | 2 +-
arch/riscv/kernel/elf_kexec.c | 485 -------------------------
arch/riscv/kernel/kexec_elf.c | 144 ++++++++
arch/riscv/kernel/machine_kexec_file.c | 360 ++++++++++++++++++
5 files changed, 510 insertions(+), 486 deletions(-)
delete mode 100644 arch/riscv/kernel/elf_kexec.c
create mode 100644 arch/riscv/kernel/kexec_elf.c
diff --git a/arch/riscv/include/asm/kexec.h b/arch/riscv/include/asm/kexec.h
index 2b56769cb530c..518825fe4160c 100644
--- a/arch/riscv/include/asm/kexec.h
+++ b/arch/riscv/include/asm/kexec.h
@@ -67,6 +67,11 @@ int arch_kexec_apply_relocations_add(struct purgatory_info *pi,
struct kimage;
int arch_kimage_file_post_load_cleanup(struct kimage *image);
#define arch_kimage_file_post_load_cleanup arch_kimage_file_post_load_cleanup
+
+int load_extra_segments(struct kimage *image, unsigned long kernel_start,
+ unsigned long kernel_len, char *initrd,
+ unsigned long initrd_len, char *cmdline,
+ unsigned long cmdline_len);
#endif
#endif
diff --git a/arch/riscv/kernel/Makefile b/arch/riscv/kernel/Makefile
index 6b3b5255c8892..0678650817d4f 100644
--- a/arch/riscv/kernel/Makefile
+++ b/arch/riscv/kernel/Makefile
@@ -106,7 +106,7 @@ obj-$(CONFIG_HOTPLUG_CPU) += cpu-hotplug.o
obj-$(CONFIG_PARAVIRT) += paravirt.o
obj-$(CONFIG_KGDB) += kgdb.o
obj-$(CONFIG_KEXEC_CORE) += kexec_relocate.o crash_save_regs.o machine_kexec.o
-obj-$(CONFIG_KEXEC_FILE) += elf_kexec.o machine_kexec_file.o
+obj-$(CONFIG_KEXEC_FILE) += kexec_elf.o machine_kexec_file.o
obj-$(CONFIG_CRASH_DUMP) += crash_dump.o
obj-$(CONFIG_VMCORE_INFO) += vmcore_info.o
diff --git a/arch/riscv/kernel/elf_kexec.c b/arch/riscv/kernel/elf_kexec.c
deleted file mode 100644
index e783a72d051f4..0000000000000
--- a/arch/riscv/kernel/elf_kexec.c
+++ /dev/null
@@ -1,485 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-only
-/*
- * Load ELF vmlinux file for the kexec_file_load syscall.
- *
- * Copyright (C) 2021 Huawei Technologies Co, Ltd.
- *
- * Author: Liao Chang (liaochang1@huawei.com)
- *
- * Based on kexec-tools' kexec-elf-riscv.c, heavily modified
- * for kernel.
- */
-
-#define pr_fmt(fmt) "kexec_image: " fmt
-
-#include <linux/elf.h>
-#include <linux/kexec.h>
-#include <linux/slab.h>
-#include <linux/of.h>
-#include <linux/libfdt.h>
-#include <linux/types.h>
-#include <linux/memblock.h>
-#include <linux/vmalloc.h>
-#include <asm/setup.h>
-
-int arch_kimage_file_post_load_cleanup(struct kimage *image)
-{
- kvfree(image->arch.fdt);
- image->arch.fdt = NULL;
-
- vfree(image->elf_headers);
- image->elf_headers = NULL;
- image->elf_headers_sz = 0;
-
- return kexec_image_post_load_cleanup_default(image);
-}
-
-static int riscv_kexec_elf_load(struct kimage *image, struct elfhdr *ehdr,
- struct kexec_elf_info *elf_info, unsigned long old_pbase,
- unsigned long new_pbase)
-{
- int i;
- int ret = 0;
- size_t size;
- struct kexec_buf kbuf;
- const struct elf_phdr *phdr;
-
- kbuf.image = image;
-
- for (i = 0; i < ehdr->e_phnum; i++) {
- phdr = &elf_info->proghdrs[i];
- if (phdr->p_type != PT_LOAD)
- continue;
-
- size = phdr->p_filesz;
- if (size > phdr->p_memsz)
- size = phdr->p_memsz;
-
- kbuf.buffer = (void *) elf_info->buffer + phdr->p_offset;
- kbuf.bufsz = size;
- kbuf.buf_align = phdr->p_align;
- kbuf.mem = phdr->p_paddr - old_pbase + new_pbase;
- kbuf.memsz = phdr->p_memsz;
- kbuf.top_down = false;
- ret = kexec_add_buffer(&kbuf);
- if (ret)
- break;
- }
-
- return ret;
-}
-
-/*
- * Go through the available phsyical memory regions and find one that hold
- * an image of the specified size.
- */
-static int elf_find_pbase(struct kimage *image, unsigned long kernel_len,
- struct elfhdr *ehdr, struct kexec_elf_info *elf_info,
- unsigned long *old_pbase, unsigned long *new_pbase)
-{
- int i;
- int ret;
- struct kexec_buf kbuf;
- const struct elf_phdr *phdr;
- unsigned long lowest_paddr = ULONG_MAX;
- unsigned long lowest_vaddr = ULONG_MAX;
-
- for (i = 0; i < ehdr->e_phnum; i++) {
- phdr = &elf_info->proghdrs[i];
- if (phdr->p_type != PT_LOAD)
- continue;
-
- if (lowest_paddr > phdr->p_paddr)
- lowest_paddr = phdr->p_paddr;
-
- if (lowest_vaddr > phdr->p_vaddr)
- lowest_vaddr = phdr->p_vaddr;
- }
-
- kbuf.image = image;
- kbuf.buf_min = lowest_paddr;
- kbuf.buf_max = ULONG_MAX;
-
- /*
- * Current riscv boot protocol requires 2MB alignment for
- * RV64 and 4MB alignment for RV32
- *
- */
- kbuf.buf_align = PMD_SIZE;
- kbuf.mem = KEXEC_BUF_MEM_UNKNOWN;
- kbuf.memsz = ALIGN(kernel_len, PAGE_SIZE);
- kbuf.top_down = false;
- ret = arch_kexec_locate_mem_hole(&kbuf);
- if (!ret) {
- *old_pbase = lowest_paddr;
- *new_pbase = kbuf.mem;
- image->start = ehdr->e_entry - lowest_vaddr + kbuf.mem;
- }
- return ret;
-}
-
-#ifdef CONFIG_CRASH_DUMP
-static int get_nr_ram_ranges_callback(struct resource *res, void *arg)
-{
- unsigned int *nr_ranges = arg;
-
- (*nr_ranges)++;
- return 0;
-}
-
-static int prepare_elf64_ram_headers_callback(struct resource *res, void *arg)
-{
- struct crash_mem *cmem = arg;
-
- cmem->ranges[cmem->nr_ranges].start = res->start;
- cmem->ranges[cmem->nr_ranges].end = res->end;
- cmem->nr_ranges++;
-
- return 0;
-}
-
-static int prepare_elf_headers(void **addr, unsigned long *sz)
-{
- struct crash_mem *cmem;
- unsigned int nr_ranges;
- int ret;
-
- nr_ranges = 1; /* For exclusion of crashkernel region */
- walk_system_ram_res(0, -1, &nr_ranges, get_nr_ram_ranges_callback);
-
- cmem = kmalloc(struct_size(cmem, ranges, nr_ranges), GFP_KERNEL);
- if (!cmem)
- return -ENOMEM;
-
- cmem->max_nr_ranges = nr_ranges;
- cmem->nr_ranges = 0;
- ret = walk_system_ram_res(0, -1, cmem, prepare_elf64_ram_headers_callback);
- if (ret)
- goto out;
-
- /* Exclude crashkernel region */
- ret = crash_exclude_mem_range(cmem, crashk_res.start, crashk_res.end);
- if (!ret)
- ret = crash_prepare_elf64_headers(cmem, true, addr, sz);
-
-out:
- kfree(cmem);
- return ret;
-}
-
-static char *setup_kdump_cmdline(struct kimage *image, char *cmdline,
- unsigned long cmdline_len)
-{
- int elfcorehdr_strlen;
- char *cmdline_ptr;
-
- cmdline_ptr = kzalloc(COMMAND_LINE_SIZE, GFP_KERNEL);
- if (!cmdline_ptr)
- return NULL;
-
- elfcorehdr_strlen = sprintf(cmdline_ptr, "elfcorehdr=0x%lx ",
- image->elf_load_addr);
-
- if (elfcorehdr_strlen + cmdline_len > COMMAND_LINE_SIZE) {
- pr_err("Appending elfcorehdr=<addr> exceeds cmdline size\n");
- kfree(cmdline_ptr);
- return NULL;
- }
-
- memcpy(cmdline_ptr + elfcorehdr_strlen, cmdline, cmdline_len);
- /* Ensure it's nul terminated */
- cmdline_ptr[COMMAND_LINE_SIZE - 1] = '\0';
- return cmdline_ptr;
-}
-#endif
-
-static void *elf_kexec_load(struct kimage *image, char *kernel_buf,
- unsigned long kernel_len, char *initrd,
- unsigned long initrd_len, char *cmdline,
- unsigned long cmdline_len)
-{
- int ret;
- void *fdt;
- unsigned long old_kernel_pbase = ULONG_MAX;
- unsigned long new_kernel_pbase = 0UL;
- unsigned long initrd_pbase = 0UL;
- unsigned long kernel_start;
- struct elfhdr ehdr;
- struct kexec_buf kbuf;
- struct kexec_elf_info elf_info;
- char *modified_cmdline = NULL;
-
- ret = kexec_build_elf_info(kernel_buf, kernel_len, &ehdr, &elf_info);
- if (ret)
- return ERR_PTR(ret);
-
- ret = elf_find_pbase(image, kernel_len, &ehdr, &elf_info,
- &old_kernel_pbase, &new_kernel_pbase);
- if (ret)
- goto out;
- kernel_start = image->start;
-
- /* Add the kernel binary to the image */
- ret = riscv_kexec_elf_load(image, &ehdr, &elf_info,
- old_kernel_pbase, new_kernel_pbase);
- if (ret)
- goto out;
-
- kbuf.image = image;
- kbuf.buf_min = new_kernel_pbase + kernel_len;
- kbuf.buf_max = ULONG_MAX;
-
-#ifdef CONFIG_CRASH_DUMP
- /* Add elfcorehdr */
- if (image->type == KEXEC_TYPE_CRASH) {
- void *headers;
- unsigned long headers_sz;
- ret = prepare_elf_headers(&headers, &headers_sz);
- if (ret) {
- pr_err("Preparing elf core header failed\n");
- goto out;
- }
-
- kbuf.buffer = headers;
- kbuf.bufsz = headers_sz;
- kbuf.mem = KEXEC_BUF_MEM_UNKNOWN;
- kbuf.memsz = headers_sz;
- kbuf.buf_align = ELF_CORE_HEADER_ALIGN;
- kbuf.top_down = true;
-
- ret = kexec_add_buffer(&kbuf);
- if (ret) {
- vfree(headers);
- goto out;
- }
- image->elf_headers = headers;
- image->elf_load_addr = kbuf.mem;
- image->elf_headers_sz = headers_sz;
-
- kexec_dprintk("Loaded elf core header at 0x%lx bufsz=0x%lx memsz=0x%lx\n",
- image->elf_load_addr, kbuf.bufsz, kbuf.memsz);
-
- /* Setup cmdline for kdump kernel case */
- modified_cmdline = setup_kdump_cmdline(image, cmdline,
- cmdline_len);
- if (!modified_cmdline) {
- pr_err("Setting up cmdline for kdump kernel failed\n");
- ret = -EINVAL;
- goto out;
- }
- cmdline = modified_cmdline;
- }
-#endif
-
-#ifdef CONFIG_ARCH_SUPPORTS_KEXEC_PURGATORY
- /* Add purgatory to the image */
- kbuf.top_down = true;
- kbuf.mem = KEXEC_BUF_MEM_UNKNOWN;
- ret = kexec_load_purgatory(image, &kbuf);
- if (ret) {
- pr_err("Error loading purgatory ret=%d\n", ret);
- goto out;
- }
- kexec_dprintk("Loaded purgatory at 0x%lx\n", kbuf.mem);
-
- ret = kexec_purgatory_get_set_symbol(image, "riscv_kernel_entry",
- &kernel_start,
- sizeof(kernel_start), 0);
- if (ret)
- pr_err("Error update purgatory ret=%d\n", ret);
-#endif /* CONFIG_ARCH_SUPPORTS_KEXEC_PURGATORY */
-
- /* Add the initrd to the image */
- if (initrd != NULL) {
- kbuf.buffer = initrd;
- kbuf.bufsz = kbuf.memsz = initrd_len;
- kbuf.buf_align = PAGE_SIZE;
- kbuf.top_down = true;
- kbuf.mem = KEXEC_BUF_MEM_UNKNOWN;
- ret = kexec_add_buffer(&kbuf);
- if (ret)
- goto out;
- initrd_pbase = kbuf.mem;
- kexec_dprintk("Loaded initrd at 0x%lx\n", initrd_pbase);
- }
-
- /* Add the DTB to the image */
- fdt = of_kexec_alloc_and_setup_fdt(image, initrd_pbase,
- initrd_len, cmdline, 0);
- if (!fdt) {
- pr_err("Error setting up the new device tree.\n");
- ret = -EINVAL;
- goto out;
- }
-
- fdt_pack(fdt);
- kbuf.buffer = fdt;
- kbuf.bufsz = kbuf.memsz = fdt_totalsize(fdt);
- kbuf.buf_align = PAGE_SIZE;
- kbuf.mem = KEXEC_BUF_MEM_UNKNOWN;
- kbuf.top_down = true;
- ret = kexec_add_buffer(&kbuf);
- if (ret) {
- pr_err("Error add DTB kbuf ret=%d\n", ret);
- goto out_free_fdt;
- }
- /* Cache the fdt buffer address for memory cleanup */
- image->arch.fdt = fdt;
- kexec_dprintk("Loaded device tree at 0x%lx\n", kbuf.mem);
- goto out;
-
-out_free_fdt:
- kvfree(fdt);
-out:
- kfree(modified_cmdline);
- kexec_free_elf_info(&elf_info);
- return ret ? ERR_PTR(ret) : NULL;
-}
-
-#define RV_X(x, s, n) (((x) >> (s)) & ((1 << (n)) - 1))
-#define RISCV_IMM_BITS 12
-#define RISCV_IMM_REACH (1LL << RISCV_IMM_BITS)
-#define RISCV_CONST_HIGH_PART(x) \
- (((x) + (RISCV_IMM_REACH >> 1)) & ~(RISCV_IMM_REACH - 1))
-#define RISCV_CONST_LOW_PART(x) ((x) - RISCV_CONST_HIGH_PART(x))
-
-#define ENCODE_ITYPE_IMM(x) \
- (RV_X(x, 0, 12) << 20)
-#define ENCODE_BTYPE_IMM(x) \
- ((RV_X(x, 1, 4) << 8) | (RV_X(x, 5, 6) << 25) | \
- (RV_X(x, 11, 1) << 7) | (RV_X(x, 12, 1) << 31))
-#define ENCODE_UTYPE_IMM(x) \
- (RV_X(x, 12, 20) << 12)
-#define ENCODE_JTYPE_IMM(x) \
- ((RV_X(x, 1, 10) << 21) | (RV_X(x, 11, 1) << 20) | \
- (RV_X(x, 12, 8) << 12) | (RV_X(x, 20, 1) << 31))
-#define ENCODE_CBTYPE_IMM(x) \
- ((RV_X(x, 1, 2) << 3) | (RV_X(x, 3, 2) << 10) | (RV_X(x, 5, 1) << 2) | \
- (RV_X(x, 6, 2) << 5) | (RV_X(x, 8, 1) << 12))
-#define ENCODE_CJTYPE_IMM(x) \
- ((RV_X(x, 1, 3) << 3) | (RV_X(x, 4, 1) << 11) | (RV_X(x, 5, 1) << 2) | \
- (RV_X(x, 6, 1) << 7) | (RV_X(x, 7, 1) << 6) | (RV_X(x, 8, 2) << 9) | \
- (RV_X(x, 10, 1) << 8) | (RV_X(x, 11, 1) << 12))
-#define ENCODE_UJTYPE_IMM(x) \
- (ENCODE_UTYPE_IMM(RISCV_CONST_HIGH_PART(x)) | \
- (ENCODE_ITYPE_IMM(RISCV_CONST_LOW_PART(x)) << 32))
-#define ENCODE_UITYPE_IMM(x) \
- (ENCODE_UTYPE_IMM(x) | (ENCODE_ITYPE_IMM(x) << 32))
-
-#define CLEAN_IMM(type, x) \
- ((~ENCODE_##type##_IMM((uint64_t)(-1))) & (x))
-
-int arch_kexec_apply_relocations_add(struct purgatory_info *pi,
- Elf_Shdr *section,
- const Elf_Shdr *relsec,
- const Elf_Shdr *symtab)
-{
- const char *strtab, *name, *shstrtab;
- const Elf_Shdr *sechdrs;
- Elf64_Rela *relas;
- int i, r_type;
-
- /* String & section header string table */
- sechdrs = (void *)pi->ehdr + pi->ehdr->e_shoff;
- strtab = (char *)pi->ehdr + sechdrs[symtab->sh_link].sh_offset;
- shstrtab = (char *)pi->ehdr + sechdrs[pi->ehdr->e_shstrndx].sh_offset;
-
- relas = (void *)pi->ehdr + relsec->sh_offset;
-
- for (i = 0; i < relsec->sh_size / sizeof(*relas); i++) {
- const Elf_Sym *sym; /* symbol to relocate */
- unsigned long addr; /* final location after relocation */
- unsigned long val; /* relocated symbol value */
- unsigned long sec_base; /* relocated symbol value */
- void *loc; /* tmp location to modify */
-
- sym = (void *)pi->ehdr + symtab->sh_offset;
- sym += ELF64_R_SYM(relas[i].r_info);
-
- if (sym->st_name)
- name = strtab + sym->st_name;
- else
- name = shstrtab + sechdrs[sym->st_shndx].sh_name;
-
- loc = pi->purgatory_buf;
- loc += section->sh_offset;
- loc += relas[i].r_offset;
-
- if (sym->st_shndx == SHN_ABS)
- sec_base = 0;
- else if (sym->st_shndx >= pi->ehdr->e_shnum) {
- pr_err("Invalid section %d for symbol %s\n",
- sym->st_shndx, name);
- return -ENOEXEC;
- } else
- sec_base = pi->sechdrs[sym->st_shndx].sh_addr;
-
- val = sym->st_value;
- val += sec_base;
- val += relas[i].r_addend;
-
- addr = section->sh_addr + relas[i].r_offset;
-
- r_type = ELF64_R_TYPE(relas[i].r_info);
-
- switch (r_type) {
- case R_RISCV_BRANCH:
- *(u32 *)loc = CLEAN_IMM(BTYPE, *(u32 *)loc) |
- ENCODE_BTYPE_IMM(val - addr);
- break;
- case R_RISCV_JAL:
- *(u32 *)loc = CLEAN_IMM(JTYPE, *(u32 *)loc) |
- ENCODE_JTYPE_IMM(val - addr);
- break;
- /*
- * With no R_RISCV_PCREL_LO12_S, R_RISCV_PCREL_LO12_I
- * sym is expected to be next to R_RISCV_PCREL_HI20
- * in purgatory relsec. Handle it like R_RISCV_CALL
- * sym, instead of searching the whole relsec.
- */
- case R_RISCV_PCREL_HI20:
- case R_RISCV_CALL_PLT:
- case R_RISCV_CALL:
- *(u64 *)loc = CLEAN_IMM(UITYPE, *(u64 *)loc) |
- ENCODE_UJTYPE_IMM(val - addr);
- break;
- case R_RISCV_RVC_BRANCH:
- *(u32 *)loc = CLEAN_IMM(CBTYPE, *(u32 *)loc) |
- ENCODE_CBTYPE_IMM(val - addr);
- break;
- case R_RISCV_RVC_JUMP:
- *(u32 *)loc = CLEAN_IMM(CJTYPE, *(u32 *)loc) |
- ENCODE_CJTYPE_IMM(val - addr);
- break;
- case R_RISCV_ADD16:
- *(u16 *)loc += val;
- break;
- case R_RISCV_SUB16:
- *(u16 *)loc -= val;
- break;
- case R_RISCV_ADD32:
- *(u32 *)loc += val;
- break;
- case R_RISCV_SUB32:
- *(u32 *)loc -= val;
- break;
- /* It has been applied by R_RISCV_PCREL_HI20 sym */
- case R_RISCV_PCREL_LO12_I:
- case R_RISCV_ALIGN:
- case R_RISCV_RELAX:
- break;
- case R_RISCV_64:
- *(u64 *)loc = val;
- break;
- default:
- pr_err("Unknown rela relocation: %d\n", r_type);
- return -ENOEXEC;
- }
- }
- return 0;
-}
-
-const struct kexec_file_ops elf_kexec_ops = {
- .probe = kexec_elf_probe,
- .load = elf_kexec_load,
-};
diff --git a/arch/riscv/kernel/kexec_elf.c b/arch/riscv/kernel/kexec_elf.c
new file mode 100644
index 0000000000000..f4755d49b89ed
--- /dev/null
+++ b/arch/riscv/kernel/kexec_elf.c
@@ -0,0 +1,144 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Load ELF vmlinux file for the kexec_file_load syscall.
+ *
+ * Copyright (C) 2021 Huawei Technologies Co, Ltd.
+ *
+ * Author: Liao Chang (liaochang1@huawei.com)
+ *
+ * Based on kexec-tools' kexec-elf-riscv.c, heavily modified
+ * for kernel.
+ */
+
+#define pr_fmt(fmt) "kexec_image: " fmt
+
+#include <linux/elf.h>
+#include <linux/kexec.h>
+#include <linux/slab.h>
+#include <linux/of.h>
+#include <linux/libfdt.h>
+#include <linux/types.h>
+#include <linux/memblock.h>
+#include <asm/setup.h>
+
+static int riscv_kexec_elf_load(struct kimage *image, struct elfhdr *ehdr,
+ struct kexec_elf_info *elf_info, unsigned long old_pbase,
+ unsigned long new_pbase)
+{
+ int i;
+ int ret = 0;
+ size_t size;
+ struct kexec_buf kbuf;
+ const struct elf_phdr *phdr;
+
+ kbuf.image = image;
+
+ for (i = 0; i < ehdr->e_phnum; i++) {
+ phdr = &elf_info->proghdrs[i];
+ if (phdr->p_type != PT_LOAD)
+ continue;
+
+ size = phdr->p_filesz;
+ if (size > phdr->p_memsz)
+ size = phdr->p_memsz;
+
+ kbuf.buffer = (void *) elf_info->buffer + phdr->p_offset;
+ kbuf.bufsz = size;
+ kbuf.buf_align = phdr->p_align;
+ kbuf.mem = phdr->p_paddr - old_pbase + new_pbase;
+ kbuf.memsz = phdr->p_memsz;
+ kbuf.top_down = false;
+ ret = kexec_add_buffer(&kbuf);
+ if (ret)
+ break;
+ }
+
+ return ret;
+}
+
+/*
+ * Go through the available phsyical memory regions and find one that hold
+ * an image of the specified size.
+ */
+static int elf_find_pbase(struct kimage *image, unsigned long kernel_len,
+ struct elfhdr *ehdr, struct kexec_elf_info *elf_info,
+ unsigned long *old_pbase, unsigned long *new_pbase)
+{
+ int i;
+ int ret;
+ struct kexec_buf kbuf;
+ const struct elf_phdr *phdr;
+ unsigned long lowest_paddr = ULONG_MAX;
+ unsigned long lowest_vaddr = ULONG_MAX;
+
+ for (i = 0; i < ehdr->e_phnum; i++) {
+ phdr = &elf_info->proghdrs[i];
+ if (phdr->p_type != PT_LOAD)
+ continue;
+
+ if (lowest_paddr > phdr->p_paddr)
+ lowest_paddr = phdr->p_paddr;
+
+ if (lowest_vaddr > phdr->p_vaddr)
+ lowest_vaddr = phdr->p_vaddr;
+ }
+
+ kbuf.image = image;
+ kbuf.buf_min = lowest_paddr;
+ kbuf.buf_max = ULONG_MAX;
+
+ /*
+ * Current riscv boot protocol requires 2MB alignment for
+ * RV64 and 4MB alignment for RV32
+ *
+ */
+ kbuf.buf_align = PMD_SIZE;
+ kbuf.mem = KEXEC_BUF_MEM_UNKNOWN;
+ kbuf.memsz = ALIGN(kernel_len, PAGE_SIZE);
+ kbuf.top_down = false;
+ ret = arch_kexec_locate_mem_hole(&kbuf);
+ if (!ret) {
+ *old_pbase = lowest_paddr;
+ *new_pbase = kbuf.mem;
+ image->start = ehdr->e_entry - lowest_vaddr + kbuf.mem;
+ }
+ return ret;
+}
+
+static void *elf_kexec_load(struct kimage *image, char *kernel_buf,
+ unsigned long kernel_len, char *initrd,
+ unsigned long initrd_len, char *cmdline,
+ unsigned long cmdline_len)
+{
+ int ret;
+ unsigned long old_kernel_pbase = ULONG_MAX;
+ unsigned long new_kernel_pbase = 0UL;
+ struct elfhdr ehdr;
+ struct kexec_elf_info elf_info;
+
+ ret = kexec_build_elf_info(kernel_buf, kernel_len, &ehdr, &elf_info);
+ if (ret)
+ return ERR_PTR(ret);
+
+ ret = elf_find_pbase(image, kernel_len, &ehdr, &elf_info,
+ &old_kernel_pbase, &new_kernel_pbase);
+ if (ret)
+ goto out;
+
+ /* Add the kernel binary to the image */
+ ret = riscv_kexec_elf_load(image, &ehdr, &elf_info,
+ old_kernel_pbase, new_kernel_pbase);
+ if (ret)
+ goto out;
+
+ ret = load_extra_segments(image, image->start, kernel_len,
+ initrd, initrd_len, cmdline, cmdline_len);
+out:
+ kexec_free_elf_info(&elf_info);
+ return ret ? ERR_PTR(ret) : NULL;
+}
+
+const struct kexec_file_ops elf_kexec_ops = {
+ .probe = kexec_elf_probe,
+ .load = elf_kexec_load,
+};
diff --git a/arch/riscv/kernel/machine_kexec_file.c b/arch/riscv/kernel/machine_kexec_file.c
index b0bf8c1722c0c..99bd5a5f42346 100644
--- a/arch/riscv/kernel/machine_kexec_file.c
+++ b/arch/riscv/kernel/machine_kexec_file.c
@@ -7,8 +7,368 @@
* Author: Liao Chang (liaochang1@huawei.com)
*/
#include <linux/kexec.h>
+#include <linux/elf.h>
+#include <linux/slab.h>
+#include <linux/of.h>
+#include <linux/libfdt.h>
+#include <linux/types.h>
+#include <linux/memblock.h>
+#include <linux/vmalloc.h>
+#include <asm/setup.h>
const struct kexec_file_ops * const kexec_file_loaders[] = {
&elf_kexec_ops,
NULL
};
+
+int arch_kimage_file_post_load_cleanup(struct kimage *image)
+{
+ kvfree(image->arch.fdt);
+ image->arch.fdt = NULL;
+
+ vfree(image->elf_headers);
+ image->elf_headers = NULL;
+ image->elf_headers_sz = 0;
+
+ return kexec_image_post_load_cleanup_default(image);
+}
+
+#ifdef CONFIG_CRASH_DUMP
+static int get_nr_ram_ranges_callback(struct resource *res, void *arg)
+{
+ unsigned int *nr_ranges = arg;
+
+ (*nr_ranges)++;
+ return 0;
+}
+
+static int prepare_elf64_ram_headers_callback(struct resource *res, void *arg)
+{
+ struct crash_mem *cmem = arg;
+
+ cmem->ranges[cmem->nr_ranges].start = res->start;
+ cmem->ranges[cmem->nr_ranges].end = res->end;
+ cmem->nr_ranges++;
+
+ return 0;
+}
+
+static int prepare_elf_headers(void **addr, unsigned long *sz)
+{
+ struct crash_mem *cmem;
+ unsigned int nr_ranges;
+ int ret;
+
+ nr_ranges = 1; /* For exclusion of crashkernel region */
+ walk_system_ram_res(0, -1, &nr_ranges, get_nr_ram_ranges_callback);
+
+ cmem = kmalloc(struct_size(cmem, ranges, nr_ranges), GFP_KERNEL);
+ if (!cmem)
+ return -ENOMEM;
+
+ cmem->max_nr_ranges = nr_ranges;
+ cmem->nr_ranges = 0;
+ ret = walk_system_ram_res(0, -1, cmem, prepare_elf64_ram_headers_callback);
+ if (ret)
+ goto out;
+
+ /* Exclude crashkernel region */
+ ret = crash_exclude_mem_range(cmem, crashk_res.start, crashk_res.end);
+ if (!ret)
+ ret = crash_prepare_elf64_headers(cmem, true, addr, sz);
+
+out:
+ kfree(cmem);
+ return ret;
+}
+
+static char *setup_kdump_cmdline(struct kimage *image, char *cmdline,
+ unsigned long cmdline_len)
+{
+ int elfcorehdr_strlen;
+ char *cmdline_ptr;
+
+ cmdline_ptr = kzalloc(COMMAND_LINE_SIZE, GFP_KERNEL);
+ if (!cmdline_ptr)
+ return NULL;
+
+ elfcorehdr_strlen = sprintf(cmdline_ptr, "elfcorehdr=0x%lx ",
+ image->elf_load_addr);
+
+ if (elfcorehdr_strlen + cmdline_len > COMMAND_LINE_SIZE) {
+ pr_err("Appending elfcorehdr=<addr> exceeds cmdline size\n");
+ kfree(cmdline_ptr);
+ return NULL;
+ }
+
+ memcpy(cmdline_ptr + elfcorehdr_strlen, cmdline, cmdline_len);
+ /* Ensure it's nul terminated */
+ cmdline_ptr[COMMAND_LINE_SIZE - 1] = '\0';
+ return cmdline_ptr;
+}
+#endif
+
+#define RV_X(x, s, n) (((x) >> (s)) & ((1 << (n)) - 1))
+#define RISCV_IMM_BITS 12
+#define RISCV_IMM_REACH (1LL << RISCV_IMM_BITS)
+#define RISCV_CONST_HIGH_PART(x) \
+ (((x) + (RISCV_IMM_REACH >> 1)) & ~(RISCV_IMM_REACH - 1))
+#define RISCV_CONST_LOW_PART(x) ((x) - RISCV_CONST_HIGH_PART(x))
+
+#define ENCODE_ITYPE_IMM(x) \
+ (RV_X(x, 0, 12) << 20)
+#define ENCODE_BTYPE_IMM(x) \
+ ((RV_X(x, 1, 4) << 8) | (RV_X(x, 5, 6) << 25) | \
+ (RV_X(x, 11, 1) << 7) | (RV_X(x, 12, 1) << 31))
+#define ENCODE_UTYPE_IMM(x) \
+ (RV_X(x, 12, 20) << 12)
+#define ENCODE_JTYPE_IMM(x) \
+ ((RV_X(x, 1, 10) << 21) | (RV_X(x, 11, 1) << 20) | \
+ (RV_X(x, 12, 8) << 12) | (RV_X(x, 20, 1) << 31))
+#define ENCODE_CBTYPE_IMM(x) \
+ ((RV_X(x, 1, 2) << 3) | (RV_X(x, 3, 2) << 10) | (RV_X(x, 5, 1) << 2) | \
+ (RV_X(x, 6, 2) << 5) | (RV_X(x, 8, 1) << 12))
+#define ENCODE_CJTYPE_IMM(x) \
+ ((RV_X(x, 1, 3) << 3) | (RV_X(x, 4, 1) << 11) | (RV_X(x, 5, 1) << 2) | \
+ (RV_X(x, 6, 1) << 7) | (RV_X(x, 7, 1) << 6) | (RV_X(x, 8, 2) << 9) | \
+ (RV_X(x, 10, 1) << 8) | (RV_X(x, 11, 1) << 12))
+#define ENCODE_UJTYPE_IMM(x) \
+ (ENCODE_UTYPE_IMM(RISCV_CONST_HIGH_PART(x)) | \
+ (ENCODE_ITYPE_IMM(RISCV_CONST_LOW_PART(x)) << 32))
+#define ENCODE_UITYPE_IMM(x) \
+ (ENCODE_UTYPE_IMM(x) | (ENCODE_ITYPE_IMM(x) << 32))
+
+#define CLEAN_IMM(type, x) \
+ ((~ENCODE_##type##_IMM((uint64_t)(-1))) & (x))
+
+int arch_kexec_apply_relocations_add(struct purgatory_info *pi,
+ Elf_Shdr *section,
+ const Elf_Shdr *relsec,
+ const Elf_Shdr *symtab)
+{
+ const char *strtab, *name, *shstrtab;
+ const Elf_Shdr *sechdrs;
+ Elf64_Rela *relas;
+ int i, r_type;
+
+ /* String & section header string table */
+ sechdrs = (void *)pi->ehdr + pi->ehdr->e_shoff;
+ strtab = (char *)pi->ehdr + sechdrs[symtab->sh_link].sh_offset;
+ shstrtab = (char *)pi->ehdr + sechdrs[pi->ehdr->e_shstrndx].sh_offset;
+
+ relas = (void *)pi->ehdr + relsec->sh_offset;
+
+ for (i = 0; i < relsec->sh_size / sizeof(*relas); i++) {
+ const Elf_Sym *sym; /* symbol to relocate */
+ unsigned long addr; /* final location after relocation */
+ unsigned long val; /* relocated symbol value */
+ unsigned long sec_base; /* relocated symbol value */
+ void *loc; /* tmp location to modify */
+
+ sym = (void *)pi->ehdr + symtab->sh_offset;
+ sym += ELF64_R_SYM(relas[i].r_info);
+
+ if (sym->st_name)
+ name = strtab + sym->st_name;
+ else
+ name = shstrtab + sechdrs[sym->st_shndx].sh_name;
+
+ loc = pi->purgatory_buf;
+ loc += section->sh_offset;
+ loc += relas[i].r_offset;
+
+ if (sym->st_shndx == SHN_ABS)
+ sec_base = 0;
+ else if (sym->st_shndx >= pi->ehdr->e_shnum) {
+ pr_err("Invalid section %d for symbol %s\n",
+ sym->st_shndx, name);
+ return -ENOEXEC;
+ } else
+ sec_base = pi->sechdrs[sym->st_shndx].sh_addr;
+
+ val = sym->st_value;
+ val += sec_base;
+ val += relas[i].r_addend;
+
+ addr = section->sh_addr + relas[i].r_offset;
+
+ r_type = ELF64_R_TYPE(relas[i].r_info);
+
+ switch (r_type) {
+ case R_RISCV_BRANCH:
+ *(u32 *)loc = CLEAN_IMM(BTYPE, *(u32 *)loc) |
+ ENCODE_BTYPE_IMM(val - addr);
+ break;
+ case R_RISCV_JAL:
+ *(u32 *)loc = CLEAN_IMM(JTYPE, *(u32 *)loc) |
+ ENCODE_JTYPE_IMM(val - addr);
+ break;
+ /*
+ * With no R_RISCV_PCREL_LO12_S, R_RISCV_PCREL_LO12_I
+ * sym is expected to be next to R_RISCV_PCREL_HI20
+ * in purgatory relsec. Handle it like R_RISCV_CALL
+ * sym, instead of searching the whole relsec.
+ */
+ case R_RISCV_PCREL_HI20:
+ case R_RISCV_CALL_PLT:
+ case R_RISCV_CALL:
+ *(u64 *)loc = CLEAN_IMM(UITYPE, *(u64 *)loc) |
+ ENCODE_UJTYPE_IMM(val - addr);
+ break;
+ case R_RISCV_RVC_BRANCH:
+ *(u32 *)loc = CLEAN_IMM(CBTYPE, *(u32 *)loc) |
+ ENCODE_CBTYPE_IMM(val - addr);
+ break;
+ case R_RISCV_RVC_JUMP:
+ *(u32 *)loc = CLEAN_IMM(CJTYPE, *(u32 *)loc) |
+ ENCODE_CJTYPE_IMM(val - addr);
+ break;
+ case R_RISCV_ADD16:
+ *(u16 *)loc += val;
+ break;
+ case R_RISCV_SUB16:
+ *(u16 *)loc -= val;
+ break;
+ case R_RISCV_ADD32:
+ *(u32 *)loc += val;
+ break;
+ case R_RISCV_SUB32:
+ *(u32 *)loc -= val;
+ break;
+ /* It has been applied by R_RISCV_PCREL_HI20 sym */
+ case R_RISCV_PCREL_LO12_I:
+ case R_RISCV_ALIGN:
+ case R_RISCV_RELAX:
+ break;
+ case R_RISCV_64:
+ *(u64 *)loc = val;
+ break;
+ default:
+ pr_err("Unknown rela relocation: %d\n", r_type);
+ return -ENOEXEC;
+ }
+ }
+ return 0;
+}
+
+
+int load_extra_segments(struct kimage *image, unsigned long kernel_start,
+ unsigned long kernel_len, char *initrd,
+ unsigned long initrd_len, char *cmdline,
+ unsigned long cmdline_len)
+{
+ int ret;
+ void *fdt;
+ unsigned long initrd_pbase = 0UL;
+ struct kexec_buf kbuf;
+ char *modified_cmdline = NULL;
+
+ kbuf.image = image;
+ kbuf.buf_min = kernel_start + kernel_len;
+ kbuf.buf_max = ULONG_MAX;
+
+#ifdef CONFIG_CRASH_DUMP
+ /* Add elfcorehdr */
+ if (image->type == KEXEC_TYPE_CRASH) {
+ void *headers;
+ unsigned long headers_sz;
+ ret = prepare_elf_headers(&headers, &headers_sz);
+ if (ret) {
+ pr_err("Preparing elf core header failed\n");
+ goto out;
+ }
+
+ kbuf.buffer = headers;
+ kbuf.bufsz = headers_sz;
+ kbuf.mem = KEXEC_BUF_MEM_UNKNOWN;
+ kbuf.memsz = headers_sz;
+ kbuf.buf_align = ELF_CORE_HEADER_ALIGN;
+ kbuf.top_down = true;
+
+ ret = kexec_add_buffer(&kbuf);
+ if (ret) {
+ vfree(headers);
+ goto out;
+ }
+ image->elf_headers = headers;
+ image->elf_load_addr = kbuf.mem;
+ image->elf_headers_sz = headers_sz;
+
+ kexec_dprintk("Loaded elf core header at 0x%lx bufsz=0x%lx memsz=0x%lx\n",
+ image->elf_load_addr, kbuf.bufsz, kbuf.memsz);
+
+ /* Setup cmdline for kdump kernel case */
+ modified_cmdline = setup_kdump_cmdline(image, cmdline,
+ cmdline_len);
+ if (!modified_cmdline) {
+ pr_err("Setting up cmdline for kdump kernel failed\n");
+ ret = -EINVAL;
+ goto out;
+ }
+ cmdline = modified_cmdline;
+ }
+#endif
+
+#ifdef CONFIG_ARCH_SUPPORTS_KEXEC_PURGATORY
+ /* Add purgatory to the image */
+ kbuf.top_down = true;
+ kbuf.mem = KEXEC_BUF_MEM_UNKNOWN;
+ ret = kexec_load_purgatory(image, &kbuf);
+ if (ret) {
+ pr_err("Error loading purgatory ret=%d\n", ret);
+ goto out;
+ }
+ kexec_dprintk("Loaded purgatory at 0x%lx\n", kbuf.mem);
+
+ ret = kexec_purgatory_get_set_symbol(image, "riscv_kernel_entry",
+ &kernel_start,
+ sizeof(kernel_start), 0);
+ if (ret)
+ pr_err("Error update purgatory ret=%d\n", ret);
+#endif /* CONFIG_ARCH_SUPPORTS_KEXEC_PURGATORY */
+
+ /* Add the initrd to the image */
+ if (initrd != NULL) {
+ kbuf.buffer = initrd;
+ kbuf.bufsz = kbuf.memsz = initrd_len;
+ kbuf.buf_align = PAGE_SIZE;
+ kbuf.top_down = true;
+ kbuf.mem = KEXEC_BUF_MEM_UNKNOWN;
+ ret = kexec_add_buffer(&kbuf);
+ if (ret)
+ goto out;
+ initrd_pbase = kbuf.mem;
+ kexec_dprintk("Loaded initrd at 0x%lx\n", initrd_pbase);
+ }
+
+ /* Add the DTB to the image */
+ fdt = of_kexec_alloc_and_setup_fdt(image, initrd_pbase,
+ initrd_len, cmdline, 0);
+ if (!fdt) {
+ pr_err("Error setting up the new device tree.\n");
+ ret = -EINVAL;
+ goto out;
+ }
+
+ fdt_pack(fdt);
+ kbuf.buffer = fdt;
+ kbuf.bufsz = kbuf.memsz = fdt_totalsize(fdt);
+ kbuf.buf_align = PAGE_SIZE;
+ kbuf.mem = KEXEC_BUF_MEM_UNKNOWN;
+ kbuf.top_down = true;
+ ret = kexec_add_buffer(&kbuf);
+ if (ret) {
+ pr_err("Error add DTB kbuf ret=%d\n", ret);
+ goto out_free_fdt;
+ }
+ /* Cache the fdt buffer address for memory cleanup */
+ image->arch.fdt = fdt;
+ kexec_dprintk("Loaded device tree at 0x%lx\n", kbuf.mem);
+ goto out;
+
+out_free_fdt:
+ kvfree(fdt);
+out:
+ kfree(modified_cmdline);
+ return ret;
+}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0348/1376] riscv: kexec_file: Fix crashk_low_res not exclude bug
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (346 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0347/1376] riscv: kexec_file: Split the loading of kernel and others Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0349/1376] media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define Greg Kroah-Hartman
` (650 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guo Ren, Baoquan He, Jinjie Ruan,
Mike Rapoport (Microsoft), Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <ruanjinjie@huawei.com>
[ Upstream commit 5fc6e7d45373571d03cd04fd4c6069c0a97fa75a ]
As done in commit 944a45abfabc ("arm64: kdump: Reimplement crashkernel=X")
and commit 4831be702b95 ("arm64/kexec: Fix missing extra range for
crashkres_low.") for arm64, while implementing crashkernel=X,[high,low],
riscv should have excluded the "crashk_low_res" reserved ranges from
the crash kernel memory to prevent them from being exported through
/proc/vmcore, and the exclusion would need an extra crash_mem range.
Just simply tested on qemu with crashkernel=4G with kexec in [1] mentioned
in [2]. And the second kernel can be started normally.
# dmesg | grep crash
[ 0.000000] crashkernel low memory reserved: 0xf8000000 - 0x100000000 (128 MB)
[ 0.000000] crashkernel reserved: 0x000000017fe00000 - 0x000000027fe00000 (4096 MB)
[1]: https://github.com/chenjh005/kexec-tools/tree/build-test-riscv-v2
[2]: https://lore.kernel.org/all/20230726175000.2536220-1-chenjiahao16@huawei.com/
Cc: Guo Ren <guoren@kernel.org>
Cc: Baoquan He <bhe@redhat.com>
Fixes: 5882e5acf18d ("riscv: kdump: Implement crashkernel=X,[high,low]")
Reviewed-by: Guo Ren <guoren@kernel.org>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Link: https://github.com/chenjh005/kexec-tools/tree/build-test-riscv-v2
Link: https://lore.kernel.org/all/20230726175000.2536220-1-chenjiahao16@huawei.com/
Link: https://patch.msgid.link/20260629094746.191843-2-ruanjinjie@huawei.com
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/riscv/kernel/machine_kexec_file.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/arch/riscv/kernel/machine_kexec_file.c b/arch/riscv/kernel/machine_kexec_file.c
index 99bd5a5f42346..fc506f95aeaa1 100644
--- a/arch/riscv/kernel/machine_kexec_file.c
+++ b/arch/riscv/kernel/machine_kexec_file.c
@@ -59,7 +59,7 @@ static int prepare_elf_headers(void **addr, unsigned long *sz)
unsigned int nr_ranges;
int ret;
- nr_ranges = 1; /* For exclusion of crashkernel region */
+ nr_ranges = 2; /* For exclusion of crashkernel region */
walk_system_ram_res(0, -1, &nr_ranges, get_nr_ram_ranges_callback);
cmem = kmalloc(struct_size(cmem, ranges, nr_ranges), GFP_KERNEL);
@@ -74,8 +74,16 @@ static int prepare_elf_headers(void **addr, unsigned long *sz)
/* Exclude crashkernel region */
ret = crash_exclude_mem_range(cmem, crashk_res.start, crashk_res.end);
- if (!ret)
- ret = crash_prepare_elf64_headers(cmem, true, addr, sz);
+ if (ret)
+ goto out;
+
+ if (crashk_low_res.end) {
+ ret = crash_exclude_mem_range(cmem, crashk_low_res.start, crashk_low_res.end);
+ if (ret)
+ goto out;
+ }
+
+ ret = crash_prepare_elf64_headers(cmem, true, addr, sz);
out:
kfree(cmem);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0349/1376] media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (347 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0348/1376] riscv: kexec_file: Fix crashk_low_res not exclude bug Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0350/1376] media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW " Greg Kroah-Hartman
` (649 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Young, Mauro Carvalho Chehab,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
[ Upstream commit 5370facb7b4461166a4610d456fefeb92ef50a82 ]
Since commit 206241069ecf ("[media] rc/keymaps: Remove the obsolete
rc-rc5-tv keymap"), the rc-rc5-tv keymap is no longer in the tree.
Fixes: 206241069ecf ("[media] rc/keymaps: Remove the obsolete rc-rc5-tv keymap")
Signed-off-by: Sean Young <sean@mess.org>
Acked-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/media/rc-map.h | 1 -
1 file changed, 1 deletion(-)
diff --git a/include/media/rc-map.h b/include/media/rc-map.h
index 4867eb2f931e0..8c74175bf296a 100644
--- a/include/media/rc-map.h
+++ b/include/media/rc-map.h
@@ -309,7 +309,6 @@ struct rc_map *rc_map_get(const char *name);
#define RC_MAP_PROTEUS_2309 "rc-proteus-2309"
#define RC_MAP_PURPLETV "rc-purpletv"
#define RC_MAP_PV951 "rc-pv951"
-#define RC_MAP_RC5_TV "rc-rc5-tv"
#define RC_MAP_RC6_MCE "rc-rc6-mce"
#define RC_MAP_REAL_AUDIO_220_32_KEYS "rc-real-audio-220-32-keys"
#define RC_MAP_REDDO "rc-reddo"
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0350/1376] media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (348 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0349/1376] media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0351/1376] perf test: Update all metrics test like metricgroups test Greg Kroah-Hartman
` (648 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Young, Mauro Carvalho Chehab,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
[ Upstream commit 6e5deb2923b0d1b73c77a1a77c30b0da43d9e022 ]
Since commit af86ce79f020 ("[media] remove the old RC_MAP_HAUPPAUGE_NEW
RC map"), the RC_MAP_HAUPPAUGE_NEW define is no longer used.
Fixes: af86ce79f020 ("[media] remove the old RC_MAP_HAUPPAUGE_NEW RC map")
Signed-off-by: Sean Young <sean@mess.org>
Acked-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/media/rc-map.h | 1 -
1 file changed, 1 deletion(-)
diff --git a/include/media/rc-map.h b/include/media/rc-map.h
index 8c74175bf296a..ab8c1b82dff6a 100644
--- a/include/media/rc-map.h
+++ b/include/media/rc-map.h
@@ -262,7 +262,6 @@ struct rc_map *rc_map_get(const char *name);
#define RC_MAP_GENIUS_TVGO_A11MCE "rc-genius-tvgo-a11mce"
#define RC_MAP_GOTVIEW7135 "rc-gotview7135"
#define RC_MAP_HAUPPAUGE "rc-hauppauge"
-#define RC_MAP_HAUPPAUGE_NEW "rc-hauppauge"
#define RC_MAP_HISI_POPLAR "rc-hisi-poplar"
#define RC_MAP_HISI_TV_DEMO "rc-hisi-tv-demo"
#define RC_MAP_IMON_MCE "rc-imon-mce"
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0351/1376] perf test: Update all metrics test like metricgroups test
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (349 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0350/1376] media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW " Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0352/1376] perf test stat_all_metrics: Ensure missing events fail test Greg Kroah-Hartman
` (647 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ian Rogers, Namhyung Kim,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <namhyung@kernel.org>
[ Upstream commit e2cb1db7daf8b7863aeec07bb574d3fae54518e6 ]
Like in the metricgroup tests, it should check the permission first and
then skip relevant failures accordingly.
Also it needs to try again with the system wide flag properly. On the
second round, check if the result has the metric name because other
failure cases are checked in the first round already.
Reviewed-by: Ian Rogers <irogers@google.com>
Link: https://lore.kernel.org/r/20241018204306.741972-1-namhyung@kernel.org
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Stable-dep-of: 8953bfd8820b ("perf tests: Skip metrics validation if system-wide recording lacks permission")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/tests/shell/stat_all_metrics.sh | 87 ++++++++++++++++------
1 file changed, 66 insertions(+), 21 deletions(-)
diff --git a/tools/perf/tests/shell/stat_all_metrics.sh b/tools/perf/tests/shell/stat_all_metrics.sh
index 54774525e18a7..73e9347e88a96 100755
--- a/tools/perf/tests/shell/stat_all_metrics.sh
+++ b/tools/perf/tests/shell/stat_all_metrics.sh
@@ -2,42 +2,87 @@
# perf all metrics test
# SPDX-License-Identifier: GPL-2.0
+ParanoidAndNotRoot()
+{
+ [ "$(id -u)" != 0 ] && [ "$(cat /proc/sys/kernel/perf_event_paranoid)" -gt $1 ]
+}
+
+system_wide_flag="-a"
+if ParanoidAndNotRoot 0
+then
+ system_wide_flag=""
+fi
+
err=0
for m in $(perf list --raw-dump metrics); do
echo "Testing $m"
- result=$(perf stat -M "$m" true 2>&1)
- if [[ "$result" =~ ${m:0:50} ]] || [[ "$result" =~ "<not supported>" ]]
+ result=$(perf stat -M "$m" $system_wide_flag -- sleep 0.01 2>&1)
+ result_err=$?
+ if [[ $result_err -gt 0 ]]
then
- continue
+ if [[ "$result" =~ \
+ "Access to performance monitoring and observability operations is limited" ]]
+ then
+ echo "Permission failure"
+ echo $result
+ if [[ $err -eq 0 ]]
+ then
+ err=2 # Skip
+ fi
+ continue
+ elif [[ "$result" =~ "in per-thread mode, enable system wide" ]]
+ then
+ echo "Permissions - need system wide mode"
+ echo $result
+ if [[ $err -eq 0 ]]
+ then
+ err=2 # Skip
+ fi
+ continue
+ elif [[ "$result" =~ "<not supported>" ]]
+ then
+ echo "Not supported events"
+ echo $result
+ if [[ $err -eq 0 ]]
+ then
+ err=2 # Skip
+ fi
+ continue
+ elif [[ "$result" =~ "FP_ARITH" || "$result" =~ "AMX" ]]
+ then
+ echo "FP issues"
+ echo $result
+ if [[ $err -eq 0 ]]
+ then
+ err=2 # Skip
+ fi
+ continue
+ elif [[ "$result" =~ "PMM" ]]
+ then
+ echo "Optane memory issues"
+ echo $result
+ if [[ $err -eq 0 ]]
+ then
+ err=2 # Skip
+ fi
+ continue
+ fi
fi
- # Failed so try system wide.
- result=$(perf stat -M "$m" -a sleep 0.01 2>&1)
+
if [[ "$result" =~ ${m:0:50} ]]
then
continue
fi
- # Failed again, possibly the workload was too small so retry with something
- # longer.
- result=$(perf stat -M "$m" perf bench internals synthesize 2>&1)
+
+ # Failed, possibly the workload was too small so retry with something longer.
+ result=$(perf stat -M "$m" $system_wide_flag -- perf bench internals synthesize 2>&1)
if [[ "$result" =~ ${m:0:50} ]]
then
continue
fi
echo "Metric '$m' not printed in:"
echo "$result"
- if [[ "$err" != "1" ]]
- then
- err=2
- if [[ "$result" =~ "FP_ARITH" || "$result" =~ "AMX" ]]
- then
- echo "Skip, not fail, for FP issues"
- elif [[ "$result" =~ "PMM" ]]
- then
- echo "Skip, not fail, for Optane memory issues"
- else
- err=1
- fi
- fi
+ err=1
done
exit "$err"
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0352/1376] perf test stat_all_metrics: Ensure missing events fail test
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (350 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0351/1376] perf test: Update all metrics test like metricgroups test Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0353/1376] perf tests metrics: Permission related fixes Greg Kroah-Hartman
` (646 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ian Rogers, Kan Liang, Thomas Falcon,
Namhyung Kim, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <irogers@google.com>
[ Upstream commit 08d9e883481b2c38326ed37314b1f6a1284c03d8 ]
Issue reported by Thomas Falcon and diagnosed by Kan Liang here:
https://lore.kernel.org/lkml/d44036481022c27d83ce0faf8c7f77042baedb34.camel@intel.com/
Metrics with missing events can be erroneously skipped if they contain
FP, AMX or PMM events.
Signed-off-by: Ian Rogers <irogers@google.com>
Acked-by: Kan Liang <kan.liang@linux.intel.com>
Tested-by: Thomas Falcon <thomas.falcon@intel.com>
Link: https://lore.kernel.org/r/20250211213031.114209-25-irogers@google.com
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Stable-dep-of: 8953bfd8820b ("perf tests: Skip metrics validation if system-wide recording lacks permission")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/tests/shell/stat_all_metrics.sh | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/tools/perf/tests/shell/stat_all_metrics.sh b/tools/perf/tests/shell/stat_all_metrics.sh
index 73e9347e88a96..ee817c66da061 100755
--- a/tools/perf/tests/shell/stat_all_metrics.sh
+++ b/tools/perf/tests/shell/stat_all_metrics.sh
@@ -20,7 +20,13 @@ for m in $(perf list --raw-dump metrics); do
result_err=$?
if [[ $result_err -gt 0 ]]
then
- if [[ "$result" =~ \
+ if [[ "$result" =~ "Cannot resolve IDs for" ]]
+ then
+ echo "Metric contains missing events"
+ echo $result
+ err=1 # Fail
+ continue
+ elif [[ "$result" =~ \
"Access to performance monitoring and observability operations is limited" ]]
then
echo "Permission failure"
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0353/1376] perf tests metrics: Permission related fixes
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (351 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0352/1376] perf test stat_all_metrics: Ensure missing events fail test Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0354/1376] perf test metrics: Update all metrics for possibly failing default metrics Greg Kroah-Hartman
` (645 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ian Rogers, Adrian Hunter,
Alexander Shishkin, Ingo Molnar, James Clark, Jiri Olsa,
Kan Liang, Mark Rutland, Namhyung Kim, Peter Zijlstra,
Weilin Wang, Arnaldo Carvalho de Melo, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <irogers@google.com>
[ Upstream commit 365e02ddb65d443f1ba16af5a4ddcd638f1e7823 ]
When permissions are limited running sleep without system wide isn't a
good benchmark to run to achieve samples, switch to running noploop.
Remove indent for non-success cases.
Allow skip for the not counted case.
Minor debug changes.
Signed-off-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Kan Liang <kan.liang@linux.intel.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Weilin Wang <weilin.wang@intel.com>
Link: https://lore.kernel.org/r/20250412004704.2297939-2-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Stable-dep-of: 8953bfd8820b ("perf tests: Skip metrics validation if system-wide recording lacks permission")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/tests/shell/stat_all_metrics.sh | 118 +++++++++++----------
1 file changed, 64 insertions(+), 54 deletions(-)
diff --git a/tools/perf/tests/shell/stat_all_metrics.sh b/tools/perf/tests/shell/stat_all_metrics.sh
index ee817c66da061..6fa585a1e34c9 100755
--- a/tools/perf/tests/shell/stat_all_metrics.sh
+++ b/tools/perf/tests/shell/stat_all_metrics.sh
@@ -7,86 +7,96 @@ ParanoidAndNotRoot()
[ "$(id -u)" != 0 ] && [ "$(cat /proc/sys/kernel/perf_event_paranoid)" -gt $1 ]
}
+test_prog="sleep 0.01"
system_wide_flag="-a"
if ParanoidAndNotRoot 0
then
system_wide_flag=""
+ test_prog="perf test -w noploop"
fi
err=0
for m in $(perf list --raw-dump metrics); do
echo "Testing $m"
- result=$(perf stat -M "$m" $system_wide_flag -- sleep 0.01 2>&1)
+ result=$(perf stat -M "$m" $system_wide_flag -- $test_prog 2>&1)
result_err=$?
- if [[ $result_err -gt 0 ]]
+ if [[ $result_err -eq 0 && "$result" =~ ${m:0:50} ]]
then
- if [[ "$result" =~ "Cannot resolve IDs for" ]]
- then
- echo "Metric contains missing events"
- echo $result
- err=1 # Fail
- continue
- elif [[ "$result" =~ \
- "Access to performance monitoring and observability operations is limited" ]]
+ # No error result and metric shown.
+ continue
+ fi
+ if [[ "$result" =~ "Cannot resolve IDs for" ]]
+ then
+ echo "Metric contains missing events"
+ echo $result
+ err=1 # Fail
+ continue
+ elif [[ "$result" =~ \
+ "Access to performance monitoring and observability operations is limited" ]]
+ then
+ echo "Permission failure"
+ echo $result
+ if [[ $err -eq 0 ]]
then
- echo "Permission failure"
- echo $result
- if [[ $err -eq 0 ]]
- then
- err=2 # Skip
- fi
- continue
- elif [[ "$result" =~ "in per-thread mode, enable system wide" ]]
+ err=2 # Skip
+ fi
+ continue
+ elif [[ "$result" =~ "in per-thread mode, enable system wide" ]]
+ then
+ echo "Permissions - need system wide mode"
+ echo $result
+ if [[ $err -eq 0 ]]
then
- echo "Permissions - need system wide mode"
- echo $result
- if [[ $err -eq 0 ]]
- then
- err=2 # Skip
- fi
- continue
- elif [[ "$result" =~ "<not supported>" ]]
+ err=2 # Skip
+ fi
+ continue
+ elif [[ "$result" =~ "<not supported>" ]]
+ then
+ echo "Not supported events"
+ echo $result
+ if [[ $err -eq 0 ]]
then
- echo "Not supported events"
- echo $result
- if [[ $err -eq 0 ]]
- then
- err=2 # Skip
- fi
- continue
- elif [[ "$result" =~ "FP_ARITH" || "$result" =~ "AMX" ]]
+ err=2 # Skip
+ fi
+ continue
+ elif [[ "$result" =~ "<not counted>" ]]
+ then
+ echo "Not counted events"
+ echo $result
+ if [[ $err -eq 0 ]]
then
- echo "FP issues"
- echo $result
- if [[ $err -eq 0 ]]
- then
- err=2 # Skip
- fi
- continue
- elif [[ "$result" =~ "PMM" ]]
+ err=2 # Skip
+ fi
+ continue
+ elif [[ "$result" =~ "FP_ARITH" || "$result" =~ "AMX" ]]
+ then
+ echo "FP issues"
+ echo $result
+ if [[ $err -eq 0 ]]
then
- echo "Optane memory issues"
- echo $result
- if [[ $err -eq 0 ]]
- then
- err=2 # Skip
- fi
- continue
+ err=2 # Skip
fi
- fi
-
- if [[ "$result" =~ ${m:0:50} ]]
+ continue
+ elif [[ "$result" =~ "PMM" ]]
then
+ echo "Optane memory issues"
+ echo $result
+ if [[ $err -eq 0 ]]
+ then
+ err=2 # Skip
+ fi
continue
fi
# Failed, possibly the workload was too small so retry with something longer.
result=$(perf stat -M "$m" $system_wide_flag -- perf bench internals synthesize 2>&1)
- if [[ "$result" =~ ${m:0:50} ]]
+ result_err=$?
+ if [[ $result_err -eq 0 && "$result" =~ ${m:0:50} ]]
then
+ # No error result and metric shown.
continue
fi
- echo "Metric '$m' not printed in:"
+ echo "Metric '$m' has non-zero error '$result_err' or not printed in:"
echo "$result"
err=1
done
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0354/1376] perf test metrics: Update all metrics for possibly failing default metrics
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (352 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0353/1376] perf tests metrics: Permission related fixes Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0355/1376] perf test all metrics: Fully ignore Default metric failures Greg Kroah-Hartman
` (644 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ian Rogers, Namhyung Kim,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <irogers@google.com>
[ Upstream commit 91c1949d768520d9befa7761eb97c3826997da25 ]
Default metrics may use unsupported events and be ignored. These
metrics shouldn't cause metric testing to fail.
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Stable-dep-of: 8953bfd8820b ("perf tests: Skip metrics validation if system-wide recording lacks permission")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/tests/shell/stat_all_metrics.sh | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/tools/perf/tests/shell/stat_all_metrics.sh b/tools/perf/tests/shell/stat_all_metrics.sh
index 6fa585a1e34c9..a7edf01b39433 100755
--- a/tools/perf/tests/shell/stat_all_metrics.sh
+++ b/tools/perf/tests/shell/stat_all_metrics.sh
@@ -25,8 +25,13 @@ for m in $(perf list --raw-dump metrics); do
# No error result and metric shown.
continue
fi
- if [[ "$result" =~ "Cannot resolve IDs for" ]]
+ if [[ "$result" =~ "Cannot resolve IDs for" || "$result" =~ "No supported events found" ]]
then
+ if [[ "$m" == @(l1_prefetch_miss_rate|stalled_cycles_per_instruction) ]]
+ then
+ # Default metrics that may use unsupported events.
+ continue
+ fi
echo "Metric contains missing events"
echo $result
err=1 # Fail
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0355/1376] perf test all metrics: Fully ignore Default metric failures
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (353 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0354/1376] perf test metrics: Update all metrics for possibly failing default metrics Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0356/1376] perf test: Do not skip when some metrics tests succeeded Greg Kroah-Hartman
` (643 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Richter, Namhyung Kim,
James Clark, Ian Rogers, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <irogers@google.com>
[ Upstream commit 41b67ab3d2f5be9d0b6e5ba9cbec97c820fc50e8 ]
Determine if a metric is default from `perf list --raw-dump $m` eg:
```
$ perf list --raw-dump l1_prefetch_miss_rate
Default4 l1_prefetch_miss_rate
```
If a metric has "not supported" or "no supported events" then ignore
these failures for default metrics. Tidy up the skip/fail messages in
the output to make them easier to spot/read.
```
$ perf list -vv "all metrics"
...
Testing llc_miss_rate
[Ignored llc_miss_rate] failed but as a Default metric this can be expected
Error: No supported events found. The LLC-loads event is not supported.
...
```
Reported-by: Thomas Richter <tmricht@linux.ibm.com>
Closes: https://lore.kernel.org/linux-perf-users/20251119104751.51960-1-tmricht@linux.ibm.com/
Reported-by: Namhyung Kim <namhyung@kernel.org>
Reported-by: James Clark <james.clark@linaro.org>
Closes: https://lore.kernel.org/lkml/aRi9xnwdLh3Dir9f@google.com/
Signed-off-by: Ian Rogers <irogers@google.com>
Reviewed-by: James Clark <james.clark@linaro.org>
Tested-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Stable-dep-of: 8953bfd8820b ("perf tests: Skip metrics validation if system-wide recording lacks permission")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/tests/shell/stat_all_metrics.sh | 27 ++++++++++++++--------
1 file changed, 17 insertions(+), 10 deletions(-)
diff --git a/tools/perf/tests/shell/stat_all_metrics.sh b/tools/perf/tests/shell/stat_all_metrics.sh
index a7edf01b39433..3dabb39c7cc8c 100755
--- a/tools/perf/tests/shell/stat_all_metrics.sh
+++ b/tools/perf/tests/shell/stat_all_metrics.sh
@@ -27,19 +27,20 @@ for m in $(perf list --raw-dump metrics); do
fi
if [[ "$result" =~ "Cannot resolve IDs for" || "$result" =~ "No supported events found" ]]
then
- if [[ "$m" == @(l1_prefetch_miss_rate|stalled_cycles_per_instruction) ]]
+ if [[ $(perf list --raw-dump $m) == "Default"* ]]
then
- # Default metrics that may use unsupported events.
+ echo "[Ignored $m] failed but as a Default metric this can be expected"
+ echo $result
continue
fi
- echo "Metric contains missing events"
+ echo "[Failed $m] Metric contains missing events"
echo $result
err=1 # Fail
continue
elif [[ "$result" =~ \
"Access to performance monitoring and observability operations is limited" ]]
then
- echo "Permission failure"
+ echo "[Skipped $m] Permission failure"
echo $result
if [[ $err -eq 0 ]]
then
@@ -48,7 +49,7 @@ for m in $(perf list --raw-dump metrics); do
continue
elif [[ "$result" =~ "in per-thread mode, enable system wide" ]]
then
- echo "Permissions - need system wide mode"
+ echo "[Skipped $m] Permissions - need system wide mode"
echo $result
if [[ $err -eq 0 ]]
then
@@ -57,7 +58,13 @@ for m in $(perf list --raw-dump metrics); do
continue
elif [[ "$result" =~ "<not supported>" ]]
then
- echo "Not supported events"
+ if [[ $(perf list --raw-dump $m) == "Default"* ]]
+ then
+ echo "[Ignored $m] failed but as a Default metric this can be expected"
+ echo $result
+ continue
+ fi
+ echo "[Skipped $m] Not supported events"
echo $result
if [[ $err -eq 0 ]]
then
@@ -66,7 +73,7 @@ for m in $(perf list --raw-dump metrics); do
continue
elif [[ "$result" =~ "<not counted>" ]]
then
- echo "Not counted events"
+ echo "[Skipped $m] Not counted events"
echo $result
if [[ $err -eq 0 ]]
then
@@ -75,7 +82,7 @@ for m in $(perf list --raw-dump metrics); do
continue
elif [[ "$result" =~ "FP_ARITH" || "$result" =~ "AMX" ]]
then
- echo "FP issues"
+ echo "[Skipped $m] FP issues"
echo $result
if [[ $err -eq 0 ]]
then
@@ -84,7 +91,7 @@ for m in $(perf list --raw-dump metrics); do
continue
elif [[ "$result" =~ "PMM" ]]
then
- echo "Optane memory issues"
+ echo "[Skipped $m] Optane memory issues"
echo $result
if [[ $err -eq 0 ]]
then
@@ -101,7 +108,7 @@ for m in $(perf list --raw-dump metrics); do
# No error result and metric shown.
continue
fi
- echo "Metric '$m' has non-zero error '$result_err' or not printed in:"
+ echo "[Failed $m] has non-zero error '$result_err' or not printed in:"
echo "$result"
err=1
done
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0356/1376] perf test: Do not skip when some metrics tests succeeded
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (354 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0355/1376] perf test all metrics: Fully ignore Default metric failures Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0357/1376] perf tests: Skip metrics validation if system-wide recording lacks permission Greg Kroah-Hartman
` (642 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Namhyung Kim,
Arnaldo Carvalho de Melo, Adrian Hunter, Ian Rogers, Ingo Molnar,
James Clark, Jiri Olsa, Peter Zijlstra, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <namhyung@kernel.org>
[ Upstream commit 1c89bc1b95fa9058f3e7cd37f1142939261417d5 ]
I think the return value of SKIP (2) should be used when it skipped the
entire test suite rather than a few of them. While the FAIL should be
reserved if any of test failed.
$ perf test -vv 110
110: perf all metrics test:
--- start ---
test child forked, pid 2496399
Testing tma_core_bound
Testing tma_info_core_ilp
Testing tma_info_memory_l2mpki
Testing tma_memory_bound
Testing tma_bottleneck_irregular_overhead
Testing tma_bottleneck_mispredictions
Testing tma_info_bad_spec_branch_misprediction_cost
Testing tma_info_bad_spec_ipmisp_cond_ntaken
Testing tma_info_bad_spec_ipmisp_cond_taken
Testing tma_info_bad_spec_ipmisp_indirect
Testing tma_info_bad_spec_ipmisp_ret
Testing tma_info_bad_spec_ipmispredict
Testing tma_info_branches_callret
Testing tma_info_branches_cond_nt
Testing tma_info_branches_cond_tk
Testing tma_info_branches_jump
Testing tma_info_branches_other_branches
Testing tma_branch_mispredicts
Testing tma_clears_resteers
Testing tma_machine_clears
Testing tma_mispredicts_resteers
Testing tma_bottleneck_big_code
Testing tma_icache_misses
Testing tma_itlb_misses
Testing tma_unknown_branches
Testing tma_info_bad_spec_spec_clears_ratio
Testing tma_other_mispredicts
Testing tma_branch_instructions
Testing tma_info_frontend_tbpc
Testing tma_info_inst_mix_bptkbranch
Testing tma_info_inst_mix_ipbranch
Testing tma_info_inst_mix_ipcall
Testing tma_info_inst_mix_iptb
Testing tma_info_system_ipfarbranch
Testing tma_info_thread_uptb
Testing tma_bottleneck_branching_overhead
Testing tma_nop_instructions
Testing tma_bottleneck_compute_bound_est
Testing tma_divider
Testing tma_ports_utilized_3m
Testing tma_bottleneck_instruction_fetch_bw
Testing tma_frontend_bound
Testing tma_assists
Testing tma_other_nukes
Testing tma_serializing_operation
Testing tma_bottleneck_data_cache_memory_bandwidth
Testing tma_fb_full
Testing tma_mem_bandwidth
Testing tma_sq_full
Testing tma_bottleneck_data_cache_memory_latency
Testing tma_l1_latency_dependency
Testing tma_l2_bound
Testing tma_l3_hit_latency
Testing tma_mem_latency
Testing tma_store_latency
Testing tma_bottleneck_memory_synchronization
Testing tma_contested_accesses
Testing tma_data_sharing
Testing tma_false_sharing
Testing tma_bottleneck_memory_data_tlbs
Testing tma_dtlb_load
Testing tma_dtlb_store
Testing tma_backend_bound
Testing tma_bottleneck_other_bottlenecks
Testing tma_bottleneck_useful_work
Testing tma_retiring
Testing tma_info_memory_fb_hpki
Testing tma_info_memory_l1mpki
Testing tma_info_memory_l1mpki_load
Testing tma_info_memory_l2hpki_all
Testing tma_info_memory_l2hpki_load
Testing tma_info_memory_l2mpki_all
Testing tma_info_memory_l2mpki_load
Testing tma_l1_bound
Testing tma_l3_bound
Testing tma_info_memory_l2mpki_rfo
Testing tma_fp_scalar
Testing tma_fp_vector
Testing tma_fp_vector_128b
Testing tma_fp_vector_256b
Testing tma_fp_vector_512b
Testing tma_port_0
Testing tma_x87_use
Testing tma_info_botlnk_l0_core_bound_likely
Testing tma_info_core_fp_arith_utilization
Testing tma_info_pipeline_execute
Testing tma_info_system_gflops
Testing tma_info_thread_execute_per_issue
Testing tma_dsb
Testing tma_info_botlnk_l2_dsb_bandwidth
Testing tma_info_frontend_dsb_coverage
Testing tma_decoder0_alone
Testing tma_dsb_switches
Testing tma_info_botlnk_l2_dsb_misses
Testing tma_info_frontend_dsb_switch_cost
Testing tma_info_frontend_ipdsb_miss_ret
Testing tma_mite
Testing tma_mite_4wide
Testing CPUs_utilized
Testing backend_cycles_idle
[Ignored backend_cycles_idle] failed but as a Default metric this can be expected
Performance counter stats for 'perf test -w noploop': <not counted> cpu-cycles:u <not supported> stalled-cycles-backend:u 1.014051473 seconds time elapsed 1.005718000 seconds user 0.008013000 seconds sys
Testing branch_frequency
Testing branch_miss_rate
Testing cs_per_second
Testing cycles_frequency
Testing frontend_cycles_idle
[Ignored frontend_cycles_idle] failed but as a Default metric this can be expected
Performance counter stats for 'perf test -w noploop': <not counted> cpu-cycles:u <not supported> stalled-cycles-frontend:u 1.012813656 seconds time elapsed 1.004603000 seconds user 0.008004000 seconds sys
Testing insn_per_cycle
Testing migrations_per_second
Testing page_faults_per_second
Testing stalled_cycles_per_instruction
[Ignored stalled_cycles_per_instruction] failed but as a Default metric this can be expected
Error: No supported events found. The stalled-cycles-backend:u event is not supported.
Testing tma_bad_speculation
Testing l1d_miss_rate
Testing llc_miss_rate
Testing dtlb_miss_rate
Testing itlb_miss_rate
[Ignored itlb_miss_rate] failed but as a Default metric this can be expected
Performance counter stats for 'perf test -w noploop': <not supported> iTLB-loads:u 3,097 iTLB-load-misses:u 1.012766732 seconds time elapsed 1.004318000 seconds user 0.008002000 seconds sys
Testing l1i_miss_rate
[Ignored l1i_miss_rate] failed but as a Default metric this can be expected
Performance counter stats for 'perf test -w noploop': <not counted> L1-icache-load-misses:u <not supported> L1-icache-loads:u 1.013606395 seconds time elapsed 1.001371000 seconds user 0.011968000 seconds sys
Testing l1_prefetch_miss_rate
[Ignored l1_prefetch_miss_rate] failed but as a Default metric this can be expected
Error: No supported events found. The L1-dcache-prefetches:u event is not supported.
Testing tma_info_botlnk_l2_ic_misses
Testing tma_info_frontend_fetch_upc
Testing tma_info_frontend_icache_miss_latency
Testing tma_info_frontend_ipunknown_branch
Testing tma_info_frontend_lsd_coverage
Testing tma_info_memory_tlb_code_stlb_mpki
Testing tma_info_pipeline_fetch_dsb
Testing tma_info_pipeline_fetch_lsd
Testing tma_info_pipeline_fetch_mite
Testing tma_info_pipeline_fetch_ms
Testing tma_fetch_bandwidth
Testing tma_lsd
Testing tma_branch_resteers
Testing tma_code_l2_hit
Testing tma_code_l2_miss
Testing tma_code_stlb_hit
Testing tma_code_stlb_miss
Testing tma_code_stlb_miss_2m
Testing tma_code_stlb_miss_4k
Testing tma_lcp
Testing tma_ms_switches
Testing tma_info_core_flopc
Testing tma_info_inst_mix_iparith
Testing tma_info_inst_mix_iparith_avx128
Testing tma_info_inst_mix_iparith_avx256
Testing tma_info_inst_mix_iparith_avx512
Testing tma_info_inst_mix_iparith_scalar_dp
Testing tma_info_inst_mix_iparith_scalar_sp
Testing tma_info_inst_mix_ipflop
Testing tma_info_inst_mix_ippause
Testing tma_fetch_latency
Testing tma_fp_arith
Testing tma_fp_assists
Testing tma_info_system_cpu_utilization
Testing tma_info_system_dram_bw_use
[Skipped tma_info_system_dram_bw_use] Not supported events
Performance counter stats for 'perf test -w noploop': <not supported> UNC_ARB_TRK_REQUESTS.ALL:u <not supported> UNC_ARB_COH_TRK_REQUESTS.ALL:u 1,013,554,749 duration_time 1.013527265 seconds time elapsed 1.005417000 seconds user 0.008011000 seconds sys
Testing tma_info_frontend_l2mpki_code
Testing tma_info_frontend_l2mpki_code_all
Testing tma_info_inst_mix_ipload
Testing tma_info_inst_mix_ipstore
Testing tma_info_memory_latency_load_l2_miss_latency
Testing tma_lock_latency
Testing tma_info_memory_core_l1d_cache_fill_bw_2t
Testing tma_info_memory_core_l2_cache_fill_bw_2t
Testing tma_info_memory_core_l3_cache_access_bw_2t
Testing tma_info_memory_core_l3_cache_fill_bw_2t
Testing tma_info_memory_l1d_cache_fill_bw
Testing tma_info_memory_l2_cache_fill_bw
Testing tma_info_memory_l3_cache_access_bw
Testing tma_info_memory_l3_cache_fill_bw
Testing tma_info_memory_l3mpki
Testing tma_info_memory_load_miss_real_latency
Testing tma_info_memory_mix_bus_lock_pki
Testing tma_info_memory_mix_uc_load_pki
Testing tma_info_memory_mlp
Testing tma_info_memory_tlb_load_stlb_mpki
Testing tma_info_memory_tlb_page_walks_utilization
Testing tma_info_memory_tlb_store_stlb_mpki
Testing tma_info_system_mem_parallel_reads
[Skipped tma_info_system_mem_parallel_reads] Not supported events
Performance counter stats for 'perf test -w noploop': <not supported> UNC_ARB_DAT_OCCUPANCY.RD:u <not counted> UNC_ARB_DAT_OCCUPANCY.RD/cmask=1/ 1.013354884 seconds time elapsed 1.009239000 seconds user 0.004004000 seconds sys
Testing tma_info_system_mem_read_latency
[Skipped tma_info_system_mem_read_latency] Not supported events
Performance counter stats for 'perf test -w noploop': <not supported> UNC_ARB_DAT_OCCUPANCY.RD:u <not counted> UNC_ARB_TRK_OCCUPANCY.RD <not counted> UNC_ARB_TRK_REQUESTS.RD 1.012882143 seconds time elapsed 1.004600000 seconds user 0.008036000 seconds sys
Testing tma_info_thread_cpi
Testing tma_streaming_stores
Testing tma_dram_bound
Testing tma_store_bound
Testing tma_l2_hit_latency
Testing tma_load_stlb_hit
Testing tma_load_stlb_miss
Testing tma_load_stlb_miss_1g
Testing tma_load_stlb_miss_2m
Testing tma_load_stlb_miss_4k
Testing tma_store_stlb_hit
Testing tma_store_stlb_miss
Testing tma_store_stlb_miss_1g
Testing tma_store_stlb_miss_2m
Testing tma_store_stlb_miss_4k
Testing tma_info_memory_latency_data_l2_mlp
Testing tma_info_memory_latency_load_l2_mlp
Testing tma_info_pipeline_ipassist
Testing tma_microcode_sequencer
Testing tma_ms
Testing tma_info_system_kernel_cpi
[Failed tma_info_system_kernel_cpi] Metric contains missing events
Error: No supported events found. Access to performance monitoring and observability operations is limited. Consider adjusting /proc/sys/kernel/perf_event_paranoid setting to open access to performance monitoring and observability operations for processes without CAP_PERFMON, CAP_SYS_PTRACE or CAP_SYS_ADMIN Linux capability. More information can be found at 'Perf events and tool security' document: https://www.kernel.org/doc/html/latest/admin-guide/perf-security.html perf_event_paranoid setting is 2: -1: Allow use of (almost) all events by all users Ignore mlock limit after perf_event_mlock_kb without CAP_IPC_LOCK >= 0: Disallow raw and ftrace function tracepoint access >= 1: Disallow CPU event access >= 2: Disallow kernel profiling To make the adjusted perf_event_paranoid setting permanent preserve it in /etc/sysctl.conf (e.g. kernel.perf_event_paranoid = <setting>)
Testing tma_info_system_kernel_utilization
[Failed tma_info_system_kernel_utilization] Metric contains missing events
Error: No supported events found. Access to performance monitoring and observability operations is limited. Consider adjusting /proc/sys/kernel/perf_event_paranoid setting to open access to performance monitoring and observability operations for processes without CAP_PERFMON, CAP_SYS_PTRACE or CAP_SYS_ADMIN Linux capability. More information can be found at 'Perf events and tool security' document: https://www.kernel.org/doc/html/latest/admin-guide/perf-security.html perf_event_paranoid setting is 2: -1: Allow use of (almost) all events by all users Ignore mlock limit after perf_event_mlock_kb without CAP_IPC_LOCK >= 0: Disallow raw and ftrace function tracepoint access >= 1: Disallow CPU event access >= 2: Disallow kernel profiling To make the adjusted perf_event_paranoid setting permanent preserve it in /etc/sysctl.conf (e.g. kernel.perf_event_paranoid = <setting>)
Testing tma_info_pipeline_retire
Testing tma_info_thread_clks
Testing tma_info_thread_uoppi
Testing tma_memory_operations
Testing tma_other_light_ops
Testing tma_ports_utilization
Testing tma_ports_utilized_0
Testing tma_ports_utilized_1
Testing tma_ports_utilized_2
Testing C10_Pkg_Residency
[Failed C10_Pkg_Residency] Metric contains missing events
WARNING: grouped events cpus do not match. Events with CPUs not matching the leader will be removed from the group. anon group { cstate_pkg/c10-residency/, msr/tsc/ } Error: No supported events found. Invalid event (cstate_pkg/c10-residency/u) in per-thread mode, enable system wide with '-a'.
Testing C2_Pkg_Residency
[Failed C2_Pkg_Residency] Metric contains missing events
WARNING: grouped events cpus do not match. Events with CPUs not matching the leader will be removed from the group. anon group { cstate_pkg/c2-residency/, msr/tsc/ } Error: No supported events found. Invalid event (cstate_pkg/c2-residency/u) in per-thread mode, enable system wide with '-a'.
Testing C3_Pkg_Residency
[Failed C3_Pkg_Residency] Metric contains missing events
WARNING: grouped events cpus do not match. Events with CPUs not matching the leader will be removed from the group. anon group { msr/tsc/, cstate_pkg/c3-residency/ } Error: No supported events found. Invalid event (msr/tsc/u) in per-thread mode, enable system wide with '-a'.
Testing C6_Core_Residency
[Failed C6_Core_Residency] Metric contains missing events
WARNING: grouped events cpus do not match. Events with CPUs not matching the leader will be removed from the group. anon group { cstate_core/c6-residency/, msr/tsc/ } Error: No supported events found. Invalid event (cstate_core/c6-residency/u) in per-thread mode, enable system wide with '-a'.
Testing C6_Pkg_Residency
[Failed C6_Pkg_Residency] Metric contains missing events
WARNING: grouped events cpus do not match. Events with CPUs not matching the leader will be removed from the group. anon group { cstate_pkg/c6-residency/, msr/tsc/ } Error: No supported events found. Invalid event (cstate_pkg/c6-residency/u) in per-thread mode, enable system wide with '-a'.
Testing C7_Core_Residency
[Failed C7_Core_Residency] Metric contains missing events
WARNING: grouped events cpus do not match. Events with CPUs not matching the leader will be removed from the group. anon group { cstate_core/c7-residency/, msr/tsc/ } Error: No supported events found. Invalid event (cstate_core/c7-residency/u) in per-thread mode, enable system wide with '-a'.
Testing C7_Pkg_Residency
[Failed C7_Pkg_Residency] Metric contains missing events
WARNING: grouped events cpus do not match. Events with CPUs not matching the leader will be removed from the group. anon group { cstate_pkg/c7-residency/, msr/tsc/ } Error: No supported events found. Invalid event (cstate_pkg/c7-residency/u) in per-thread mode, enable system wide with '-a'.
Testing C8_Pkg_Residency
[Failed C8_Pkg_Residency] Metric contains missing events
WARNING: grouped events cpus do not match. Events with CPUs not matching the leader will be removed from the group. anon group { cstate_pkg/c8-residency/, msr/tsc/ } Error: No supported events found. Invalid event (cstate_pkg/c8-residency/u) in per-thread mode, enable system wide with '-a'.
Testing C9_Pkg_Residency
[Failed C9_Pkg_Residency] Metric contains missing events
WARNING: grouped events cpus do not match. Events with CPUs not matching the leader will be removed from the group. anon group { cstate_pkg/c9-residency/, msr/tsc/ } Error: No supported events found. Invalid event (cstate_pkg/c9-residency/u) in per-thread mode, enable system wide with '-a'.
Testing tma_info_core_epc
Testing tma_info_system_core_frequency
Testing tma_info_system_power
[Skipped tma_info_system_power] Not supported events
Performance counter stats for 'perf test -w noploop': <not supported> Joules power/energy-pkg/u 1,013,238,256 duration_time 1.013223072 seconds time elapsed 0.995924000 seconds user 0.011903000 seconds sys
Testing tma_info_system_power_license0_utilization
Testing tma_info_system_power_license1_utilization
Testing tma_info_system_power_license2_utilization
Testing tma_info_system_turbo_utilization
Testing tma_info_inst_mix_ipswpf
Testing tma_info_memory_prefetches_useless_hwpf
Testing tma_info_core_coreipc
Testing tma_info_thread_ipc
Testing tma_heavy_operations
Testing tma_light_operations
Testing tma_info_core_core_clks
Testing tma_info_system_smt_2t_utilization
Testing tma_info_thread_slots_utilization
Testing UNCORE_FREQ
[Skipped UNCORE_FREQ] Not supported events
Performance counter stats for 'perf test -w noploop': <not supported> UNC_CLOCK.SOCKET:u 1,015,993,466 duration_time 1.015949387 seconds time elapsed 1.007676000 seconds user 0.008029000 seconds sys
Testing tma_info_system_socket_clks
[Failed tma_info_system_socket_clks] Metric contains missing events
Error: No supported events found. Invalid event (UNC_CLOCK.SOCKET:u) in per-thread mode, enable system wide with '-a'.
Testing tma_info_inst_mix_instructions
Testing tma_info_system_cpus_utilized
Testing tma_info_system_mux
Testing tma_info_system_time
Testing tma_info_thread_slots
Testing tma_few_uops_instructions
Testing tma_4k_aliasing
Testing tma_cisc
Testing tma_fp_divider
Testing tma_int_divider
Testing tma_slow_pause
Testing tma_split_loads
Testing tma_split_stores
Testing tma_store_fwd_blk
Testing tma_alu_op_utilization
Testing tma_load_op_utilization
Testing tma_mixing_vectors
Testing tma_store_op_utilization
Testing tma_port_1
Testing tma_port_5
Testing tma_port_6
Testing smi_cycles
[Skipped smi_cycles] Not supported events
Performance counter stats for 'perf test -w noploop': <not supported> msr/smi/u <not supported> msr/aperf/u 3,965,789,327 cycles:u 1.012779591 seconds time elapsed 1.004579000 seconds user 0.007972000 seconds sys
Testing smi_num
[Failed smi_num] Metric contains missing events
Error: No supported events found. Invalid event (msr/smi/u) in per-thread mode, enable system wide with '-a'.
Testing tsx_aborted_cycles
Testing tsx_cycles_per_elision
Testing tsx_cycles_per_transaction
Testing tsx_transactional_cycles
---- end(-1) ----
110: perf all metrics test : FAILED!
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Stable-dep-of: 8953bfd8820b ("perf tests: Skip metrics validation if system-wide recording lacks permission")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/tests/shell/stat_all_metrics.sh | 29 ++++++++++++++++------
1 file changed, 22 insertions(+), 7 deletions(-)
diff --git a/tools/perf/tests/shell/stat_all_metrics.sh b/tools/perf/tests/shell/stat_all_metrics.sh
index 3dabb39c7cc8c..b582d23f28c9e 100755
--- a/tools/perf/tests/shell/stat_all_metrics.sh
+++ b/tools/perf/tests/shell/stat_all_metrics.sh
@@ -15,7 +15,8 @@ then
test_prog="perf test -w noploop"
fi
-err=0
+skip=0
+err=3
for m in $(perf list --raw-dump metrics); do
echo "Testing $m"
result=$(perf stat -M "$m" $system_wide_flag -- $test_prog 2>&1)
@@ -23,6 +24,10 @@ for m in $(perf list --raw-dump metrics); do
if [[ $result_err -eq 0 && "$result" =~ ${m:0:50} ]]
then
# No error result and metric shown.
+ if [[ "$err" -ne 1 ]]
+ then
+ err=0
+ fi
continue
fi
if [[ "$result" =~ "Cannot resolve IDs for" || "$result" =~ "No supported events found" ]]
@@ -44,7 +49,7 @@ for m in $(perf list --raw-dump metrics); do
echo $result
if [[ $err -eq 0 ]]
then
- err=2 # Skip
+ skip=1
fi
continue
elif [[ "$result" =~ "in per-thread mode, enable system wide" ]]
@@ -53,7 +58,7 @@ for m in $(perf list --raw-dump metrics); do
echo $result
if [[ $err -eq 0 ]]
then
- err=2 # Skip
+ skip=1
fi
continue
elif [[ "$result" =~ "<not supported>" ]]
@@ -68,7 +73,7 @@ for m in $(perf list --raw-dump metrics); do
echo $result
if [[ $err -eq 0 ]]
then
- err=2 # Skip
+ skip=1
fi
continue
elif [[ "$result" =~ "<not counted>" ]]
@@ -77,7 +82,7 @@ for m in $(perf list --raw-dump metrics); do
echo $result
if [[ $err -eq 0 ]]
then
- err=2 # Skip
+ skip=1
fi
continue
elif [[ "$result" =~ "FP_ARITH" || "$result" =~ "AMX" ]]
@@ -86,7 +91,7 @@ for m in $(perf list --raw-dump metrics); do
echo $result
if [[ $err -eq 0 ]]
then
- err=2 # Skip
+ skip=1
fi
continue
elif [[ "$result" =~ "PMM" ]]
@@ -95,7 +100,7 @@ for m in $(perf list --raw-dump metrics); do
echo $result
if [[ $err -eq 0 ]]
then
- err=2 # Skip
+ skip=1
fi
continue
fi
@@ -106,6 +111,10 @@ for m in $(perf list --raw-dump metrics); do
if [[ $result_err -eq 0 && "$result" =~ ${m:0:50} ]]
then
# No error result and metric shown.
+ if [[ "$err" -ne 1 ]]
+ then
+ err=0
+ fi
continue
fi
echo "[Failed $m] has non-zero error '$result_err' or not printed in:"
@@ -113,4 +122,10 @@ for m in $(perf list --raw-dump metrics); do
err=1
done
+# return SKIP only if no success returned
+if [[ "$err" -eq 3 && "$skip" -eq 1 ]]
+then
+ err=2
+fi
+
exit "$err"
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0357/1376] perf tests: Skip metrics validation if system-wide recording lacks permission
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (355 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0356/1376] perf test: Do not skip when some metrics tests succeeded Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0358/1376] perf test: Use sqrtloop workload to test bperf event Greg Kroah-Hartman
` (641 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ian Rogers, Namhyung Kim,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <irogers@google.com>
[ Upstream commit 8953bfd8820b6525032023fda3a420098c1823ae ]
The metrics value validation test requires system-wide recording (`-a`),
which can fail on systems without root permissions or where paranoid
levels restrict tracing. Add a check to skip the test if `-a` is not
supported.
Also fix false negatives during validation by updating parse error string
patterns and resolving issues in metric list generation.
Fixes: 3ad7092f5145 ("perf test: Add metric value validation test")
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../tests/shell/lib/perf_metric_validation.py | 11 ++-
tools/perf/tests/shell/stat_all_metrics.sh | 75 ++++++++++++-------
tools/perf/tests/shell/stat_metrics_values.sh | 7 ++
3 files changed, 60 insertions(+), 33 deletions(-)
diff --git a/tools/perf/tests/shell/lib/perf_metric_validation.py b/tools/perf/tests/shell/lib/perf_metric_validation.py
index 0b94216c9c46d..32b81e0855159 100644
--- a/tools/perf/tests/shell/lib/perf_metric_validation.py
+++ b/tools/perf/tests/shell/lib/perf_metric_validation.py
@@ -381,10 +381,13 @@ class Validator:
wl = workload.split()
command.extend(wl)
print(" ".join(command))
- cmd = subprocess.run(command, stderr=subprocess.PIPE, encoding='utf-8')
- data = [x+'}' for x in cmd.stderr.split('}\n') if x]
- if data[0][0] != '{':
- data[0] = data[0][data[0].find('{'):]
+ cmd = subprocess.run(command, stdout=subprocess.PIPE, stderr=subprocess.PIPE, encoding='utf-8')
+ lines = cmd.stderr.splitlines() + cmd.stdout.splitlines()
+ data = []
+ for line in lines:
+ line = line.strip()
+ if line.startswith('{') and line.endswith('}'):
+ data.append(line)
return data
def collect_perf(self, workload: str):
diff --git a/tools/perf/tests/shell/stat_all_metrics.sh b/tools/perf/tests/shell/stat_all_metrics.sh
index b582d23f28c9e..feeb34c6fa6df 100755
--- a/tools/perf/tests/shell/stat_all_metrics.sh
+++ b/tools/perf/tests/shell/stat_all_metrics.sh
@@ -12,38 +12,65 @@ system_wide_flag="-a"
if ParanoidAndNotRoot 0
then
system_wide_flag=""
- test_prog="perf test -w noploop"
+ test_prog="perf test -w noploop 0.01"
fi
+check_metric() {
+ local output="$1"
+ local status="$2"
+ local metric="$3"
+
+ if [[ $status -ne 0 || ! "$output" =~ ${metric:0:50} ]]; then
+ return 1
+ fi
+
+ if [[ "$output" =~ "<not counted>" || "$output" =~ "<not supported>" ]]; then
+ return 1
+ fi
+
+ return 0
+}
+
skip=0
err=3
for m in $(perf list --raw-dump metrics); do
echo "Testing $m"
result=$(perf stat -M "$m" $system_wide_flag -- $test_prog 2>&1)
result_err=$?
- if [[ $result_err -eq 0 && "$result" =~ ${m:0:50} ]]
- then
- # No error result and metric shown.
+
+ if check_metric "$result" $result_err "$m"; then
if [[ "$err" -ne 1 ]]
then
err=0
fi
continue
fi
- if [[ "$result" =~ "Cannot resolve IDs for" || "$result" =~ "No supported events found" ]]
+
+ if [[ "$result" =~ "Access to performance monitoring and observability operations is limited" || \
+ "$result" =~ "in per-thread mode, enable system wide" || \
+ "$result" =~ "<not supported>" || \
+ "$result" =~ "Cannot resolve IDs for" || \
+ "$result" =~ "No supported events found" || \
+ "$result" =~ "FP_ARITH" || \
+ "$result" =~ "AMX" || \
+ "$result" =~ "PMM" ]]
then
- if [[ $(perf list --raw-dump $m) == "Default"* ]]
- then
- echo "[Ignored $m] failed but as a Default metric this can be expected"
- echo $result
+ true
+ else
+ result=$(perf stat -M "$m" $system_wide_flag -- perf test -w noploop 0.1 2>&1)
+ result_err=$?
+
+ if check_metric "$result" $result_err "$m"; then
+ if [[ "$err" -ne 1 ]]
+ then
+ err=0
+ fi
continue
fi
- echo "[Failed $m] Metric contains missing events"
- echo $result
- err=1 # Fail
- continue
- elif [[ "$result" =~ \
- "Access to performance monitoring and observability operations is limited" ]]
+ fi
+
+ # If retry also failed, determine if we skip, ignore, or fail
+ if [[ "$result" =~ "Access to performance monitoring and observability operations is limited" ]]
then
echo "[Skipped $m] Permission failure"
echo $result
@@ -61,7 +88,9 @@ for m in $(perf list --raw-dump metrics); do
skip=1
fi
continue
- elif [[ "$result" =~ "<not supported>" ]]
+ elif [[ "$result" =~ "<not supported>" || \
+ "$result" =~ "Cannot resolve IDs for" || \
+ "$result" =~ "No supported events found" ]]
then
if [[ $(perf list --raw-dump $m) == "Default"* ]]
then
@@ -105,19 +134,7 @@ for m in $(perf list --raw-dump metrics); do
continue
fi
- # Failed, possibly the workload was too small so retry with something longer.
- result=$(perf stat -M "$m" $system_wide_flag -- perf bench internals synthesize 2>&1)
- result_err=$?
- if [[ $result_err -eq 0 && "$result" =~ ${m:0:50} ]]
- then
- # No error result and metric shown.
- if [[ "$err" -ne 1 ]]
- then
- err=0
- fi
- continue
- fi
- echo "[Failed $m] has non-zero error '$result_err' or not printed in:"
+ echo "[Failed $m] has non-zero error '$result_err' or not printed/counted in:"
echo "$result"
err=1
done
diff --git a/tools/perf/tests/shell/stat_metrics_values.sh b/tools/perf/tests/shell/stat_metrics_values.sh
index 279f19c5919ae..94969023cf8e4 100755
--- a/tools/perf/tests/shell/stat_metrics_values.sh
+++ b/tools/perf/tests/shell/stat_metrics_values.sh
@@ -8,6 +8,13 @@ shelldir=$(dirname "$0")
grep -q GenuineIntel /proc/cpuinfo || { echo Skipping non-Intel; exit 2; }
+# Skip if no permission to record system-wide events
+if ! perf stat -a -e instructions sleep 0.01 >/dev/null 2>&1; then
+ echo "Skipping: no permission to record system-wide events (-a)"
+ exit 2
+fi
+
+
pythonvalidator=$(dirname $0)/lib/perf_metric_validation.py
rulefile=$(dirname $0)/lib/perf_metric_validation_rules.json
tmpdir=$(mktemp -d /tmp/__perf_test.program.XXXXX)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0358/1376] perf test: Use sqrtloop workload to test bperf event
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (356 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0357/1376] perf tests: Skip metrics validation if system-wide recording lacks permission Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0359/1376] perf test: Fix perf stat --bpf-counters on hybrid machines Greg Kroah-Hartman
` (640 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tengda Wu, song, bpf, Namhyung Kim,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tengda Wu <wutengda@huaweicloud.com>
[ Upstream commit d36e5b36a2928b30e09ff59ce5ce2d5df935176e ]
Replace `brstack` workload with `sqrtloop` workload, because `sqrtloop`
workload contains fork(), which is suitable for testing the bperf event
inheritance feature.
Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
Cc: song@kernel.org
Cc: bpf@vger.kernel.org
Link: https://lore.kernel.org/r/20241021110201.325617-3-wutengda@huaweicloud.com
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Stable-dep-of: b02027776ac5 ("perf tests: Fix flakiness in BPF counters test on hybrid systems")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/tests/shell/stat_bpf_counters.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/tests/shell/stat_bpf_counters.sh b/tools/perf/tests/shell/stat_bpf_counters.sh
index f250b7d6f773f..831f02add75e5 100755
--- a/tools/perf/tests/shell/stat_bpf_counters.sh
+++ b/tools/perf/tests/shell/stat_bpf_counters.sh
@@ -4,7 +4,7 @@
set -e
-workload="perf test -w brstack"
+workload="perf test -w sqrtloop"
# check whether $2 is within +/- 20% of $1
compare_number()
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0359/1376] perf test: Fix perf stat --bpf-counters on hybrid machines
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (357 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0358/1376] perf test: Use sqrtloop workload to test bperf event Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0360/1376] perf tests: Fix flakiness in BPF counters test on hybrid systems Greg Kroah-Hartman
` (639 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ian Rogers, Namhyung Kim,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <namhyung@kernel.org>
[ Upstream commit d9db9c8db56c3e378aa5c91637664f77ca5a6f72 ]
The test constantly fails on my Intel hybrid machine. The issue was it
has two events in the output even if I only gave it one event.
$ perf stat -e instructions -- perf test -w sqrtloop
Performance counter stats for 'perf test -w sqrtloop':
910,856,421 cpu_atom/instructions/ (28.05%)
14,852,865,997 cpu_core/instructions/ (96.79%)
1.014313341 seconds time elapsed
1.004114000 seconds user
0.008174000 seconds sys
Let's modify the awk script to add the values for each line and print
the total. The variable 'i' has a number of input lines that have valid
output and variable 'c' has the sum of actual counter values. That way
it should work on any platforms.
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Stable-dep-of: b02027776ac5 ("perf tests: Fix flakiness in BPF counters test on hybrid systems")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/tests/shell/stat_bpf_counters.sh | 20 ++++++++++++++++----
1 file changed, 16 insertions(+), 4 deletions(-)
diff --git a/tools/perf/tests/shell/stat_bpf_counters.sh b/tools/perf/tests/shell/stat_bpf_counters.sh
index 831f02add75e5..b776ee2e445a6 100755
--- a/tools/perf/tests/shell/stat_bpf_counters.sh
+++ b/tools/perf/tests/shell/stat_bpf_counters.sh
@@ -41,8 +41,14 @@ check_counts()
test_bpf_counters()
{
printf "Testing --bpf-counters "
- base_instructions=$(perf stat --no-big-num -e instructions -- $workload 2>&1 | awk '/instructions/ {print $1}')
- bpf_instructions=$(perf stat --no-big-num --bpf-counters -e instructions -- $workload 2>&1 | awk '/instructions/ {print $1}')
+ base_instructions=$(perf stat --no-big-num -e instructions -- $workload 2>&1 | \
+ awk -v i=0 -v c=0 '/instructions/ { \
+ if ($1 != "<not") { i++; c += $1 } \
+ } END { if (i > 0) printf "%.0f", c; else print "<not" }')
+ bpf_instructions=$(perf stat --no-big-num --bpf-counters -e instructions -- $workload 2>&1 | \
+ awk -v i=0 -v c=0 '/instructions/ { \
+ if ($1 != "<not") { i++; c += $1 } \
+ } END { if (i > 0) printf "%.0f", c; else print "<not" }')
check_counts $base_instructions $bpf_instructions
compare_number $base_instructions $bpf_instructions
echo "[Success]"
@@ -52,8 +58,14 @@ test_bpf_modifier()
{
printf "Testing bpf event modifier "
stat_output=$(perf stat --no-big-num -e instructions/name=base_instructions/,instructions/name=bpf_instructions/b -- $workload 2>&1)
- base_instructions=$(echo "$stat_output"| awk '/base_instructions/ {print $1}')
- bpf_instructions=$(echo "$stat_output"| awk '/bpf_instructions/ {print $1}')
+ base_instructions=$(echo "$stat_output"| \
+ awk -v i=0 -v c=0 '/base_instructions/ { \
+ if ($1 != "<not") { i++; c += $1 } \
+ } END { if (i > 0) printf "%.0f", c; else print "<not" }')
+ bpf_instructions=$(echo "$stat_output"| \
+ awk -v i=0 -v c=0 '/bpf_instructions/ { \
+ if ($1 != "<not") { i++; c += $1 } \
+ } END { if (i > 0) printf "%.0f", c; else print "<not" }')
check_counts $base_instructions $bpf_instructions
compare_number $base_instructions $bpf_instructions
echo "[Success]"
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0360/1376] perf tests: Fix flakiness in BPF counters test on hybrid systems
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (358 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0359/1376] perf test: Fix perf stat --bpf-counters on hybrid machines Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0361/1376] perf test brstack: Speed up running test by using tr -s instead of xargs Greg Kroah-Hartman
` (638 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ian Rogers, Namhyung Kim,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <irogers@google.com>
[ Upstream commit b02027776ac5bf737f1b76f3759f405e376097e5 ]
The `perf stat --bpf-counters test` fails intermittently on hybrid
architectures or systems with dynamic frequency scaling (DVFS). This
happens because the test workload (`sqrtloop`) runs for a fixed 1-second
duration, and the CPU frequency can scale dynamically between idle and
maximum frequency. As the first run runs on a cold CPU and the second run
runs on a warmed-up CPU (or vice versa), the number of instructions
executed in 1 second differs by up to 2.2x, violating the comparison
tolerance.
Also, when running as root, BPF tracepoints and scheduling programs
trigger frequently. Since standard `perf stat -e instructions` measures
both user and kernel space instructions, it counts BPF helper and program
execution overheads, whereas the BPF counters themselves do not self-
measure. This introduces a large kernel-space instruction count
discrepancy between standard and BPF counters.
Fix these issues by:
1. Switching the workload to a strictly deterministic, iteration-based
workload: `awk 'BEGIN { for (i=0; i<10000000; i++) sum+=i }'`. We pin
the
workload to a single random allowed CPU using `taskset -c $CPU` via a
bash array.
2. Restricting the counted event to user-space only (`instructions:u` or
`/u`).
3. Tightening the comparison tolerance from 20% to 15%.
These modifications isolate the measurements to user-space instructions of
the deterministic loop, which executes a virtually identical number of
instructions on both runs (with less than 0.001% variation), eliminating
Dynamic Frequency Scaling (DVFS), kernel scheduling noise, and BPF helper
self-measurement overheads.
Fixes: 2c0cb9f56020 ("perf test: Add a shell test for 'perf stat --bpf-counters' new option")
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/tests/shell/stat_bpf_counters.sh | 28 +++++++++++++--------
1 file changed, 18 insertions(+), 10 deletions(-)
diff --git a/tools/perf/tests/shell/stat_bpf_counters.sh b/tools/perf/tests/shell/stat_bpf_counters.sh
index b776ee2e445a6..76d4a7f15a43d 100755
--- a/tools/perf/tests/shell/stat_bpf_counters.sh
+++ b/tools/perf/tests/shell/stat_bpf_counters.sh
@@ -4,21 +4,26 @@
set -e
-workload="perf test -w sqrtloop"
+# Get the first allowed CPU
+CPU=$(taskset -c -p $$ | awk -F': ' '{print $2}' | awk -F'[,-]' '{print $1}')
+if [ -z "$CPU" ]; then
+ CPU=0
+fi
+workload=(taskset -c "$CPU" awk 'BEGIN { for (i=0; i<10000000; i++) sum+=i }')
-# check whether $2 is within +/- 20% of $1
+# check whether $2 is within +/- 15% of $1
compare_number()
{
first_num=$1
second_num=$2
- # upper bound is first_num * 120%
- upper=$(expr $first_num + $first_num / 5 )
- # lower bound is first_num * 80%
- lower=$(expr $first_num - $first_num / 5 )
+ # upper bound is first_num * 115%
+ upper=$(expr $first_num + $first_num / 20 \* 3 )
+ # lower bound is first_num * 85%
+ lower=$(expr $first_num - $first_num / 20 \* 3 )
if [ $second_num -gt $upper ] || [ $second_num -lt $lower ]; then
- echo "The difference between $first_num and $second_num are greater than 20%."
+ echo "The difference between $first_num and $second_num are greater than 15%."
exit 1
fi
}
@@ -41,11 +46,12 @@ check_counts()
test_bpf_counters()
{
printf "Testing --bpf-counters "
- base_instructions=$(perf stat --no-big-num -e instructions -- $workload 2>&1 | \
+ base_instructions=$(perf stat --no-big-num -e instructions:u -- "${workload[@]}" 2>&1 | \
awk -v i=0 -v c=0 '/instructions/ { \
if ($1 != "<not") { i++; c += $1 } \
} END { if (i > 0) printf "%.0f", c; else print "<not" }')
- bpf_instructions=$(perf stat --no-big-num --bpf-counters -e instructions -- $workload 2>&1 | \
+ bpf_instructions=$(perf stat --no-big-num --bpf-counters -e instructions:u \
+ -- "${workload[@]}" 2>&1 | \
awk -v i=0 -v c=0 '/instructions/ { \
if ($1 != "<not") { i++; c += $1 } \
} END { if (i > 0) printf "%.0f", c; else print "<not" }')
@@ -57,7 +63,9 @@ test_bpf_counters()
test_bpf_modifier()
{
printf "Testing bpf event modifier "
- stat_output=$(perf stat --no-big-num -e instructions/name=base_instructions/,instructions/name=bpf_instructions/b -- $workload 2>&1)
+ stat_output=$(perf stat --no-big-num \
+ -e instructions/name=base_instructions/u,instructions/name=bpf_instructions/bu \
+ -- "${workload[@]}" 2>&1)
base_instructions=$(echo "$stat_output"| \
awk -v i=0 -v c=0 '/base_instructions/ { \
if ($1 != "<not") { i++; c += $1 } \
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0361/1376] perf test brstack: Speed up running test by using tr -s instead of xargs
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (359 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0360/1376] perf tests: Fix flakiness in BPF counters test on hybrid systems Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0362/1376] perf tests: Harden branch stack sampling test Greg Kroah-Hartman
` (637 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, James Clark, Anshuman Khandual,
James Clark, Namhyung Kim, Adrian Hunter, Alexander Shishkin,
Ian Rogers, Ingo Molnar, Jiri Olsa, Kan Liang, Mark Rutland,
Peter Zijlstra, Rob Herring, Arnaldo Carvalho de Melo,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Clark <james.clark@arm.com>
[ Upstream commit 3178155d292b2b5f0b9f59b3777dc52e029652ba ]
The brstack test runs quite slowly in software models. Part of the reason
is "xargs -n1" is quite inefficient in replacing spaces with newlines.
While that's not noticeable on normal machines, it is on software models.
Use "tr -s ' ' '\n'" instead which can do the same transformation, but is
much faster. For comparison on an M1 Macbook Pro:
$ time seq -s ' ' 10000 | xargs -n1 > /dev/null
real 0m2.729s
user 0m2.009s
sys 0m0.914s
$ time seq -s ' ' 10000 | tr -s ' ' '\n' | grep '.' > /dev/null
real 0m0.002s
user 0m0.001s
sys 0m0.001s
The "grep '.'" is also needed to remove any remaining blank lines.
Signed-off-by: James Clark <james.clark@arm.com>
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
Reviewed-by: James Clark <james.clark@linaro.org>
Reviewed-by: Namhyung Kim <namhyung@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Kan Liang <kan.liang@linux.intel.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://lore.kernel.org/r/20241213231312.2640687-2-robh@kernel.org
Signed-off-by: Anshuman Khandual <anshuman.khandual@arm.com>
Signed-off-by: Rob Herring <robh@kernel.org>
[robh: Drop changing loop iterations on arm64. Squash blank line fix and redo commit msg]
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Stable-dep-of: 344d3aec164d ("perf tests: Fix flakiness in branch stack sampling tests")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/tests/shell/test_brstack.sh | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/perf/tests/shell/test_brstack.sh b/tools/perf/tests/shell/test_brstack.sh
index 5f14d0cb013f8..e01df7581393e 100755
--- a/tools/perf/tests/shell/test_brstack.sh
+++ b/tools/perf/tests/shell/test_brstack.sh
@@ -30,7 +30,7 @@ test_user_branches() {
echo "Testing user branch stack sampling"
perf record -o $TMPDIR/perf.data --branch-filter any,save_type,u -- ${TESTPROG} > /dev/null 2>&1
- perf script -i $TMPDIR/perf.data --fields brstacksym | xargs -n1 > $TMPDIR/perf.script
+ perf script -i $TMPDIR/perf.data --fields brstacksym | tr -s ' ' '\n' > $TMPDIR/perf.script
# example of branch entries:
# brstack_foo+0x14/brstack_bar+0x40/P/-/-/0/CALL
@@ -59,7 +59,7 @@ test_filter() {
echo "Testing branch stack filtering permutation ($test_filter_filter,$test_filter_expect)"
perf record -o $TMPDIR/perf.data --branch-filter $test_filter_filter,save_type,u -- ${TESTPROG} > /dev/null 2>&1
- perf script -i $TMPDIR/perf.data --fields brstack | xargs -n1 > $TMPDIR/perf.script
+ perf script -i $TMPDIR/perf.data --fields brstack | tr -s ' ' '\n' | grep '.' > $TMPDIR/perf.script
# fail if we find any branch type that doesn't match any of the expected ones
# also consider UNKNOWN branch types (-)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0362/1376] perf tests: Harden branch stack sampling test
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (360 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0361/1376] perf test brstack: Speed up running test by using tr -s instead of xargs Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0363/1376] perf test: Refactor brstack test Greg Kroah-Hartman
` (636 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ian Rogers, Arnaldo Carvalho de Melo,
Adrian Hunter, Alexander Shishkin, Anshuman Khandual,
German Gomez, Ingo Molnar, James Clark, Jiri Olsa, Kan Liang,
Mark Rutland, Namhyung Kim, Peter Zijlstra, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <irogers@google.com>
[ Upstream commit f3061d526714ac6cc936c48e76a6eb0512c69b1a ]
On continuous testing the perf script output can be empty, or nearly
empty, causing tr/grep to exit and due to "set -e" the test traps and
fails.
Add some empty file handling that sets the test to skip and make grep
and other text rewriting failures non-fatal by adding "|| true".
Committer testing:
root@number:~# grep -m1 "model name" /proc/cpuinfo
model name : AMD Ryzen 9 9950X3D 16-Core Processor
root@number:~# perf test "Check branch stack sampling"
104: Check branch stack sampling : Ok
root@number:~#
root@number:~# perf test -vvvvvvv "Check branch stack sampling"
104: Check branch stack sampling:
--- start ---
test child forked, pid 396047
142d22-142da0 l brstack_bench
perf does have symbol 'brstack_bench'
Testing user branch stack sampling
Testing branch stack filtering permutation (any_call,CALL|IND_CALL|COND_CALL|SYSCALL|IRQ)
Testing branch stack filtering permutation (call,CALL|SYSCALL)
Testing branch stack filtering permutation (cond,COND)
Testing branch stack filtering permutation (any_ret,RET|COND_RET|SYSRET|ERET)
Testing branch stack filtering permutation (call,cond,CALL|SYSCALL|COND)
Testing branch stack filtering permutation (any_call,cond,CALL|IND_CALL|COND_CALL|IRQ|SYSCALL|COND)
Testing branch stack filtering permutation (cond,any_call,any_ret,COND|CALL|IND_CALL|COND_CALL|SYSCALL|IRQ|RET|COND_RET|SYSRET|ERET)
---- end(0) ----
104: Check branch stack sampling : Ok
root@number:~#
Signed-off-by: Ian Rogers <irogers@google.com>
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: German Gomez <german.gomez@arm.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Kan Liang <kan.liang@linux.intel.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://lore.kernel.org/r/20250318161639.34446-1-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Stable-dep-of: 344d3aec164d ("perf tests: Fix flakiness in branch stack sampling tests")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/tests/shell/test_brstack.sh | 72 +++++++++++++++++++-------
1 file changed, 52 insertions(+), 20 deletions(-)
diff --git a/tools/perf/tests/shell/test_brstack.sh b/tools/perf/tests/shell/test_brstack.sh
index e01df7581393e..9138fa83bf36d 100755
--- a/tools/perf/tests/shell/test_brstack.sh
+++ b/tools/perf/tests/shell/test_brstack.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash
# Check branch stack sampling
# SPDX-License-Identifier: GPL-2.0
@@ -17,35 +17,50 @@ fi
skip_test_missing_symbol brstack_bench
+err=0
TMPDIR=$(mktemp -d /tmp/__perf_test.program.XXXXX)
TESTPROG="perf test -w brstack"
cleanup() {
rm -rf $TMPDIR
+ trap - EXIT TERM INT
}
-trap cleanup EXIT TERM INT
+trap_cleanup() {
+ set +e
+ echo "Unexpected signal in ${FUNCNAME[1]}"
+ cleanup
+ exit 1
+}
+trap trap_cleanup EXIT TERM INT
test_user_branches() {
echo "Testing user branch stack sampling"
- perf record -o $TMPDIR/perf.data --branch-filter any,save_type,u -- ${TESTPROG} > /dev/null 2>&1
- perf script -i $TMPDIR/perf.data --fields brstacksym | tr -s ' ' '\n' > $TMPDIR/perf.script
+ perf record -o "$TMPDIR/perf.data" --branch-filter any,save_type,u -- ${TESTPROG} > "$TMPDIR/record.txt" 2>&1
+ perf script -i "$TMPDIR/perf.data" --fields brstacksym > "$TMPDIR/perf.script"
# example of branch entries:
# brstack_foo+0x14/brstack_bar+0x40/P/-/-/0/CALL
- set -x
- grep -E -m1 "^brstack_bench\+[^ ]*/brstack_foo\+[^ ]*/IND_CALL/.*$" $TMPDIR/perf.script
- grep -E -m1 "^brstack_foo\+[^ ]*/brstack_bar\+[^ ]*/CALL/.*$" $TMPDIR/perf.script
- grep -E -m1 "^brstack_bench\+[^ ]*/brstack_foo\+[^ ]*/CALL/.*$" $TMPDIR/perf.script
- grep -E -m1 "^brstack_bench\+[^ ]*/brstack_bar\+[^ ]*/CALL/.*$" $TMPDIR/perf.script
- grep -E -m1 "^brstack_bar\+[^ ]*/brstack_foo\+[^ ]*/RET/.*$" $TMPDIR/perf.script
- grep -E -m1 "^brstack_foo\+[^ ]*/brstack_bench\+[^ ]*/RET/.*$" $TMPDIR/perf.script
- grep -E -m1 "^brstack_bench\+[^ ]*/brstack_bench\+[^ ]*/COND/.*$" $TMPDIR/perf.script
- grep -E -m1 "^brstack\+[^ ]*/brstack\+[^ ]*/UNCOND/.*$" $TMPDIR/perf.script
- set +x
-
+ expected=(
+ "^brstack_bench\+[^ ]*/brstack_foo\+[^ ]*/IND_CALL/.*$"
+ "^brstack_foo\+[^ ]*/brstack_bar\+[^ ]*/CALL/.*$"
+ "^brstack_bench\+[^ ]*/brstack_foo\+[^ ]*/CALL/.*$"
+ "^brstack_bench\+[^ ]*/brstack_bar\+[^ ]*/CALL/.*$"
+ "^brstack_bar\+[^ ]*/brstack_foo\+[^ ]*/RET/.*$"
+ "^brstack_foo\+[^ ]*/brstack_bench\+[^ ]*/RET/.*$"
+ "^brstack_bench\+[^ ]*/brstack_bench\+[^ ]*/COND/.*$"
+ "^brstack\+[^ ]*/brstack\+[^ ]*/UNCOND/.*$"
+ )
+ for x in "${expected[@]}"
+ do
+ if ! tr -s ' ' '\n' < "$TMPDIR/perf.script" | grep -E -m1 -q "$x"
+ then
+ echo "Branches missing $x"
+ err=1
+ fi
+ done
# some branch types are still not being tested:
# IND COND_CALL COND_RET SYSCALL SYSRET IRQ SERROR NO_TX
}
@@ -57,14 +72,28 @@ test_filter() {
test_filter_expect=$2
echo "Testing branch stack filtering permutation ($test_filter_filter,$test_filter_expect)"
-
- perf record -o $TMPDIR/perf.data --branch-filter $test_filter_filter,save_type,u -- ${TESTPROG} > /dev/null 2>&1
- perf script -i $TMPDIR/perf.data --fields brstack | tr -s ' ' '\n' | grep '.' > $TMPDIR/perf.script
+ perf record -o "$TMPDIR/perf.data" --branch-filter "$test_filter_filter,save_type,u" -- ${TESTPROG} > "$TMPDIR/record.txt" 2>&1
+ perf script -i "$TMPDIR/perf.data" --fields brstack > "$TMPDIR/perf.script"
# fail if we find any branch type that doesn't match any of the expected ones
# also consider UNKNOWN branch types (-)
- if grep -E -vm1 "^[^ ]*/($test_filter_expect|-|( *))/.*$" $TMPDIR/perf.script; then
- return 1
+ if [ ! -s "$TMPDIR/perf.script" ]
+ then
+ echo "Empty script output"
+ err=1
+ return
+ fi
+ # Look for lines not matching test_filter_expect ignoring issues caused
+ # by empty output
+ tr -s ' ' '\n' < "$TMPDIR/perf.script" | grep '.' | \
+ grep -E -vm1 "^[^ ]*/($test_filter_expect|-|( *))/.*$" \
+ > "$TMPDIR/perf.script-filtered" || true
+ if [ -s "$TMPDIR/perf.script-filtered" ]
+ then
+ echo "Unexpected branch filter in script output"
+ cat "$TMPDIR/perf.script"
+ err=1
+ return
fi
}
@@ -80,3 +109,6 @@ test_filter "any_ret" "RET|COND_RET|SYSRET|ERET"
test_filter "call,cond" "CALL|SYSCALL|COND"
test_filter "any_call,cond" "CALL|IND_CALL|COND_CALL|IRQ|SYSCALL|COND"
test_filter "cond,any_call,any_ret" "COND|CALL|IND_CALL|COND_CALL|SYSCALL|IRQ|RET|COND_RET|SYSRET|ERET"
+
+cleanup
+exit $err
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0363/1376] perf test: Refactor brstack test
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (361 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0362/1376] perf tests: Harden branch stack sampling test Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0364/1376] perf test: Add syscall and address tests to " Greg Kroah-Hartman
` (635 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ian Rogers, James Clark, Adam Young,
Adrian Hunter, Alexander Shishkin, Anshuman Khandual,
German Gomez, Ingo Molnar, Jiri Olsa, Mark Rutland, Namhyung Kim,
Peter Zijlstra, Rob Herring, Will Deacon,
Arnaldo Carvalho de Melo, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Clark <james.clark@linaro.org>
[ Upstream commit f15548b277cc107d41b88b1a63bd4942b703666b ]
check_branches() will be used by other tests in a later commit so make
it a function. And the any_call filters are duplicated and will also
be extended in a later commit, so move them to a variable.
No functional changes intended.
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: James Clark <james.clark@linaro.org>
Cc: Adam Young <admiyo@os.amperecomputing.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: German Gomez <german.gomez@arm.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rob Herring <robh@kernel.org>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Stable-dep-of: 344d3aec164d ("perf tests: Fix flakiness in branch stack sampling tests")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/tests/shell/test_brstack.sh | 21 +++++++++++++--------
1 file changed, 13 insertions(+), 8 deletions(-)
diff --git a/tools/perf/tests/shell/test_brstack.sh b/tools/perf/tests/shell/test_brstack.sh
index 9138fa83bf36d..46e5aa9ce8ee7 100755
--- a/tools/perf/tests/shell/test_brstack.sh
+++ b/tools/perf/tests/shell/test_brstack.sh
@@ -34,6 +34,13 @@ trap_cleanup() {
}
trap trap_cleanup EXIT TERM INT
+check_branches() {
+ if ! tr -s ' ' '\n' < "$TMPDIR/perf.script" | grep -E -m1 -q "$1"; then
+ echo "Branches missing $1"
+ err=1
+ fi
+}
+
test_user_branches() {
echo "Testing user branch stack sampling"
@@ -55,11 +62,7 @@ test_user_branches() {
)
for x in "${expected[@]}"
do
- if ! tr -s ' ' '\n' < "$TMPDIR/perf.script" | grep -E -m1 -q "$x"
- then
- echo "Branches missing $x"
- err=1
- fi
+ check_branches "$x"
done
# some branch types are still not being tested:
# IND COND_CALL COND_RET SYSCALL SYSRET IRQ SERROR NO_TX
@@ -101,14 +104,16 @@ set -e
test_user_branches
-test_filter "any_call" "CALL|IND_CALL|COND_CALL|SYSCALL|IRQ"
+any_call="CALL|IND_CALL|COND_CALL|SYSCALL|IRQ"
+
+test_filter "any_call" "$any_call"
test_filter "call" "CALL|SYSCALL"
test_filter "cond" "COND"
test_filter "any_ret" "RET|COND_RET|SYSRET|ERET"
test_filter "call,cond" "CALL|SYSCALL|COND"
-test_filter "any_call,cond" "CALL|IND_CALL|COND_CALL|IRQ|SYSCALL|COND"
-test_filter "cond,any_call,any_ret" "COND|CALL|IND_CALL|COND_CALL|SYSCALL|IRQ|RET|COND_RET|SYSRET|ERET"
+test_filter "any_call,cond" "$any_call|COND"
+test_filter "any_call,cond,any_ret" "$any_call|COND|RET|COND_RET"
cleanup
exit $err
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0364/1376] perf test: Add syscall and address tests to brstack test
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (362 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0363/1376] perf test: Refactor brstack test Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0365/1376] perf test: Extend branch stack sampling test for Arm64 BRBE Greg Kroah-Hartman
` (634 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ian Rogers, James Clark, Adam Young,
Adrian Hunter, Alexander Shishkin, Anshuman Khandual,
German Gomez, Ingo Molnar, Jiri Olsa, Mark Rutland, Namhyung Kim,
Peter Zijlstra, Rob Herring, Will Deacon,
Arnaldo Carvalho de Melo, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Clark <james.clark@linaro.org>
[ Upstream commit 11e59335b0d1c4bc259ee6f0533e04c4b3a9f1dd ]
Test that SYSCALL type branches are emitted from the expected 'getppid'
symbol. Test that when only 'k' is used, sources addresses are all in
the kernel. Test that no kernel addresses leak by checking for them in
the 'u' test.
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: James Clark <james.clark@linaro.org>
Cc: Adam Young <admiyo@os.amperecomputing.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: German Gomez <german.gomez@arm.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rob Herring <robh@kernel.org>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Stable-dep-of: 344d3aec164d ("perf tests: Fix flakiness in branch stack sampling tests")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/tests/shell/test_brstack.sh | 61 +++++++++++++++++++++++++-
1 file changed, 60 insertions(+), 1 deletion(-)
diff --git a/tools/perf/tests/shell/test_brstack.sh b/tools/perf/tests/shell/test_brstack.sh
index 46e5aa9ce8ee7..252d22d39c7b0 100755
--- a/tools/perf/tests/shell/test_brstack.sh
+++ b/tools/perf/tests/shell/test_brstack.sh
@@ -64,8 +64,50 @@ test_user_branches() {
do
check_branches "$x"
done
+
+ # Dump addresses only this time
+ perf script -i "$TMPDIR/perf.data" --fields brstack | \
+ tr ' ' '\n' > "$TMPDIR/perf.script"
+
+ # There should be no kernel addresses with the u option, in either
+ # source or target addresses.
+ if grep -E -m1 "0x[89a-f][0-9a-f]{15}" $TMPDIR/perf.script; then
+ echo "ERROR: Kernel address found in user mode"
+ err=1
+ fi
# some branch types are still not being tested:
- # IND COND_CALL COND_RET SYSCALL SYSRET IRQ SERROR NO_TX
+ # IND COND_CALL COND_RET SYSRET IRQ SERROR NO_TX
+}
+
+
+test_kernel_branches() {
+ echo "Testing that k option only includes kernel source addresses"
+
+ if ! perf record --branch-filter any,k -o- -- true > /dev/null; then
+ echo "skip: not enough privileges"
+ else
+ perf record -o $TMPDIR/perf.data --branch-filter any,k -- \
+ perf bench syscall basic --loop 1000
+ perf script -i $TMPDIR/perf.data --fields brstack | \
+ tr ' ' '\n' > $TMPDIR/perf.script
+
+ # Example of branch entries:
+ # "0xffffffff93bda241/0xffffffff93bda20f/M/-/-/..."
+ # Source addresses come first and target address can be either
+ # userspace or kernel even with k option, as long as the source
+ # is in kernel.
+
+ #Look for source addresses with top bit set
+ if ! grep -E -m1 "^0x[89a-f][0-9a-f]{15}" $TMPDIR/perf.script; then
+ echo "ERROR: Kernel branches missing"
+ err=1
+ fi
+ # Look for no source addresses without top bit set
+ if grep -E -m1 "^0x[0-7][0-9a-f]{0,15}" $TMPDIR/perf.script; then
+ echo "ERROR: User branches found with kernel filter"
+ err=1
+ fi
+ fi
}
# first argument <arg0> is the argument passed to "--branch-stack <arg0>,save_type,u"
@@ -100,9 +142,26 @@ test_filter() {
fi
}
+test_syscall() {
+ echo "Testing syscalls"
+ # skip if perf doesn't have enough privileges
+ if ! perf record --branch-filter any,k -o- -- true > /dev/null; then
+ echo "skip: not enough privileges"
+ else
+ perf record -o $TMPDIR/perf.data --branch-filter \
+ any_call,save_type,u,k -c 10000 -- \
+ perf bench syscall basic --loop 1000
+ perf script -i $TMPDIR/perf.data --fields brstacksym | \
+ tr ' ' '\n' > $TMPDIR/perf.script
+
+ check_branches "getppid[^ ]*/SYSCALL/"
+ fi
+}
set -e
test_user_branches
+test_syscall
+test_kernel_branches
any_call="CALL|IND_CALL|COND_CALL|SYSCALL|IRQ"
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0365/1376] perf test: Extend branch stack sampling test for Arm64 BRBE
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (363 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0364/1376] perf test: Add syscall and address tests to " Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0366/1376] perf test: Fixes for check branch stack sampling Greg Kroah-Hartman
` (633 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ian Rogers, German Gomez,
James Clark, Adam Young, Adrian Hunter, Alexander Shishkin,
Anshuman Khandual, Ingo Molnar, Jiri Olsa, Mark Rutland,
Namhyung Kim, Peter Zijlstra, Rob Herring, Will Deacon,
Arnaldo Carvalho de Melo, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Clark <james.clark@linaro.org>
[ Upstream commit 9f0fa213790e3633d37e981386da99149573135b ]
BRBE emits IRQ and ERET branches for branching and returning from
trapped instructions. Add a test that loops on a trapped instruction
(MRS - Read special register) for this.
Extend the expected 'any_call' branches to include FAULT_DATA and
FAULT_INST as these are emitted by BRBE.
Reviewed-by: Ian Rogers <irogers@google.com>
Co-developed-by: German Gomez <german.gomez@arm.com>
Signed-off-by: German Gomez <german.gomez@arm.com>
Signed-off-by: James Clark <james.clark@linaro.org>
Cc: Adam Young <admiyo@os.amperecomputing.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rob Herring <robh@kernel.org>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Stable-dep-of: 344d3aec164d ("perf tests: Fix flakiness in branch stack sampling tests")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/tests/builtin-test.c | 1 +
tools/perf/tests/shell/test_brstack.sh | 26 ++++++++++++++++++++-
tools/perf/tests/tests.h | 1 +
tools/perf/tests/workloads/Build | 2 ++
tools/perf/tests/workloads/traploop.c | 31 ++++++++++++++++++++++++++
5 files changed, 60 insertions(+), 1 deletion(-)
create mode 100644 tools/perf/tests/workloads/traploop.c
diff --git a/tools/perf/tests/builtin-test.c b/tools/perf/tests/builtin-test.c
index 470a9709427dd..3aa4ab160947d 100644
--- a/tools/perf/tests/builtin-test.c
+++ b/tools/perf/tests/builtin-test.c
@@ -153,6 +153,7 @@ static struct test_workload *workloads[] = {
&workload__brstack,
&workload__datasym,
&workload__landlock,
+ &workload__traploop,
};
static int num_subtests(const struct test_suite *t)
diff --git a/tools/perf/tests/shell/test_brstack.sh b/tools/perf/tests/shell/test_brstack.sh
index 252d22d39c7b0..85233d435be63 100755
--- a/tools/perf/tests/shell/test_brstack.sh
+++ b/tools/perf/tests/shell/test_brstack.sh
@@ -34,6 +34,10 @@ trap_cleanup() {
}
trap trap_cleanup EXIT TERM INT
+is_arm64() {
+ [ "$(uname -m)" = "aarch64" ];
+}
+
check_branches() {
if ! tr -s ' ' '\n' < "$TMPDIR/perf.script" | grep -E -m1 -q "$1"; then
echo "Branches missing $1"
@@ -76,9 +80,24 @@ test_user_branches() {
err=1
fi
# some branch types are still not being tested:
- # IND COND_CALL COND_RET SYSRET IRQ SERROR NO_TX
+ # IND COND_CALL COND_RET SYSRET SERROR NO_TX
}
+test_trap_eret_branches() {
+ echo "Testing trap & eret branches"
+ if ! is_arm64; then
+ echo "skip: not arm64"
+ else
+ perf record -o $TMPDIR/perf.data --branch-filter any,save_type,u,k -- \
+ perf test -w traploop 1000
+ perf script -i $TMPDIR/perf.data --fields brstacksym | \
+ tr ' ' '\n' > $TMPDIR/perf.script
+
+ # BRBINF<n>.TYPE == TRAP are mapped to PERF_BR_IRQ by the BRBE driver
+ check_branches "^trap_bench\+[^ ]+/[^ ]/IRQ/"
+ check_branches "^[^ ]+/trap_bench\+[^ ]+/ERET/"
+ fi
+}
test_kernel_branches() {
echo "Testing that k option only includes kernel source addresses"
@@ -162,9 +181,14 @@ set -e
test_user_branches
test_syscall
test_kernel_branches
+test_trap_eret_branches
any_call="CALL|IND_CALL|COND_CALL|SYSCALL|IRQ"
+if is_arm64; then
+ any_call="$any_call|FAULT_DATA|FAULT_INST"
+fi
+
test_filter "any_call" "$any_call"
test_filter "call" "CALL|SYSCALL"
test_filter "cond" "COND"
diff --git a/tools/perf/tests/tests.h b/tools/perf/tests/tests.h
index 6ea2be86b7bf8..6d8e46ab82335 100644
--- a/tools/perf/tests/tests.h
+++ b/tools/perf/tests/tests.h
@@ -206,6 +206,7 @@ DECLARE_WORKLOAD(sqrtloop);
DECLARE_WORKLOAD(brstack);
DECLARE_WORKLOAD(datasym);
DECLARE_WORKLOAD(landlock);
+DECLARE_WORKLOAD(traploop);
extern const char *dso_to_test;
extern const char *test_objdump_path;
diff --git a/tools/perf/tests/workloads/Build b/tools/perf/tests/workloads/Build
index 5af17206f04d1..fb1012cc4fc31 100644
--- a/tools/perf/tests/workloads/Build
+++ b/tools/perf/tests/workloads/Build
@@ -7,8 +7,10 @@ perf-test-y += sqrtloop.o
perf-test-y += brstack.o
perf-test-y += datasym.o
perf-test-y += landlock.o
+perf-test-y += traploop.o
CFLAGS_sqrtloop.o = -g -O0 -fno-inline -U_FORTIFY_SOURCE
CFLAGS_leafloop.o = -g -O0 -fno-inline -fno-omit-frame-pointer -U_FORTIFY_SOURCE
CFLAGS_brstack.o = -g -O0 -fno-inline -U_FORTIFY_SOURCE
CFLAGS_datasym.o = -g -O0 -fno-inline -U_FORTIFY_SOURCE
+CFLAGS_traploop.o = -g -O0 -fno-inline -U_FORTIFY_SOURCE
diff --git a/tools/perf/tests/workloads/traploop.c b/tools/perf/tests/workloads/traploop.c
new file mode 100644
index 0000000000000..68dec399a7350
--- /dev/null
+++ b/tools/perf/tests/workloads/traploop.c
@@ -0,0 +1,31 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <stdlib.h>
+#include "../tests.h"
+
+#define BENCH_RUNS 999999
+
+#ifdef __aarch64__
+static void trap_bench(void)
+{
+ unsigned long val;
+
+ asm("mrs %0, ID_AA64ISAR0_EL1" : "=r" (val)); /* TRAP + ERET */
+}
+#else
+static void trap_bench(void) { }
+#endif
+
+static int traploop(int argc, const char **argv)
+{
+ int num_loops = BENCH_RUNS;
+
+ if (argc > 0)
+ num_loops = atoi(argv[0]);
+
+ for (int i = 0; i < num_loops; i++)
+ trap_bench();
+
+ return 0;
+}
+
+DEFINE_WORKLOAD(traploop);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0366/1376] perf test: Fixes for check branch stack sampling
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (364 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0365/1376] perf test: Extend branch stack sampling test for Arm64 BRBE Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0367/1376] perf tests: Fix flakiness in branch stack sampling tests Greg Kroah-Hartman
` (632 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ian Rogers, James Clark,
Namhyung Kim, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <irogers@google.com>
[ Upstream commit 86d1095fdb7017a93e9d7be875775f7e5aa5c2f5 ]
When filtering branch stack samples on user events they sample in user
land but may have come from the kernel. Aarch64 avoids leaking the
kernel address for kaslr reasons but other platforms, for now,
don't. Be more permissive in allowing kernel addresses in the source
of user branch stacks.
When filtering branch stack samples on kernel events they sample in
kernel land but may have come from user land. Avoid the target being a
user address but allow the source to be in user land. Aarch64 may not
leak the user land addresses (making them 0) but other platforms
do. As the kernel address sampling implies privelege, just allow this.
Increase the duration of the system call sampling test to make the
likelihood of sampling a system call higher (increased from 1000 to
8000 loops - a number found through experimentation on an Intel
Tigerlake laptop), also make the period of the event a prime number.
Put unneeded perf record output into a temporary file so that the test
output isn't cluttered. More clearly state which test is running and
the pass, fail or skipped result of the test.
These changes make the test on an Intel tigerlake laptop reliably pass
rather than reliably fail.
Signed-off-by: Ian Rogers <irogers@google.com>
Reviewed-by: James Clark <james.clark@linaro.org>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Stable-dep-of: 344d3aec164d ("perf tests: Fix flakiness in branch stack sampling tests")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/tests/shell/test_brstack.sh | 146 ++++++++++++++++---------
1 file changed, 96 insertions(+), 50 deletions(-)
diff --git a/tools/perf/tests/shell/test_brstack.sh b/tools/perf/tests/shell/test_brstack.sh
index 85233d435be63..eb5837f82e390 100755
--- a/tools/perf/tests/shell/test_brstack.sh
+++ b/tools/perf/tests/shell/test_brstack.sh
@@ -38,9 +38,13 @@ is_arm64() {
[ "$(uname -m)" = "aarch64" ];
}
+has_kaslr_bug() {
+ [ "$(uname -m)" != "aarch64" ];
+}
+
check_branches() {
if ! tr -s ' ' '\n' < "$TMPDIR/perf.script" | grep -E -m1 -q "$1"; then
- echo "Branches missing $1"
+ echo "ERROR: Branches missing $1"
err=1
fi
}
@@ -48,6 +52,8 @@ check_branches() {
test_user_branches() {
echo "Testing user branch stack sampling"
+ start_err=$err
+ err=0
perf record -o "$TMPDIR/perf.data" --branch-filter any,save_type,u -- ${TESTPROG} > "$TMPDIR/record.txt" 2>&1
perf script -i "$TMPDIR/perf.data" --fields brstacksym > "$TMPDIR/perf.script"
@@ -73,59 +79,88 @@ test_user_branches() {
perf script -i "$TMPDIR/perf.data" --fields brstack | \
tr ' ' '\n' > "$TMPDIR/perf.script"
- # There should be no kernel addresses with the u option, in either
- # source or target addresses.
- if grep -E -m1 "0x[89a-f][0-9a-f]{15}" $TMPDIR/perf.script; then
- echo "ERROR: Kernel address found in user mode"
+ # There should be no kernel addresses in the target with the u option.
+ local regex="0x[89a-f][0-9a-f]{15}"
+ if has_kaslr_bug; then
+ # If the system has a kaslr bug that may leak kernel addresses
+ # in the source of something like an ERET/SYSRET. Make the regex
+ # more specific and just check the target address is in user
+ # code.
+ regex="^0x[0-9a-f]{0,16}/0x[89a-f][0-9a-f]{15}/"
+ fi
+ if grep -q -E -m1 "$regex" $TMPDIR/perf.script; then
+ echo "Testing user branch stack sampling [Failed kernel address found in user mode]"
err=1
fi
# some branch types are still not being tested:
# IND COND_CALL COND_RET SYSRET SERROR NO_TX
+ if [ $err -eq 0 ]; then
+ echo "Testing user branch stack sampling [Passed]"
+ err=$start_err
+ else
+ echo "Testing user branch stack sampling [Failed]"
+ fi
}
test_trap_eret_branches() {
echo "Testing trap & eret branches"
+
if ! is_arm64; then
- echo "skip: not arm64"
+ echo "Testing trap & eret branches [Skipped not arm64]"
+ return
+ fi
+ start_err=$err
+ err=0
+ perf record -o $TMPDIR/perf.data --branch-filter any,save_type,u,k -- \
+ perf test -w traploop 1000 > "$TMPDIR/record.txt" 2>&1
+ perf script -i $TMPDIR/perf.data --fields brstacksym | \
+ tr ' ' '\n' > $TMPDIR/perf.script
+
+ # BRBINF<n>.TYPE == TRAP are mapped to PERF_BR_IRQ by the BRBE driver
+ check_branches "^trap_bench\+[^ ]+/[^ ]/IRQ/"
+ check_branches "^[^ ]+/trap_bench\+[^ ]+/ERET/"
+ if [ $err -eq 0 ]; then
+ echo "Testing trap & eret branches [Passed]"
+ err=$start_err
else
- perf record -o $TMPDIR/perf.data --branch-filter any,save_type,u,k -- \
- perf test -w traploop 1000
- perf script -i $TMPDIR/perf.data --fields brstacksym | \
- tr ' ' '\n' > $TMPDIR/perf.script
-
- # BRBINF<n>.TYPE == TRAP are mapped to PERF_BR_IRQ by the BRBE driver
- check_branches "^trap_bench\+[^ ]+/[^ ]/IRQ/"
- check_branches "^[^ ]+/trap_bench\+[^ ]+/ERET/"
+ echo "Testing trap & eret branches [Failed]"
fi
}
test_kernel_branches() {
- echo "Testing that k option only includes kernel source addresses"
+ echo "Testing kernel branch sampling"
- if ! perf record --branch-filter any,k -o- -- true > /dev/null; then
- echo "skip: not enough privileges"
+ if ! perf record --branch-filter any,k -o- -- true > "$TMPDIR/record.txt" 2>&1; then
+ echo "Testing that k option [Skipped not enough privileges]"
+ return
+ fi
+ start_err=$err
+ err=0
+ perf record -o $TMPDIR/perf.data --branch-filter any,k -- \
+ perf bench syscall basic --loop 1000 > "$TMPDIR/record.txt" 2>&1
+ perf script -i $TMPDIR/perf.data --fields brstack | \
+ tr ' ' '\n' > $TMPDIR/perf.script
+
+ # Example of branch entries:
+ # "0xffffffff93bda241/0xffffffff93bda20f/M/-/-/..."
+ # Source addresses come first in user or kernel code. Next is the target
+ # address that must be in the kernel.
+
+ # Look for source addresses with top bit set
+ if ! grep -q -E -m1 "^0x[89a-f][0-9a-f]{15}" $TMPDIR/perf.script; then
+ echo "Testing kernel branch sampling [Failed kernel branches missing]"
+ err=1
+ fi
+ # Look for no target addresses without top bit set
+ if grep -q -E -m1 "^0x[0-9a-f]{0,16}/0x[0-7][0-9a-f]{1,15}/" $TMPDIR/perf.script; then
+ echo "Testing kernel branch sampling [Failed user branches found]"
+ err=1
+ fi
+ if [ $err -eq 0 ]; then
+ echo "Testing kernel branch sampling [Passed]"
+ err=$start_err
else
- perf record -o $TMPDIR/perf.data --branch-filter any,k -- \
- perf bench syscall basic --loop 1000
- perf script -i $TMPDIR/perf.data --fields brstack | \
- tr ' ' '\n' > $TMPDIR/perf.script
-
- # Example of branch entries:
- # "0xffffffff93bda241/0xffffffff93bda20f/M/-/-/..."
- # Source addresses come first and target address can be either
- # userspace or kernel even with k option, as long as the source
- # is in kernel.
-
- #Look for source addresses with top bit set
- if ! grep -E -m1 "^0x[89a-f][0-9a-f]{15}" $TMPDIR/perf.script; then
- echo "ERROR: Kernel branches missing"
- err=1
- fi
- # Look for no source addresses without top bit set
- if grep -E -m1 "^0x[0-7][0-9a-f]{0,15}" $TMPDIR/perf.script; then
- echo "ERROR: User branches found with kernel filter"
- err=1
- fi
+ echo "Testing kernel branch sampling [Failed]"
fi
}
@@ -136,14 +171,15 @@ test_filter() {
test_filter_expect=$2
echo "Testing branch stack filtering permutation ($test_filter_filter,$test_filter_expect)"
- perf record -o "$TMPDIR/perf.data" --branch-filter "$test_filter_filter,save_type,u" -- ${TESTPROG} > "$TMPDIR/record.txt" 2>&1
+ perf record -o "$TMPDIR/perf.data" --branch-filter "$test_filter_filter,save_type,u" -- \
+ ${TESTPROG} > "$TMPDIR/record.txt" 2>&1
perf script -i "$TMPDIR/perf.data" --fields brstack > "$TMPDIR/perf.script"
# fail if we find any branch type that doesn't match any of the expected ones
# also consider UNKNOWN branch types (-)
if [ ! -s "$TMPDIR/perf.script" ]
then
- echo "Empty script output"
+ echo "Testing branch stack filtering [Failed empty script output]"
err=1
return
fi
@@ -154,26 +190,36 @@ test_filter() {
> "$TMPDIR/perf.script-filtered" || true
if [ -s "$TMPDIR/perf.script-filtered" ]
then
- echo "Unexpected branch filter in script output"
+ echo "Testing branch stack filtering [Failed unexpected branch filter]"
cat "$TMPDIR/perf.script"
err=1
return
fi
+ echo "Testing branch stack filtering [Passed]"
}
test_syscall() {
echo "Testing syscalls"
# skip if perf doesn't have enough privileges
- if ! perf record --branch-filter any,k -o- -- true > /dev/null; then
- echo "skip: not enough privileges"
+ if ! perf record --branch-filter any,k -o- -- true > "$TMPDIR/record.txt" 2>&1; then
+ echo "Testing syscalls [Skipped: not enough privileges]"
+ return
+ fi
+ start_err=$err
+ err=0
+ perf record -o $TMPDIR/perf.data --branch-filter \
+ any_call,save_type,u,k -c 10007 -- \
+ perf bench syscall basic --loop 8000 > "$TMPDIR/record.txt" 2>&1
+ perf script -i $TMPDIR/perf.data --fields brstacksym | \
+ tr ' ' '\n' > $TMPDIR/perf.script
+
+ check_branches "getppid[^ ]*/SYSCALL/"
+
+ if [ $err -eq 0 ]; then
+ echo "Testing syscalls [Passed]"
+ err=$start_err
else
- perf record -o $TMPDIR/perf.data --branch-filter \
- any_call,save_type,u,k -c 10000 -- \
- perf bench syscall basic --loop 1000
- perf script -i $TMPDIR/perf.data --fields brstacksym | \
- tr ' ' '\n' > $TMPDIR/perf.script
-
- check_branches "getppid[^ ]*/SYSCALL/"
+ echo "Testing syscalls [Failed]"
fi
}
set -e
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0367/1376] perf tests: Fix flakiness in branch stack sampling tests
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (365 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0366/1376] perf test: Fixes for check branch stack sampling Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0368/1376] regulator: tps6594-regulator: Constify struct tps6594_regulator_irq_type Greg Kroah-Hartman
` (631 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ian Rogers, Namhyung Kim,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <irogers@google.com>
[ Upstream commit 344d3aec164dba83a5520f23a0d46e13e904a205 ]
The branch stack sampling test (test 130) runs short iteration-based
workloads to verify syscall, kernel, and trap branch stack sampling.
Specifically, `test_syscall()` and `test_kernel_branches()` run `perf
bench syscall basic` with loop counts of 8000 and 1000, and
`test_trap_eret_branches()` runs `traploop` with 1000 iterations.
Because these loop limits are extremely small, the total benchmark
runtimes last only a few milliseconds (or less). Under high load,
virtualization, or coarse sampling conditions, PMU cycle sampling fails to
capture enough samples inside the brief benchmark loops. This leads to
false negatives where the script output lacks the expected syscall,
kernel, or trap branch entries (e.g. "ERROR: Branches missing getppid[^
]*/SYSCALL/").
Fix this by increasing the workload loop counts to 100,000 across all
three test sections. Running 100,000 loops still finishes virtually
instantaneously (less than 0.1 seconds), but generates enough iterations
to guarantee robust branch stack capture.
Fixes: b55878c90ab9 ("perf test: Add test for branch stack sampling")
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/tests/shell/test_brstack.sh | 107 +++++++++++++++----------
1 file changed, 66 insertions(+), 41 deletions(-)
diff --git a/tools/perf/tests/shell/test_brstack.sh b/tools/perf/tests/shell/test_brstack.sh
index eb5837f82e390..71550e0b37baa 100755
--- a/tools/perf/tests/shell/test_brstack.sh
+++ b/tools/perf/tests/shell/test_brstack.sh
@@ -110,20 +110,29 @@ test_trap_eret_branches() {
return
fi
start_err=$err
- err=0
- perf record -o $TMPDIR/perf.data --branch-filter any,save_type,u,k -- \
- perf test -w traploop 1000 > "$TMPDIR/record.txt" 2>&1
- perf script -i $TMPDIR/perf.data --fields brstacksym | \
- tr ' ' '\n' > $TMPDIR/perf.script
-
- # BRBINF<n>.TYPE == TRAP are mapped to PERF_BR_IRQ by the BRBE driver
- check_branches "^trap_bench\+[^ ]+/[^ ]/IRQ/"
- check_branches "^[^ ]+/trap_bench\+[^ ]+/ERET/"
- if [ $err -eq 0 ]; then
+ local ret=1
+ for loops in 1000 10000 100000; do
+ err=0
+ perf record -o $TMPDIR/perf.data --branch-filter any,save_type,u,k -- \
+ perf test -w traploop $loops > "$TMPDIR/record.txt" 2>&1
+ perf script -i $TMPDIR/perf.data --fields brstacksym | \
+ tr ' ' '\n' > $TMPDIR/perf.script
+
+ # BRBINF<n>.TYPE == TRAP are mapped to PERF_BR_IRQ by the BRBE driver
+ check_branches "^trap_bench\+[^ ]+/[^ ]/IRQ/"
+ check_branches "^[^ ]+/trap_bench\+[^ ]+/ERET/"
+ if [ $err -eq 0 ]; then
+ ret=0
+ break
+ fi
+ done
+
+ if [ $ret -eq 0 ]; then
echo "Testing trap & eret branches [Passed]"
err=$start_err
else
echo "Testing trap & eret branches [Failed]"
+ err=1
fi
}
@@ -135,32 +144,40 @@ test_kernel_branches() {
return
fi
start_err=$err
- err=0
- perf record -o $TMPDIR/perf.data --branch-filter any,k -- \
- perf bench syscall basic --loop 1000 > "$TMPDIR/record.txt" 2>&1
- perf script -i $TMPDIR/perf.data --fields brstack | \
- tr ' ' '\n' > $TMPDIR/perf.script
-
- # Example of branch entries:
- # "0xffffffff93bda241/0xffffffff93bda20f/M/-/-/..."
- # Source addresses come first in user or kernel code. Next is the target
- # address that must be in the kernel.
-
- # Look for source addresses with top bit set
- if ! grep -q -E -m1 "^0x[89a-f][0-9a-f]{15}" $TMPDIR/perf.script; then
- echo "Testing kernel branch sampling [Failed kernel branches missing]"
- err=1
- fi
- # Look for no target addresses without top bit set
- if grep -q -E -m1 "^0x[0-9a-f]{0,16}/0x[0-7][0-9a-f]{1,15}/" $TMPDIR/perf.script; then
- echo "Testing kernel branch sampling [Failed user branches found]"
- err=1
- fi
- if [ $err -eq 0 ]; then
+ local ret=1
+ for loops in 1000 10000 100000; do
+ err=0
+ perf record -o $TMPDIR/perf.data --branch-filter any,k -- \
+ perf bench syscall basic --loop $loops > "$TMPDIR/record.txt" 2>&1
+ perf script -i $TMPDIR/perf.data --fields brstack | \
+ tr ' ' '\n' > $TMPDIR/perf.script
+
+ # Example of branch entries:
+ # "0xffffffff93bda241/0xffffffff93bda20f/M/-/-/..."
+ # Source addresses come first in user or kernel code. Next is the target
+ # address that must be in the kernel.
+
+ # Look for source addresses with top bit set
+ if ! grep -q -E -m1 "^0x[89a-f][0-9a-f]{15}" $TMPDIR/perf.script; then
+ err=1
+ fi
+ # Look for no target addresses without top bit set
+ if grep -q -E -m1 "^0x[0-9a-f]{0,16}/0x[0-7][0-9a-f]{1,15}/" \
+ $TMPDIR/perf.script; then
+ err=1
+ fi
+ if [ $err -eq 0 ]; then
+ ret=0
+ break
+ fi
+ done
+
+ if [ $ret -eq 0 ]; then
echo "Testing kernel branch sampling [Passed]"
err=$start_err
else
echo "Testing kernel branch sampling [Failed]"
+ err=1
fi
}
@@ -206,20 +223,28 @@ test_syscall() {
return
fi
start_err=$err
- err=0
- perf record -o $TMPDIR/perf.data --branch-filter \
- any_call,save_type,u,k -c 10007 -- \
- perf bench syscall basic --loop 8000 > "$TMPDIR/record.txt" 2>&1
- perf script -i $TMPDIR/perf.data --fields brstacksym | \
- tr ' ' '\n' > $TMPDIR/perf.script
-
- check_branches "getppid[^ ]*/SYSCALL/"
+ local ret=1
+ for loops in 8000 30000 100000; do
+ err=0
+ perf record -o $TMPDIR/perf.data --branch-filter \
+ any_call,save_type,u,k -c 10007 -- \
+ perf bench syscall basic --loop $loops > "$TMPDIR/record.txt" 2>&1
+ perf script -i $TMPDIR/perf.data --fields brstacksym | \
+ tr ' ' '\n' > $TMPDIR/perf.script
+
+ check_branches "getppid[^ ]*/SYSCALL/"
+ if [ $err -eq 0 ]; then
+ ret=0
+ break
+ fi
+ done
- if [ $err -eq 0 ]; then
+ if [ $ret -eq 0 ]; then
echo "Testing syscalls [Passed]"
err=$start_err
else
echo "Testing syscalls [Failed]"
+ err=1
fi
}
set -e
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0368/1376] regulator: tps6594-regulator: Constify struct tps6594_regulator_irq_type
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (366 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0367/1376] perf tests: Fix flakiness in branch stack sampling tests Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0369/1376] regulator: tps6594-regulator: remove interrupt_count Greg Kroah-Hartman
` (630 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Mark Brown,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit c266209eaef4fef863363557817f7d6a68314321 ]
'struct tps6594_regulator_irq_type' are not modified in this driver.
Constifying this structure moves some data to a read-only section, so
increases overall security.
On a x86_64, with allmodconfig, as an example:
Before:
======
text data bss dec hex filename
25645 14480 64 40189 9cfd drivers/regulator/tps6594-regulator.o
After:
=====
text data bss dec hex filename
27949 12176 64 40189 9cfd drivers/regulator/tps6594-regulator.o
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://patch.msgid.link/1446fb1938f3f38115be3e53f5dda3c8bb0ba5a1.1748103005.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: 7fd28093b3ef ("regulator: tps6594: Fix device node reference leaks in multiphase loop")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/tps6594-regulator.c | 60 +++++++++++++--------------
1 file changed, 30 insertions(+), 30 deletions(-)
diff --git a/drivers/regulator/tps6594-regulator.c b/drivers/regulator/tps6594-regulator.c
index ac53792e3fede..0193efb5dffa9 100644
--- a/drivers/regulator/tps6594-regulator.c
+++ b/drivers/regulator/tps6594-regulator.c
@@ -56,7 +56,7 @@ struct tps6594_regulator_irq_type {
unsigned long event;
};
-static struct tps6594_regulator_irq_type tps6594_ext_regulator_irq_types[] = {
+static const struct tps6594_regulator_irq_type tps6594_ext_regulator_irq_types[] = {
{ TPS6594_IRQ_NAME_VCCA_OV, "VCCA", "overvoltage", REGULATOR_EVENT_OVER_VOLTAGE_WARN },
{ TPS6594_IRQ_NAME_VCCA_UV, "VCCA", "undervoltage", REGULATOR_EVENT_UNDER_VOLTAGE },
{ TPS6594_IRQ_NAME_VMON1_OV, "VMON1", "overvoltage", REGULATOR_EVENT_OVER_VOLTAGE_WARN },
@@ -69,7 +69,7 @@ static struct tps6594_regulator_irq_type tps6594_ext_regulator_irq_types[] = {
REGULATOR_EVENT_OVER_VOLTAGE_WARN },
};
-static struct tps6594_regulator_irq_type tps65224_ext_regulator_irq_types[] = {
+static const struct tps6594_regulator_irq_type tps65224_ext_regulator_irq_types[] = {
{ TPS65224_IRQ_NAME_VCCA_UVOV, "VCCA", "voltage out of range",
REGULATOR_EVENT_REGULATION_OUT },
{ TPS65224_IRQ_NAME_VMON1_UVOV, "VMON1", "voltage out of range",
@@ -80,13 +80,13 @@ static struct tps6594_regulator_irq_type tps65224_ext_regulator_irq_types[] = {
struct tps6594_regulator_irq_data {
struct device *dev;
- struct tps6594_regulator_irq_type *type;
+ const struct tps6594_regulator_irq_type *type;
struct regulator_dev *rdev;
};
struct tps6594_ext_regulator_irq_data {
struct device *dev;
- struct tps6594_regulator_irq_type *type;
+ const struct tps6594_regulator_irq_type *type;
};
#define TPS6594_REGULATOR(_name, _of, _id, _type, _ops, _n, _vr, _vm, _er, \
@@ -262,7 +262,7 @@ static const struct regulator_desc tps65224_buck_regs[] = {
4, 0, 0, NULL, 0, 0),
};
-static struct tps6594_regulator_irq_type tps6594_buck1_irq_types[] = {
+static const struct tps6594_regulator_irq_type tps6594_buck1_irq_types[] = {
{ TPS6594_IRQ_NAME_BUCK1_OV, "BUCK1", "overvoltage", REGULATOR_EVENT_OVER_VOLTAGE_WARN },
{ TPS6594_IRQ_NAME_BUCK1_UV, "BUCK1", "undervoltage", REGULATOR_EVENT_UNDER_VOLTAGE },
{ TPS6594_IRQ_NAME_BUCK1_SC, "BUCK1", "short circuit", REGULATOR_EVENT_REGULATION_OUT },
@@ -270,7 +270,7 @@ static struct tps6594_regulator_irq_type tps6594_buck1_irq_types[] = {
REGULATOR_EVENT_OVER_CURRENT },
};
-static struct tps6594_regulator_irq_type tps6594_buck2_irq_types[] = {
+static const struct tps6594_regulator_irq_type tps6594_buck2_irq_types[] = {
{ TPS6594_IRQ_NAME_BUCK2_OV, "BUCK2", "overvoltage", REGULATOR_EVENT_OVER_VOLTAGE_WARN },
{ TPS6594_IRQ_NAME_BUCK2_UV, "BUCK2", "undervoltage", REGULATOR_EVENT_UNDER_VOLTAGE },
{ TPS6594_IRQ_NAME_BUCK2_SC, "BUCK2", "short circuit", REGULATOR_EVENT_REGULATION_OUT },
@@ -278,7 +278,7 @@ static struct tps6594_regulator_irq_type tps6594_buck2_irq_types[] = {
REGULATOR_EVENT_OVER_CURRENT },
};
-static struct tps6594_regulator_irq_type tps6594_buck3_irq_types[] = {
+static const struct tps6594_regulator_irq_type tps6594_buck3_irq_types[] = {
{ TPS6594_IRQ_NAME_BUCK3_OV, "BUCK3", "overvoltage", REGULATOR_EVENT_OVER_VOLTAGE_WARN },
{ TPS6594_IRQ_NAME_BUCK3_UV, "BUCK3", "undervoltage", REGULATOR_EVENT_UNDER_VOLTAGE },
{ TPS6594_IRQ_NAME_BUCK3_SC, "BUCK3", "short circuit", REGULATOR_EVENT_REGULATION_OUT },
@@ -286,7 +286,7 @@ static struct tps6594_regulator_irq_type tps6594_buck3_irq_types[] = {
REGULATOR_EVENT_OVER_CURRENT },
};
-static struct tps6594_regulator_irq_type tps6594_buck4_irq_types[] = {
+static const struct tps6594_regulator_irq_type tps6594_buck4_irq_types[] = {
{ TPS6594_IRQ_NAME_BUCK4_OV, "BUCK4", "overvoltage", REGULATOR_EVENT_OVER_VOLTAGE_WARN },
{ TPS6594_IRQ_NAME_BUCK4_UV, "BUCK4", "undervoltage", REGULATOR_EVENT_UNDER_VOLTAGE },
{ TPS6594_IRQ_NAME_BUCK4_SC, "BUCK4", "short circuit", REGULATOR_EVENT_REGULATION_OUT },
@@ -294,7 +294,7 @@ static struct tps6594_regulator_irq_type tps6594_buck4_irq_types[] = {
REGULATOR_EVENT_OVER_CURRENT },
};
-static struct tps6594_regulator_irq_type tps6594_buck5_irq_types[] = {
+static const struct tps6594_regulator_irq_type tps6594_buck5_irq_types[] = {
{ TPS6594_IRQ_NAME_BUCK5_OV, "BUCK5", "overvoltage", REGULATOR_EVENT_OVER_VOLTAGE_WARN },
{ TPS6594_IRQ_NAME_BUCK5_UV, "BUCK5", "undervoltage", REGULATOR_EVENT_UNDER_VOLTAGE },
{ TPS6594_IRQ_NAME_BUCK5_SC, "BUCK5", "short circuit", REGULATOR_EVENT_REGULATION_OUT },
@@ -302,7 +302,7 @@ static struct tps6594_regulator_irq_type tps6594_buck5_irq_types[] = {
REGULATOR_EVENT_OVER_CURRENT },
};
-static struct tps6594_regulator_irq_type tps6594_ldo1_irq_types[] = {
+static const struct tps6594_regulator_irq_type tps6594_ldo1_irq_types[] = {
{ TPS6594_IRQ_NAME_LDO1_OV, "LDO1", "overvoltage", REGULATOR_EVENT_OVER_VOLTAGE_WARN },
{ TPS6594_IRQ_NAME_LDO1_UV, "LDO1", "undervoltage", REGULATOR_EVENT_UNDER_VOLTAGE },
{ TPS6594_IRQ_NAME_LDO1_SC, "LDO1", "short circuit", REGULATOR_EVENT_REGULATION_OUT },
@@ -310,7 +310,7 @@ static struct tps6594_regulator_irq_type tps6594_ldo1_irq_types[] = {
REGULATOR_EVENT_OVER_CURRENT },
};
-static struct tps6594_regulator_irq_type tps6594_ldo2_irq_types[] = {
+static const struct tps6594_regulator_irq_type tps6594_ldo2_irq_types[] = {
{ TPS6594_IRQ_NAME_LDO2_OV, "LDO2", "overvoltage", REGULATOR_EVENT_OVER_VOLTAGE_WARN },
{ TPS6594_IRQ_NAME_LDO2_UV, "LDO2", "undervoltage", REGULATOR_EVENT_UNDER_VOLTAGE },
{ TPS6594_IRQ_NAME_LDO2_SC, "LDO2", "short circuit", REGULATOR_EVENT_REGULATION_OUT },
@@ -318,7 +318,7 @@ static struct tps6594_regulator_irq_type tps6594_ldo2_irq_types[] = {
REGULATOR_EVENT_OVER_CURRENT },
};
-static struct tps6594_regulator_irq_type tps6594_ldo3_irq_types[] = {
+static const struct tps6594_regulator_irq_type tps6594_ldo3_irq_types[] = {
{ TPS6594_IRQ_NAME_LDO3_OV, "LDO3", "overvoltage", REGULATOR_EVENT_OVER_VOLTAGE_WARN },
{ TPS6594_IRQ_NAME_LDO3_UV, "LDO3", "undervoltage", REGULATOR_EVENT_UNDER_VOLTAGE },
{ TPS6594_IRQ_NAME_LDO3_SC, "LDO3", "short circuit", REGULATOR_EVENT_REGULATION_OUT },
@@ -326,7 +326,7 @@ static struct tps6594_regulator_irq_type tps6594_ldo3_irq_types[] = {
REGULATOR_EVENT_OVER_CURRENT },
};
-static struct tps6594_regulator_irq_type tps6594_ldo4_irq_types[] = {
+static const struct tps6594_regulator_irq_type tps6594_ldo4_irq_types[] = {
{ TPS6594_IRQ_NAME_LDO4_OV, "LDO4", "overvoltage", REGULATOR_EVENT_OVER_VOLTAGE_WARN },
{ TPS6594_IRQ_NAME_LDO4_UV, "LDO4", "undervoltage", REGULATOR_EVENT_UNDER_VOLTAGE },
{ TPS6594_IRQ_NAME_LDO4_SC, "LDO4", "short circuit", REGULATOR_EVENT_REGULATION_OUT },
@@ -334,42 +334,42 @@ static struct tps6594_regulator_irq_type tps6594_ldo4_irq_types[] = {
REGULATOR_EVENT_OVER_CURRENT },
};
-static struct tps6594_regulator_irq_type tps65224_buck1_irq_types[] = {
+static const struct tps6594_regulator_irq_type tps65224_buck1_irq_types[] = {
{ TPS65224_IRQ_NAME_BUCK1_UVOV, "BUCK1", "voltage out of range",
REGULATOR_EVENT_REGULATION_OUT },
};
-static struct tps6594_regulator_irq_type tps65224_buck2_irq_types[] = {
+static const struct tps6594_regulator_irq_type tps65224_buck2_irq_types[] = {
{ TPS65224_IRQ_NAME_BUCK2_UVOV, "BUCK2", "voltage out of range",
REGULATOR_EVENT_REGULATION_OUT },
};
-static struct tps6594_regulator_irq_type tps65224_buck3_irq_types[] = {
+static const struct tps6594_regulator_irq_type tps65224_buck3_irq_types[] = {
{ TPS65224_IRQ_NAME_BUCK3_UVOV, "BUCK3", "voltage out of range",
REGULATOR_EVENT_REGULATION_OUT },
};
-static struct tps6594_regulator_irq_type tps65224_buck4_irq_types[] = {
+static const struct tps6594_regulator_irq_type tps65224_buck4_irq_types[] = {
{ TPS65224_IRQ_NAME_BUCK4_UVOV, "BUCK4", "voltage out of range",
REGULATOR_EVENT_REGULATION_OUT },
};
-static struct tps6594_regulator_irq_type tps65224_ldo1_irq_types[] = {
+static const struct tps6594_regulator_irq_type tps65224_ldo1_irq_types[] = {
{ TPS65224_IRQ_NAME_LDO1_UVOV, "LDO1", "voltage out of range",
REGULATOR_EVENT_REGULATION_OUT },
};
-static struct tps6594_regulator_irq_type tps65224_ldo2_irq_types[] = {
+static const struct tps6594_regulator_irq_type tps65224_ldo2_irq_types[] = {
{ TPS65224_IRQ_NAME_LDO2_UVOV, "LDO2", "voltage out of range",
REGULATOR_EVENT_REGULATION_OUT },
};
-static struct tps6594_regulator_irq_type tps65224_ldo3_irq_types[] = {
+static const struct tps6594_regulator_irq_type tps65224_ldo3_irq_types[] = {
{ TPS65224_IRQ_NAME_LDO3_UVOV, "LDO3", "voltage out of range",
REGULATOR_EVENT_REGULATION_OUT },
};
-static struct tps6594_regulator_irq_type *tps6594_bucks_irq_types[] = {
+static const struct tps6594_regulator_irq_type *tps6594_bucks_irq_types[] = {
tps6594_buck1_irq_types,
tps6594_buck2_irq_types,
tps6594_buck3_irq_types,
@@ -377,21 +377,21 @@ static struct tps6594_regulator_irq_type *tps6594_bucks_irq_types[] = {
tps6594_buck5_irq_types,
};
-static struct tps6594_regulator_irq_type *tps6594_ldos_irq_types[] = {
+static const struct tps6594_regulator_irq_type *tps6594_ldos_irq_types[] = {
tps6594_ldo1_irq_types,
tps6594_ldo2_irq_types,
tps6594_ldo3_irq_types,
tps6594_ldo4_irq_types,
};
-static struct tps6594_regulator_irq_type *tps65224_bucks_irq_types[] = {
+static const struct tps6594_regulator_irq_type *tps65224_bucks_irq_types[] = {
tps65224_buck1_irq_types,
tps65224_buck2_irq_types,
tps65224_buck3_irq_types,
tps65224_buck4_irq_types,
};
-static struct tps6594_regulator_irq_type *tps65224_ldos_irq_types[] = {
+static const struct tps6594_regulator_irq_type *tps65224_ldos_irq_types[] = {
tps65224_ldo1_irq_types,
tps65224_ldo2_irq_types,
tps65224_ldo3_irq_types,
@@ -516,11 +516,11 @@ static irqreturn_t tps6594_regulator_irq_handler(int irq, void *data)
static int tps6594_request_reg_irqs(struct platform_device *pdev,
struct regulator_dev *rdev,
struct tps6594_regulator_irq_data *irq_data,
- struct tps6594_regulator_irq_type *regs_irq_types,
+ const struct tps6594_regulator_irq_type *regs_irq_types,
size_t interrupt_cnt,
int *irq_idx)
{
- struct tps6594_regulator_irq_type *irq_type;
+ const struct tps6594_regulator_irq_type *irq_type;
struct tps6594 *tps = dev_get_drvdata(pdev->dev.parent);
size_t j;
int irq;
@@ -558,8 +558,8 @@ static int tps6594_regulator_probe(struct platform_device *pdev)
struct regulator_config config = {};
struct tps6594_regulator_irq_data *irq_data;
struct tps6594_ext_regulator_irq_data *irq_ext_reg_data;
- struct tps6594_regulator_irq_type *irq_type;
- struct tps6594_regulator_irq_type *irq_types;
+ const struct tps6594_regulator_irq_type *irq_type;
+ const struct tps6594_regulator_irq_type *irq_types;
bool buck_configured[BUCK_NB] = { false };
bool buck_multi[MULTI_PHASE_NB] = { false };
@@ -573,9 +573,9 @@ static int tps6594_regulator_probe(struct platform_device *pdev)
unsigned int irq_count;
unsigned int multi_phase_cnt;
size_t reg_irq_nb;
- struct tps6594_regulator_irq_type **bucks_irq_types;
+ const struct tps6594_regulator_irq_type **bucks_irq_types;
const struct regulator_desc *multi_regs;
- struct tps6594_regulator_irq_type **ldos_irq_types;
+ const struct tps6594_regulator_irq_type **ldos_irq_types;
const struct regulator_desc *ldo_regs;
size_t interrupt_count;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0369/1376] regulator: tps6594-regulator: remove interrupt_count
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (367 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0368/1376] regulator: tps6594-regulator: Constify struct tps6594_regulator_irq_type Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0370/1376] regulator: tps6594-regulator: remove hardcoded buck config Greg Kroah-Hartman
` (629 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Walle, Mark Brown,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Walle <mwalle@kernel.org>
[ Upstream commit 16d1a9bf36ef649b1fdb866985b4b87584491fac ]
In .probe() interrupt_count and nr_types is essentially the same. It
contains the number of different interrupt per LDO or buck converter.
Drop one. This is a preparation patch to further simplify the handling
of different variants of this PMIC.
This patch is only compile-time tested.
Signed-off-by: Michael Walle <mwalle@kernel.org>
Acked-by: Mark Brown <broonie@kernel.org>
Link: https://patch.msgid.link/20250703113153.2447110-6-mwalle@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: 7fd28093b3ef ("regulator: tps6594: Fix device node reference leaks in multiphase loop")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/tps6594-regulator.c | 17 ++++++-----------
1 file changed, 6 insertions(+), 11 deletions(-)
diff --git a/drivers/regulator/tps6594-regulator.c b/drivers/regulator/tps6594-regulator.c
index 0193efb5dffa9..1284a702db8f2 100644
--- a/drivers/regulator/tps6594-regulator.c
+++ b/drivers/regulator/tps6594-regulator.c
@@ -577,18 +577,15 @@ static int tps6594_regulator_probe(struct platform_device *pdev)
const struct regulator_desc *multi_regs;
const struct tps6594_regulator_irq_type **ldos_irq_types;
const struct regulator_desc *ldo_regs;
- size_t interrupt_count;
if (tps->chip_id == TPS65224) {
bucks_irq_types = tps65224_bucks_irq_types;
- interrupt_count = ARRAY_SIZE(tps65224_buck1_irq_types);
multi_regs = tps65224_multi_regs;
ldos_irq_types = tps65224_ldos_irq_types;
ldo_regs = tps65224_ldo_regs;
multi_phase_cnt = ARRAY_SIZE(tps65224_multi_regs);
} else {
bucks_irq_types = tps6594_bucks_irq_types;
- interrupt_count = ARRAY_SIZE(tps6594_buck1_irq_types);
multi_regs = tps6594_multi_regs;
ldos_irq_types = tps6594_ldos_irq_types;
ldo_regs = tps6594_ldo_regs;
@@ -686,29 +683,27 @@ static int tps6594_regulator_probe(struct platform_device *pdev)
error = tps6594_request_reg_irqs(pdev, rdev, irq_data,
bucks_irq_types[buck_idx],
- interrupt_count, &irq_idx);
+ nr_types, &irq_idx);
if (error)
return error;
error = tps6594_request_reg_irqs(pdev, rdev, irq_data,
bucks_irq_types[buck_idx + 1],
- interrupt_count, &irq_idx);
+ nr_types, &irq_idx);
if (error)
return error;
if (i == MULTI_BUCK123 || i == MULTI_BUCK1234) {
error = tps6594_request_reg_irqs(pdev, rdev, irq_data,
tps6594_bucks_irq_types[buck_idx + 2],
- interrupt_count,
- &irq_idx);
+ nr_types, &irq_idx);
if (error)
return error;
}
if (i == MULTI_BUCK1234) {
error = tps6594_request_reg_irqs(pdev, rdev, irq_data,
tps6594_bucks_irq_types[buck_idx + 3],
- interrupt_count,
- &irq_idx);
+ nr_types, &irq_idx);
if (error)
return error;
}
@@ -727,7 +722,7 @@ static int tps6594_regulator_probe(struct platform_device *pdev)
"failed to register %s regulator\n", pdev->name);
error = tps6594_request_reg_irqs(pdev, rdev, irq_data,
- bucks_irq_types[i], interrupt_count, &irq_idx);
+ bucks_irq_types[i], nr_types, &irq_idx);
if (error)
return error;
}
@@ -742,7 +737,7 @@ static int tps6594_regulator_probe(struct platform_device *pdev)
pdev->name);
error = tps6594_request_reg_irqs(pdev, rdev, irq_data,
- ldos_irq_types[i], interrupt_count,
+ ldos_irq_types[i], nr_types,
&irq_idx);
if (error)
return error;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0370/1376] regulator: tps6594-regulator: remove hardcoded buck config
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (368 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0369/1376] regulator: tps6594-regulator: remove interrupt_count Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0371/1376] regulator: tps6594-regulator: refactor variant descriptions Greg Kroah-Hartman
` (628 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Walle, Mark Brown,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Walle <mwalle@kernel.org>
[ Upstream commit 180a135eafa9e05657559bb04cc9eb6a86ca45f3 ]
Commit 00c826525fba ("regulator: tps6594-regulator: Add TI TPS65224 PMIC
regulators") added support for the TPS65224 and made the description of
the multi-phase buck converter variable depending on the variant of the
PMIC. But this was just done for MUTLI_BUCK12 and MULTI_BUCK12_34
configs probably because this variant only supports a multi-phase
configuration on buck 1 and 2. Remove the hardcoded value for the
remaining two configs, too as future PMIC variants might also support
these.
This is a preparation patch to refactor the regulator description and
is compile-time only tested.
Signed-off-by: Michael Walle <mwalle@kernel.org>
Acked-by: Mark Brown <broonie@kernel.org>
Link: https://patch.msgid.link/20250703113153.2447110-7-mwalle@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: 7fd28093b3ef ("regulator: tps6594: Fix device node reference leaks in multiphase loop")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/tps6594-regulator.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/regulator/tps6594-regulator.c b/drivers/regulator/tps6594-regulator.c
index 1284a702db8f2..5420c6eb3e1a8 100644
--- a/drivers/regulator/tps6594-regulator.c
+++ b/drivers/regulator/tps6594-regulator.c
@@ -695,14 +695,14 @@ static int tps6594_regulator_probe(struct platform_device *pdev)
if (i == MULTI_BUCK123 || i == MULTI_BUCK1234) {
error = tps6594_request_reg_irqs(pdev, rdev, irq_data,
- tps6594_bucks_irq_types[buck_idx + 2],
+ bucks_irq_types[buck_idx + 2],
nr_types, &irq_idx);
if (error)
return error;
}
if (i == MULTI_BUCK1234) {
error = tps6594_request_reg_irqs(pdev, rdev, irq_data,
- tps6594_bucks_irq_types[buck_idx + 3],
+ bucks_irq_types[buck_idx + 3],
nr_types, &irq_idx);
if (error)
return error;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0371/1376] regulator: tps6594-regulator: refactor variant descriptions
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (369 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0370/1376] regulator: tps6594-regulator: remove hardcoded buck config Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0372/1376] regulator: tps6594: Fix device node reference leaks in multiphase loop Greg Kroah-Hartman
` (627 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Walle, Mark Brown,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Walle <mwalle@kernel.org>
[ Upstream commit e64ee27abfe1e9baea14b31c0a6b6bf93ac8652c ]
Instead of using conditionals or tri state operators throughout the
.probe() provide a description per variant. This will make it much
easier to add new variants later.
While at it, make the variable naming more consistent.
This patch is only compile-time tested.
Signed-off-by: Michael Walle <mwalle@kernel.org>
Acked-by: Mark Brown <broonie@kernel.org>
Link: https://patch.msgid.link/20250703113153.2447110-8-mwalle@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: 7fd28093b3ef ("regulator: tps6594: Fix device node reference leaks in multiphase loop")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/tps6594-regulator.c | 199 +++++++++++++++-----------
1 file changed, 112 insertions(+), 87 deletions(-)
diff --git a/drivers/regulator/tps6594-regulator.c b/drivers/regulator/tps6594-regulator.c
index 5420c6eb3e1a8..953b47f60f9b7 100644
--- a/drivers/regulator/tps6594-regulator.c
+++ b/drivers/regulator/tps6594-regulator.c
@@ -21,10 +21,6 @@
#define BUCK_NB 5
#define LDO_NB 4
#define MULTI_PHASE_NB 4
-/* TPS6593 and LP8764 supports OV, UV, SC, ILIM */
-#define REGS_INT_NB 4
-/* TPS65224 supports OV or UV */
-#define TPS65224_REGS_INT_NB 1
enum tps6594_regulator_id {
/* DCDC's */
@@ -192,7 +188,7 @@ static const struct regulator_ops tps6594_ldos_4_ops = {
.map_voltage = regulator_map_voltage_linear_range,
};
-static const struct regulator_desc buck_regs[] = {
+static const struct regulator_desc tps6594_buck_regs[] = {
TPS6594_REGULATOR("BUCK1", "buck1", TPS6594_BUCK_1,
REGULATOR_VOLTAGE, tps6594_bucks_ops, TPS6594_MASK_BUCKS_VSET,
TPS6594_REG_BUCKX_VOUT_1(0),
@@ -549,6 +545,63 @@ static int tps6594_request_reg_irqs(struct platform_device *pdev,
return 0;
}
+struct tps6594_regulator_desc {
+ const struct regulator_desc *multi_phase_regs;
+ unsigned int num_multi_phase_regs;
+
+ const struct regulator_desc *buck_regs;
+ int num_buck_regs;
+
+ const struct regulator_desc *ldo_regs;
+ int num_ldo_regs;
+
+ const struct tps6594_regulator_irq_type **bucks_irq_types;
+ const struct tps6594_regulator_irq_type **ldos_irq_types;
+ int num_irq_types;
+
+ const struct tps6594_regulator_irq_type *ext_irq_types;
+ int num_ext_irqs;
+};
+
+static const struct tps6594_regulator_desc tps65224_reg_desc = {
+ .multi_phase_regs = tps65224_multi_regs,
+ .num_multi_phase_regs = ARRAY_SIZE(tps65224_multi_regs),
+ .buck_regs = tps65224_buck_regs,
+ .num_buck_regs = ARRAY_SIZE(tps65224_buck_regs),
+ .ldo_regs = tps65224_ldo_regs,
+ .num_ldo_regs = ARRAY_SIZE(tps65224_ldo_regs),
+ .bucks_irq_types = tps65224_bucks_irq_types,
+ .ldos_irq_types = tps65224_ldos_irq_types,
+ .num_irq_types = 1, /* OV or UV */
+ .ext_irq_types = tps65224_ext_regulator_irq_types,
+ .num_ext_irqs = ARRAY_SIZE(tps65224_ext_regulator_irq_types),
+};
+
+static const struct tps6594_regulator_desc tps6594_reg_desc = {
+ .multi_phase_regs = tps6594_multi_regs,
+ .num_multi_phase_regs = ARRAY_SIZE(tps6594_multi_regs),
+ .buck_regs = tps6594_buck_regs,
+ .num_buck_regs = ARRAY_SIZE(tps6594_buck_regs),
+ .ldo_regs = tps6594_ldo_regs,
+ .num_ldo_regs = ARRAY_SIZE(tps6594_ldo_regs),
+ .bucks_irq_types = tps6594_bucks_irq_types,
+ .ldos_irq_types = tps6594_ldos_irq_types,
+ .num_irq_types = 4, /* OV, UV, SC and ILIM */
+ .ext_irq_types = tps6594_ext_regulator_irq_types,
+ .num_ext_irqs = 2, /* only VCCA OV and UV */
+};
+
+static const struct tps6594_regulator_desc lp8764_reg_desc = {
+ .multi_phase_regs = tps6594_multi_regs,
+ .num_multi_phase_regs = ARRAY_SIZE(tps6594_multi_regs),
+ .buck_regs = tps6594_buck_regs,
+ .num_buck_regs = ARRAY_SIZE(tps6594_buck_regs),
+ .bucks_irq_types = tps6594_bucks_irq_types,
+ .num_irq_types = 4, /* OV, UV, SC and ILIM */
+ .ext_irq_types = tps6594_ext_regulator_irq_types,
+ .num_ext_irqs = ARRAY_SIZE(tps6594_ext_regulator_irq_types),
+};
+
static int tps6594_regulator_probe(struct platform_device *pdev)
{
struct tps6594 *tps = dev_get_drvdata(pdev->dev.parent);
@@ -559,38 +612,32 @@ static int tps6594_regulator_probe(struct platform_device *pdev)
struct tps6594_regulator_irq_data *irq_data;
struct tps6594_ext_regulator_irq_data *irq_ext_reg_data;
const struct tps6594_regulator_irq_type *irq_type;
- const struct tps6594_regulator_irq_type *irq_types;
bool buck_configured[BUCK_NB] = { false };
bool buck_multi[MULTI_PHASE_NB] = { false };
+ const struct tps6594_regulator_desc *desc;
+ const struct regulator_desc *multi_regs;
static const char *npname;
int error, i, irq, multi;
int irq_idx = 0;
int buck_idx = 0;
- int nr_ldo;
- int nr_buck;
- int nr_types;
- unsigned int irq_count;
- unsigned int multi_phase_cnt;
size_t reg_irq_nb;
- const struct tps6594_regulator_irq_type **bucks_irq_types;
- const struct regulator_desc *multi_regs;
- const struct tps6594_regulator_irq_type **ldos_irq_types;
- const struct regulator_desc *ldo_regs;
- if (tps->chip_id == TPS65224) {
- bucks_irq_types = tps65224_bucks_irq_types;
- multi_regs = tps65224_multi_regs;
- ldos_irq_types = tps65224_ldos_irq_types;
- ldo_regs = tps65224_ldo_regs;
- multi_phase_cnt = ARRAY_SIZE(tps65224_multi_regs);
- } else {
- bucks_irq_types = tps6594_bucks_irq_types;
- multi_regs = tps6594_multi_regs;
- ldos_irq_types = tps6594_ldos_irq_types;
- ldo_regs = tps6594_ldo_regs;
- multi_phase_cnt = ARRAY_SIZE(tps6594_multi_regs);
- }
+ switch (tps->chip_id) {
+ case TPS65224:
+ desc = &tps65224_reg_desc;
+ break;
+ case TPS6594:
+ case TPS6593:
+ desc = &tps6594_reg_desc;
+ break;
+ case LP8764:
+ desc = &lp8764_reg_desc;
+ break;
+ default:
+ dev_err(tps->dev, "unknown chip_id %lu\n", tps->chip_id);
+ return -EINVAL;
+ };
enum {
MULTI_BUCK12,
@@ -611,13 +658,14 @@ static int tps6594_regulator_probe(struct platform_device *pdev)
* In case of Multiphase configuration, value should be defined for
* buck_configured to avoid creating bucks for every buck in multiphase
*/
- for (multi = 0; multi < multi_phase_cnt; multi++) {
- np = of_find_node_by_name(tps->dev->of_node, multi_regs[multi].supply_name);
+ for (multi = 0; multi < desc->num_multi_phase_regs; multi++) {
+ multi_regs = &desc->multi_phase_regs[multi];
+ np = of_find_node_by_name(tps->dev->of_node, multi_regs->supply_name);
npname = of_node_full_name(np);
np_pmic_parent = of_get_parent(of_get_parent(np));
if (of_node_cmp(of_node_full_name(np_pmic_parent), tps->dev->of_node->full_name))
continue;
- if (strcmp(npname, multi_regs[multi].supply_name) == 0) {
+ if (strcmp(npname, multi_regs->supply_name) == 0) {
switch (multi) {
case MULTI_BUCK12:
buck_multi[0] = true;
@@ -650,28 +698,19 @@ static int tps6594_regulator_probe(struct platform_device *pdev)
}
}
- if (tps->chip_id == TPS65224) {
- nr_buck = ARRAY_SIZE(tps65224_buck_regs);
- nr_ldo = ARRAY_SIZE(tps65224_ldo_regs);
- nr_types = TPS65224_REGS_INT_NB;
- } else {
- nr_buck = ARRAY_SIZE(buck_regs);
- nr_ldo = (tps->chip_id == LP8764) ? 0 : ARRAY_SIZE(tps6594_ldo_regs);
- nr_types = REGS_INT_NB;
- }
-
- reg_irq_nb = nr_types * (nr_buck + nr_ldo);
+ reg_irq_nb = desc->num_irq_types * (desc->num_buck_regs + desc->num_ldo_regs);
irq_data = devm_kmalloc_array(tps->dev, reg_irq_nb,
sizeof(struct tps6594_regulator_irq_data), GFP_KERNEL);
if (!irq_data)
return -ENOMEM;
- for (i = 0; i < multi_phase_cnt; i++) {
+ for (i = 0; i < desc->num_multi_phase_regs; i++) {
if (!buck_multi[i])
continue;
- rdev = devm_regulator_register(&pdev->dev, &multi_regs[i], &config);
+ rdev = devm_regulator_register(&pdev->dev, &desc->multi_phase_regs[i],
+ &config);
if (IS_ERR(rdev))
return dev_err_probe(tps->dev, PTR_ERR(rdev),
"failed to register %s regulator\n",
@@ -682,89 +721,74 @@ static int tps6594_regulator_probe(struct platform_device *pdev)
buck_idx = 2;
error = tps6594_request_reg_irqs(pdev, rdev, irq_data,
- bucks_irq_types[buck_idx],
- nr_types, &irq_idx);
+ desc->bucks_irq_types[buck_idx],
+ desc->num_irq_types, &irq_idx);
if (error)
return error;
error = tps6594_request_reg_irqs(pdev, rdev, irq_data,
- bucks_irq_types[buck_idx + 1],
- nr_types, &irq_idx);
+ desc->bucks_irq_types[buck_idx + 1],
+ desc->num_irq_types, &irq_idx);
if (error)
return error;
if (i == MULTI_BUCK123 || i == MULTI_BUCK1234) {
error = tps6594_request_reg_irqs(pdev, rdev, irq_data,
- bucks_irq_types[buck_idx + 2],
- nr_types, &irq_idx);
+ desc->bucks_irq_types[buck_idx + 2],
+ desc->num_irq_types,
+ &irq_idx);
if (error)
return error;
}
if (i == MULTI_BUCK1234) {
error = tps6594_request_reg_irqs(pdev, rdev, irq_data,
- bucks_irq_types[buck_idx + 3],
- nr_types, &irq_idx);
+ desc->bucks_irq_types[buck_idx + 3],
+ desc->num_irq_types,
+ &irq_idx);
if (error)
return error;
}
}
- for (i = 0; i < nr_buck; i++) {
+ for (i = 0; i < desc->num_buck_regs; i++) {
if (buck_configured[i])
continue;
- const struct regulator_desc *buck_cfg = (tps->chip_id == TPS65224) ?
- tps65224_buck_regs : buck_regs;
-
- rdev = devm_regulator_register(&pdev->dev, &buck_cfg[i], &config);
+ rdev = devm_regulator_register(&pdev->dev, &desc->buck_regs[i], &config);
if (IS_ERR(rdev))
return dev_err_probe(tps->dev, PTR_ERR(rdev),
"failed to register %s regulator\n", pdev->name);
error = tps6594_request_reg_irqs(pdev, rdev, irq_data,
- bucks_irq_types[i], nr_types, &irq_idx);
+ desc->bucks_irq_types[i],
+ desc->num_irq_types, &irq_idx);
if (error)
return error;
}
- /* LP8764 doesn't have LDO */
- if (tps->chip_id != LP8764) {
- for (i = 0; i < nr_ldo; i++) {
- rdev = devm_regulator_register(&pdev->dev, &ldo_regs[i], &config);
- if (IS_ERR(rdev))
- return dev_err_probe(tps->dev, PTR_ERR(rdev),
- "failed to register %s regulator\n",
- pdev->name);
-
- error = tps6594_request_reg_irqs(pdev, rdev, irq_data,
- ldos_irq_types[i], nr_types,
- &irq_idx);
- if (error)
- return error;
- }
- }
+ for (i = 0; i < desc->num_ldo_regs; i++) {
+ rdev = devm_regulator_register(&pdev->dev, &desc->ldo_regs[i], &config);
+ if (IS_ERR(rdev))
+ return dev_err_probe(tps->dev, PTR_ERR(rdev),
+ "failed to register %s regulator\n",
+ pdev->name);
- if (tps->chip_id == TPS65224) {
- irq_types = tps65224_ext_regulator_irq_types;
- irq_count = ARRAY_SIZE(tps65224_ext_regulator_irq_types);
- } else {
- irq_types = tps6594_ext_regulator_irq_types;
- if (tps->chip_id == LP8764)
- irq_count = ARRAY_SIZE(tps6594_ext_regulator_irq_types);
- else
- /* TPS6593 supports only VCCA OV and UV */
- irq_count = 2;
+ error = tps6594_request_reg_irqs(pdev, rdev, irq_data,
+ desc->ldos_irq_types[i],
+ desc->num_irq_types, &irq_idx);
+ if (error)
+ return error;
}
irq_ext_reg_data = devm_kmalloc_array(tps->dev,
- irq_count,
+ desc->num_ext_irqs,
sizeof(struct tps6594_ext_regulator_irq_data),
GFP_KERNEL);
if (!irq_ext_reg_data)
return -ENOMEM;
- for (i = 0; i < irq_count; ++i) {
- irq_type = &irq_types[i];
+ for (i = 0; i < desc->num_ext_irqs; ++i) {
+ irq_type = &desc->ext_irq_types[i];
irq = platform_get_irq_byname(pdev, irq_type->irq_name);
if (irq < 0)
return -EINVAL;
@@ -782,6 +806,7 @@ static int tps6594_regulator_probe(struct platform_device *pdev)
"failed to request %s IRQ %d\n",
irq_type->irq_name, irq);
}
+
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0372/1376] regulator: tps6594: Fix device node reference leaks in multiphase loop
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (370 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0371/1376] regulator: tps6594-regulator: refactor variant descriptions Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0373/1376] drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup Greg Kroah-Hartman
` (626 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Uday Khare, Mark Brown, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uday Khare <udaykhare77@gmail.com>
[ Upstream commit 7fd28093b3effc4f92566466df364622830ec608 ]
In tps6594_regulator_probe(), the multi-phase configuration loop calls
of_find_node_by_name() to find buck nodes by name, and of_get_parent()
twice to navigate to the PMIC parent node. None of the acquired node
references (np, intermediate parent, np_pmic_parent) are ever released
via of_node_put(), causing a reference leak on every loop iteration.
Additionally, of_find_node_by_name() can return NULL, but the result was
immediately passed to of_node_full_name() and of_get_parent() without a
NULL check, which could lead to a NULL pointer dereference.
Fix this by:
- Adding a NULL check for np after of_find_node_by_name()
- Storing the intermediate parent node in a local variable np_parent
- Calling of_node_put() on np, np_parent and np_pmic_parent at the
end of each loop iteration
Fixes: f17ccc5deb4d ("regulator: tps6594-regulator: Add driver for TI TPS6594 regulators")
Signed-off-by: Uday Khare <udaykhare77@gmail.com>
Link: https://patch.msgid.link/20260618132327.11529-1-udaykhare77@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/tps6594-regulator.c | 19 +++++++++++++++----
1 file changed, 15 insertions(+), 4 deletions(-)
diff --git a/drivers/regulator/tps6594-regulator.c b/drivers/regulator/tps6594-regulator.c
index 953b47f60f9b7..9ede063986487 100644
--- a/drivers/regulator/tps6594-regulator.c
+++ b/drivers/regulator/tps6594-regulator.c
@@ -659,13 +659,20 @@ static int tps6594_regulator_probe(struct platform_device *pdev)
* buck_configured to avoid creating bucks for every buck in multiphase
*/
for (multi = 0; multi < desc->num_multi_phase_regs; multi++) {
+ struct device_node *np_parent;
+
multi_regs = &desc->multi_phase_regs[multi];
np = of_find_node_by_name(tps->dev->of_node, multi_regs->supply_name);
- npname = of_node_full_name(np);
- np_pmic_parent = of_get_parent(of_get_parent(np));
- if (of_node_cmp(of_node_full_name(np_pmic_parent), tps->dev->of_node->full_name))
+ if (!np)
continue;
- if (strcmp(npname, multi_regs->supply_name) == 0) {
+
+ npname = of_node_full_name(np);
+ np_parent = of_get_parent(np);
+ np_pmic_parent = of_get_parent(np_parent);
+
+ if (np_pmic_parent &&
+ !of_node_cmp(of_node_full_name(np_pmic_parent), tps->dev->of_node->full_name) &&
+ strcmp(npname, multi_regs->supply_name) == 0) {
switch (multi) {
case MULTI_BUCK12:
buck_multi[0] = true;
@@ -696,6 +703,10 @@ static int tps6594_regulator_probe(struct platform_device *pdev)
break;
}
}
+
+ of_node_put(np_pmic_parent);
+ of_node_put(np_parent);
+ of_node_put(np);
}
reg_irq_nb = desc->num_irq_types * (desc->num_buck_regs + desc->num_ldo_regs);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0373/1376] drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (371 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0372/1376] regulator: tps6594: Fix device node reference leaks in multiphase loop Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0374/1376] drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup Greg Kroah-Hartman
` (625 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Asad Kamal, Lijo Lazar,
Hawking Zhang, Alex Deucher, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asad Kamal <asad.kamal@amd.com>
[ Upstream commit 3a8a05477cda6c8293e2b629495b42981dcaba32 ]
vddInd and vddcInd fields from VBIOS-parsed tables are used to index into
voltage lookup tables without a bounds check. Return -EINVAL when any
index is out of range.
Fixes: c82baa281843 ("drm/amd/powerplay: add Tonga dpm support (v3)")
Signed-off-by: Asad Kamal <asad.kamal@amd.com>
Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 24 +++++++++++++++++++
1 file changed, 24 insertions(+)
diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
index 80e34a7748d72..2f46c185b528b 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
@@ -2216,12 +2216,24 @@ static int smu7_patch_voltage_dependency_tables_with_lookup_table(
if (data->vdd_gfx_control == SMU7_VOLTAGE_CONTROL_BY_SVID2) {
for (entry_id = 0; entry_id < sclk_table->count; ++entry_id) {
voltage_id = sclk_table->entries[entry_id].vddInd;
+ if (voltage_id >= table_info->vddgfx_lookup_table->count) {
+ pr_err("amdgpu: sclk[%u] vddgfx index %u out of bounds (%u)\n",
+ entry_id, voltage_id,
+ table_info->vddgfx_lookup_table->count);
+ return -EINVAL;
+ }
sclk_table->entries[entry_id].vddgfx =
table_info->vddgfx_lookup_table->entries[voltage_id].us_vdd;
}
} else {
for (entry_id = 0; entry_id < sclk_table->count; ++entry_id) {
voltage_id = sclk_table->entries[entry_id].vddInd;
+ if (voltage_id >= table_info->vddc_lookup_table->count) {
+ pr_err("amdgpu: sclk[%u] vddc index %u out of bounds (%u)\n",
+ entry_id, voltage_id,
+ table_info->vddc_lookup_table->count);
+ return -EINVAL;
+ }
sclk_table->entries[entry_id].vddc =
table_info->vddc_lookup_table->entries[voltage_id].us_vdd;
}
@@ -2229,12 +2241,24 @@ static int smu7_patch_voltage_dependency_tables_with_lookup_table(
for (entry_id = 0; entry_id < mclk_table->count; ++entry_id) {
voltage_id = mclk_table->entries[entry_id].vddInd;
+ if (voltage_id >= table_info->vddc_lookup_table->count) {
+ pr_err("amdgpu: mclk[%u] vddc index %u out of bounds (%u)\n",
+ entry_id, voltage_id,
+ table_info->vddc_lookup_table->count);
+ return -EINVAL;
+ }
mclk_table->entries[entry_id].vddc =
table_info->vddc_lookup_table->entries[voltage_id].us_vdd;
}
for (entry_id = 0; entry_id < mm_table->count; ++entry_id) {
voltage_id = mm_table->entries[entry_id].vddcInd;
+ if (voltage_id >= table_info->vddc_lookup_table->count) {
+ pr_err("amdgpu: mm[%u] vddc index %u out of bounds (%u)\n",
+ entry_id, voltage_id,
+ table_info->vddc_lookup_table->count);
+ return -EINVAL;
+ }
mm_table->entries[entry_id].vddc =
table_info->vddc_lookup_table->entries[voltage_id].us_vdd;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0374/1376] drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (372 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0373/1376] drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0375/1376] tools/bpf/bpftool: Reset vmlinux BTF after map commands Greg Kroah-Hartman
` (624 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Asad Kamal, Lijo Lazar,
Hawking Zhang, Alex Deucher, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asad Kamal <asad.kamal@amd.com>
[ Upstream commit 6fa33f594e46e775a94097f71b486d7b006b6917 ]
vddInd, vddciInd and mvddInd from VBIOS-parsed tables index into vddc,
vddci and vddmem lookup tables without bounds checks across nine sites.
Return -EINVAL when any index is out of range.
Fixes: f83a9991648b ("drm/amd/powerplay: add Vega10 powerplay support (v5)")
Signed-off-by: Asad Kamal <asad.kamal@amd.com>
Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 35 ++++++++++++++++++-
1 file changed, 34 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c
index 9ace863792d48..b3fed2a478aab 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c
@@ -685,10 +685,18 @@ static int vega10_patch_voltage_dependency_tables_with_lookup_table(
case 3: vdt = table_info->vdd_dep_on_pixclk; break;
case 4: vdt = table_info->vdd_dep_on_dispclk; break;
case 5: vdt = table_info->vdd_dep_on_phyclk; break;
+ default:
+ continue;
}
for (entry_id = 0; entry_id < vdt->count; entry_id++) {
voltage_id = vdt->entries[entry_id].vddInd;
+ if (voltage_id >= table_info->vddc_lookup_table->count) {
+ pr_err("amdgpu: clk_dep[%u][%u] vddc index %u out of bounds (%u)\n",
+ i, entry_id, voltage_id,
+ table_info->vddc_lookup_table->count);
+ return -EINVAL;
+ }
vdt->entries[entry_id].vddc =
table_info->vddc_lookup_table->entries[voltage_id].us_vdd;
}
@@ -696,23 +704,48 @@ static int vega10_patch_voltage_dependency_tables_with_lookup_table(
for (entry_id = 0; entry_id < mm_table->count; ++entry_id) {
voltage_id = mm_table->entries[entry_id].vddcInd;
+ if (voltage_id >= table_info->vddc_lookup_table->count) {
+ pr_err("amdgpu: mm[%u] vddc index %u out of bounds (%u)\n",
+ entry_id, voltage_id,
+ table_info->vddc_lookup_table->count);
+ return -EINVAL;
+ }
mm_table->entries[entry_id].vddc =
table_info->vddc_lookup_table->entries[voltage_id].us_vdd;
}
for (entry_id = 0; entry_id < mclk_table->count; ++entry_id) {
voltage_id = mclk_table->entries[entry_id].vddInd;
+ if (voltage_id >= table_info->vddc_lookup_table->count) {
+ pr_err("amdgpu: mclk[%u] vddc index %u out of bounds (%u)\n",
+ entry_id, voltage_id,
+ table_info->vddc_lookup_table->count);
+ return -EINVAL;
+ }
mclk_table->entries[entry_id].vddc =
table_info->vddc_lookup_table->entries[voltage_id].us_vdd;
+
voltage_id = mclk_table->entries[entry_id].vddciInd;
+ if (voltage_id >= table_info->vddci_lookup_table->count) {
+ pr_err("amdgpu: mclk[%u] vddci index %u out of bounds (%u)\n",
+ entry_id, voltage_id,
+ table_info->vddci_lookup_table->count);
+ return -EINVAL;
+ }
mclk_table->entries[entry_id].vddci =
table_info->vddci_lookup_table->entries[voltage_id].us_vdd;
+
voltage_id = mclk_table->entries[entry_id].mvddInd;
+ if (voltage_id >= table_info->vddmem_lookup_table->count) {
+ pr_err("amdgpu: mclk[%u] vddmem index %u out of bounds (%u)\n",
+ entry_id, voltage_id,
+ table_info->vddmem_lookup_table->count);
+ return -EINVAL;
+ }
mclk_table->entries[entry_id].mvdd =
table_info->vddmem_lookup_table->entries[voltage_id].us_vdd;
}
-
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0375/1376] tools/bpf/bpftool: Reset vmlinux BTF after map commands
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (373 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0374/1376] drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0376/1376] tools/bpf/bpftool: Reset vmlinux BTF after struct_ops commands Greg Kroah-Hartman
` (623 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yichong Chen, Andrii Nakryiko,
Emil Tsalapatis, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yichong Chen <chenyichong@uniontech.com>
[ Upstream commit 66d7e39e49b0dd57610c9b63afc65b4d5690983b ]
get_map_kv_btf() caches the vmlinux BTF object when a map uses
btf_vmlinux_value_type_id. map dump released that object when the
command completed, but left the global pointer stale.
The same cached object can also be returned to print_key_value(), which
freed it directly. That leaves btf_vmlinux dangling before the command
cleanup path runs.
Use free_map_kv_btf() for per-entry cleanup, and reset the cached
btf_vmlinux pointer when the map command releases the object. This keeps
batch mode from reusing a freed BTF object.
Fixes: 4e1ea33292ff ("bpftool: Support dumping a map with btf_vmlinux_value_type_id")
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Link: https://lore.kernel.org/bpf/9072F43B3F74DF91+20260624025055.1574875-2-chenyichong@uniontech.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/bpf/bpftool/map.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c
index b89bd792c1d51..332e040677154 100644
--- a/tools/bpf/bpftool/map.c
+++ b/tools/bpf/bpftool/map.c
@@ -787,6 +787,12 @@ static int maps_have_btf(int *fds, int nb_fds)
static struct btf *btf_vmlinux;
+static void free_btf_vmlinux(void)
+{
+ btf__free(btf_vmlinux);
+ btf_vmlinux = NULL;
+}
+
static int get_map_kv_btf(const struct bpf_map_info *info, struct btf **btf)
{
int err = 0;
@@ -955,7 +961,7 @@ static int do_dump(int argc, char **argv)
close(fds[i]);
exit_free:
free(fds);
- btf__free(btf_vmlinux);
+ free_btf_vmlinux();
return err;
}
@@ -1046,7 +1052,7 @@ static void print_key_value(struct bpf_map_info *info, void *key,
btf_wtr = get_btf_writer();
if (!btf_wtr) {
p_info("failed to create json writer for btf. falling back to plain output");
- btf__free(btf);
+ free_map_kv_btf(btf);
btf = NULL;
print_entry_plain(info, key, value);
} else {
@@ -1062,7 +1068,7 @@ static void print_key_value(struct bpf_map_info *info, void *key,
} else {
print_entry_plain(info, key, value);
}
- btf__free(btf);
+ free_map_kv_btf(btf);
}
static int do_lookup(int argc, char **argv)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0376/1376] tools/bpf/bpftool: Reset vmlinux BTF after struct_ops commands
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (374 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0375/1376] tools/bpf/bpftool: Reset vmlinux BTF after map commands Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0377/1376] bpf: Copy per-CPU map value padding in copy_map_value_long() Greg Kroah-Hartman
` (622 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yichong Chen, Andrii Nakryiko,
Emil Tsalapatis, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yichong Chen <chenyichong@uniontech.com>
[ Upstream commit f7f540e19751face50c68bb9ce58460fcb46c293 ]
struct_ops frees the global btf_vmlinux object.
In batch mode, a later struct_ops command can reuse stale state.
Reset the BTF pointer and cached map info state.
Fixes: 65c93628599d ("bpftool: Add struct_ops support")
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Link: https://lore.kernel.org/bpf/9F9017160ABE125F+20260624025055.1574875-3-chenyichong@uniontech.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/bpf/bpftool/struct_ops.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/tools/bpf/bpftool/struct_ops.c b/tools/bpf/bpftool/struct_ops.c
index aa43dead249cb..835e5e561f7fc 100644
--- a/tools/bpf/bpftool/struct_ops.c
+++ b/tools/bpf/bpftool/struct_ops.c
@@ -643,6 +643,10 @@ int do_struct_ops(int argc, char **argv)
err = cmd_select(cmds, argc, argv, do_help);
btf__free(btf_vmlinux);
+ btf_vmlinux = NULL;
+ map_info_type = NULL;
+ map_info_alloc_len = 0;
+ map_info_type_id = 0;
return err;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0377/1376] bpf: Copy per-CPU map value padding in copy_map_value_long()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (375 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0376/1376] tools/bpf/bpftool: Reset vmlinux BTF after struct_ops commands Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0378/1376] selftests/bpf: Systematically add SO_REUSEADDR in start_server_addr Greg Kroah-Hartman
` (621 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Leon Hwang, Andrii Nakryiko,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Hwang <leon.hwang@linux.dev>
[ Upstream commit 7cf9cd98cf6f0df3befc167ca6b54c07014d71de ]
In kernel, per-CPU map elements are stored with
round_up(map->value_size, 8) bytes. On UAPI lookup paths, it copies the
rounded size for each CPU into a temporary buffer.
However, copy_map_value_long() passes 'map->value_size' to
bpf_obj_memcpy(). When the map has special fields, bpf_obj_memcpy() copies
around those fields with memcpy(), and does not copy the tail padding
between 'map->value_size' and round_up(map->value_size, 8).
The temporary UAPI lookup buffers are allocated without __GFP_ZERO. As a
result, when the per-CPU map's value size is not equal to
round_up(map->value_size, 8), UAPI LOOKUP_ELEM and its variants can return
stale heap contents from that padding to user space. The same issue
applies to bpf_iter for per-CPU maps.
Pass round_up(map->value_size, 8) to bpf_obj_memcpy() from
copy_map_value_long(), so per-CPU maps both with and without special
fields copy the entire per-CPU slot. Remove the now redundant round_up()
from bpf_obj_memcpy()'s long_memcpy path.
Fixes: 448325199f57 ("bpf: Add copy_map_value_long to copy to remote percpu memory")
Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20260624155115.85196-2-leon.hwang@linux.dev
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/bpf.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 9e1731db76d86..47fdbf13abe16 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -500,7 +500,7 @@ static inline void bpf_obj_memcpy(struct btf_record *rec,
if (IS_ERR_OR_NULL(rec)) {
if (long_memcpy)
- bpf_long_memcpy(dst, src, round_up(size, 8));
+ bpf_long_memcpy(dst, src, size);
else
memcpy(dst, src, size);
return;
@@ -523,7 +523,7 @@ static inline void copy_map_value(struct bpf_map *map, void *dst, void *src)
static inline void copy_map_value_long(struct bpf_map *map, void *dst, void *src)
{
- bpf_obj_memcpy(map->record, dst, src, map->value_size, true);
+ bpf_obj_memcpy(map->record, dst, src, round_up(map->value_size, 8), true);
}
static inline void bpf_obj_memzero(struct btf_record *rec, void *dst, u32 size)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0378/1376] selftests/bpf: Systematically add SO_REUSEADDR in start_server_addr
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (376 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0377/1376] bpf: Copy per-CPU map value padding in copy_map_value_long() Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0379/1376] selftests/bpf: Mask socket type flags in mptcpify prog Greg Kroah-Hartman
` (620 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexis Lothoré ,
Martin KaFai Lau, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>
[ Upstream commit 38e36514fcb01ff1cce84cd77a93906f233a4cb8 ]
Some tests have to stop/start a server multiple time with the same
listening address. Doing so without SO_REUSADDR leads to failures due to
the socket still being in TIME_WAIT right after the first instance
stop/before the second instance start. Instead of letting each test
manually set SO_REUSEADDR on their servers, it can be done automatically
by start_server_addr for all tests (and without any major downside).
Enforce SO_REUSEADDR in start_server_addr for all tests.
Signed-off-by: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Link: https://patch.msgid.link/20251105-start-server-soreuseaddr-v1-1-1bbd9c1f8d65@bootlin.com
Stable-dep-of: b4b8b334f6b5 ("selftests/bpf: Mask socket type flags in mptcpify prog")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/bpf/network_helpers.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/bpf/network_helpers.c b/tools/testing/selftests/bpf/network_helpers.c
index af0ee70a53f9f..e5f8cab87dd9a 100644
--- a/tools/testing/selftests/bpf/network_helpers.c
+++ b/tools/testing/selftests/bpf/network_helpers.c
@@ -97,7 +97,7 @@ int settimeo(int fd, int timeout_ms)
int start_server_addr(int type, const struct sockaddr_storage *addr, socklen_t addrlen,
const struct network_helper_opts *opts)
{
- int fd;
+ int on = 1, fd;
if (!opts)
opts = &default_opts;
@@ -111,6 +111,12 @@ int start_server_addr(int type, const struct sockaddr_storage *addr, socklen_t a
if (settimeo(fd, opts->timeout_ms))
goto error_close;
+ if (type == SOCK_STREAM &&
+ setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on))) {
+ log_err("Failed to enable SO_REUSEADDR");
+ goto error_close;
+ }
+
if (opts->post_socket_cb &&
opts->post_socket_cb(fd, opts->cb_opts)) {
log_err("Failed to call post_socket_cb");
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0379/1376] selftests/bpf: Mask socket type flags in mptcpify prog
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (377 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0378/1376] selftests/bpf: Systematically add SO_REUSEADDR in start_server_addr Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0380/1376] bpf,lsm: Drop bpf_prog_free from sleepable_lsm_hooks Greg Kroah-Hartman
` (619 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guillaume Maudoux, Andrii Nakryiko,
Matthieu Baerts (NGI0), Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Maudoux <layus.on@gmail.com>
[ Upstream commit b4b8b334f6b535a86ab83f18d3d241fe01270bc3 ]
The mptcpify BPF prog upgrades eligible TCP sockets to MPTCP, but only
when the socket type is exactly SOCK_STREAM. Its update_socket_protocol()
hook runs on the raw type from userspace, before the socket core masks
it with SOCK_TYPE_MASK, so the type may still carry SOCK_CLOEXEC or
SOCK_NONBLOCK in its upper bits and the equality check fails.
As a result, a socket(AF_INET, SOCK_STREAM | SOCK_CLOEXEC, 0) -- what
common libraries do by default -- is silently left as plain TCP. This
was hit in practice with curl. Since mptcpify.c is referenced as example
code for enabling MPTCP transparently, the same mistake is likely to be
copied into real deployments where it fails the same way and is hard to
diagnose.
Mask the type before comparing, mirroring the socket core. Extend the
test to also create the server with SOCK_CLOEXEC set; the same masking
is applied to start_server_addr() so a flagged type still listens.
Fixes: ddba122428a7 ("selftests/bpf: Add mptcpify test")
Signed-off-by: Guillaume Maudoux <layus.on@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://lore.kernel.org/bpf/20260630095723.564392-1-layus.on@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/bpf/network_helpers.c | 4 ++--
tools/testing/selftests/bpf/network_helpers.h | 5 +++++
tools/testing/selftests/bpf/prog_tests/mptcp.c | 13 ++++++++++---
tools/testing/selftests/bpf/progs/bpf_tracing_net.h | 3 +++
tools/testing/selftests/bpf/progs/mptcpify.c | 2 +-
5 files changed, 21 insertions(+), 6 deletions(-)
diff --git a/tools/testing/selftests/bpf/network_helpers.c b/tools/testing/selftests/bpf/network_helpers.c
index e5f8cab87dd9a..cd92745c4948e 100644
--- a/tools/testing/selftests/bpf/network_helpers.c
+++ b/tools/testing/selftests/bpf/network_helpers.c
@@ -111,7 +111,7 @@ int start_server_addr(int type, const struct sockaddr_storage *addr, socklen_t a
if (settimeo(fd, opts->timeout_ms))
goto error_close;
- if (type == SOCK_STREAM &&
+ if ((type & SOCK_TYPE_MASK) == SOCK_STREAM &&
setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on))) {
log_err("Failed to enable SO_REUSEADDR");
goto error_close;
@@ -128,7 +128,7 @@ int start_server_addr(int type, const struct sockaddr_storage *addr, socklen_t a
goto error_close;
}
- if (type == SOCK_STREAM) {
+ if ((type & SOCK_TYPE_MASK) == SOCK_STREAM) {
if (listen(fd, opts->backlog ? MAX(opts->backlog, 0) : 1) < 0) {
log_err("Failed to listed on socket");
goto error_close;
diff --git a/tools/testing/selftests/bpf/network_helpers.h b/tools/testing/selftests/bpf/network_helpers.h
index 5764155b6d251..a80916a267790 100644
--- a/tools/testing/selftests/bpf/network_helpers.h
+++ b/tools/testing/selftests/bpf/network_helpers.h
@@ -22,6 +22,11 @@ typedef __u16 __sum16;
#define VIP_NUM 5
#define MAGIC_BYTES 123
+/* include/linux/net.h */
+#ifndef SOCK_TYPE_MASK
+#define SOCK_TYPE_MASK 0xf
+#endif
+
struct network_helper_opts {
int timeout_ms;
int proto;
diff --git a/tools/testing/selftests/bpf/prog_tests/mptcp.c b/tools/testing/selftests/bpf/prog_tests/mptcp.c
index d2ca32fa3b21e..e7158a8e95e1e 100644
--- a/tools/testing/selftests/bpf/prog_tests/mptcp.c
+++ b/tools/testing/selftests/bpf/prog_tests/mptcp.c
@@ -275,7 +275,7 @@ static int verify_mptcpify(int server_fd, int client_fd)
return err;
}
-static int run_mptcpify(int cgroup_fd)
+static int run_mptcpify(int cgroup_fd, int type)
{
int server_fd, client_fd, err = 0;
struct mptcpify *mptcpify_skel;
@@ -291,7 +291,7 @@ static int run_mptcpify(int cgroup_fd)
goto out;
/* without MPTCP */
- server_fd = start_server(AF_INET, SOCK_STREAM, NULL, 0, 0);
+ server_fd = start_server(AF_INET, type, NULL, 0, 0);
if (!ASSERT_GE(server_fd, 0, "start_server")) {
err = -EIO;
goto out;
@@ -328,7 +328,14 @@ static void test_mptcpify(void)
if (!ASSERT_OK_PTR(nstoken, "create_netns"))
goto fail;
- ASSERT_OK(run_mptcpify(cgroup_fd), "run_mptcpify");
+ ASSERT_OK(run_mptcpify(cgroup_fd, SOCK_STREAM), "run_mptcpify");
+ /* userspace sets flags such as SOCK_CLOEXEC together with the type;
+ * the BPF prog must still upgrade the socket to MPTCP. See
+ * update_socket_protocol() in net/socket.c, which runs before the
+ * type is masked with SOCK_TYPE_MASK.
+ */
+ ASSERT_OK(run_mptcpify(cgroup_fd, SOCK_STREAM | SOCK_CLOEXEC),
+ "run_mptcpify_cloexec");
fail:
cleanup_netns(nstoken);
diff --git a/tools/testing/selftests/bpf/progs/bpf_tracing_net.h b/tools/testing/selftests/bpf/progs/bpf_tracing_net.h
index 59843b430f76a..674120405e494 100644
--- a/tools/testing/selftests/bpf/progs/bpf_tracing_net.h
+++ b/tools/testing/selftests/bpf/progs/bpf_tracing_net.h
@@ -8,6 +8,9 @@
#define AF_INET 2
#define AF_INET6 10
+/* include/linux/net.h */
+#define SOCK_TYPE_MASK 0xf
+
#define SOL_SOCKET 1
#define SO_REUSEADDR 2
#define SO_SNDBUF 7
diff --git a/tools/testing/selftests/bpf/progs/mptcpify.c b/tools/testing/selftests/bpf/progs/mptcpify.c
index cbdc730c3a471..e3f8cb54dbe97 100644
--- a/tools/testing/selftests/bpf/progs/mptcpify.c
+++ b/tools/testing/selftests/bpf/progs/mptcpify.c
@@ -15,7 +15,7 @@ int BPF_PROG(mptcpify, int family, int type, int protocol)
return protocol;
if ((family == AF_INET || family == AF_INET6) &&
- type == SOCK_STREAM &&
+ (type & SOCK_TYPE_MASK) == SOCK_STREAM &&
(!protocol || protocol == IPPROTO_TCP)) {
return IPPROTO_MPTCP;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0380/1376] bpf,lsm: Drop bpf_prog_free from sleepable_lsm_hooks
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (378 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0379/1376] selftests/bpf: Mask socket type flags in mptcpify prog Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0381/1376] mm: add build-time option for hotplug memory default online type Greg Kroah-Hartman
` (618 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sechang Lim, Andrii Nakryiko,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sechang Lim <rhkrqnwk98@gmail.com>
[ Upstream commit 2ce3f548cfc6a1fe4c53479cf8a21931cdfd51d8 ]
__bpf_prog_put_rcu() is the call_rcu() callback for non-sleepable programs.
security_bpf_prog_free() called from there fires bpf_prog_free in softirq;
if a sleepable LSM prog is attached to that hook, might_fault() BUGs:
BUG: sleeping function called from invalid context
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5038
preempt_count: 101, expected: 0
Call Trace:
<IRQ>
__bpf_prog_enter_sleepable+0x1cd/0x320 kernel/bpf/trampoline.c:1255
bpf_trampoline_6442549705+0x53/0xd7
security_bpf_prog_free+0xde/0x130 security/security.c:5465
__bpf_prog_put_rcu+0xab/0xd0 kernel/bpf/syscall.c:2365
rcu_do_batch kernel/rcu/tree.c:2617 [inline]
handle_softirqs+0x236/0x800 kernel/softirq.c:622
</IRQ>
The call_rcu/call_rcu_tasks_trace split reflects the freed program's
sleepability, not that of any attached observer.
security_bpf_prog_free() also frees prog->aux->security, which has to stay
after the grace period, so drop bpf_prog_free from sleepable_lsm_hooks
rather than move the call. Non-sleepable observers still run there.
Fixes: 1b67772e4e3f ("bpf,lsm: Refactor bpf_prog_alloc/bpf_prog_free LSM hooks")
Signed-off-by: Sechang Lim <rhkrqnwk98@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20260701080757.1394144-1-rhkrqnwk98@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/bpf_lsm.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c
index 969a6ca362ecb..140c63a816d09 100644
--- a/kernel/bpf/bpf_lsm.c
+++ b/kernel/bpf/bpf_lsm.c
@@ -293,7 +293,6 @@ BTF_ID(func, bpf_lsm_bpf_map_create)
BTF_ID(func, bpf_lsm_bpf_map_free)
BTF_ID(func, bpf_lsm_bpf_prog)
BTF_ID(func, bpf_lsm_bpf_prog_load)
-BTF_ID(func, bpf_lsm_bpf_prog_free)
BTF_ID(func, bpf_lsm_bpf_token_create)
BTF_ID(func, bpf_lsm_bpf_token_free)
BTF_ID(func, bpf_lsm_bpf_token_cmd)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0381/1376] mm: add build-time option for hotplug memory default online type
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (379 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0380/1376] bpf,lsm: Drop bpf_prog_free from sleepable_lsm_hooks Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0382/1376] mm: convert memory block states (MEM_*) macros to enum Greg Kroah-Hartman
` (617 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gregory Price, David Hildenbrand,
Huacai Chen, Jonathan Corbet, Oscar Salvador, Rafael J. Wysocki,
WANG Xuerui, Andrew Morton, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory Price <gourry@gourry.net>
[ Upstream commit 44d46b76c3a4b514a0cc9dab147ed430e5c1d699 ]
Memory hotplug presently auto-onlines memory into a zone the kernel deems
appropriate if CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE=y.
The memhp_default_state boot param enables runtime config, but it's not
possible to do this at build-time.
Remove CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE, and replace it with
CONFIG_MHP_DEFAULT_ONLINE_TYPE_* choices that sync with the boot param.
Selections:
CONFIG_MHP_DEFAULT_ONLINE_TYPE_OFFLINE
=> mhp_default_online_type = "offline"
Memory will not be onlined automatically.
CONFIG_MHP_DEFAULT_ONLINE_TYPE_ONLINE_AUTO
=> mhp_default_online_type = "online"
Memory will be onlined automatically in a zone deemed.
appropriate by the kernel.
CONFIG_MHP_DEFAULT_ONLINE_TYPE_ONLINE_KERNEL
=> mhp_default_online_type = "online_kernel"
Memory will be onlined automatically.
The zone may allow kernel data (e.g. ZONE_NORMAL).
CONFIG_MHP_DEFAULT_ONLINE_TYPE_ONLINE_MOVABLE
=> mhp_default_online_type = "online_movable"
Memory will be onlined automatically.
The zone will be ZONE_MOVABLE.
Default to CONFIG_MHP_DEFAULT_ONLINE_TYPE_OFFLINE to match the existing
default CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE=n behavior.
Existing users of CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE=y should use
CONFIG_MHP_DEFAULT_ONLINE_TYPE_ONLINE_AUTO.
[gourry@gourry.net: update KConfig comments]
Link: https://lkml.kernel.org/r/20241226182918.648799-1-gourry@gourry.net
Link: https://lkml.kernel.org/r/20241220210709.300066-1-gourry@gourry.net
Signed-off-by: Gregory Price <gourry@gourry.net>
Acked-by: David Hildenbrand <david@redhat.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Huacai Chen <chenhuacai@kernel.org>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: "Rafael J. Wysocki" <rafael@kernel.org>
Cc: WANG Xuerui <kernel@xen0n.name>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Stable-dep-of: 2ebce860bdd7 ("mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../admin-guide/kernel-parameters.txt | 4 +-
.../admin-guide/mm/memory-hotplug.rst | 4 +-
arch/loongarch/configs/loongson3_defconfig | 5 +-
drivers/base/memory.c | 4 +-
include/linux/memory_hotplug.h | 5 +-
mm/Kconfig | 57 ++++++++++++++++---
mm/memory_hotplug.c | 33 ++++++++---
7 files changed, 89 insertions(+), 23 deletions(-)
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 811345669be4e..be2957b10d0b0 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -3362,8 +3362,8 @@
[KNL] Set the initial state for the memory hotplug
onlining policy. If not specified, the default value is
set according to the
- CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE kernel config
- option.
+ CONFIG_MHP_DEFAULT_ONLINE_TYPE kernel config
+ options.
See Documentation/admin-guide/mm/memory-hotplug.rst.
memmap=exactmap [KNL,X86,EARLY] Enable setting of an exact
diff --git a/Documentation/admin-guide/mm/memory-hotplug.rst b/Documentation/admin-guide/mm/memory-hotplug.rst
index cb2c080f400ce..33c886f3d1983 100644
--- a/Documentation/admin-guide/mm/memory-hotplug.rst
+++ b/Documentation/admin-guide/mm/memory-hotplug.rst
@@ -280,8 +280,8 @@ The following files are currently defined:
blocks; configure auto-onlining.
The default value depends on the
- CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE kernel configuration
- option.
+ CONFIG_MHP_DEFAULT_ONLINE_TYPE kernel configuration
+ options.
See the ``state`` property of memory blocks for details.
``block_size_bytes`` read-only: the size in bytes of a memory block.
diff --git a/arch/loongarch/configs/loongson3_defconfig b/arch/loongarch/configs/loongson3_defconfig
index 75b366407a60a..60424d59a4ec5 100644
--- a/arch/loongarch/configs/loongson3_defconfig
+++ b/arch/loongarch/configs/loongson3_defconfig
@@ -99,7 +99,10 @@ CONFIG_ZBUD=y
CONFIG_ZSMALLOC=m
# CONFIG_COMPAT_BRK is not set
CONFIG_MEMORY_HOTPLUG=y
-CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE=y
+# CONFIG_MHP_DEFAULT_ONLINE_TYPE_OFFLINE is not set
+CONFIG_MHP_DEFAULT_ONLINE_TYPE_ONLINE_AUTO=y
+# CONFIG_MHP_DEFAULT_ONLINE_TYPE_ONLINE_KERNEL is not set
+# CONFIG_MHP_DEFAULT_ONLINE_TYPE_ONLINE_MOVABLE is not set
CONFIG_MEMORY_HOTREMOVE=y
CONFIG_KSM=y
CONFIG_TRANSPARENT_HUGEPAGE=y
diff --git a/drivers/base/memory.c b/drivers/base/memory.c
index 2f7e8bab3d10c..354bf9fd857d4 100644
--- a/drivers/base/memory.c
+++ b/drivers/base/memory.c
@@ -512,7 +512,7 @@ static ssize_t auto_online_blocks_show(struct device *dev,
struct device_attribute *attr, char *buf)
{
return sysfs_emit(buf, "%s\n",
- online_type_to_str[mhp_default_online_type]);
+ online_type_to_str[mhp_get_default_online_type()]);
}
static ssize_t auto_online_blocks_store(struct device *dev,
@@ -524,7 +524,7 @@ static ssize_t auto_online_blocks_store(struct device *dev,
if (online_type < 0)
return -EINVAL;
- mhp_default_online_type = online_type;
+ mhp_set_default_online_type(online_type);
return count;
}
diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h
index 99d6ba41ed290..0cbf14756d129 100644
--- a/include/linux/memory_hotplug.h
+++ b/include/linux/memory_hotplug.h
@@ -144,8 +144,6 @@ extern u64 max_mem_size;
extern int mhp_online_type_from_str(const char *str);
-/* Default online_type (MMOP_*) when new memory blocks are added. */
-extern int mhp_default_online_type;
/* If movable_node boot option specified */
extern bool movable_node_enabled;
static inline bool movable_node_is_enabled(void)
@@ -304,6 +302,9 @@ static inline void __remove_memory(u64 start, u64 size) {}
#endif /* CONFIG_MEMORY_HOTREMOVE */
#ifdef CONFIG_MEMORY_HOTPLUG
+/* Default online_type (MMOP_*) when new memory blocks are added. */
+extern int mhp_get_default_online_type(void);
+extern void mhp_set_default_online_type(int online_type);
extern void __ref free_area_init_core_hotplug(struct pglist_data *pgdat);
extern int __add_memory(int nid, u64 start, u64 size, mhp_t mhp_flags);
extern int add_memory(int nid, u64 start, u64 size, mhp_t mhp_flags);
diff --git a/mm/Kconfig b/mm/Kconfig
index 763a9105ee188..620d33330f795 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -550,20 +550,63 @@ menuconfig MEMORY_HOTPLUG
if MEMORY_HOTPLUG
-config MEMORY_HOTPLUG_DEFAULT_ONLINE
- bool "Online the newly added memory blocks by default"
- depends on MEMORY_HOTPLUG
+choice
+ prompt "Memory Hotplug Default Online Type"
+ default MHP_DEFAULT_ONLINE_TYPE_OFFLINE
help
+ Default memory type for hotplugged memory.
+
This option sets the default policy setting for memory hotplug
onlining policy (/sys/devices/system/memory/auto_online_blocks) which
determines what happens to newly added memory regions. Policy setting
can always be changed at runtime.
+
+ The default is 'offline'.
+
+ Select offline to defer onlining to drivers and user policy.
+ Select auto to let the kernel choose what zones to utilize.
+ Select online_kernel to generally allow kernel usage of this memory.
+ Select online_movable to generally disallow kernel usage of this memory.
+
+ Example kernel usage would be page structs and page tables.
+
See Documentation/admin-guide/mm/memory-hotplug.rst for more information.
- Say Y here if you want all hot-plugged memory blocks to appear in
- 'online' state by default.
- Say N here if you want the default policy to keep all hot-plugged
- memory blocks in 'offline' state.
+config MHP_DEFAULT_ONLINE_TYPE_OFFLINE
+ bool "offline"
+ help
+ Hotplugged memory will not be onlined by default.
+ Choose this for systems with drivers and user policy that
+ handle onlining of hotplug memory policy.
+
+config MHP_DEFAULT_ONLINE_TYPE_ONLINE_AUTO
+ bool "auto"
+ help
+ Select this if you want the kernel to automatically online
+ hotplugged memory into the zone it thinks is reasonable.
+ This memory may be utilized for kernel data.
+
+config MHP_DEFAULT_ONLINE_TYPE_ONLINE_KERNEL
+ bool "kernel"
+ help
+ Select this if you want the kernel to automatically online
+ hotplugged memory into a zone capable of being used for kernel
+ data. This typically means ZONE_NORMAL.
+
+config MHP_DEFAULT_ONLINE_TYPE_ONLINE_MOVABLE
+ bool "movable"
+ help
+ Select this if you want the kernel to automatically online
+ hotplug memory into ZONE_MOVABLE. This memory will generally
+ not be utilized for kernel data.
+
+ This should only be used when the admin knows sufficient
+ ZONE_NORMAL memory is available to describe hotplug memory,
+ otherwise hotplug memory may fail to online. For example,
+ sufficient kernel-capable memory (ZONE_NORMAL) must be
+ available to allocate page structs to describe ZONE_MOVABLE.
+
+endchoice
config MEMORY_HOTREMOVE
bool "Allow for memory hot remove"
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 9479cb19cecf2..6426be4d82995 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -219,11 +219,30 @@ void put_online_mems(void)
bool movable_node_enabled = false;
-#ifndef CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE
-int mhp_default_online_type = MMOP_OFFLINE;
-#else
-int mhp_default_online_type = MMOP_ONLINE;
-#endif
+static int mhp_default_online_type = -1;
+int mhp_get_default_online_type(void)
+{
+ if (mhp_default_online_type >= 0)
+ return mhp_default_online_type;
+
+ if (IS_ENABLED(CONFIG_MHP_DEFAULT_ONLINE_TYPE_OFFLINE))
+ mhp_default_online_type = MMOP_OFFLINE;
+ else if (IS_ENABLED(CONFIG_MHP_DEFAULT_ONLINE_TYPE_ONLINE_AUTO))
+ mhp_default_online_type = MMOP_ONLINE;
+ else if (IS_ENABLED(CONFIG_MHP_DEFAULT_ONLINE_TYPE_ONLINE_KERNEL))
+ mhp_default_online_type = MMOP_ONLINE_KERNEL;
+ else if (IS_ENABLED(CONFIG_MHP_DEFAULT_ONLINE_TYPE_ONLINE_MOVABLE))
+ mhp_default_online_type = MMOP_ONLINE_MOVABLE;
+ else
+ mhp_default_online_type = MMOP_OFFLINE;
+
+ return mhp_default_online_type;
+}
+
+void mhp_set_default_online_type(int online_type)
+{
+ mhp_default_online_type = online_type;
+}
static int __init setup_memhp_default_state(char *str)
{
@@ -1321,7 +1340,7 @@ static int check_hotplug_memory_range(u64 start, u64 size)
static int online_memory_block(struct memory_block *mem, void *arg)
{
- mem->online_type = mhp_default_online_type;
+ mem->online_type = mhp_get_default_online_type();
return device_online(&mem->dev);
}
@@ -1570,7 +1589,7 @@ int add_memory_resource(int nid, struct resource *res, mhp_t mhp_flags)
merge_system_ram_resource(res);
/* online pages if requested */
- if (mhp_default_online_type != MMOP_OFFLINE)
+ if (mhp_get_default_online_type() != MMOP_OFFLINE)
walk_memory_blocks(start, size, NULL, online_memory_block);
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0382/1376] mm: convert memory block states (MEM_*) macros to enum
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (380 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0381/1376] mm: add build-time option for hotplug memory default online type Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0383/1376] mm: change type of state in struct memory_block Greg Kroah-Hartman
` (616 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Israel Batista, David Hildenbrand,
Mike Rapoport (Microsoft), Lorenzo Stoakes, Omar Sandoval,
Randy Dunlap, Andrew Morton, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Israel Batista <linux@israelbatista.dev.br>
[ Upstream commit 1a4f70f6851a1916c4f0e52731c7ecfe99bf36e6 ]
Patch series "mm: Convert memory block states (MEM_*) macros to enums", v2.
The MEM_* constants indicating the state of a memory block are currently
defined as macros, meaning their definitions will be omitted from the
debuginfo on most kernel builds. This makes it harder for debuggers to
correctly map the block state at runtime, which can be quite useful when
analysing errors related to memory hot plugging and unplugging with tools
such as drgn.
Converting the constants to an enum ensures the correct information is
emitted by the compiler and available for the debugger, without needing to
hard-code them into the debugger and track their changes.
This patch series aims to replace the current macros with a newly created
enum named memory_block_state, while also taking advantage of the compile
time guarantees that we get when using enums.
The first patch does the conversion of the macros to an enum, while the
2nd and 3rd patches use this enum to clean up some type declarations and
make sure that only valid values are used.
This patch (of 3):
Converting the MEM_* constants from macros to an enum ensures that their
values will be correctly emitted in the debug symbols, making it easier to
trace the meaning of each value when debugging with tools such as drgn,
without the need to hard-code the values.
Since the values are mutually exclusive and they are not exposed directly
to userspace, I also dropped the misleading pattern (1<<X) that made it
look like they were combinable flags.
Link: https://lkml.kernel.org/r/20251029195617.2210700-1-linux@israelbatista.dev.br
Link: https://lkml.kernel.org/r/20251029195617.2210700-2-linux@israelbatista.dev.br
Signed-off-by: Israel Batista <linux@israelbatista.dev.br>
Acked-by: David Hildenbrand <david@redhat.com>
Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Omar Sandoval <osandov@osandov.com>
Cc: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Stable-dep-of: 2ebce860bdd7 ("mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/memory.h | 22 ++++++++++++----------
1 file changed, 12 insertions(+), 10 deletions(-)
diff --git a/include/linux/memory.h b/include/linux/memory.h
index c0afee5d126ef..4b9be8afdc849 100644
--- a/include/linux/memory.h
+++ b/include/linux/memory.h
@@ -64,6 +64,18 @@ struct memory_group {
};
};
+enum memory_block_state {
+ /* These states are exposed to userspace as text strings in sysfs */
+ MEM_ONLINE, /* exposed to userspace */
+ MEM_GOING_OFFLINE, /* exposed to userspace */
+ MEM_OFFLINE, /* exposed to userspace */
+ MEM_GOING_ONLINE,
+ MEM_CANCEL_ONLINE,
+ MEM_CANCEL_OFFLINE,
+ MEM_PREPARE_ONLINE,
+ MEM_FINISH_OFFLINE,
+};
+
struct memory_block {
unsigned long start_section_nr;
unsigned long state; /* serialized by the dev->lock */
@@ -89,16 +101,6 @@ int arch_get_memory_phys_device(unsigned long start_pfn);
unsigned long memory_block_size_bytes(void);
int set_memory_block_size_order(unsigned int order);
-/* These states are exposed to userspace as text strings in sysfs */
-#define MEM_ONLINE (1<<0) /* exposed to userspace */
-#define MEM_GOING_OFFLINE (1<<1) /* exposed to userspace */
-#define MEM_OFFLINE (1<<2) /* exposed to userspace */
-#define MEM_GOING_ONLINE (1<<3)
-#define MEM_CANCEL_ONLINE (1<<4)
-#define MEM_CANCEL_OFFLINE (1<<5)
-#define MEM_PREPARE_ONLINE (1<<6)
-#define MEM_FINISH_OFFLINE (1<<7)
-
struct memory_notify {
/*
* The altmap_start_pfn and altmap_nr_pages fields are designated for
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0383/1376] mm: change type of state in struct memory_block
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (381 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0382/1376] mm: convert memory block states (MEM_*) macros to enum Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0384/1376] mm: name the anonymous MMOP enum as enum mmop Greg Kroah-Hartman
` (615 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Israel Batista, David Hildenbrand,
Mike Rapoport (Microsoft), Lorenzo Stoakes, Omar Sandoval,
Randy Dunlap, Andrew Morton, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Israel Batista <linux@israelbatista.dev.br>
[ Upstream commit 8bc7ba3d265d6ee698de4b1941b7e8f7d91a0562 ]
The state of a memory block should be restricted to values specified in
the documentation of the memory hotplug API. However, since the state
field in the memory_block struct was defined as an unsigned long, this
restriction was not enforced at compile time.
With the introduction of the enum memory_block_state, it is now possible
to incorporate the desired semantics in the field declaration and enforce
these restrictions at compile time.
[akpm@linux-foundation.org: fix whitespace, per Randy]
Link: https://lkml.kernel.org/r/20251029195617.2210700-3-linux@israelbatista.dev.br
Signed-off-by: Israel Batista <linux@israelbatista.dev.br>
Acked-by: David Hildenbrand <david@redhat.com>
Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Omar Sandoval <osandov@osandov.com>
Cc: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Stable-dep-of: 2ebce860bdd7 ("mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/memory.c | 2 +-
include/linux/memory.h | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/base/memory.c b/drivers/base/memory.c
index 354bf9fd857d4..cd1e6e15bb719 100644
--- a/drivers/base/memory.c
+++ b/drivers/base/memory.c
@@ -160,7 +160,7 @@ static ssize_t state_show(struct device *dev, struct device_attribute *attr,
break;
default:
WARN_ON(1);
- return sysfs_emit(buf, "ERROR-UNKNOWN-%ld\n", mem->state);
+ return sysfs_emit(buf, "ERROR-UNKNOWN-%d\n", mem->state);
}
return sysfs_emit(buf, "%s\n", output);
diff --git a/include/linux/memory.h b/include/linux/memory.h
index 4b9be8afdc849..a334f1382b21d 100644
--- a/include/linux/memory.h
+++ b/include/linux/memory.h
@@ -78,7 +78,7 @@ enum memory_block_state {
struct memory_block {
unsigned long start_section_nr;
- unsigned long state; /* serialized by the dev->lock */
+ enum memory_block_state state; /* serialized by the dev->lock */
int online_type; /* for passing data to online routine */
int nid; /* NID for this memory block */
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0384/1376] mm: name the anonymous MMOP enum as enum mmop
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (382 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0383/1376] mm: change type of state in struct memory_block Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0385/1376] mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug Greg Kroah-Hartman
` (614 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gregory Price, Jonathan Cameron,
David Hildenbrand (arm), Ben Cheatham, Dave Jiang,
Davidlohr Bueso, Danilo Krummrich, Liam Howlett, Lorenzo Stoakes,
Michal Hocko, Mike Rapoport, Oscar Salvador, Suren Baghdasaryan,
Vlastimil Babka, Andrew Morton, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory Price <gourry@gourry.net>
[ Upstream commit c5c48345135ff04e039377020df23294d59aa59a ]
Give the MMOP enum (MMOP_OFFLINE, MMOP_ONLINE, etc) a proper type name so
the compiler can help catch invalid values being assigned to variables of
this type.
Leave the existing functions returning int alone to allow for
value-or-error pattern to remain unchanged without churn.
mmop_default_online_type is left as int because it uses the -1 sentinal
value to signal it hasn't been initialized yet.
Keep the uint8_t buffer in offline_and_remove_memory() as-is for space
efficiency, with an explicit cast when we consume the value.
Move the enum definition before the CONFIG_MEMORY_HOTPLUG guard so it is
unconditionally available for struct memory_block in memory.h.
No functional change.
Link: https://lore.kernel.org/linux-mm/3424eba7-523b-4351-abd0-3a888a3e5e61@kernel.org/
Link: https://lkml.kernel.org/r/20260211215447.2194189-1-gourry@gourry.net
Signed-off-by: Gregory Price <gourry@gourry.net>
Suggested-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Suggested-by: "David Hildenbrand (arm)" <david@kernel.org>
Reviewed-by: Ben Cheatham <benjamin.cheatham@amd.com>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Davidlohr Bueso <dave@stgolabs.net>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Cc: Danilo Krummrich <dakr@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Stable-dep-of: 2ebce860bdd7 ("mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/memory.c | 2 +-
include/linux/memory.h | 3 ++-
include/linux/memory_hotplug.h | 16 ++++++++--------
mm/memory_hotplug.c | 10 +++++-----
4 files changed, 16 insertions(+), 15 deletions(-)
diff --git a/drivers/base/memory.c b/drivers/base/memory.c
index cd1e6e15bb719..889e653781453 100644
--- a/drivers/base/memory.c
+++ b/drivers/base/memory.c
@@ -435,7 +435,7 @@ static ssize_t phys_device_show(struct device *dev,
static int print_allowed_zone(char *buf, int len, int nid,
struct memory_group *group,
unsigned long start_pfn, unsigned long nr_pages,
- int online_type, struct zone *default_zone)
+ enum mmop online_type, struct zone *default_zone)
{
struct zone *zone;
diff --git a/include/linux/memory.h b/include/linux/memory.h
index a334f1382b21d..f6109556ed105 100644
--- a/include/linux/memory.h
+++ b/include/linux/memory.h
@@ -19,6 +19,7 @@
#include <linux/node.h>
#include <linux/compiler.h>
#include <linux/mutex.h>
+#include <linux/memory_hotplug.h>
#define MIN_MEMORY_BLOCK_SIZE (1UL << SECTION_SIZE_BITS)
@@ -79,7 +80,7 @@ enum memory_block_state {
struct memory_block {
unsigned long start_section_nr;
enum memory_block_state state; /* serialized by the dev->lock */
- int online_type; /* for passing data to online routine */
+ enum mmop online_type; /* for passing data to online routine */
int nid; /* NID for this memory block */
/*
* The single zone of this memory block if all PFNs of this memory block
diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h
index 0cbf14756d129..1b6b9ed7887db 100644
--- a/include/linux/memory_hotplug.h
+++ b/include/linux/memory_hotplug.h
@@ -16,11 +16,8 @@ struct resource;
struct vmem_altmap;
struct dev_pagemap;
-#ifdef CONFIG_MEMORY_HOTPLUG
-struct page *pfn_to_online_page(unsigned long pfn);
-
/* Types for control the zone type of onlined and offlined memory */
-enum {
+enum mmop {
/* Offline the memory. */
MMOP_OFFLINE = 0,
/* Online the memory. Zone depends, see default_zone_for_pfn(). */
@@ -31,6 +28,9 @@ enum {
MMOP_ONLINE_MOVABLE,
};
+#ifdef CONFIG_MEMORY_HOTPLUG
+struct page *pfn_to_online_page(unsigned long pfn);
+
/* Flags for add_memory() and friends to specify memory hotplug details. */
typedef int __bitwise mhp_t;
@@ -303,8 +303,8 @@ static inline void __remove_memory(u64 start, u64 size) {}
#ifdef CONFIG_MEMORY_HOTPLUG
/* Default online_type (MMOP_*) when new memory blocks are added. */
-extern int mhp_get_default_online_type(void);
-extern void mhp_set_default_online_type(int online_type);
+extern enum mmop mhp_get_default_online_type(void);
+extern void mhp_set_default_online_type(enum mmop online_type);
extern void __ref free_area_init_core_hotplug(struct pglist_data *pgdat);
extern int __add_memory(int nid, u64 start, u64 size, mhp_t mhp_flags);
extern int add_memory(int nid, u64 start, u64 size, mhp_t mhp_flags);
@@ -327,8 +327,8 @@ extern void sparse_remove_section(unsigned long pfn, unsigned long nr_pages,
struct dev_pagemap *pgmap);
extern struct page *sparse_decode_mem_map(unsigned long coded_mem_map,
unsigned long pnum);
-extern struct zone *zone_for_pfn_range(int online_type, int nid,
- struct memory_group *group, unsigned long start_pfn,
+extern struct zone *zone_for_pfn_range(enum mmop online_type,
+ int nid, struct memory_group *group, unsigned long start_pfn,
unsigned long nr_pages);
extern int arch_create_linear_mapping(int nid, u64 start, u64 size,
struct mhp_params *params);
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 6426be4d82995..4d764f4ec213b 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -220,7 +220,7 @@ void put_online_mems(void)
bool movable_node_enabled = false;
static int mhp_default_online_type = -1;
-int mhp_get_default_online_type(void)
+enum mmop mhp_get_default_online_type(void)
{
if (mhp_default_online_type >= 0)
return mhp_default_online_type;
@@ -239,7 +239,7 @@ int mhp_get_default_online_type(void)
return mhp_default_online_type;
}
-void mhp_set_default_online_type(int online_type)
+void mhp_set_default_online_type(enum mmop online_type)
{
mhp_default_online_type = online_type;
}
@@ -1060,7 +1060,7 @@ static inline struct zone *default_zone_for_pfn(int nid, unsigned long start_pfn
return movable_node_enabled ? movable_zone : kernel_zone;
}
-struct zone *zone_for_pfn_range(int online_type, int nid,
+struct zone *zone_for_pfn_range(enum mmop online_type, int nid,
struct memory_group *group, unsigned long start_pfn,
unsigned long nr_pages)
{
@@ -2349,7 +2349,7 @@ EXPORT_SYMBOL_GPL(remove_memory);
static int try_offline_memory_block(struct memory_block *mem, void *arg)
{
- uint8_t online_type = MMOP_ONLINE_KERNEL;
+ enum mmop online_type = MMOP_ONLINE_KERNEL;
uint8_t **online_types = arg;
struct page *page;
int rc;
@@ -2382,7 +2382,7 @@ static int try_reonline_memory_block(struct memory_block *mem, void *arg)
int rc;
if (**online_types != MMOP_OFFLINE) {
- mem->online_type = **online_types;
+ mem->online_type = (enum mmop)**online_types;
rc = device_online(&mem->dev);
if (rc < 0)
pr_warn("%s: Failed to re-online memory: %d",
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0385/1376] mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (383 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0384/1376] mm: name the anonymous MMOP enum as enum mmop Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0386/1376] dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure Greg Kroah-Hartman
` (613 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Gregory Price,
David Hildenbrand (Arm), Mike Rapoport (Microsoft), Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory Price <gourry@gourry.net>
[ Upstream commit 2ebce860bdd7ae5e13002811bc9bbbf33fcfc221 ]
We miss a failed allocation check for pgdat->per_cpu_nodestats, which
results in a NULL deref when we offset into the per-cpu area.
Propagate -ENOMEM up the stack and leave per_cpu_nodestats pointing
at boot_nodestats so a later online can retry the allocation.
hotadd_init_pgdat() returns NULL on failure, which __try_online_node()
already maps to -ENOMEM.
On failure nothing needs to be unwound:
- the node is never marked online
- per_cpu_nodestats is left pointing at boot_nodestats
- __add_memory_resource() cleans up pending memblock resources
- later online attempts retry the per_cpu_nodestats allocation
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/patchset/20260627202243.758289-1-gourry%40gourry.net
Fixes: 75ef71840539 ("mm, vmstat: add infrastructure for per-node vmstats")
Signed-off-by: Gregory Price <gourry@gourry.net>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Link: https://patch.msgid.link/20260701221613.2818148-1-gourry@gourry.net
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/memory_hotplug.h | 2 +-
mm/memory_hotplug.c | 3 ++-
mm/mm_init.c | 14 +++++++++++---
3 files changed, 14 insertions(+), 5 deletions(-)
diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h
index 1b6b9ed7887db..d93a70c112ee8 100644
--- a/include/linux/memory_hotplug.h
+++ b/include/linux/memory_hotplug.h
@@ -305,7 +305,7 @@ static inline void __remove_memory(u64 start, u64 size) {}
/* Default online_type (MMOP_*) when new memory blocks are added. */
extern enum mmop mhp_get_default_online_type(void);
extern void mhp_set_default_online_type(enum mmop online_type);
-extern void __ref free_area_init_core_hotplug(struct pglist_data *pgdat);
+int __ref free_area_init_core_hotplug(struct pglist_data *pgdat);
extern int __add_memory(int nid, u64 start, u64 size, mhp_t mhp_flags);
extern int add_memory(int nid, u64 start, u64 size, mhp_t mhp_flags);
extern int add_memory_resource(int nid, struct resource *resource,
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 4d764f4ec213b..e21f59cf29d9f 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1266,7 +1266,8 @@ static pg_data_t *hotadd_init_pgdat(int nid)
pgdat = NODE_DATA(nid);
/* init node's zones as empty zones, we don't have any present pages.*/
- free_area_init_core_hotplug(pgdat);
+ if (free_area_init_core_hotplug(pgdat))
+ return NULL;
/*
* The node we allocated has no zone fallback lists. For avoiding
diff --git a/mm/mm_init.c b/mm/mm_init.c
index c8ac7f206f941..65f997ddd740d 100644
--- a/mm/mm_init.c
+++ b/mm/mm_init.c
@@ -1519,7 +1519,7 @@ void __init set_pageblock_order(void)
* NOTE: this function is only called during memory hotplug
*/
#ifdef CONFIG_MEMORY_HOTPLUG
-void __ref free_area_init_core_hotplug(struct pglist_data *pgdat)
+int __ref free_area_init_core_hotplug(struct pglist_data *pgdat)
{
int nid = pgdat->node_id;
enum zone_type z;
@@ -1527,8 +1527,14 @@ void __ref free_area_init_core_hotplug(struct pglist_data *pgdat)
pgdat_init_internals(pgdat);
- if (pgdat->per_cpu_nodestats == &boot_nodestats)
- pgdat->per_cpu_nodestats = alloc_percpu(struct per_cpu_nodestat);
+ if (pgdat->per_cpu_nodestats == &boot_nodestats) {
+ struct per_cpu_nodestat __percpu *p;
+
+ p = alloc_percpu(struct per_cpu_nodestat);
+ if (!p)
+ return -ENOMEM;
+ pgdat->per_cpu_nodestats = p;
+ }
/*
* Reset the nr_zones, order and highest_zoneidx before reuse.
@@ -1566,6 +1572,8 @@ void __ref free_area_init_core_hotplug(struct pglist_data *pgdat)
zone->present_pages = 0;
zone_init_internals(zone, z, nid, 0);
}
+
+ return 0;
}
#endif
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0386/1376] dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (384 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0385/1376] mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0387/1376] dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers Greg Kroah-Hartman
` (612 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladimir Zapolskiy,
AngeloGioacchino Del Regno, Frank Li, Matthias Brugger,
Vinod Koul, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <vz@kernel.org>
[ Upstream commit 467265c750edd7ab43803deeafe7d3120a791d32 ]
If dynamic memory allocation in driver's probe function execution fails, it
should be reported to the driver's framework with -ENOMEM error code.
Fixes: 9135408c3ace ("dmaengine: mediatek: Add MediaTek UART APDMA support")
Signed-off-by: Vladimir Zapolskiy <vz@kernel.org>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
Link: https://patch.msgid.link/20260701200703.117929-1-vz@kernel.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/mediatek/mtk-uart-apdma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dma/mediatek/mtk-uart-apdma.c b/drivers/dma/mediatek/mtk-uart-apdma.c
index 3e7f8acf41dd0..0c439e85c46d0 100644
--- a/drivers/dma/mediatek/mtk-uart-apdma.c
+++ b/drivers/dma/mediatek/mtk-uart-apdma.c
@@ -530,7 +530,7 @@ static int mtk_uart_apdma_probe(struct platform_device *pdev)
for (i = 0; i < mtkd->dma_requests; i++) {
c = devm_kzalloc(mtkd->ddev.dev, sizeof(*c), GFP_KERNEL);
if (!c) {
- rc = -ENODEV;
+ rc = -ENOMEM;
goto err_no_dma;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0387/1376] dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (385 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0386/1376] dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0388/1376] dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe Greg Kroah-Hartman
` (611 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Folker Schwesinger, Suraj Gupta,
Srinivas Neeli, Radhey Shyam Pandey, Vinod Koul, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suraj Gupta <suraj.gupta2@amd.com>
[ Upstream commit 0b6d055edb55ecadadf54e930c2b4fab76fa9a5a ]
Fix a race condition in AXIDMA and MCDMA irq handlers where the channel
could be incorrectly marked as idle and attempt spurious transfers when
descriptors are still being processed.
The issue occurs when:
1. Multiple descriptors are queued and active.
2. An interrupt fires after completing some descriptors.
3. xilinx_dma_complete_descriptor() moves completed descriptors to
done_list.
4. Channel is marked idle and start_transfer() is called even though
active_list still contains unprocessed descriptors.
5. This leads to premature transfer attempts and potential descriptor
corruption or missed completions.
Only mark the channel as idle and start new transfers when the active list
is actually empty, ensuring proper channel state management and avoiding
spurious transfer attempts.
Fixes: c0bba3a99f07 ("dmaengine: vdma: Add Support for Xilinx AXI Direct Memory Access Engine")
Tested-by: Folker Schwesinger <dev@folker-schwesinger.de>
Signed-off-by: Suraj Gupta <suraj.gupta2@amd.com>
Co-developed-by: Srinivas Neeli <srinivas.neeli@amd.com>
Signed-off-by: Srinivas Neeli <srinivas.neeli@amd.com>
Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
Link: https://patch.msgid.link/20260626092656.1563871-2-suraj.gupta2@amd.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/xilinx/xilinx_dma.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
index a0361bcee1201..bea55dc99673b 100644
--- a/drivers/dma/xilinx/xilinx_dma.c
+++ b/drivers/dma/xilinx/xilinx_dma.c
@@ -1869,8 +1869,10 @@ static irqreturn_t xilinx_mcdma_irq_handler(int irq, void *data)
if (status & XILINX_MCDMA_IRQ_IOC_MASK) {
spin_lock(&chan->lock);
xilinx_dma_complete_descriptor(chan);
- chan->idle = true;
- chan->start_transfer(chan);
+ if (list_empty(&chan->active_list)) {
+ chan->idle = true;
+ chan->start_transfer(chan);
+ }
spin_unlock(&chan->lock);
}
@@ -1926,8 +1928,10 @@ static irqreturn_t xilinx_dma_irq_handler(int irq, void *data)
XILINX_DMA_DMASR_DLY_CNT_IRQ)) {
spin_lock(&chan->lock);
xilinx_dma_complete_descriptor(chan);
- chan->idle = true;
- chan->start_transfer(chan);
+ if (list_empty(&chan->active_list)) {
+ chan->idle = true;
+ chan->start_transfer(chan);
+ }
spin_unlock(&chan->lock);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0388/1376] dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (386 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0387/1376] dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0389/1376] soundwire: qcom: Fix port exhaustion check in stream_alloc_ports Greg Kroah-Hartman
` (610 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladimir Zapolskiy, Frank Li,
Vinod Koul, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <vz@kernel.org>
[ Upstream commit cbabdd6ce1b313b5877c7fbb2f5e2f7936564d2f ]
Out of memory situation on driver's probe is expected to be reported to
the driver's framework with a proper -ENOMEM error code.
Fixes: e9f08b65250d ("dmaengine: hisilicon: Add Kunpeng DMA engine support")
Signed-off-by: Vladimir Zapolskiy <vz@kernel.org>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260630144214.4080302-1-vz@kernel.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/hisi_dma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dma/hisi_dma.c b/drivers/dma/hisi_dma.c
index 25a4134be36b7..ede094e0d0905 100644
--- a/drivers/dma/hisi_dma.c
+++ b/drivers/dma/hisi_dma.c
@@ -983,7 +983,7 @@ static int hisi_dma_probe(struct pci_dev *pdev, const struct pci_device_id *id)
hdma_dev = devm_kzalloc(dev, struct_size(hdma_dev, chan, chan_num),
GFP_KERNEL);
if (!hdma_dev)
- return -EINVAL;
+ return -ENOMEM;
hdma_dev->base = pcim_iomap_table(pdev)[PCI_BAR_2];
hdma_dev->pdev = pdev;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0389/1376] soundwire: qcom: Fix port exhaustion check in stream_alloc_ports
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (387 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0388/1376] dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0390/1376] iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure Greg Kroah-Hartman
` (609 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Srinivas Kandagatla,
Vinod Koul, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
[ Upstream commit 6ccec91c3535b07310e12d32fe9c67ff8d31d965 ]
find_first_zero_bit(mask, n) returns n (not n+1) when all bits are set,
so the guard `pn > maxport` is never true on exhaustion. The driver
would silently call set_bit(maxport, port_mask) and assign the
out-of-range port instead of returning -EBUSY. Fix the comparison to
`pn >= maxport`.
Fixes: 02efb49aa805 ("soundwire: qcom: add support for SoundWire controller")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Assisted-by: Claude Sonnet 4.6
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Link: https://patch.msgid.link/20260701193006.4113-2-srinivas.kandagatla@oss.qualcomm.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soundwire/qcom.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/soundwire/qcom.c b/drivers/soundwire/qcom.c
index aed57002fd0e6..db7c8fb04f117 100644
--- a/drivers/soundwire/qcom.c
+++ b/drivers/soundwire/qcom.c
@@ -1204,7 +1204,7 @@ static int qcom_swrm_stream_alloc_ports(struct qcom_swrm_ctrl *ctrl,
else
pn = find_first_zero_bit(port_mask, maxport);
- if (pn > maxport) {
+ if (pn >= maxport) {
dev_err(ctrl->dev, "All ports busy\n");
ret = -EBUSY;
goto out;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0390/1376] iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (388 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0389/1376] soundwire: qcom: Fix port exhaustion check in stream_alloc_ports Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0391/1376] csky: Fix a4/a5 restoration in syscall trace path Greg Kroah-Hartman
` (608 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sanjay Chitroda, Andy Shevchenko,
Srinivas Pandruvada, Jonathan Cameron, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanjay Chitroda <sanjayembeddedse@gmail.com>
[ Upstream commit 0e32649a7cf3cd784862f8dc0c68a5134731bfff ]
The driver currently exposes the IIO device to userspace before
completing sensor hub callback registration, and similarly removes
callbacks while the device can still be accessed during teardown.
This creates a timing window where userspace may enable the buffer
before callbacks are available. In such cases:
- samples can be dropped,
- buffered reads may observe stale or no data.
Reorder probe and remove paths to ensure callbacks are active before
device exposure and are removed after device is no longer accessible.
This avoids a race window leading to data loss.
Signed-off-by: Sanjay Chitroda <sanjayembeddedse@gmail.com>
Fixes: fc18dddc0625 ("iio: hid-sensors: Added device rotation support")
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/orientation/hid-sensor-rotation.c | 20 +++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
diff --git a/drivers/iio/orientation/hid-sensor-rotation.c b/drivers/iio/orientation/hid-sensor-rotation.c
index a0cf5d2a87fba..2ee34e677aa92 100644
--- a/drivers/iio/orientation/hid-sensor-rotation.c
+++ b/drivers/iio/orientation/hid-sensor-rotation.c
@@ -337,12 +337,6 @@ static int hid_dev_rot_probe(struct platform_device *pdev)
return ret;
}
- ret = iio_device_register(indio_dev);
- if (ret) {
- dev_err(&pdev->dev, "device register failed\n");
- goto error_remove_trigger;
- }
-
rot_state->callbacks.send_event = dev_rot_proc_event;
rot_state->callbacks.capture_sample = dev_rot_capture_sample;
rot_state->callbacks.pdev = pdev;
@@ -350,13 +344,19 @@ static int hid_dev_rot_probe(struct platform_device *pdev)
&rot_state->callbacks);
if (ret) {
dev_err(&pdev->dev, "callback reg failed\n");
- goto error_iio_unreg;
+ goto error_remove_trigger;
+ }
+
+ ret = iio_device_register(indio_dev);
+ if (ret) {
+ dev_err(&pdev->dev, "device register failed\n");
+ goto error_remove_callback;
}
return 0;
-error_iio_unreg:
- iio_device_unregister(indio_dev);
+error_remove_callback:
+ sensor_hub_remove_callback(hsdev, hsdev->usage);
error_remove_trigger:
hid_sensor_remove_trigger(indio_dev, &rot_state->common_attributes);
return ret;
@@ -369,8 +369,8 @@ static void hid_dev_rot_remove(struct platform_device *pdev)
struct iio_dev *indio_dev = platform_get_drvdata(pdev);
struct dev_rot_state *rot_state = iio_priv(indio_dev);
- sensor_hub_remove_callback(hsdev, hsdev->usage);
iio_device_unregister(indio_dev);
+ sensor_hub_remove_callback(hsdev, hsdev->usage);
hid_sensor_remove_trigger(indio_dev, &rot_state->common_attributes);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0391/1376] csky: Fix a4/a5 restoration in syscall trace path
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (389 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0390/1376] iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0392/1376] selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check Greg Kroah-Hartman
` (607 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guo Ren, Hanlin Song, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hanlin Song <pgeorge8929@gmail.com>
[ Upstream commit abb81e5ce7d995baa41556b8125fa59e28ba3be8 ]
The syscall trace path reloads syscall arguments from pt_regs before
calling the syscall handler. On C-SKY ABIv2, the 5th and 6th syscall
arguments are prepared as stack arguments before invoking syscallid.
The current code adjusts sp before loading LSAVE_A4 and LSAVE_A5. Since
those offsets are relative to the original pt_regs base, loading them
after changing sp fetches the wrong slots. As a result, traced syscalls
that use the 5th or 6th argument may receive corrupted arguments.
This is visible with mmap2(), which takes six arguments. A small
PTRACE_SYSCALL reproducer opens a file and maps one page with:
mmap(NULL, 4096, PROT_READ | PROT_EXEC, MAP_PRIVATE, fd, 0)
Before the fix, the traced child fails the mmap and exits with 12.
After the fix, the mapping succeeds and the child exits with 0.
Fix the trace path by loading a4/a5 from pt_regs before changing sp.
Tested on: ck860f, linux-4.19.15, C-SKY abiv2
Fixes: e0bbb53843b5 ("csky: Fixup abiv2 syscall_trace break a4 & a5")
Suggested-by: Guo Ren <guoren@kernel.org>
Signed-off-by: Hanlin Song <pgeorge8929@gmail.com>
Signed-off-by: Guo Ren (Alibaba DAMO Academy) <guoren@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/csky/kernel/entry.S | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/csky/kernel/entry.S b/arch/csky/kernel/entry.S
index c68cdcc76d60e..3261f46f22442 100644
--- a/arch/csky/kernel/entry.S
+++ b/arch/csky/kernel/entry.S
@@ -93,11 +93,11 @@ csky_syscall_trace:
ldw a2, (sp, LSAVE_A2)
ldw a3, (sp, LSAVE_A3)
#if defined(__CSKYABIV2__)
- subi sp, 8
ldw r9, (sp, LSAVE_A4)
+ ldw r10, (sp, LSAVE_A5)
+ subi sp, 8
stw r9, (sp, 0x0)
- ldw r9, (sp, LSAVE_A5)
- stw r9, (sp, 0x4)
+ stw r10, (sp, 0x4)
jsr syscallid /* Do system call */
addi sp, 8
#else
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0392/1376] selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (390 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0391/1376] csky: Fix a4/a5 restoration in syscall trace path Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0393/1376] platform/chrome: sensorhub: Fix memory overread in ring handler Greg Kroah-Hartman
` (606 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hisam Mehboob, Thomas Gleixner,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hisam Mehboob <hisamshar@gmail.com>
[ Upstream commit d7b2769f8dba3e5f40d2a8a11988812d51160b17 ]
Building the rseq selftests against musl libc fails because musl's
<features.h> does not provide the glibc-specific __GNUC_PREREQ macro:
error: missing binary operator before token '('
Replace __GNUC_PREREQ(11, 1) with an equivalent check using __GNUC__
and __GNUC_MINOR__ directly. This pattern is portable across all C
library implementations and is already used elsewhere in the tools/
tree (e.g., tools/include/linux/string.h).
This also allows removing the #include <features.h>, which was only
needed for __GNUC_PREREQ.
Fixes: 886ddfba933f ("selftests/rseq: Introduce thread pointer getters")
Signed-off-by: Hisam Mehboob <hisamshar@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260618193724.589113-2-hisamshar@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/rseq/rseq-x86-thread-pointer.h | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/tools/testing/selftests/rseq/rseq-x86-thread-pointer.h b/tools/testing/selftests/rseq/rseq-x86-thread-pointer.h
index d3133587d9968..5a29d6bec51f4 100644
--- a/tools/testing/selftests/rseq/rseq-x86-thread-pointer.h
+++ b/tools/testing/selftests/rseq/rseq-x86-thread-pointer.h
@@ -8,13 +8,11 @@
#ifndef _RSEQ_X86_THREAD_POINTER
#define _RSEQ_X86_THREAD_POINTER
-#include <features.h>
-
#ifdef __cplusplus
extern "C" {
#endif
-#if __GNUC_PREREQ (11, 1)
+#if __GNUC__ > 11 || (__GNUC__ == 11 && __GNUC_MINOR__ >= 1)
static inline void *rseq_thread_pointer(void)
{
return __builtin_thread_pointer();
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0393/1376] platform/chrome: sensorhub: Fix memory overread in ring handler
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (391 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0392/1376] selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check Greg Kroah-Hartman
@ 2026-09-12 6:46 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0394/1376] wifi: rtw89: fix HE extended capability length check Greg Kroah-Hartman
` (605 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tomasz Figa, Tzung-Bi Shih,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tzung-Bi Shih <tzungbi@kernel.org>
[ Upstream commit d1ceb2b2324717fa30b44d56ef0c52813e239569 ]
`max_response` and `sensor_num` are read from different EC commands:
- `max_response` is from cros_ec_get_proto_info().
ec_dev->max_response = info->max_response_packet_size -
sizeof(struct ec_host_response);
- `sensor_num` is from cros_ec_get_sensor_count().
sensor_num = cros_ec_get_sensor_count(ec);
With a malfunctioning EC firmware, it is possible that the `msg->insize`
(i.e., `fifo_info_length` in the context) could be clamped in
cros_ec_cmd_xfer() because `msg->insize` is greater than `max_response`.
int fifo_info_length =
sizeof(struct ec_response_motion_sense_fifo_info) +
sizeof(u16) * sensorhub->sensor_num;
This means the number of read bytes could be less than expected. As a
result, the subsequent memcpy() in cros_ec_sensorhub_ring_handler()
overreads the `resp->fifo_info` buffer.
Check the return value of cros_ec_cmd_xfer_status() and abort if the
number of bytes read does not match the expected length.
Fixes: 145d59baff59 ("platform/chrome: cros_ec_sensorhub: Add FIFO support")
Reviewed-by: Tomasz Figa <tfiga@chromium.org>
Link: https://lore.kernel.org/r/20260702082745.1014968-1-tzungbi@kernel.org
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/chrome/cros_ec_sensorhub_ring.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/platform/chrome/cros_ec_sensorhub_ring.c b/drivers/platform/chrome/cros_ec_sensorhub_ring.c
index 302d037b90a1f..b5970e8620bf0 100644
--- a/drivers/platform/chrome/cros_ec_sensorhub_ring.c
+++ b/drivers/platform/chrome/cros_ec_sensorhub_ring.c
@@ -825,8 +825,15 @@ static void cros_ec_sensorhub_ring_handler(struct cros_ec_sensorhub *sensorhub)
sensorhub->msg->outsize = 1;
sensorhub->msg->insize = fifo_info_length;
- if (cros_ec_cmd_xfer_status(ec->ec_dev, sensorhub->msg) < 0)
+ ret = cros_ec_cmd_xfer_status(ec->ec_dev, sensorhub->msg);
+ if (ret < 0)
+ goto error;
+ if (ret != fifo_info_length) {
+ dev_warn_ratelimited(sensorhub->dev,
+ "Mismatch read length: size %d - expected %d\n",
+ ret, fifo_info_length);
goto error;
+ }
memcpy(fifo_info, &sensorhub->resp->fifo_info,
fifo_info_length);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0394/1376] wifi: rtw89: fix HE extended capability length check
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (392 preceding siblings ...)
2026-09-12 6:46 ` [PATCH 6.12 0393/1376] platform/chrome: sensorhub: Fix memory overread in ring handler Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0395/1376] perf cs-etm: Queue context packets for frontend Greg Kroah-Hartman
` (604 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Ping-Ke Shih,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ Upstream commit 2aba608a86e9b099c9af2ea70b620552dee2b628 ]
rtw89_mac_check_he_obss_narrow_bw_ru_iter() reads extended capability
byte 10, but rejects only datalen values below 10. Byte 10 requires at
least 11 bytes.
Require datalen >= 11 before reading data[10].
Fixes: 8d540f9d2916 ("wifi: rtw89: disable 26-tone RU HE TB PPDU transmissions")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/2026063009025530.2-ccfa108-0024-wifi-rtw89-fix-HE-extended--pengpeng@iscas.ac.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/mac.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c
index 31465893f866d..f323417a88d20 100644
--- a/drivers/net/wireless/realtek/rtw89/mac.c
+++ b/drivers/net/wireless/realtek/rtw89/mac.c
@@ -4730,7 +4730,7 @@ static void rtw89_mac_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
elem = cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY, ies->data,
ies->len);
- if (!elem || elem->datalen < 10 ||
+ if (!elem || elem->datalen < 11 ||
!(elem->data[10] & WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
*tolerated = false;
rcu_read_unlock();
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0395/1376] perf cs-etm: Queue context packets for frontend
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (393 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0394/1376] wifi: rtw89: fix HE extended capability length check Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0396/1376] perf cs-etm: Fix thread leaks on trace queue init failure Greg Kroah-Hartman
` (603 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Amir Ayupov, Leo Yan, Ian Rogers,
Jiri Olsa, Jonathan Corbet, linux-doc, Mike Leach, Namhyung Kim,
Paschalis Mpeis, Robert Walker, Shuah Khan, Suzuki Poulouse,
James Clark, Arnaldo Carvalho de Melo, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Clark <james.clark@linaro.org>
[ Upstream commit 68ca50bc0fa64841cd73b8a1538df1d7f7eb4108 ]
PE_CONTEXT elements update the context ID and exception level, but the
decoder may still have prior packets cached for frontend processing.
Updating the context immediately in the decoder backend can make those
cached packets get consumed with the wrong thread or EL state.
Add a CS_ETM_CONTEXT packet carrying the TID and EL to the frontend,
this keeps context changes ordered with the rest of the packet stream
and avoids mismatches when synthesizing samples from cached packets.
Separate the memory access function into one for the frontend and one
for decoding. The frontend also needs memory access to attach the
instruction to samples. Because the frontend does memory access for
both previous and current packets, change all the frontend memory access
function signatures to take both a tidq and packet. But backend always
uses the current backend EL and thread from the tidq.
Treat context packets as a boundary for branch sample generation and
remove tidq->prev_packet_thread because it's not possible to branch to a
different thread, so only tracking the current thread is required for
sample generation.
Fixes: e573e978fb12e160 ("perf cs-etm: Inject capabilitity for CoreSight traces")
Reported-by: Amir Ayupov <aaupov@meta.com>
Closes: https://lore.kernel.org/linux-perf-users/20260515021135.1729028-1-aaupov@meta.com/
Co-authored-by: James Clark <james.clark@linaro.org>
Signed-off-by: Leo Yan <leo.yan@arm.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: linux-doc@vger.kernel.org
Cc: Mike Leach <mike.leach@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Paschalis Mpeis <Paschalis.Mpeis@arm.com>
Cc: Robert Walker <robert.walker@arm.com>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Cc: Suzuki Poulouse <suzuki.poulose@arm.com>
Signed-off-by: James Clark <james.clark@linaro.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Stable-dep-of: 50cd0d54f1f6 ("perf cs-etm: Fix thread leaks on trace queue init failure")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../perf/util/cs-etm-decoder/cs-etm-decoder.c | 21 +-
tools/perf/util/cs-etm.c | 236 +++++++++++-------
tools/perf/util/cs-etm.h | 8 +-
3 files changed, 163 insertions(+), 102 deletions(-)
diff --git a/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c b/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c
index 9bf09a856b44a..c1257c5ef4256 100644
--- a/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c
+++ b/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c
@@ -399,6 +399,8 @@ cs_etm_decoder__buffer_packet(struct cs_etm_queue *etmq,
packet_queue->packet_buffer[et].flags = 0;
packet_queue->packet_buffer[et].exception_number = UINT32_MAX;
packet_queue->packet_buffer[et].trace_chan_id = trace_chan_id;
+ packet_queue->packet_buffer[et].el = ocsd_EL_unknown;
+ packet_queue->packet_buffer[et].tid = -1;
if (packet_queue->packet_count == CS_ETM_PACKET_MAX_BUFFER - 1)
return OCSD_RESP_WAIT;
@@ -446,6 +448,7 @@ cs_etm_decoder__buffer_range(struct cs_etm_queue *etmq,
packet->last_instr_type = elem->last_i_type;
packet->last_instr_subtype = elem->last_i_subtype;
packet->last_instr_cond = elem->last_instr_cond;
+ packet->el = elem->context.exception_level;
if (elem->last_i_type == OCSD_INSTR_BR || elem->last_i_type == OCSD_INSTR_BR_INDIRECT)
packet->last_instr_taken_branch = elem->last_instr_exec;
@@ -522,7 +525,9 @@ cs_etm_decoder__set_tid(struct cs_etm_queue *etmq,
const ocsd_generic_trace_elem *elem,
const uint8_t trace_chan_id)
{
+ struct cs_etm_packet *packet;
pid_t tid = -1;
+ int ret;
/*
* Process the PE_CONTEXT packets if we have a valid contextID or VMID.
@@ -543,12 +548,18 @@ cs_etm_decoder__set_tid(struct cs_etm_queue *etmq,
break;
}
- if (cs_etm__etmq_set_tid_el(etmq, tid, trace_chan_id,
- elem->context.exception_level))
+ if (cs_etm__etmq_update_decode_context(etmq, trace_chan_id,
+ elem->context.exception_level, tid))
return OCSD_RESP_FATAL_SYS_ERR;
- if (tid == -1)
- return OCSD_RESP_CONT;
+ ret = cs_etm_decoder__buffer_packet(etmq, packet_queue, trace_chan_id,
+ CS_ETM_CONTEXT);
+ if (ret != OCSD_RESP_CONT && ret != OCSD_RESP_WAIT)
+ return ret;
+
+ packet = &packet_queue->packet_buffer[packet_queue->tail];
+ packet->tid = tid;
+ packet->el = elem->context.exception_level;
/*
* A timestamp is generated after a PE_CONTEXT element so make sure
@@ -556,7 +567,7 @@ cs_etm_decoder__set_tid(struct cs_etm_queue *etmq,
*/
cs_etm_decoder__reset_timestamp(packet_queue);
- return OCSD_RESP_CONT;
+ return ret;
}
static ocsd_datapath_resp_t cs_etm_decoder__gen_trace_elem_printer(
diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c
index 0bf9e5c27b599..9e3a4a676535a 100644
--- a/tools/perf/util/cs-etm.c
+++ b/tools/perf/util/cs-etm.c
@@ -86,15 +86,22 @@ struct cs_etm_traceid_queue {
u64 period_instructions;
size_t last_branch_pos;
union perf_event *event_buf;
- struct thread *thread;
- struct thread *prev_packet_thread;
- ocsd_ex_level prev_packet_el;
- ocsd_ex_level el;
struct branch_stack *last_branch;
struct branch_stack *last_branch_rb;
struct cs_etm_packet *prev_packet;
struct cs_etm_packet *packet;
struct cs_etm_packet_queue packet_queue;
+
+ struct thread *decode_thread;
+ ocsd_ex_level decode_el;
+
+ /*
+ * The frontend accesses the EL from '[prev_]packet' because it needs
+ * previous EL for branch and current EL for instruction samples. It's
+ * not possible to change thread in a single branch sample so no need to
+ * store or access the thread through the packet.
+ */
+ struct thread *frontend_thread;
};
enum cs_etm_format {
@@ -608,10 +615,11 @@ static int cs_etm__init_traceid_queue(struct cs_etm_queue *etmq,
queue = &etmq->etm->queues.queue_array[etmq->queue_nr];
tidq->trace_chan_id = trace_chan_id;
- tidq->el = tidq->prev_packet_el = ocsd_EL_unknown;
- tidq->thread = machine__findnew_thread(&etm->session->machines.host, -1,
+ tidq->decode_el = ocsd_EL_unknown;
+ tidq->frontend_thread = machine__findnew_thread(&etm->session->machines.host, -1,
+ queue->tid);
+ tidq->decode_thread = machine__findnew_thread(&etm->session->machines.host, -1,
queue->tid);
- tidq->prev_packet_thread = machine__idle_thread(&etm->session->machines.host);
tidq->packet = zalloc(sizeof(struct cs_etm_packet));
if (!tidq->packet)
@@ -744,21 +752,10 @@ static void cs_etm__packet_swap(struct cs_etm_auxtrace *etm,
/*
* Swap PACKET with PREV_PACKET: PACKET becomes PREV_PACKET for
* the next incoming packet.
- *
- * Threads and exception levels are also tracked for both the
- * previous and current packets. This is because the previous
- * packet is used for the 'from' IP for branch samples, so the
- * thread at that time must also be assigned to that sample.
- * Across discontinuity packets the thread can change, so by
- * tracking the thread for the previous packet the branch sample
- * will have the correct info.
*/
tmp = tidq->packet;
tidq->packet = tidq->prev_packet;
tidq->prev_packet = tmp;
- tidq->prev_packet_el = tidq->el;
- thread__put(tidq->prev_packet_thread);
- tidq->prev_packet_thread = thread__get(tidq->thread);
}
}
@@ -931,8 +928,8 @@ static void cs_etm__free_traceid_queues(struct cs_etm_queue *etmq)
/* Free this traceid_queue from the array */
tidq = etmq->traceid_queues[idx];
- thread__zput(tidq->thread);
- thread__zput(tidq->prev_packet_thread);
+ thread__zput(tidq->frontend_thread);
+ thread__zput(tidq->decode_thread);
zfree(&tidq->event_buf);
zfree(&tidq->last_branch);
zfree(&tidq->last_branch_rb);
@@ -1077,47 +1074,43 @@ static u8 cs_etm__cpu_mode(struct cs_etm_queue *etmq, u64 address,
}
}
-static u32 cs_etm__mem_access(struct cs_etm_queue *etmq, u8 trace_chan_id,
- u64 address, size_t size, u8 *buffer,
- const ocsd_mem_space_acc_t mem_space)
+static u32 __cs_etm__mem_access(struct cs_etm_queue *etmq,
+ u64 address, size_t size, u8 *buffer,
+ const ocsd_mem_space_acc_t mem_space,
+ ocsd_ex_level el, struct thread *thread)
{
u8 cpumode;
u64 offset;
int len;
struct addr_location al;
struct dso *dso;
- struct cs_etm_traceid_queue *tidq;
int ret = 0;
if (!etmq)
return 0;
addr_location__init(&al);
- tidq = cs_etm__etmq_get_traceid_queue(etmq, trace_chan_id);
- if (!tidq)
- goto out;
/*
- * We've already tracked EL along side the PID in cs_etm__set_thread()
- * so double check that it matches what OpenCSD thinks as well. It
- * doesn't distinguish between EL0 and EL1 for this mem access callback
- * so we had to do the extra tracking. Skip validation if it's any of
- * the 'any' values.
+ * We track EL for the frontend and the backend when receiving context
+ * and range packets. OpenCSD doesn't distinguish between EL0 and EL1
+ * for this mem access callback so we had to do the extra tracking. Skip
+ * validation if it's any of the 'any' values.
*/
if (!(mem_space == OCSD_MEM_SPACE_ANY ||
mem_space == OCSD_MEM_SPACE_N || mem_space == OCSD_MEM_SPACE_S)) {
if (mem_space & OCSD_MEM_SPACE_EL1N) {
/* Includes both non secure EL1 and EL0 */
- assert(tidq->el == ocsd_EL1 || tidq->el == ocsd_EL0);
+ assert(el == ocsd_EL1 || el == ocsd_EL0);
} else if (mem_space & OCSD_MEM_SPACE_EL2)
- assert(tidq->el == ocsd_EL2);
+ assert(el == ocsd_EL2);
else if (mem_space & OCSD_MEM_SPACE_EL3)
- assert(tidq->el == ocsd_EL3);
+ assert(el == ocsd_EL3);
}
- cpumode = cs_etm__cpu_mode(etmq, address, tidq->el);
+ cpumode = cs_etm__cpu_mode(etmq, address, el);
- if (!thread__find_map(tidq->thread, cpumode, address, &al))
+ if (!thread__find_map(thread, cpumode, address, &al))
goto out;
dso = map__dso(al.map);
@@ -1132,7 +1125,7 @@ static u32 cs_etm__mem_access(struct cs_etm_queue *etmq, u8 trace_chan_id,
map__load(al.map);
- len = dso__data_read_offset(dso, maps__machine(thread__maps(tidq->thread)),
+ len = dso__data_read_offset(dso, maps__machine(thread__maps(thread)),
offset, buffer, size);
if (len <= 0) {
@@ -1152,6 +1145,30 @@ static u32 cs_etm__mem_access(struct cs_etm_queue *etmq, u8 trace_chan_id,
return ret;
}
+static u32 cs_etm__frontend_mem_access(struct cs_etm_queue *etmq,
+ struct cs_etm_traceid_queue *tidq,
+ struct cs_etm_packet *packet,
+ u64 address, size_t size, u8 *buffer)
+{
+ return __cs_etm__mem_access(etmq, address, size, buffer, 0, packet->el,
+ tidq->frontend_thread);
+}
+
+static u32 cs_etm__decoder_mem_access(struct cs_etm_queue *etmq, u8 trace_chan_id,
+ u64 address, size_t size, u8 *buffer,
+ const ocsd_mem_space_acc_t mem_space)
+{
+ struct cs_etm_traceid_queue *tidq;
+
+ tidq = cs_etm__etmq_get_traceid_queue(etmq, trace_chan_id);
+ if (!tidq)
+ return 0;
+
+ return __cs_etm__mem_access(etmq, address, size, buffer,
+ mem_space, tidq->decode_el,
+ tidq->decode_thread);
+}
+
static struct cs_etm_queue *cs_etm__alloc_queue(void)
{
struct cs_etm_queue *etmq = zalloc(sizeof(*etmq));
@@ -1327,12 +1344,13 @@ void cs_etm__reset_last_branch_rb(struct cs_etm_traceid_queue *tidq)
}
static inline int cs_etm__t32_instr_size(struct cs_etm_queue *etmq,
- u8 trace_chan_id, u64 addr)
+ struct cs_etm_traceid_queue *tidq,
+ struct cs_etm_packet *packet, u64 addr)
{
u8 instrBytes[2];
- cs_etm__mem_access(etmq, trace_chan_id, addr, ARRAY_SIZE(instrBytes),
- instrBytes, 0);
+ cs_etm__frontend_mem_access(etmq, tidq, packet, addr,
+ ARRAY_SIZE(instrBytes), instrBytes);
/*
* T32 instruction size is indicated by bits[15:11] of the first
* 16-bit word of the instruction: 0b11101, 0b11110 and 0b11111
@@ -1365,16 +1383,16 @@ u64 cs_etm__last_executed_instr(const struct cs_etm_packet *packet)
}
static inline u64 cs_etm__instr_addr(struct cs_etm_queue *etmq,
- u64 trace_chan_id,
- const struct cs_etm_packet *packet,
+ struct cs_etm_traceid_queue *tidq,
+ struct cs_etm_packet *packet,
u64 offset)
{
if (packet->isa == CS_ETM_ISA_T32) {
u64 addr = packet->start_addr;
while (offset) {
- addr += cs_etm__t32_instr_size(etmq,
- trace_chan_id, addr);
+ addr += cs_etm__t32_instr_size(etmq, tidq, packet,
+ addr);
offset--;
}
return addr;
@@ -1466,34 +1484,51 @@ cs_etm__get_trace(struct cs_etm_queue *etmq)
return etmq->buf_len;
}
-static void cs_etm__set_thread(struct cs_etm_queue *etmq,
- struct cs_etm_traceid_queue *tidq, pid_t tid,
- ocsd_ex_level el)
+/*
+ * Convert a raw thread number to a thread struct and assign it to **thread.
+ */
+static int cs_etm__etmq_update_thread(struct cs_etm_queue *etmq,
+ ocsd_ex_level el, pid_t tid,
+ struct thread **thread)
{
struct machine *machine = cs_etm__get_machine(etmq, el);
+ if (!machine || !*thread)
+ return -EINVAL;
+
if (tid != -1) {
- thread__zput(tidq->thread);
- tidq->thread = machine__find_thread(machine, -1, tid);
+ thread__zput(*thread);
+ *thread = machine__find_thread(machine, -1, tid);
}
/* Couldn't find a known thread */
- if (!tidq->thread)
- tidq->thread = machine__idle_thread(machine);
+ if (!*thread)
+ *thread = machine__idle_thread(machine);
- tidq->el = el;
+ return 0;
}
-int cs_etm__etmq_set_tid_el(struct cs_etm_queue *etmq, pid_t tid,
- u8 trace_chan_id, ocsd_ex_level el)
+/*
+ * Set the thread and EL of the decode context which is ahead in time of the
+ * frontend context.
+ */
+int cs_etm__etmq_update_decode_context(struct cs_etm_queue *etmq,
+ u8 trace_chan_id,
+ ocsd_ex_level el, pid_t tid)
{
struct cs_etm_traceid_queue *tidq;
+ int ret;
tidq = cs_etm__etmq_get_traceid_queue(etmq, trace_chan_id);
if (!tidq)
return -EINVAL;
- cs_etm__set_thread(etmq, tidq, tid, el);
+ ret = cs_etm__etmq_update_thread(etmq, el, tid,
+ &tidq->decode_thread);
+ if (ret)
+ return ret;
+
+ tidq->decode_el = el;
return 0;
}
@@ -1503,8 +1538,8 @@ bool cs_etm__etmq_is_timeless(struct cs_etm_queue *etmq)
}
static void cs_etm__copy_insn(struct cs_etm_queue *etmq,
- u64 trace_chan_id,
- const struct cs_etm_packet *packet,
+ struct cs_etm_traceid_queue *tidq,
+ struct cs_etm_packet *packet,
struct perf_sample *sample)
{
/*
@@ -1521,14 +1556,14 @@ static void cs_etm__copy_insn(struct cs_etm_queue *etmq,
* cs_etm__t32_instr_size().
*/
if (packet->isa == CS_ETM_ISA_T32)
- sample->insn_len = cs_etm__t32_instr_size(etmq, trace_chan_id,
+ sample->insn_len = cs_etm__t32_instr_size(etmq, tidq, packet,
sample->ip);
/* Otherwise, A64 and A32 instruction size are always 32-bit. */
else
sample->insn_len = 4;
- cs_etm__mem_access(etmq, trace_chan_id, sample->ip, sample->insn_len,
- (void *)sample->insn, 0);
+ cs_etm__frontend_mem_access(etmq, tidq, packet, sample->ip,
+ sample->insn_len, (void *)sample->insn);
}
u64 cs_etm__convert_sample_time(struct cs_etm_queue *etmq, u64 cs_timestamp)
@@ -1555,6 +1590,7 @@ static inline u64 cs_etm__resolve_sample_time(struct cs_etm_queue *etmq,
static int cs_etm__synth_instruction_sample(struct cs_etm_queue *etmq,
struct cs_etm_traceid_queue *tidq,
+ struct cs_etm_packet *packet,
u64 addr, u64 period)
{
int ret = 0;
@@ -1563,23 +1599,23 @@ static int cs_etm__synth_instruction_sample(struct cs_etm_queue *etmq,
struct perf_sample sample = {.ip = 0,};
event->sample.header.type = PERF_RECORD_SAMPLE;
- event->sample.header.misc = cs_etm__cpu_mode(etmq, addr, tidq->el);
+ event->sample.header.misc = cs_etm__cpu_mode(etmq, addr, packet->el);
event->sample.header.size = sizeof(struct perf_event_header);
/* Set time field based on etm auxtrace config. */
sample.time = cs_etm__resolve_sample_time(etmq, tidq);
sample.ip = addr;
- sample.pid = thread__pid(tidq->thread);
- sample.tid = thread__tid(tidq->thread);
+ sample.pid = thread__pid(tidq->frontend_thread);
+ sample.tid = thread__tid(tidq->frontend_thread);
sample.id = etmq->etm->instructions_id;
sample.stream_id = etmq->etm->instructions_id;
sample.period = period;
- sample.cpu = tidq->packet->cpu;
+ sample.cpu = packet->cpu;
sample.flags = tidq->prev_packet->flags;
sample.cpumode = event->sample.header.misc;
- cs_etm__copy_insn(etmq, tidq->trace_chan_id, tidq->packet, &sample);
+ cs_etm__copy_insn(etmq, tidq, packet, &sample);
if (etm->synth_opts.last_branch)
sample.branch_stack = tidq->last_branch;
@@ -1623,15 +1659,15 @@ static int cs_etm__synth_branch_sample(struct cs_etm_queue *etmq,
event->sample.header.type = PERF_RECORD_SAMPLE;
event->sample.header.misc = cs_etm__cpu_mode(etmq, ip,
- tidq->prev_packet_el);
+ tidq->prev_packet->el);
event->sample.header.size = sizeof(struct perf_event_header);
/* Set time field based on etm auxtrace config. */
sample.time = cs_etm__resolve_sample_time(etmq, tidq);
sample.ip = ip;
- sample.pid = thread__pid(tidq->prev_packet_thread);
- sample.tid = thread__tid(tidq->prev_packet_thread);
+ sample.pid = thread__pid(tidq->frontend_thread);
+ sample.tid = thread__tid(tidq->frontend_thread);
sample.addr = cs_etm__first_executed_instr(tidq->packet);
sample.id = etmq->etm->branches_id;
sample.stream_id = etmq->etm->branches_id;
@@ -1640,8 +1676,7 @@ static int cs_etm__synth_branch_sample(struct cs_etm_queue *etmq,
sample.flags = tidq->prev_packet->flags;
sample.cpumode = event->sample.header.misc;
- cs_etm__copy_insn(etmq, tidq->trace_chan_id, tidq->prev_packet,
- &sample);
+ cs_etm__copy_insn(etmq, tidq, tidq->prev_packet, &sample);
/*
* perf report cannot handle events without a branch stack
@@ -1765,7 +1800,6 @@ static int cs_etm__sample(struct cs_etm_queue *etmq,
{
struct cs_etm_auxtrace *etm = etmq->etm;
int ret;
- u8 trace_chan_id = tidq->trace_chan_id;
u64 instrs_prev;
/* Get instructions remainder from previous packet */
@@ -1851,10 +1885,10 @@ static int cs_etm__sample(struct cs_etm_queue *etmq,
* been executed, but PC has not advanced to next
* instruction)
*/
- addr = cs_etm__instr_addr(etmq, trace_chan_id,
- tidq->packet, offset - 1);
+ addr = cs_etm__instr_addr(etmq, tidq, tidq->packet,
+ offset - 1);
ret = cs_etm__synth_instruction_sample(
- etmq, tidq, addr,
+ etmq, tidq, tidq->packet, addr,
etm->instructions_sample_period);
if (ret)
return ret;
@@ -1936,7 +1970,7 @@ static int cs_etm__flush(struct cs_etm_queue *etmq,
addr = cs_etm__last_executed_instr(tidq->prev_packet);
err = cs_etm__synth_instruction_sample(
- etmq, tidq, addr,
+ etmq, tidq, tidq->prev_packet, addr,
tidq->period_instructions);
if (err)
return err;
@@ -1991,7 +2025,7 @@ static int cs_etm__end_block(struct cs_etm_queue *etmq,
addr = cs_etm__last_executed_instr(tidq->prev_packet);
err = cs_etm__synth_instruction_sample(
- etmq, tidq, addr,
+ etmq, tidq, tidq->prev_packet, addr,
tidq->period_instructions);
if (err)
return err;
@@ -2028,9 +2062,9 @@ static int cs_etm__get_data_block(struct cs_etm_queue *etmq)
return etmq->buf_len;
}
-static bool cs_etm__is_svc_instr(struct cs_etm_queue *etmq, u8 trace_chan_id,
- struct cs_etm_packet *packet,
- u64 end_addr)
+static bool cs_etm__is_svc_instr(struct cs_etm_queue *etmq,
+ struct cs_etm_traceid_queue *tidq,
+ struct cs_etm_packet *packet, u64 end_addr)
{
/* Initialise to keep compiler happy */
u16 instr16 = 0;
@@ -2052,8 +2086,8 @@ static bool cs_etm__is_svc_instr(struct cs_etm_queue *etmq, u8 trace_chan_id,
* so below only read 2 bytes as instruction size for T32.
*/
addr = end_addr - 2;
- cs_etm__mem_access(etmq, trace_chan_id, addr, sizeof(instr16),
- (u8 *)&instr16, 0);
+ cs_etm__frontend_mem_access(etmq, tidq, packet, addr,
+ sizeof(instr16), (u8 *)&instr16);
if ((instr16 & 0xFF00) == 0xDF00)
return true;
@@ -2068,8 +2102,8 @@ static bool cs_etm__is_svc_instr(struct cs_etm_queue *etmq, u8 trace_chan_id,
* +---------+---------+-------------------------+
*/
addr = end_addr - 4;
- cs_etm__mem_access(etmq, trace_chan_id, addr, sizeof(instr32),
- (u8 *)&instr32, 0);
+ cs_etm__frontend_mem_access(etmq, tidq, packet, addr,
+ sizeof(instr32), (u8 *)&instr32);
if ((instr32 & 0x0F000000) == 0x0F000000 &&
(instr32 & 0xF0000000) != 0xF0000000)
return true;
@@ -2085,8 +2119,8 @@ static bool cs_etm__is_svc_instr(struct cs_etm_queue *etmq, u8 trace_chan_id,
* +-----------------------+---------+-----------+
*/
addr = end_addr - 4;
- cs_etm__mem_access(etmq, trace_chan_id, addr, sizeof(instr32),
- (u8 *)&instr32, 0);
+ cs_etm__frontend_mem_access(etmq, tidq, packet, addr,
+ sizeof(instr32), (u8 *)&instr32);
if ((instr32 & 0xFFE0001F) == 0xd4000001)
return true;
@@ -2102,7 +2136,6 @@ static bool cs_etm__is_svc_instr(struct cs_etm_queue *etmq, u8 trace_chan_id,
static bool cs_etm__is_syscall(struct cs_etm_queue *etmq,
struct cs_etm_traceid_queue *tidq, u64 magic)
{
- u8 trace_chan_id = tidq->trace_chan_id;
struct cs_etm_packet *packet = tidq->packet;
struct cs_etm_packet *prev_packet = tidq->prev_packet;
@@ -2117,7 +2150,7 @@ static bool cs_etm__is_syscall(struct cs_etm_queue *etmq,
*/
if (magic == __perf_cs_etmv4_magic) {
if (packet->exception_number == CS_ETMV4_EXC_CALL &&
- cs_etm__is_svc_instr(etmq, trace_chan_id, prev_packet,
+ cs_etm__is_svc_instr(etmq, tidq, prev_packet,
prev_packet->end_addr))
return true;
}
@@ -2155,7 +2188,6 @@ static bool cs_etm__is_sync_exception(struct cs_etm_queue *etmq,
struct cs_etm_traceid_queue *tidq,
u64 magic)
{
- u8 trace_chan_id = tidq->trace_chan_id;
struct cs_etm_packet *packet = tidq->packet;
struct cs_etm_packet *prev_packet = tidq->prev_packet;
@@ -2181,7 +2213,7 @@ static bool cs_etm__is_sync_exception(struct cs_etm_queue *etmq,
* (SMC, HVC) are taken as sync exceptions.
*/
if (packet->exception_number == CS_ETMV4_EXC_CALL &&
- !cs_etm__is_svc_instr(etmq, trace_chan_id, prev_packet,
+ !cs_etm__is_svc_instr(etmq, tidq, prev_packet,
prev_packet->end_addr))
return true;
@@ -2205,7 +2237,6 @@ static int cs_etm__set_sample_flags(struct cs_etm_queue *etmq,
{
struct cs_etm_packet *packet = tidq->packet;
struct cs_etm_packet *prev_packet = tidq->prev_packet;
- u8 trace_chan_id = tidq->trace_chan_id;
u64 magic;
int ret;
@@ -2286,11 +2317,11 @@ static int cs_etm__set_sample_flags(struct cs_etm_queue *etmq,
if (prev_packet->flags == (PERF_IP_FLAG_BRANCH |
PERF_IP_FLAG_RETURN |
PERF_IP_FLAG_INTERRUPT) &&
- cs_etm__is_svc_instr(etmq, trace_chan_id,
- packet, packet->start_addr))
+ cs_etm__is_svc_instr(etmq, tidq, packet, packet->start_addr)) {
prev_packet->flags = PERF_IP_FLAG_BRANCH |
PERF_IP_FLAG_RETURN |
PERF_IP_FLAG_SYSCALLRET;
+ }
break;
case CS_ETM_DISCONTINUITY:
/*
@@ -2371,6 +2402,7 @@ static int cs_etm__set_sample_flags(struct cs_etm_queue *etmq,
PERF_IP_FLAG_RETURN |
PERF_IP_FLAG_INTERRUPT;
break;
+ case CS_ETM_CONTEXT:
case CS_ETM_EMPTY:
default:
break;
@@ -2446,6 +2478,19 @@ static int cs_etm__process_traceid_queue(struct cs_etm_queue *etmq,
*/
cs_etm__sample(etmq, tidq);
break;
+ case CS_ETM_CONTEXT:
+ /*
+ * Update context but don't swap packet. Keep the
+ * previous one for branch source address info, if
+ * tracing the kernel the context packet will be emitted
+ * between two ranges.
+ */
+ ret = cs_etm__etmq_update_thread(etmq, tidq->packet->el,
+ tidq->packet->tid,
+ &tidq->frontend_thread);
+ if (ret)
+ goto out;
+ break;
case CS_ETM_EXCEPTION:
case CS_ETM_EXCEPTION_RET:
/*
@@ -2474,6 +2519,7 @@ static int cs_etm__process_traceid_queue(struct cs_etm_queue *etmq,
}
}
+out:
return ret;
}
@@ -2597,7 +2643,7 @@ static int cs_etm__process_timeless_queues(struct cs_etm_auxtrace *etm,
if (!tidq)
continue;
- if (tid == -1 || thread__tid(tidq->thread) == tid)
+ if (tid == -1 || thread__tid(tidq->frontend_thread) == tid)
cs_etm__run_per_thread_timeless_decoder(etmq);
} else
cs_etm__run_per_cpu_timeless_decoder(etmq);
@@ -3308,7 +3354,7 @@ static int cs_etm__create_queue_decoders(struct cs_etm_queue *etmq)
*/
if (cs_etm_decoder__add_mem_access_cb(etmq->decoder,
0x0L, ((u64) -1L),
- cs_etm__mem_access))
+ cs_etm__decoder_mem_access))
goto out_free_decoder;
zfree(&t_params);
diff --git a/tools/perf/util/cs-etm.h b/tools/perf/util/cs-etm.h
index a8caeea720aa1..dfc9aeacfd0b6 100644
--- a/tools/perf/util/cs-etm.h
+++ b/tools/perf/util/cs-etm.h
@@ -158,6 +158,7 @@ enum cs_etm_sample_type {
CS_ETM_DISCONTINUITY,
CS_ETM_EXCEPTION,
CS_ETM_EXCEPTION_RET,
+ CS_ETM_CONTEXT,
};
enum cs_etm_isa {
@@ -184,6 +185,8 @@ struct cs_etm_packet {
u8 last_instr_size;
u8 trace_chan_id;
int cpu;
+ int el;
+ pid_t tid;
};
#define CS_ETM_PACKET_MAX_BUFFER 1024
@@ -244,8 +247,9 @@ enum cs_etm_pid_fmt {
#include <opencsd/ocsd_if_types.h>
int cs_etm__get_cpu(struct cs_etm_queue *etmq, u8 trace_chan_id, int *cpu);
enum cs_etm_pid_fmt cs_etm__get_pid_fmt(struct cs_etm_queue *etmq);
-int cs_etm__etmq_set_tid_el(struct cs_etm_queue *etmq, pid_t tid,
- u8 trace_chan_id, ocsd_ex_level el);
+int cs_etm__etmq_update_decode_context(struct cs_etm_queue *etmq,
+ u8 trace_chan_id, ocsd_ex_level el,
+ pid_t tid);
bool cs_etm__etmq_is_timeless(struct cs_etm_queue *etmq);
void cs_etm__etmq_set_traceid_queue_timestamp(struct cs_etm_queue *etmq,
u8 trace_chan_id);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0396/1376] perf cs-etm: Fix thread leaks on trace queue init failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (394 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0395/1376] perf cs-etm: Queue context packets for frontend Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0397/1376] perf/x86/amd/uncore: Add group validation Greg Kroah-Hartman
` (602 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, James Clark, Leo Yan, Namhyung Kim,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <leo.yan@arm.com>
[ Upstream commit 50cd0d54f1f6dd9b3de7c0ad101bd41d06206ace ]
cs_etm__init_traceid_queue() allocates the frontend and decode threads,
if a later allocation fails, the error path does not drop thread
reference that was already acquired.
Release both thread pointers with thread__zput() on the error path, so
does not leak thread references or leave stale pointers behind.
Fixes: 951ccccdc715 ("perf cs-etm: Only track threads instead of PID and TIDs")
Reviewed-by: James Clark <james.clark@linaro.org>
Signed-off-by: Leo Yan <leo.yan@arm.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/cs-etm.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c
index 9e3a4a676535a..29f0211324970 100644
--- a/tools/perf/util/cs-etm.c
+++ b/tools/perf/util/cs-etm.c
@@ -620,6 +620,8 @@ static int cs_etm__init_traceid_queue(struct cs_etm_queue *etmq,
queue->tid);
tidq->decode_thread = machine__findnew_thread(&etm->session->machines.host, -1,
queue->tid);
+ if (!tidq->frontend_thread || !tidq->decode_thread)
+ goto out;
tidq->packet = zalloc(sizeof(struct cs_etm_packet));
if (!tidq->packet)
@@ -654,6 +656,8 @@ static int cs_etm__init_traceid_queue(struct cs_etm_queue *etmq,
zfree(&tidq->prev_packet);
zfree(&tidq->packet);
out:
+ thread__zput(tidq->frontend_thread);
+ thread__zput(tidq->decode_thread);
return rc;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0397/1376] perf/x86/amd/uncore: Add group validation
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (395 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0396/1376] perf cs-etm: Fix thread leaks on trace queue init failure Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0398/1376] perf vendor events amd: Update Zen 5 core events Greg Kroah-Hartman
` (601 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sandipan Das, Peter Zijlstra (Intel),
Ingo Molnar, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sandipan Das <sandipan.das@amd.com>
[ Upstream commit edda9051e267b7390c7ce24b1b71434414ad156e ]
The amd_uncore driver currently does not validate event groups and
allows creation of groups with more events than the number of available
hardware counters. Because of this, pmu->event_init() succeeds but
counter assignment fails later in pmu->add() which returns -EBUSY once
all counters are exhausted.
Address this by introducing group validation in the pmu->event_init()
path. Since the uncore PMUs have no per-event constraints and all
counters of a PMU are interchangeable, validation is reduced to just
counting the group members that target a PMU and ensuring that they fit
within the available set of counters.
Fixes: c43ca5091a37 ("perf/x86/amd: Add support for AMD NB and L2I "uncore" counters")
Signed-off-by: Sandipan Das <sandipan.das@amd.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Link: https://patch.msgid.link/750877d66e208603c3047f13eed6399625d43969.1782884387.git.sandipan.das@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/events/amd/uncore.c | 31 +++++++++++++++++++++++++++++++
1 file changed, 31 insertions(+)
diff --git a/arch/x86/events/amd/uncore.c b/arch/x86/events/amd/uncore.c
index cad240e88b4ff..06c5e485fd6e0 100644
--- a/arch/x86/events/amd/uncore.c
+++ b/arch/x86/events/amd/uncore.c
@@ -206,6 +206,29 @@ static void amd_uncore_del(struct perf_event *event, int flags)
hwc->idx = -1;
}
+static bool amd_uncore_group_valid(struct perf_event *event)
+{
+ struct amd_uncore_pmu *pmu = event_to_amd_uncore_pmu(event);
+ struct perf_event *leader = event->group_leader;
+ struct perf_event *sibling;
+ int counters = 0;
+
+ if (leader->pmu == event->pmu)
+ counters++;
+
+ for_each_sibling_event(sibling, leader) {
+ if (sibling->pmu == event->pmu &&
+ sibling->state > PERF_EVENT_STATE_OFF)
+ counters++;
+ }
+
+ /*
+ * When pmu->event_init() is called, the event is yet to be linked to
+ * its leader's sibling list, so it is counted separately
+ */
+ return (counters + 1) <= pmu->num_counters;
+}
+
static int amd_uncore_event_init(struct perf_event *event)
{
struct amd_uncore_pmu *pmu;
@@ -223,6 +246,14 @@ static int amd_uncore_event_init(struct perf_event *event)
if (!ctx)
return -ENODEV;
+ /*
+ * Ensure that all events in a group can be scheduled together so that
+ * a failure can be reported at perf_event_open() time rather than
+ * silently at pmu->add() time when no free counter is found
+ */
+ if (event->group_leader != event && !amd_uncore_group_valid(event))
+ return -EINVAL;
+
/*
* NB and Last level cache counters (MSRs) are shared across all cores
* that share the same NB / Last level cache. On family 16h and below,
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0398/1376] perf vendor events amd: Update Zen 5 core events
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (396 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0397/1376] perf/x86/amd/uncore: Add group validation Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0399/1376] hwrng: core - fix rng list on registration error Greg Kroah-Hartman
` (600 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sandipan Das, Namhyung Kim,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sandipan Das <sandipan.das@amd.com>
[ Upstream commit 047979af3bf6a118066c81099162d518de63abb1 ]
Update definitions for the following events.
* PMCx00A - Add missing unit masks
* PMCx00B - Add missing unit masks and fix descriptions
* PMCx00C - Add missing unit masks
* PMCx00D - Add missing unit masks
* PMCx025 - Add missing unit masks and fix descriptions
Fixes: 45c072f2537a ("perf vendor events amd: Add Zen 5 core events")
Signed-off-by: Sandipan Das <sandipan.das@amd.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../arch/x86/amdzen5/floating-point.json | 130 +++++++++++++++---
.../arch/x86/amdzen5/load-store.json | 8 +-
2 files changed, 120 insertions(+), 18 deletions(-)
diff --git a/tools/perf/pmu-events/arch/x86/amdzen5/floating-point.json b/tools/perf/pmu-events/arch/x86/amdzen5/floating-point.json
index 9204bfb1d69e0..569975b53cc33 100644
--- a/tools/perf/pmu-events/arch/x86/amdzen5/floating-point.json
+++ b/tools/perf/pmu-events/arch/x86/amdzen5/floating-point.json
@@ -179,6 +179,30 @@
"BriefDescription": "Retired scalar floating-point blend ops.",
"UMask": "0x09"
},
+ {
+ "EventName": "fp_ops_retired_by_type.scalar_mov",
+ "EventCode": "0x0a",
+ "BriefDescription": "Retired scalar floating-point MOV ops.",
+ "UMask": "0x0a"
+ },
+ {
+ "EventName": "fp_ops_retired_by_type.scalar_shuffle",
+ "EventCode": "0x0a",
+ "BriefDescription": "Retired scalar floating-point shuffle ops (may include instructions not necessarily thought of as including shuffles e.g. horizontal add, dot product, and certain MOV instructions).",
+ "UMask": "0x0b"
+ },
+ {
+ "EventName": "fp_ops_retired_by_type.scalar_bfloat",
+ "EventCode": "0x0a",
+ "BriefDescription": "Retired scalar floating-point bfloat ops.",
+ "UMask": "0x0c"
+ },
+ {
+ "EventName": "fp_ops_retired_by_type.scalar_logical",
+ "EventCode": "0x0a",
+ "BriefDescription": "Retired scalar floating-point logical ops.",
+ "UMask": "0x0d"
+ },
{
"EventName": "fp_ops_retired_by_type.scalar_other",
"EventCode": "0x0a",
@@ -245,12 +269,24 @@
"BriefDescription": "Retired vector floating-point blend ops.",
"UMask": "0x90"
},
+ {
+ "EventName": "fp_ops_retired_by_type.vector_mov",
+ "EventCode": "0x0a",
+ "BriefDescription": "Retired vector floating-point MOV ops.",
+ "UMask": "0xa0"
+ },
{
"EventName": "fp_ops_retired_by_type.vector_shuffle",
"EventCode": "0x0a",
"BriefDescription": "Retired vector floating-point shuffle ops (may include instructions not necessarily thought of as including shuffles e.g. horizontal add, dot product, and certain MOV instructions).",
"UMask": "0xb0"
},
+ {
+ "EventName": "fp_ops_retired_by_type.vector_bfloat",
+ "EventCode": "0x0a",
+ "BriefDescription": "Retired vector floating-point bfloat ops.",
+ "UMask": "0xc0"
+ },
{
"EventName": "fp_ops_retired_by_type.vector_logical",
"EventCode": "0x0a",
@@ -278,7 +314,7 @@
{
"EventName": "sse_avx_ops_retired.mmx_add",
"EventCode": "0x0b",
- "BriefDescription": "Retired MMX integer add.",
+ "BriefDescription": "Retired MMX integer add ops.",
"UMask": "0x01"
},
{
@@ -299,16 +335,34 @@
"BriefDescription": "Retired MMX integer multiply-accumulate ops.",
"UMask": "0x04"
},
+ {
+ "EventName": "sse_avx_ops_retired.mmx_aes",
+ "EventCode": "0x0b",
+ "BriefDescription": "Retired MMX integer AES ops.",
+ "UMask": "0x05"
+ },
+ {
+ "EventName": "sse_avx_ops_retired.mmx_sha",
+ "EventCode": "0x0b",
+ "BriefDescription": "Retired MMX integer SHA ops.",
+ "UMask": "0x06"
+ },
{
"EventName": "sse_avx_ops_retired.mmx_cmp",
"EventCode": "0x0b",
"BriefDescription": "Retired MMX integer compare ops.",
"UMask": "0x07"
},
+ {
+ "EventName": "sse_avx_ops_retired.mmx_cvt",
+ "EventCode": "0x0b",
+ "BriefDescription": "Retired MMX integer convert or pack ops.",
+ "UMask": "0x08"
+ },
{
"EventName": "sse_avx_ops_retired.mmx_shift",
"EventCode": "0x0b",
- "BriefDescription": "Retired MMX integer shift ops.",
+ "BriefDescription": "Retired MMX integer shift or rotate ops.",
"UMask": "0x09"
},
{
@@ -324,9 +378,9 @@
"UMask": "0x0b"
},
{
- "EventName": "sse_avx_ops_retired.mmx_pack",
+ "EventName": "sse_avx_ops_retired.mmx_vnni",
"EventCode": "0x0b",
- "BriefDescription": "Retired MMX integer pack ops.",
+ "BriefDescription": "Retired MMX integer VNNI ops.",
"UMask": "0x0c"
},
{
@@ -390,15 +444,15 @@
"UMask": "0x70"
},
{
- "EventName": "sse_avx_ops_retired.sse_avx_clm",
+ "EventName": "sse_avx_ops_retired.sse_avx_cvt",
"EventCode": "0x0b",
- "BriefDescription": "Retired SSE and AVX integer CLM ops.",
+ "BriefDescription": "Retired SSE and AVX integer convert or pack ops.",
"UMask": "0x80"
},
{
"EventName": "sse_avx_ops_retired.sse_avx_shift",
"EventCode": "0x0b",
- "BriefDescription": "Retired SSE and AVX integer shift ops.",
+ "BriefDescription": "Retired SSE and AVX integer shift or rotate ops.",
"UMask": "0x90"
},
{
@@ -414,9 +468,9 @@
"UMask": "0xb0"
},
{
- "EventName": "sse_avx_ops_retired.sse_avx_pack",
+ "EventName": "sse_avx_ops_retired.sse_avx_vnni",
"EventCode": "0x0b",
- "BriefDescription": "Retired SSE and AVX integer pack ops.",
+ "BriefDescription": "Retired SSE and AVX integer VNNI ops.",
"UMask": "0xc0"
},
{
@@ -497,12 +551,24 @@
"BriefDescription": "Retired 128-bit packed floating-point blend ops.",
"UMask": "0x09"
},
+ {
+ "EventName": "fp_pack_ops_retired.fp128_mov",
+ "EventCode": "0x0c",
+ "BriefDescription": "Retired 128-bit packed floating-point MOV ops.",
+ "UMask": "0x0a"
+ },
{
"EventName": "fp_pack_ops_retired.fp128_shuffle",
"EventCode": "0x0c",
"BriefDescription": "Retired 128-bit packed floating-point shuffle ops (may include instructions not necessarily thought of as including shuffles e.g. horizontal add, dot product, and certain MOV instructions).",
"UMask": "0x0b"
},
+ {
+ "EventName": "fp_pack_ops_retired.fp128_bfloat",
+ "EventCode": "0x0c",
+ "BriefDescription": "Retired 128-bit packed floating-point bfloat ops.",
+ "UMask": "0x0c"
+ },
{
"EventName": "fp_pack_ops_retired.fp128_logical",
"EventCode": "0x0c",
@@ -575,12 +641,24 @@
"BriefDescription": "Retired 256-bit packed floating-point blend ops.",
"UMask": "0x90"
},
+ {
+ "EventName": "fp_pack_ops_retired.fp256_mov",
+ "EventCode": "0x0c",
+ "BriefDescription": "Retired 256-bit packed floating-point MOV ops.",
+ "UMask": "0xa0"
+ },
{
"EventName": "fp_pack_ops_retired.fp256_shuffle",
"EventCode": "0x0c",
"BriefDescription": "Retired 256-bit packed floating-point shuffle ops (may include instructions not necessarily thought of as including shuffles e.g. horizontal add, dot product, and certain MOV instructions).",
"UMask": "0xb0"
},
+ {
+ "EventName": "fp_pack_ops_retired.fp256_bfloat",
+ "EventCode": "0x0c",
+ "BriefDescription": "Retired 256-bit packed floating-point bfloat ops.",
+ "UMask": "0xc0"
+ },
{
"EventName": "fp_pack_ops_retired.fp256_logical",
"EventCode": "0x0c",
@@ -648,15 +726,15 @@
"UMask": "0x07"
},
{
- "EventName": "packed_int_op_type.int128_clm",
+ "EventName": "packed_int_op_type.int128_cvt",
"EventCode": "0x0d",
- "BriefDescription": "Retired 128-bit packed integer CLM ops.",
+ "BriefDescription": "Retired 128-bit packed integer convert or pack ops.",
"UMask": "0x08"
},
{
"EventName": "packed_int_op_type.int128_shift",
"EventCode": "0x0d",
- "BriefDescription": "Retired 128-bit packed integer shift ops.",
+ "BriefDescription": "Retired 128-bit packed integer shift or rotate ops.",
"UMask": "0x09"
},
{
@@ -672,9 +750,9 @@
"UMask": "0x0b"
},
{
- "EventName": "packed_int_op_type.int128_pack",
+ "EventName": "packed_int_op_type.int128_vnni",
"EventCode": "0x0d",
- "BriefDescription": "Retired 128-bit packed integer pack ops.",
+ "BriefDescription": "Retired 128-bit packed integer VNNI ops.",
"UMask": "0x0c"
},
{
@@ -719,16 +797,34 @@
"BriefDescription": "Retired 256-bit packed integer multiply-accumulate ops.",
"UMask": "0x40"
},
+ {
+ "EventName": "packed_int_op_type.int256_aes",
+ "EventCode": "0x0d",
+ "BriefDescription": "Retired 256-bit packed integer AES ops.",
+ "UMask": "0x50"
+ },
+ {
+ "EventName": "packed_int_op_type.int256_sha",
+ "EventCode": "0x0d",
+ "BriefDescription": "Retired 256-bit packed integer SHA ops.",
+ "UMask": "0x60"
+ },
{
"EventName": "packed_int_op_type.int256_cmp",
"EventCode": "0x0d",
"BriefDescription": "Retired 256-bit packed integer compare ops.",
"UMask": "0x70"
},
+ {
+ "EventName": "packed_int_op_type.int256_cvt",
+ "EventCode": "0x0d",
+ "BriefDescription": "Retired 256-bit packed integer convert or pack ops.",
+ "UMask": "0x80"
+ },
{
"EventName": "packed_int_op_type.int256_shift",
"EventCode": "0x0d",
- "BriefDescription": "Retired 256-bit packed integer shift ops.",
+ "BriefDescription": "Retired 256-bit packed integer shift or rotate ops.",
"UMask": "0x90"
},
{
@@ -744,9 +840,9 @@
"UMask": "0xb0"
},
{
- "EventName": "packed_int_op_type.int256_pack",
+ "EventName": "packed_int_op_type.int256_vnni",
"EventCode": "0x0d",
- "BriefDescription": "Retired 256-bit packed integer pack ops.",
+ "BriefDescription": "Retired 256-bit packed integer VNNI ops.",
"UMask": "0xc0"
},
{
diff --git a/tools/perf/pmu-events/arch/x86/amdzen5/load-store.json b/tools/perf/pmu-events/arch/x86/amdzen5/load-store.json
index 917f9d68f85a6..d1ac7ff52a4d7 100644
--- a/tools/perf/pmu-events/arch/x86/amdzen5/load-store.json
+++ b/tools/perf/pmu-events/arch/x86/amdzen5/load-store.json
@@ -8,9 +8,15 @@
{
"EventName": "ls_locks.bus_lock",
"EventCode": "0x25",
- "BriefDescription": "Retired Lock instructions which caused a bus lock.",
+ "BriefDescription": "Retired lock instructions which caused a bus lock.",
"UMask": "0x01"
},
+ {
+ "EventName": "ls_locks.all",
+ "EventCode": "0x25",
+ "BriefDescription": "Retired lock instructions of all types.",
+ "UMask": "0x1f"
+ },
{
"EventName": "ls_ret_cl_flush",
"EventCode": "0x26",
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0399/1376] hwrng: core - fix rng list on registration error
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (397 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0398/1376] perf vendor events amd: Update Zen 5 core events Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0400/1376] crypto: qat - cancel work on re-enable SR-IOV timeout Greg Kroah-Hartman
` (599 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manos Pitsidianakis, Herbert Xu,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manos Pitsidianakis <manos@pitsidianak.is>
[ Upstream commit 3a5834db2b1ce25649f330e78efe1ccde78967fd ]
hwrng_register(rng) does the following:
1. Checks if rng has name and read methods set
2. Checks if the name already exists
3. Adds rng to global rng_list
4. May try to set rng to current_rng
If step 4 fails, it returns an error. However, it does not remove the
rng from rng_list, causing a dangling reference which can result in
use-after-free if the caller frees rng, since registration failed.
Add a list_del_init() cleanup step.
Fixes: 2bbb6983887f ("hwrng: use rng source with best quality")
Signed-off-by: Manos Pitsidianakis <manos@pitsidianak.is>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/hw_random/core.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
index c6e913497e1df..008f81a82131d 100644
--- a/drivers/char/hw_random/core.c
+++ b/drivers/char/hw_random/core.c
@@ -597,11 +597,13 @@ int hwrng_register(struct hwrng *rng)
*/
err = set_current_rng(rng);
if (err)
- goto out_unlock;
+ goto out_list_del;
}
}
mutex_unlock(&rng_mutex);
return 0;
+out_list_del:
+ list_del_init(&rng->list);
out_unlock:
mutex_unlock(&rng_mutex);
out:
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0400/1376] crypto: qat - cancel work on re-enable SR-IOV timeout
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (398 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0399/1376] hwrng: core - fix rng list on registration error Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0401/1376] crypto: qat - clear AES key schedule from stack Greg Kroah-Hartman
` (598 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Giovanni Cabiddu, Ahsan Atta,
Herbert Xu, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
[ Upstream commit 455b0f3ac9e254edab9f5a873d337abe5e6e3604 ]
The QAT reset worker queues SR-IOV reenable work using a work_struct and
completion embedded in an on-stack adf_sriov_dev_data. If the completion
wait times out, the reset worker can return while device_sriov_wq still
holds or executes the stack-backed work item.
Cancel the work on the device_sriov_wq on timeout before the stack frame
unwinds.
Fixes: 4469f9b23468 ("crypto: qat - re-enable sriov after pf reset")
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Ahsan Atta <ahsan.atta@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/intel/qat/qat_common/adf_aer.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/crypto/intel/qat/qat_common/adf_aer.c b/drivers/crypto/intel/qat/qat_common/adf_aer.c
index bd81458bcf327..403e53347f8e2 100644
--- a/drivers/crypto/intel/qat/qat_common/adf_aer.c
+++ b/drivers/crypto/intel/qat/qat_common/adf_aer.c
@@ -140,6 +140,8 @@ static void adf_device_reset_worker(struct work_struct *work)
queue_work(device_sriov_wq, &sriov_data.sriov_work);
if (wait_for_completion_timeout(&sriov_data.compl, wait_jiffies))
adf_pf2vf_notify_restarted(accel_dev);
+ else
+ cancel_work_sync(&sriov_data.sriov_work);
adf_dev_restarted_notify(accel_dev);
clear_bit(ADF_STATUS_RESTARTING, &accel_dev->status);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0401/1376] crypto: qat - clear AES key schedule from stack
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (399 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0400/1376] crypto: qat - cancel work on re-enable SR-IOV timeout Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0402/1376] crypto: atmel-ecc - replace min_t with min Greg Kroah-Hartman
` (597 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Giovanni Cabiddu, Ahsan Atta,
Herbert Xu, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
[ Upstream commit d41a9fcfb7f9ee36e4a4aaf5e7996bca6be1e7a9 ]
qat_alg_xts_reverse_key() expands the forward XTS AES key on the stack.
That schedule contains key material and can remain in the stack frame.
Clear the temporary crypto_aes_ctx with memzero_explicit() after the copy.
Fixes: 5106dfeaeabe ("crypto: qat - add AES-XTS support for QAT GEN4 devices")
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Ahsan Atta <ahsan.atta@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/intel/qat/qat_common/qat_algs.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/crypto/intel/qat/qat_common/qat_algs.c b/drivers/crypto/intel/qat/qat_common/qat_algs.c
index d69cc1e5e0239..274bcc83a1fc2 100644
--- a/drivers/crypto/intel/qat/qat_common/qat_algs.c
+++ b/drivers/crypto/intel/qat/qat_common/qat_algs.c
@@ -481,6 +481,7 @@ static void qat_alg_xts_reverse_key(const u8 *key_forward, unsigned int keylen,
memcpy(key_reverse + AES_BLOCK_SIZE, key - AES_BLOCK_SIZE,
AES_BLOCK_SIZE);
}
+ memzero_explicit(&aes_expanded, sizeof(aes_expanded));
}
static void qat_alg_skcipher_init_dec(struct qat_alg_skcipher_ctx *ctx,
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0402/1376] crypto: atmel-ecc - replace min_t with min
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (400 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0401/1376] crypto: qat - clear AES key schedule from stack Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0403/1376] crypto: atmel-ecc - clean up and improve ECDH comments Greg Kroah-Hartman
` (596 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thorsten Blum, David Laight,
Herbert Xu, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@linux.dev>
[ Upstream commit 5b085b2a038a1458f9398cb3b3b03cba6e38e1e0 ]
Use the simpler min() macro since the values are all unsigned and
compatible.
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Reviewed-by: David Laight <david.laght.linux@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Stable-dep-of: f240f9b588f4 ("crypto: atmel-ecc - reject hardware ECDH without a public key")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/atmel-ecc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/crypto/atmel-ecc.c b/drivers/crypto/atmel-ecc.c
index 9da5a03880807..0ce56b095805a 100644
--- a/drivers/crypto/atmel-ecc.c
+++ b/drivers/crypto/atmel-ecc.c
@@ -56,7 +56,7 @@ static void atmel_ecdh_done(struct atmel_i2c_work_data *work_data, void *areq,
goto free_work_data;
/* might want less than we've got */
- n_sz = min_t(size_t, ATMEL_ECC_NIST_P256_N_SIZE, req->dst_len);
+ n_sz = min(ATMEL_ECC_NIST_P256_N_SIZE, req->dst_len);
/* copy the shared secret */
copied = sg_copy_from_buffer(req->dst, sg_nents_for_len(req->dst, n_sz),
@@ -150,7 +150,7 @@ static int atmel_ecdh_generate_public_key(struct kpp_request *req)
return -EINVAL;
/* might want less than we've got */
- nbytes = min_t(size_t, ATMEL_ECC_PUBKEY_SIZE, req->dst_len);
+ nbytes = min(ATMEL_ECC_PUBKEY_SIZE, req->dst_len);
/* public key was saved at private key generation */
copied = sg_copy_from_buffer(req->dst,
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0403/1376] crypto: atmel-ecc - clean up and improve ECDH comments
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (401 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0402/1376] crypto: atmel-ecc - replace min_t with min Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0404/1376] crypto: atmel-ecc - reject hardware ECDH without a public key Greg Kroah-Hartman
` (595 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Herbert Xu,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@linux.dev>
[ Upstream commit 3e84fb698abada239d3e35ed3d52a24dbfda5f6a ]
Improve the kerneldoc for struct atmel_ecdh_ctx by removing the stale
"unsupported curves" wording, since the device only supports a single
curve (P-256), and move the set_secret() constraint to the description.
In atmel_ecdh_set_secret(), clarify that the device generates the
private key, and drop the redundant "only supports NIST P256" comment.
In atmel_ecdh_done() and atmel_ecdh_generate_public_key(), clarify the
truncation comments. Also note that a P-256 public key consists of two
32-byte coordinates in atmel_ecdh_compute_shared_secret(), and remove
the unnecessary fall-through comment and other redundant comments.
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Stable-dep-of: f240f9b588f4 ("crypto: atmel-ecc - reject hardware ECDH without a public key")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/atmel-ecc.c | 38 ++++++++++++++------------------------
1 file changed, 14 insertions(+), 24 deletions(-)
diff --git a/drivers/crypto/atmel-ecc.c b/drivers/crypto/atmel-ecc.c
index 0ce56b095805a..efb346e5550e8 100644
--- a/drivers/crypto/atmel-ecc.c
+++ b/drivers/crypto/atmel-ecc.c
@@ -27,15 +27,14 @@ static struct atmel_ecc_driver_data driver_data;
/**
* struct atmel_ecdh_ctx - transformation context
- * @client : pointer to i2c client device
- * @fallback : used for unsupported curves or when user wants to use its own
- * private key.
- * @public_key : generated when calling set_secret(). It's the responsibility
- * of the user to not call set_secret() while
- * generate_public_key() or compute_shared_secret() are in flight.
- * @curve_id : elliptic curve id
- * @do_fallback: true when the device doesn't support the curve or when the user
- * wants to use its own private key.
+ * @client: I2C client device
+ * @fallback: ECDH fallback used for caller-provided private keys
+ * @public_key: cached public key for the device-generated private key
+ * @curve_id: elliptic curve id
+ * @do_fallback: true when ECDH operations should use @fallback
+ *
+ * The caller must not invoke set_secret() while generate_public_key()
+ * or compute_shared_secret() are in flight.
*/
struct atmel_ecdh_ctx {
struct i2c_client *client;
@@ -55,7 +54,7 @@ static void atmel_ecdh_done(struct atmel_i2c_work_data *work_data, void *areq,
if (status)
goto free_work_data;
- /* might want less than we've got */
+ /* copy only as much as requested, capped at 32 bytes */
n_sz = min(ATMEL_ECC_NIST_P256_N_SIZE, req->dst_len);
/* copy the shared secret */
@@ -64,15 +63,15 @@ static void atmel_ecdh_done(struct atmel_i2c_work_data *work_data, void *areq,
if (copied != n_sz)
status = -EINVAL;
- /* fall through */
free_work_data:
kfree_sensitive(work_data);
kpp_request_complete(req, status);
}
/*
- * A random private key is generated and stored in the device. The device
- * returns the pair public key.
+ * If no private key is provided, generate one in the device and cache
+ * the corresponding public key. The generated private key never leaves
+ * the device.
*/
static int atmel_ecdh_set_secret(struct crypto_kpp *tfm, const void *buf,
unsigned int len)
@@ -83,9 +82,7 @@ static int atmel_ecdh_set_secret(struct crypto_kpp *tfm, const void *buf,
struct ecdh params;
int ret = -ENOMEM;
- /* free the old public key, if any */
kfree(ctx->public_key);
- /* make sure you don't free the old public key twice */
ctx->public_key = NULL;
if (crypto_ecdh_decode_key(buf, len, ¶ms) < 0) {
@@ -94,7 +91,6 @@ static int atmel_ecdh_set_secret(struct crypto_kpp *tfm, const void *buf,
}
if (params.key_size) {
- /* fallback to ecdh software implementation */
ctx->do_fallback = true;
return crypto_kpp_set_secret(ctx->fallback, buf, len);
}
@@ -103,11 +99,6 @@ static int atmel_ecdh_set_secret(struct crypto_kpp *tfm, const void *buf,
if (!cmd)
return -ENOMEM;
- /*
- * The device only supports NIST P256 ECC keys. The public key size will
- * always be the same. Use a macro for the key size to avoid unnecessary
- * computations.
- */
public_key = kmalloc(ATMEL_ECC_PUBKEY_SIZE, GFP_KERNEL);
if (!public_key)
goto free_cmd;
@@ -120,7 +111,6 @@ static int atmel_ecdh_set_secret(struct crypto_kpp *tfm, const void *buf,
if (ret)
goto free_public_key;
- /* save the public key */
memcpy(public_key, &cmd->data[RSP_DATA_IDX], ATMEL_ECC_PUBKEY_SIZE);
ctx->public_key = public_key;
@@ -149,7 +139,7 @@ static int atmel_ecdh_generate_public_key(struct kpp_request *req)
if (!ctx->public_key)
return -EINVAL;
- /* might want less than we've got */
+ /* copy only as much as requested, capped at 64 bytes */
nbytes = min(ATMEL_ECC_PUBKEY_SIZE, req->dst_len);
/* public key was saved at private key generation */
@@ -175,7 +165,7 @@ static int atmel_ecdh_compute_shared_secret(struct kpp_request *req)
return crypto_kpp_compute_shared_secret(req);
}
- /* must have exactly two points to be on the curve */
+ /* A P-256 public key must contain two 32-byte coordinates */
if (req->src_len != ATMEL_ECC_PUBKEY_SIZE)
return -EINVAL;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0404/1376] crypto: atmel-ecc - reject hardware ECDH without a public key
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (402 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0403/1376] crypto: atmel-ecc - clean up and improve ECDH comments Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0405/1376] crypto: atmel-sha204a - fix heap info leak on I2C transfer failure Greg Kroah-Hartman
` (594 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Herbert Xu,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@linux.dev>
[ Upstream commit f240f9b588f4e2de89822adebf560a96b5d263ed ]
The hardware ECDH path in atmel_ecdh_compute_shared_secret() uses the
private key stored in the device. However, the public key is cached only
after atmel_ecdh_set_secret() successfully generated that private key
for the current tfm.
atmel_ecdh_generate_public_key() already rejects requests when no public
key is cached. Add the same check to atmel_ecdh_compute_shared_secret()
to prevent the device from using a private key that was not generated
for the current tfm.
Fixes: 11105693fa05 ("crypto: atmel-ecc - introduce Microchip / Atmel ECC driver")
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/atmel-ecc.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/crypto/atmel-ecc.c b/drivers/crypto/atmel-ecc.c
index efb346e5550e8..c64431380d303 100644
--- a/drivers/crypto/atmel-ecc.c
+++ b/drivers/crypto/atmel-ecc.c
@@ -165,6 +165,9 @@ static int atmel_ecdh_compute_shared_secret(struct kpp_request *req)
return crypto_kpp_compute_shared_secret(req);
}
+ if (!ctx->public_key)
+ return -EINVAL;
+
/* A P-256 public key must contain two 32-byte coordinates */
if (req->src_len != ATMEL_ECC_PUBKEY_SIZE)
return -EINVAL;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0405/1376] crypto: atmel-sha204a - fix heap info leak on I2C transfer failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (403 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0404/1376] crypto: atmel-ecc - reject hardware ECDH without a public key Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0406/1376] crypto: sa2ul - stop probe if context pool creation fails Greg Kroah-Hartman
` (593 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lothar Rubusch, Thorsten Blum,
Herbert Xu, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lothar Rubusch <l.rubusch@gmail.com>
[ Upstream commit 72bbf11ba14bd7d5fbf31a1ec42fff608b657f74 ]
The nonblocking RNG path allocates a work_data structure to track the
state of an in-flight asynchronous I2C request. This pointer is stored
in rng->priv and later consumed by the read path once the transaction
completes.
If the underlying I2C transfer fails, the completion callback is invoked
with a non-zero status. In this case, the allocated work_data is not
usable for producing RNG output and must not remain associated with the
hwrng state.
Previously, the failure path only logged a warning but left the pointer
state uncleared, which can result in subsequent read attempts observing
stale state and interpreting it as valid completion data.
Fix this by freeing the pending work_data. The I2C transaction reports
an error. This ensures that failed requests do not leave residual state
behind that could be interpreted as valid RNG data on later reads.
Clearing rng->priv is done at the subsequent call to nonblocking read.
Fixes: da001fb651b0 ("crypto: atmel-i2c - add support for SHA204A random number generator")
Signed-off-by: Lothar Rubusch <l.rubusch@gmail.com>
Assisted-by: Gemini:1.5 Pro [google]
Reviewed-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/atmel-sha204a.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/crypto/atmel-sha204a.c b/drivers/crypto/atmel-sha204a.c
index 8a3520c9a0ff5..d2031abbd8efa 100644
--- a/drivers/crypto/atmel-sha204a.c
+++ b/drivers/crypto/atmel-sha204a.c
@@ -31,10 +31,14 @@ static void atmel_sha204a_rng_done(struct atmel_i2c_work_data *work_data,
struct atmel_i2c_client_priv *i2c_priv = work_data->ctx;
struct hwrng *rng = areq;
- if (status)
+ if (status) {
dev_warn_ratelimited(&i2c_priv->client->dev,
"i2c transaction failed (%d)\n",
status);
+ kfree(work_data);
+ atomic_dec(&i2c_priv->tfm_count);
+ return;
+ }
rng->priv = (unsigned long)work_data;
atomic_dec(&i2c_priv->tfm_count);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0406/1376] crypto: sa2ul - stop probe if context pool creation fails
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (404 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0405/1376] crypto: atmel-sha204a - fix heap info leak on I2C transfer failure Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0407/1376] crypto: rk3288 - fail ahash requests on HASH idle timeout Greg Kroah-Hartman
` (592 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Herbert Xu,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ Upstream commit d03f980a25853f6a380895119a572a3bb1194e8d ]
sa_ul_probe() calls sa_init_mem() to create the DMA pool used for
security context buffers, but ignores its return value. If pool creation
fails, probe still continues with DMA setup, algorithm registration and
child population even though later request setup depends on that pool.
Stop probing when sa_init_mem() fails, and route that failure to the PM
cleanup path without attempting to destroy an uncreated DMA pool.
Fixes: 7694b6ca649f ("crypto: sa2ul - Add crypto driver")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/sa2ul.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/crypto/sa2ul.c b/drivers/crypto/sa2ul.c
index d1c2d129ad418..a8f5f475acbe6 100644
--- a/drivers/crypto/sa2ul.c
+++ b/drivers/crypto/sa2ul.c
@@ -2426,7 +2426,10 @@ static int sa_ul_probe(struct platform_device *pdev)
return ret;
}
- sa_init_mem(dev_data);
+ ret = sa_init_mem(dev_data);
+ if (ret)
+ goto disable_pm;
+
ret = sa_dma_init(dev_data);
if (ret)
goto destroy_dma_pool;
@@ -2461,6 +2464,7 @@ static int sa_ul_probe(struct platform_device *pdev)
destroy_dma_pool:
dma_pool_destroy(dev_data->sc_pool);
+disable_pm:
pm_runtime_put_sync(dev);
pm_runtime_disable(dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0407/1376] crypto: rk3288 - fail ahash requests on HASH idle timeout
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (405 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0406/1376] crypto: sa2ul - stop probe if context pool creation fails Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0408/1376] crypto: keembay - Fix AEAD unregister count in error path Greg Kroah-Hartman
` (591 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Herbert Xu,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ Upstream commit ae150db7826f21e8d19e54fb6243169628809c4d ]
rk_hash_run() waits for RK_CRYPTO_HASH_STS to become idle after the
final DMA transfer, but ignores the poll result. If the hash engine
never becomes idle, the driver still reads the digest registers and
finalizes the request with the previous success value.
Store the poll result and finalize the request with the timeout error
before reading the digest registers.
Fixes: 37bc22159c45 ("crypto: rockchip - use read_poll_timeout")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/rockchip/rk3288_crypto_ahash.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/crypto/rockchip/rk3288_crypto_ahash.c b/drivers/crypto/rockchip/rk3288_crypto_ahash.c
index ba26b4db7a608..f726e53df9fed 100644
--- a/drivers/crypto/rockchip/rk3288_crypto_ahash.c
+++ b/drivers/crypto/rockchip/rk3288_crypto_ahash.c
@@ -322,7 +322,12 @@ static int rk_hash_run(struct crypto_engine *engine, void *breq)
* efficiency, and make it response quickly when dma
* complete.
*/
- readl_poll_timeout(rkc->reg + RK_CRYPTO_HASH_STS, v, v == 0, 10, 1000);
+ err = readl_poll_timeout(rkc->reg + RK_CRYPTO_HASH_STS, v,
+ v == 0, 10, 1000);
+ if (err) {
+ dev_err(rkc->dev, "HASH idle timeout\n");
+ goto theend;
+ }
for (i = 0; i < crypto_ahash_digestsize(tfm) / 4; i++) {
v = readl(rkc->reg + RK_CRYPTO_HASH_DOUT_0 + i * 4);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0408/1376] crypto: keembay - Fix AEAD unregister count in error path
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (406 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0407/1376] crypto: rk3288 - fail ahash requests on HASH idle timeout Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0409/1376] nvme-apple: Use acquire/release for queue enabled state Greg Kroah-Hartman
` (590 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak, Herbert Xu,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit e264401ce4776a288524e5b87593d4d864147115 ]
register_aes_algs() registers the AEAD algorithms before registering the
skcipher algorithms. If skcipher registration fails, the function unwinds
the earlier AEAD registration with crypto_engine_unregister_aeads(), but it
passes ARRAY_SIZE(algs), which is the skcipher table size.
Use ARRAY_SIZE(algs_aead) for the AEAD unwind path so the unregister helper
iterates over the same table that was registered. Also clarify the nearby
comment: the crypto registration helpers clean up algorithms registered
within the same call, while this function must still unwind earlier
successful registration steps.
Fixes: 885743324513 ("crypto: keembay - Add support for Keem Bay OCS AES/SM4")
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/intel/keembay/keembay-ocs-aes-core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/crypto/intel/keembay/keembay-ocs-aes-core.c b/drivers/crypto/intel/keembay/keembay-ocs-aes-core.c
index 9b2d098e5eb2c..a02a75bd29860 100644
--- a/drivers/crypto/intel/keembay/keembay-ocs-aes-core.c
+++ b/drivers/crypto/intel/keembay/keembay-ocs-aes-core.c
@@ -1541,7 +1541,7 @@ static int register_aes_algs(struct ocs_aes_dev *aes_dev)
/*
* If any algorithm fails to register, all preceding algorithms that
- * were successfully registered will be automatically unregistered.
+ * were registered in the same call are automatically unregistered.
*/
ret = crypto_engine_register_aeads(algs_aead, ARRAY_SIZE(algs_aead));
if (ret)
@@ -1549,7 +1549,7 @@ static int register_aes_algs(struct ocs_aes_dev *aes_dev)
ret = crypto_engine_register_skciphers(algs, ARRAY_SIZE(algs));
if (ret)
- crypto_engine_unregister_aeads(algs_aead, ARRAY_SIZE(algs));
+ crypto_engine_unregister_aeads(algs_aead, ARRAY_SIZE(algs_aead));
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0409/1376] nvme-apple: Use acquire/release for queue enabled state
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (407 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0408/1376] crypto: keembay - Fix AEAD unregister count in error path Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0410/1376] nvmet-rdma: factor out response resource cleanup Greg Kroah-Hartman
` (589 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gui-Dong Han, Christoph Hellwig,
Keith Busch, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gui-Dong Han <hanguidong02@gmail.com>
[ Upstream commit f61c934aa084b7440fec681be3f4b481eb5a8609 ]
apple_nvme_init_queue() initializes queue state and then marks the queue
enabled. The interrupt and request paths check enabled before using that
queue state.
The old wmb() after WRITE_ONCE(enabled, true) does not publish the
earlier initialization before enabled becomes visible. Use a release store
when enabling the queue and acquire loads when testing it.
Although the shutdown-side enabled accesses are not used for publishing
queue initialization, use helpers for them as well for consistency.
Fixes: 5bd2927aceba ("nvme-apple: Add initial Apple SoC NVMe driver")
Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/apple.c | 30 +++++++++++++++++++++++-------
1 file changed, 23 insertions(+), 7 deletions(-)
diff --git a/drivers/nvme/host/apple.c b/drivers/nvme/host/apple.c
index 839c6737dbb6b..a83721ec22993 100644
--- a/drivers/nvme/host/apple.c
+++ b/drivers/nvme/host/apple.c
@@ -149,6 +149,23 @@ struct apple_nvme_queue {
bool enabled;
};
+static inline bool apple_nvme_queue_enabled(struct apple_nvme_queue *q)
+{
+ /* Pair with apple_nvme_enable_queue(). */
+ return smp_load_acquire(&q->enabled);
+}
+
+static inline void apple_nvme_enable_queue(struct apple_nvme_queue *q)
+{
+ /* Publish queue initialization before setting q->enabled. */
+ smp_store_release(&q->enabled, true);
+}
+
+static inline void apple_nvme_disable_queue(struct apple_nvme_queue *q)
+{
+ WRITE_ONCE(q->enabled, false);
+}
+
/*
* The apple_nvme_iod describes the data in an I/O.
*
@@ -645,7 +662,7 @@ static bool apple_nvme_handle_cq(struct apple_nvme_queue *q, bool force)
bool found;
DEFINE_IO_COMP_BATCH(iob);
- if (!READ_ONCE(q->enabled) && !force)
+ if (!apple_nvme_queue_enabled(q) && !force)
return false;
found = apple_nvme_poll_cq(q, &iob);
@@ -748,7 +765,7 @@ static blk_status_t apple_nvme_queue_rq(struct blk_mq_hw_ctx *hctx,
* We should not need to do this, but we're still using this to
* ensure we can drain requests on a dying queue.
*/
- if (unlikely(!READ_ONCE(q->enabled)))
+ if (unlikely(!apple_nvme_queue_enabled(q)))
return BLK_STS_IOERR;
if (!nvme_check_ready(&anv->ctrl, req, true))
@@ -826,7 +843,7 @@ static void apple_nvme_disable(struct apple_nvme *anv, bool shutdown)
nvme_quiesce_io_queues(&anv->ctrl);
if (!dead) {
- if (READ_ONCE(anv->ioq.enabled)) {
+ if (apple_nvme_queue_enabled(&anv->ioq)) {
apple_nvme_remove_sq(anv);
apple_nvme_remove_cq(anv);
}
@@ -850,8 +867,8 @@ static void apple_nvme_disable(struct apple_nvme *anv, bool shutdown)
nvme_disable_ctrl(&anv->ctrl, false);
}
- WRITE_ONCE(anv->ioq.enabled, false);
- WRITE_ONCE(anv->adminq.enabled, false);
+ apple_nvme_disable_queue(&anv->ioq);
+ apple_nvme_disable_queue(&anv->adminq);
mb(); /* ensure that nvme_queue_rq() sees that enabled is cleared */
nvme_quiesce_admin_queue(&anv->ctrl);
@@ -976,8 +993,7 @@ static void apple_nvme_init_queue(struct apple_nvme_queue *q)
memset(q->tcbs, 0,
APPLE_ANS_MAX_QUEUE_DEPTH * sizeof(struct apple_nvmmu_tcb));
memset(q->cqes, 0, depth * sizeof(struct nvme_completion));
- WRITE_ONCE(q->enabled, true);
- wmb(); /* ensure the first interrupt sees the initialization */
+ apple_nvme_enable_queue(q);
}
static void apple_nvme_reset_work(struct work_struct *work)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0410/1376] nvmet-rdma: factor out response resource cleanup
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (408 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0409/1376] nvme-apple: Use acquire/release for queue enabled state Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0411/1376] nvmet-rdma: fix response resource leak on queue teardown Greg Kroah-Hartman
` (588 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shinichiro Kawasaki,
Christoph Hellwig, Keith Busch, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
[ Upstream commit 90096175473f7c86e39c3f74f10343f965f5a05d ]
Move the RDMA read/write context teardown and the request SGL freeing
out of nvmet_rdma_release_rsp() into a new helper function
nvmet_rdma_free_rsp_resources().
This is a refactoring with no functional change, in preparation for the
following patch that uses nvmet_rdma_free_rsp_resources().
Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Stable-dep-of: 0114dd303b37 ("nvmet-rdma: fix response resource leak on queue teardown")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/rdma.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
index eb971feece0fd..f8574eecd2c71 100644
--- a/drivers/nvme/target/rdma.c
+++ b/drivers/nvme/target/rdma.c
@@ -658,18 +658,25 @@ static void nvmet_rdma_rw_ctx_destroy(struct nvmet_rdma_rsp *rsp)
req->sg, req->sg_cnt, nvmet_data_dir(req));
}
-static void nvmet_rdma_release_rsp(struct nvmet_rdma_rsp *rsp)
+static void nvmet_rdma_free_rsp_resources(struct nvmet_rdma_rsp *rsp)
{
struct nvmet_rdma_queue *queue = rsp->queue;
- atomic_add(1 + rsp->n_rdma, &queue->sq_wr_avail);
-
if (rsp->n_rdma)
nvmet_rdma_rw_ctx_destroy(rsp);
if (rsp->req.sg < rsp->cmd->inline_sg ||
rsp->req.sg >= rsp->cmd->inline_sg + queue->dev->inline_page_count)
nvmet_req_free_sgls(&rsp->req);
+}
+
+static void nvmet_rdma_release_rsp(struct nvmet_rdma_rsp *rsp)
+{
+ struct nvmet_rdma_queue *queue = rsp->queue;
+
+ atomic_add(1 + rsp->n_rdma, &queue->sq_wr_avail);
+
+ nvmet_rdma_free_rsp_resources(rsp);
if (unlikely(!list_empty_careful(&queue->rsp_wr_wait_list)))
nvmet_rdma_process_wr_wait_list(queue);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0411/1376] nvmet-rdma: fix response resource leak on queue teardown
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (409 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0410/1376] nvmet-rdma: factor out response resource cleanup Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0412/1376] bus: ti-sysc: Fix /chosen node reference leak Greg Kroah-Hartman
` (587 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shinichiro Kawasaki,
Christoph Hellwig, Keith Busch, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
[ Upstream commit 0114dd303b373522dea06053aabae34bdd33a7c4 ]
When an nvme target with rdma transport is removed while I/Os are in
flight, a response can be posted but its send completion is never
delivered before the connection is torn down. As a result
nvmet_rdma_send_done() and nvmet_rdma_release_rsp() are never called for
the response, and this leaks the allocated RDMA read/write context and
request SGLs.
These leaks are recreated by running blktests nvme/061 with the rdma
transport and the siw driver. Kernel kmemleak feature reports them as
follows:
unreferenced object 0xffff88812bc490c0 (size 32):
comm "kworker/2:1H", pid 409, jiffies 4307744490
backtrace (crc 89afd339):
__kmalloc_noprof+0x5f9/0x890
sgl_alloc_order+0x7b/0x380
nvmet_req_alloc_sgls+0x290/0x4f0 [nvmet]
nvmet_rdma_map_sgl_keyed+0x241/0x12e0 [nvmet_rdma]
nvmet_rdma_handle_command+0x73e/0xb80 [nvmet_rdma]
__ib_process_cq+0x149/0x4c0 [ib_core]
ib_cq_poll_work+0x49/0x160 [ib_core]
process_one_work+0x8b2/0x1640
worker_thread+0x5fd/0xfe0
kthread+0x367/0x460
ret_from_fork+0x655/0x9d0
ret_from_fork_asm+0x1a/0x30
unreferenced object 0xffff88814bd05e80 (size 64):
comm "kworker/3:1H", pid 148, jiffies 4295195428
backtrace (crc e35510cb):
__kmalloc_noprof+0x5f9/0x890
rdma_rw_ctx_init+0x333/0x1fa0 [ib_core]
nvmet_rdma_map_sgl_keyed+0x5c8/0x12e0 [nvmet_rdma]
nvmet_rdma_handle_command+0x73e/0xb80 [nvmet_rdma]
__ib_process_cq+0x149/0x4c0 [ib_core]
ib_cq_poll_work+0x49/0x160 [ib_core]
process_one_work+0x8b2/0x1640
worker_thread+0x5fd/0xfe0
kthread+0x367/0x460
ret_from_fork+0x655/0x9d0
ret_from_fork_asm+0x1a/0x30
To avoid the memory leaks, reclaim the memory of the in-flight responses
when the queue QP is torn down. Call nvmet_rdma_free_rsp_resources()
that frees up the RDMA read/write context and the request SGLs of such
responses.
Fixes: 8f000cac6e7a ("nvmet-rdma: add a NVMe over Fabrics RDMA target driver")
Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/rdma.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
index f8574eecd2c71..36eb26c5a05d2 100644
--- a/drivers/nvme/target/rdma.c
+++ b/drivers/nvme/target/rdma.c
@@ -1347,9 +1347,27 @@ static int nvmet_rdma_create_queue_ib(struct nvmet_rdma_queue *queue)
goto out;
}
+static bool nvmet_rdma_reclaim_rsp(struct sbitmap *sb, unsigned int bitnr,
+ void *data)
+{
+ struct nvmet_rdma_queue *queue = data;
+
+ nvmet_rdma_free_rsp_resources(&queue->rsps[bitnr]);
+
+ return true;
+}
+
static void nvmet_rdma_destroy_queue_ib(struct nvmet_rdma_queue *queue)
{
ib_drain_qp(queue->qp);
+
+ /*
+ * Reclaim resources of a response that is still in-flight when the
+ * queue is being torn down. This happens when the connection was
+ * forcefully disconnected while an I/O is in flight.
+ */
+ sbitmap_for_each_set(&queue->rsp_tags, nvmet_rdma_reclaim_rsp, queue);
+
if (queue->cm_id)
rdma_destroy_id(queue->cm_id);
ib_destroy_qp(queue->qp);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0412/1376] bus: ti-sysc: Fix /chosen node reference leak
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (410 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0411/1376] nvmet-rdma: fix response resource leak on queue teardown Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0413/1376] PM: sleep: Fix off-by-one in wakelocks number limit check Greg Kroah-Hartman
` (586 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuho Choi, Andreas Kemnade,
Kevin Hilman (TI), Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <dbgh9129@gmail.com>
[ Upstream commit 6342de0aed216b6df460b492ddb532b3e0ed16f1 ]
sysc_init_stdout_path() gets the /chosen node with
of_find_node_by_path() to read stdout-path. The function then overwrites
the local node pointer with the stdout-path lookup result, or exits on
error, without dropping the /chosen reference.
Keep the /chosen node in a separate variable and put it after the
stdout-path value has been used for the lookup. The successful stdout
node lookup remains referenced by the cached stdout_path pointer.
Fixes: 3bb37c8e6e6a ("bus: ti-sysc: Handle stdout-path for debug console")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Reviewed-by: Andreas Kemnade <andreas@kemnade.info>
Link: https://patch.msgid.link/20260615200540.770205-1-dbgh9129@gmail.com
Signed-off-by: Kevin Hilman (TI) <khilman@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bus/ti-sysc.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
index 27149eb29afb2..382f7bc2e1eb4 100644
--- a/drivers/bus/ti-sysc.c
+++ b/drivers/bus/ti-sysc.c
@@ -682,6 +682,7 @@ static struct device_node *stdout_path;
static void sysc_init_stdout_path(struct sysc *ddata)
{
+ struct device_node *chosen;
struct device_node *np = NULL;
const char *uart;
@@ -691,15 +692,18 @@ static void sysc_init_stdout_path(struct sysc *ddata)
if (stdout_path)
return;
- np = of_find_node_by_path("/chosen");
- if (!np)
+ chosen = of_find_node_by_path("/chosen");
+ if (!chosen)
goto err;
- uart = of_get_property(np, "stdout-path", NULL);
- if (!uart)
+ uart = of_get_property(chosen, "stdout-path", NULL);
+ if (!uart) {
+ of_node_put(chosen);
goto err;
+ }
np = of_find_node_by_path(uart);
+ of_node_put(chosen);
if (!np)
goto err;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0413/1376] PM: sleep: Fix off-by-one in wakelocks number limit check
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (411 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0412/1376] bus: ti-sysc: Fix /chosen node reference leak Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0414/1376] cgroup/cpuset: Make nr_deadline_tasks an atomic_t Greg Kroah-Hartman
` (585 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haowen Tu, Rafael J. Wysocki,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haowen Tu <tuhaowen@uniontech.com>
[ Upstream commit 6058646587dded0ce0ba91bd5a6afbf14fe42055 ]
CONFIG_PM_WAKELOCKS_LIMIT is documented as the maximum number of
user-space wakeup sources, but the limit check is performed before
the counter is incremented and only rejects new wakeup sources when the
current number is greater than the limit. This allows one extra wakeup
source to be created.
Reject new wakeup sources once the counter has reached the limit.
Fixes: b86ff9820fd5 ("PM / Sleep: Add user space interface for manipulating wakeup sources, v3")
Signed-off-by: Haowen Tu <tuhaowen@uniontech.com>
[ rjw: Subject edits ]
Link: https://patch.msgid.link/20260624053839.2150567-1-tuhaowen@uniontech.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/power/wakelock.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/power/wakelock.c b/kernel/power/wakelock.c
index 4e941999a53ba..5c2a248cf249a 100644
--- a/kernel/power/wakelock.c
+++ b/kernel/power/wakelock.c
@@ -63,7 +63,7 @@ static unsigned int number_of_wakelocks;
static inline bool wakelocks_limit_exceeded(void)
{
- return number_of_wakelocks > CONFIG_PM_WAKELOCKS_LIMIT;
+ return number_of_wakelocks >= CONFIG_PM_WAKELOCKS_LIMIT;
}
static inline void increment_wakelocks_number(void)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0414/1376] cgroup/cpuset: Make nr_deadline_tasks an atomic_t
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (412 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0413/1376] PM: sleep: Fix off-by-one in wakelocks number limit check Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0415/1376] arm64: dts: qcom: sm7225-fairphone-fp4: Fix address in fb node name Greg Kroah-Hartman
` (584 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ridong Chen, Waiman Long, Tejun Heo,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Waiman Long <longman@redhat.com>
[ Upstream commit 95220e1f18f6321008f021abc7d6f581f64bcb82 ]
The nr_deadline_tasks variable in the cpuset structure was introduced by
commit 6c24849f5515 ("sched/cpuset: Keep track of SCHED_DEADLINE task
in cpusets"). It is reported by sashiko [1] that nr_deadline_tasks
can currently be modified by inc_dl_tasks_cs() under rq->lock and
by cpuset_attach() under cpuset_mutex. So if both updates happen
simultaneously, the nr_deadline_tasks variable can be corrupted leading
to incorrect operations down the road.
Fix that by changing its type to atomic_t so that nr_deadline_tasks
are always atomically updated. This fix patch is a low hanging fruit.
It can handle some of the races between a concurrent sched_setscheduler()
and cpuset_can_attach()/cpuset_attach() calls, but not all of them like
the other issue raised by sashiko [2]. This will be handled hopefully
in a future follow up patch.
[1] https://sashiko.dev/#/patchset/20260626181923.133658-1-longman%40redhat.com
[2] https://sashiko.dev/#/patchset/20260630033344.352702-1-longman%40redhat.com
Fixes: 6c24849f5515 ("sched/cpuset: Keep track of SCHED_DEADLINE task in cpusets")
Reviewed-by: Ridong Chen <ridong.chen@linux.dev>
Signed-off-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/cgroup/cpuset-internal.h | 2 +-
kernel/cgroup/cpuset.c | 10 +++++-----
2 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/kernel/cgroup/cpuset-internal.h b/kernel/cgroup/cpuset-internal.h
index 383963e28ac69..6c9916e85efd1 100644
--- a/kernel/cgroup/cpuset-internal.h
+++ b/kernel/cgroup/cpuset-internal.h
@@ -166,7 +166,7 @@ struct cpuset {
* number of SCHED_DEADLINE tasks attached to this cpuset, so that we
* know when to rebuild associated root domain bandwidth information.
*/
- int nr_deadline_tasks;
+ atomic_t nr_deadline_tasks;
int nr_migrate_dl_tasks;
u64 sum_migrate_dl_bw;
diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index 4bc1ea983fe79..425d1cbe73793 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -145,14 +145,14 @@ void inc_dl_tasks_cs(struct task_struct *p)
{
struct cpuset *cs = task_cs(p);
- cs->nr_deadline_tasks++;
+ atomic_inc(&cs->nr_deadline_tasks);
}
void dec_dl_tasks_cs(struct task_struct *p)
{
struct cpuset *cs = task_cs(p);
- cs->nr_deadline_tasks--;
+ atomic_dec(&cs->nr_deadline_tasks);
}
static inline int is_partition_valid(const struct cpuset *cs)
@@ -956,7 +956,7 @@ static void dl_update_tasks_root_domain(struct cpuset *cs)
struct css_task_iter it;
struct task_struct *task;
- if (cs->nr_deadline_tasks == 0)
+ if (atomic_read(&cs->nr_deadline_tasks) == 0)
return;
css_task_iter_start(&cs->css, 0, &it);
@@ -3142,8 +3142,8 @@ static void cpuset_attach(struct cgroup_taskset *tset)
cs->old_mems_allowed = cpuset_attach_nodemask_to;
if (cs->nr_migrate_dl_tasks) {
- cs->nr_deadline_tasks += cs->nr_migrate_dl_tasks;
- oldcs->nr_deadline_tasks -= cs->nr_migrate_dl_tasks;
+ atomic_add(cs->nr_migrate_dl_tasks, &cs->nr_deadline_tasks);
+ atomic_sub(cs->nr_migrate_dl_tasks, &oldcs->nr_deadline_tasks);
reset_migrate_dl_data(cs);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0415/1376] arm64: dts: qcom: sm7225-fairphone-fp4: Fix address in fb node name
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (413 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0414/1376] cgroup/cpuset: Make nr_deadline_tasks an atomic_t Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0416/1376] arm64: dts: qcom: hamoa: Fix clocks for HSPHYs Greg Kroah-Hartman
` (583 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luca Weiss, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <luca.weiss@fairphone.com>
[ Upstream commit f6e65005fe55c3d09287851523de06367cbf0bc2 ]
'reg' is 0xa0000000 so the node name is missing a zero. Add it, so that
the reg and address in the node name matches.
No functional impact.
Fixes: 4cbea668767d ("arm64: dts: qcom: sm7225: Add device tree for Fairphone 4")
Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260505-sm6350-misc-v1-3-0b9efc22690c@fairphone.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts b/arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts
index 83dac3ca53318..2a7c5a33b5dda 100644
--- a/arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts
+++ b/arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts
@@ -47,7 +47,7 @@ chosen {
stdout-path = "serial0:115200n8";
- framebuffer0: framebuffer@a000000 {
+ framebuffer0: framebuffer@a0000000 {
compatible = "simple-framebuffer";
reg = <0 0xa0000000 0 (2340 * 1080 * 4)>;
width = <1080>;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0416/1376] arm64: dts: qcom: hamoa: Fix clocks for HSPHYs
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (414 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0415/1376] arm64: dts: qcom: sm7225-fairphone-fp4: Fix address in fb node name Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0417/1376] bus: qcom-ebi2: Simplify with scoped for each OF child loop Greg Kroah-Hartman
` (582 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Abel Vesa,
Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
[ Upstream commit 115894bc201b0cd1799d239875a1b40924f0ef7b ]
The tertiary controller's HSPHY has its own toggle in TCSR, while the
primary one is wired directly to the XO clock. Fix that.
Fixes: 4af46b7bd66f ("arm64: dts: qcom: x1e80100: Add USB nodes")
Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260518-topic-hamoa_hsphy_clk-v1-1-d85203756505@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/x1e80100.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/x1e80100.dtsi b/arch/arm64/boot/dts/qcom/x1e80100.dtsi
index 7e9de1b7c7a31..d456190ed76d4 100644
--- a/arch/arm64/boot/dts/qcom/x1e80100.dtsi
+++ b/arch/arm64/boot/dts/qcom/x1e80100.dtsi
@@ -2596,7 +2596,7 @@ usb_1_ss0_hsphy: phy@fd3000 {
reg = <0 0x00fd3000 0 0x154>;
#phy-cells = <0>;
- clocks = <&tcsr TCSR_USB2_1_CLKREF_EN>;
+ clocks = <&rpmhcc RPMH_CXO_CLK>;
clock-names = "ref";
resets = <&gcc GCC_QUSB2PHY_PRIM_BCR>;
@@ -2736,7 +2736,7 @@ usb_1_ss2_hsphy: phy@fde000 {
reg = <0 0x00fde000 0 0x154>;
#phy-cells = <0>;
- clocks = <&tcsr TCSR_USB2_1_CLKREF_EN>;
+ clocks = <&tcsr TCSR_USB2_2_CLKREF_EN>;
clock-names = "ref";
resets = <&gcc GCC_QUSB2PHY_TERT_BCR>;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0417/1376] bus: qcom-ebi2: Simplify with scoped for each OF child loop
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (415 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0416/1376] arm64: dts: qcom: hamoa: Fix clocks for HSPHYs Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0418/1376] bus: qcom-ebi2: Fix clock leak on probe failure Greg Kroah-Hartman
` (581 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
[ Upstream commit 9c252f3c8f390fae4ca09de36c9262a35ae88ace ]
Use scoped for-each loop when iterating over device nodes to make code a
bit simpler.
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260102125030.65186-3-krzysztof.kozlowski@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Stable-dep-of: 64774dea5896 ("bus: qcom-ebi2: Fix clock leak on probe failure")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bus/qcom-ebi2.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/drivers/bus/qcom-ebi2.c b/drivers/bus/qcom-ebi2.c
index c1fef1b4bd89b..be8166565e7cc 100644
--- a/drivers/bus/qcom-ebi2.c
+++ b/drivers/bus/qcom-ebi2.c
@@ -292,7 +292,6 @@ static void qcom_ebi2_setup_chipselect(struct device_node *np,
static int qcom_ebi2_probe(struct platform_device *pdev)
{
struct device_node *np = pdev->dev.of_node;
- struct device_node *child;
struct device *dev = &pdev->dev;
struct resource *res;
void __iomem *ebi2_base;
@@ -348,15 +347,13 @@ static int qcom_ebi2_probe(struct platform_device *pdev)
writel(val, ebi2_base);
/* Walk over the child nodes and see what chipselects we use */
- for_each_available_child_of_node(np, child) {
+ for_each_available_child_of_node_scoped(np, child) {
u32 csindex;
/* Figure out the chipselect */
ret = of_property_read_u32(child, "reg", &csindex);
- if (ret) {
- of_node_put(child);
+ if (ret)
return ret;
- }
if (csindex > 5) {
dev_err(dev,
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0418/1376] bus: qcom-ebi2: Fix clock leak on probe failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (416 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0417/1376] bus: qcom-ebi2: Simplify with scoped for each OF child loop Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0419/1376] wifi: mac80211_hwsim: avoid NULL skb in stop queue drain Greg Kroah-Hartman
` (580 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ruoyu Wang, Bjorn Andersson,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <ruoyuw560@gmail.com>
[ Upstream commit 64774dea58969194ea5c27fa639954e551a87024 ]
qcom_ebi2_probe() enables the EBI2X and EBI2 clocks before it walks
child nodes and populates child devices. If reading a child node's reg
property fails, or if of_platform_default_populate() fails, probe returns
without disabling either clock.
Route those failure paths through the existing clock cleanup labels so a
failed probe does not leave the clocks prepared and enabled.
Fixes: 335a12754808 ("bus: qcom: add EBI2 driver")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Link: https://lore.kernel.org/r/20260620080406.1970447-1-ruoyuw560@gmail.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bus/qcom-ebi2.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/bus/qcom-ebi2.c b/drivers/bus/qcom-ebi2.c
index be8166565e7cc..ab00c75b9e953 100644
--- a/drivers/bus/qcom-ebi2.c
+++ b/drivers/bus/qcom-ebi2.c
@@ -353,7 +353,7 @@ static int qcom_ebi2_probe(struct platform_device *pdev)
/* Figure out the chipselect */
ret = of_property_read_u32(child, "reg", &csindex);
if (ret)
- return ret;
+ goto err_disable_clk;
if (csindex > 5) {
dev_err(dev,
@@ -372,8 +372,12 @@ static int qcom_ebi2_probe(struct platform_device *pdev)
have_children = true;
}
- if (have_children)
- return of_platform_default_populate(np, NULL, dev);
+ if (have_children) {
+ ret = of_platform_default_populate(np, NULL, dev);
+ if (ret)
+ goto err_disable_clk;
+ }
+
return 0;
err_disable_clk:
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0419/1376] wifi: mac80211_hwsim: avoid NULL skb in stop queue drain
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (417 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0418/1376] bus: qcom-ebi2: Fix clock leak on probe failure Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0420/1376] staging: greybus: audio: correct sscanf() return value check Greg Kroah-Hartman
` (579 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cen Zhang, Johannes Berg,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <zzzccc427@gmail.com>
[ Upstream commit 158438cd6ad69d6dd7d871582c38baf22169fede ]
mac80211_hwsim_stop() drops any frames left in data->pending. The loop
currently checks skb_queue_empty() and then dequeues separately.
That split is racy with TX status handling, which can remove a pending
frame under the queue lock. If the last entry is removed after the empty
check, skb_dequeue() returns NULL and the stop path passes that NULL skb
to ieee80211_free_txskb().
Use skb_dequeue() as the loop condition instead. The dequeue result is the
object that stop owns and frees, and a concurrent status completion that
empties the queue simply makes the loop terminate.
Fixes: bd18de517923 ("mac80211_hwsim: drop pending frames on stop")
Assisted-by: Codex:gpt-5.5
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Link: https://patch.msgid.link/20260706161822.921039-1-zzzccc427@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/virtual/mac80211_hwsim.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/virtual/mac80211_hwsim.c b/drivers/net/wireless/virtual/mac80211_hwsim.c
index 63fae67c81622..4622cbf4f5f98 100644
--- a/drivers/net/wireless/virtual/mac80211_hwsim.c
+++ b/drivers/net/wireless/virtual/mac80211_hwsim.c
@@ -2117,6 +2117,7 @@ static int mac80211_hwsim_start(struct ieee80211_hw *hw)
static void mac80211_hwsim_stop(struct ieee80211_hw *hw, bool suspend)
{
struct mac80211_hwsim_data *data = hw->priv;
+ struct sk_buff *skb;
int i;
data->started = false;
@@ -2124,8 +2125,8 @@ static void mac80211_hwsim_stop(struct ieee80211_hw *hw, bool suspend)
for (i = 0; i < ARRAY_SIZE(data->link_data); i++)
hrtimer_cancel(&data->link_data[i].beacon_timer);
- while (!skb_queue_empty(&data->pending))
- ieee80211_free_txskb(hw, skb_dequeue(&data->pending));
+ while ((skb = skb_dequeue(&data->pending)))
+ ieee80211_free_txskb(hw, skb);
wiphy_dbg(hw->wiphy, "%s\n", __func__);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0420/1376] staging: greybus: audio: correct sscanf() return value check
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (418 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0419/1376] wifi: mac80211_hwsim: avoid NULL skb in stop queue drain Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0421/1376] staging: sm750fb: gate dualview dataflow using g_dualview Greg Kroah-Hartman
` (578 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alexander A. Klimov, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander A. Klimov <grandmaster@al2klimov.de>
[ Upstream commit f883fa1a0a0212f63acb18c50e5f900301f3bb1e ]
manager_sysfs_add_store() passes 6 pointers to sscanf(),
but required latter to return 7 which always failed the operation.
I corrected it to 6.
Fixes: 49b9137a6002 ("staging: greybus: audio: remove redundant slot field")
Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
Link: https://patch.msgid.link/20260521182331.22685-1-grandmaster@al2klimov.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/greybus/audio_manager_sysfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/greybus/audio_manager_sysfs.c b/drivers/staging/greybus/audio_manager_sysfs.c
index fcd518f9540cd..ff323ca8154f3 100644
--- a/drivers/staging/greybus/audio_manager_sysfs.c
+++ b/drivers/staging/greybus/audio_manager_sysfs.c
@@ -23,7 +23,7 @@ static ssize_t manager_sysfs_add_store(struct kobject *kobj,
desc.name, &desc.vid, &desc.pid, &desc.intf_id,
&desc.ip_devices, &desc.op_devices);
- if (num != 7)
+ if (num != 6)
return -EINVAL;
num = gb_audio_manager_add(&desc);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0421/1376] staging: sm750fb: gate dualview dataflow using g_dualview
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (419 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0420/1376] staging: greybus: audio: correct sscanf() return value check Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0422/1376] staging: sm750fb: Add missing Kconfig dependency Greg Kroah-Hartman
` (577 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ahmet Sezgin Duran, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahmet Sezgin Duran <ahmet@sezginduran.net>
[ Upstream commit d352778979d2eed09e266ed0f3a5e3ccd3983940 ]
In sm750fb_setup and sm750fb_set_drv functions, the dualview
related code is guarded by `sm750_dev->fb_count > 1` condition.
That value is updated only after each framebuffer is registered,
while both guards are used before any increment.
Current flow:
lynxfb_pci_probe()
sm750fb_setup() // fb_count is 0
for each fb:
sm750fb_framebuffer_alloc()
lynxfb_set_fbinfo()
sm750fb_set_drv() // fb_count is 0 or 1
register_framebuffer()
sm750_dev->fb_count++; // fb_count is incremented
Thus even if `dualview=1` parameter is passed down to the driver,
fb_count is never > 1 at either check, so dualview dataflows are
not selected and crtc->vidmem_size is never halved.
Use `g_dualview` global variable instead of fb_count > 1 to correctly
enable dualview capabilities.
Fixes: a3f92cc94c61 ("staging: sm750fb: replace dual member of sm750_dev with fb_count")
Signed-off-by: Ahmet Sezgin Duran <ahmet@sezginduran.net>
Link: https://patch.msgid.link/20260521204425.82627-1-ahmet@sezginduran.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/sm750fb/sm750.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
index 94a83ec342827..1452edab96cc9 100644
--- a/drivers/staging/sm750fb/sm750.c
+++ b/drivers/staging/sm750fb/sm750.c
@@ -599,7 +599,7 @@ static int sm750fb_set_drv(struct lynxfb_par *par)
crtc = &par->crtc;
crtc->vidmem_size = sm750_dev->vidmem_size;
- if (sm750_dev->fb_count > 1)
+ if (g_dualview)
crtc->vidmem_size >>= 1;
/* setup crtc and output member */
@@ -966,7 +966,7 @@ static void sm750fb_setup(struct sm750_dev *sm750_dev, char *src)
NO_PARAM:
if (sm750_dev->revid != SM750LE_REVISION_ID) {
- if (sm750_dev->fb_count > 1) {
+ if (g_dualview) {
if (swap)
sm750_dev->dataflow = sm750_dual_swap;
else
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0422/1376] staging: sm750fb: Add missing Kconfig dependency
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (420 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0421/1376] staging: sm750fb: gate dualview dataflow using g_dualview Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0423/1376] greybus: audio: bound the topology section sizes against the fetched size Greg Kroah-Hartman
` (576 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Rong Zhang, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rong Zhang <i@rong.moe>
[ Upstream commit da8fd33e7d6af4c069668c2d42234b969f706885 ]
The sm750 frame buffer driver depends on FB_IOMEM_FOPS, but its Kconfig
somehow misses it.
Fix it by making FB_SM750 select FB_IOMEM_FOPS, as other frame buffer
drivers do.
Fixes: dc0ad215e5d8 ("staging/sm750fb: Initialize fb_ops with fbdev macros")
Signed-off-by: Rong Zhang <i@rong.moe>
Link: https://patch.msgid.link/20260603-sm750-fb-iomem-kconfig-v1-1-7f6a3046cce2@rong.moe
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/sm750fb/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/staging/sm750fb/Kconfig b/drivers/staging/sm750fb/Kconfig
index 08bcccdd0f1c4..25fe422f55f2c 100644
--- a/drivers/staging/sm750fb/Kconfig
+++ b/drivers/staging/sm750fb/Kconfig
@@ -6,6 +6,7 @@ config FB_SM750
select FB_CFB_FILLRECT
select FB_CFB_COPYAREA
select FB_CFB_IMAGEBLIT
+ select FB_IOMEM_FOPS
help
Frame buffer driver for the Silicon Motion SM750 chip
with 2D acceleration and dual head support.
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0423/1376] greybus: audio: bound the topology section sizes against the fetched size
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (421 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0422/1376] staging: sm750fb: Add missing Kconfig dependency Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0424/1376] staging: fbtft: Use sysfs_emit_at() to print to sysfs file Greg Kroah-Hartman
` (575 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
[ Upstream commit 33d8c7b794d2a30637c9d3fcb478f1d3222bef1e ]
gb_audio_gb_get_topology() fetches a topology blob of a module-supplied
size, and gbaudio_tplg_parse_data() then walks it by adding the
module-supplied size_dais, size_controls and size_widgets fields to
form the control, widget and route section offsets. Those le32 sizes
are never checked against the fetched blob, so a module reporting a
small topology size but large section sizes makes the offsets point
past the allocation, and parsing reads out of bounds.
Reject a topology whose section sizes do not fit within the fetched
size before it is parsed.
Fixes: 184992e305f1 ("greybus: audio: Add Greybus Audio Device Class Protocol helper routines")
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Link: https://patch.msgid.link/20260616-b4-disp-4352e8b0-v1-1-3e09f62e0ad5@proton.me
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/greybus/audio_gb.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/drivers/staging/greybus/audio_gb.c b/drivers/staging/greybus/audio_gb.c
index 9d8994fdb41a2..144591f1a5128 100644
--- a/drivers/staging/greybus/audio_gb.c
+++ b/drivers/staging/greybus/audio_gb.c
@@ -37,6 +37,19 @@ int gb_audio_gb_get_topology(struct gb_connection *connection,
return ret;
}
+ /*
+ * The size_* fields are supplied by the module and are used by
+ * gbaudio_tplg_parse_data() to compute offsets into the blob; make
+ * sure the sections fit within the fetched topology, so walking it
+ * cannot read out of bounds.
+ */
+ if ((u64)le32_to_cpu(topo->size_dais) + le32_to_cpu(topo->size_controls) +
+ le32_to_cpu(topo->size_widgets) + le32_to_cpu(topo->size_routes) >
+ size - sizeof(*topo)) {
+ kfree(topo);
+ return -EINVAL;
+ }
+
*topology = topo;
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0424/1376] staging: fbtft: Use sysfs_emit_at() to print to sysfs file
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (422 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0423/1376] greybus: audio: bound the topology section sizes against the fetched size Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0425/1376] staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown Greg Kroah-Hartman
` (574 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Andy Shevchenko,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <error27@gmail.com>
[ Upstream commit 221192a784c25e28b489a7e75fabf59be4f63d57 ]
This scnprintf() uses the wrong limit. It should be "PAGE_SIZE - len"
instead of just PAGE_SIZE. We're not going to hit the limit in real
life since we are printing at most FBTFT_GAMMA_MAX_VALUES_TOTAL (128)
u32 values, however, it's still worth fixing.
Use sysfs_emit_at() to fix this since this is a sysfs file.
Fixes: c296d5f9957c ("staging: fbtft: core support")
Signed-off-by: Dan Carpenter <error27@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Link: https://patch.msgid.link/ah_Y_Y2RtqeGxchF@stanley.mountain
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/fbtft/fbtft-sysfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/fbtft/fbtft-sysfs.c b/drivers/staging/fbtft/fbtft-sysfs.c
index e45c90a03a903..7bd6cbf2f1e56 100644
--- a/drivers/staging/fbtft/fbtft-sysfs.c
+++ b/drivers/staging/fbtft/fbtft-sysfs.c
@@ -98,7 +98,7 @@ sprintf_gamma(struct fbtft_par *par, u32 *curves, char *buf)
mutex_lock(&par->gamma.lock);
for (i = 0; i < par->gamma.num_curves; i++) {
for (j = 0; j < par->gamma.num_values; j++)
- len += scnprintf(&buf[len], PAGE_SIZE,
+ len += sysfs_emit_at(buf, len,
"%04x ", curves[i * par->gamma.num_values + j]);
buf[len - 1] = '\n';
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0425/1376] staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (423 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0424/1376] staging: fbtft: Use sysfs_emit_at() to print to sysfs file Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0426/1376] staging: octeon: fix free_irq dev_id mismatch in cvm_oct_rx_shutdown Greg Kroah-Hartman
` (573 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Ayush Mukkanwar,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ayush Mukkanwar <ayushmukkanwar@gmail.com>
[ Upstream commit b9af44b0d20b2247c4eb0ea5cfca907d643eea50 ]
The TX cleanup tasklet can be scheduled by the watchdog IRQ handler
to execute cvm_oct_tx_do_cleanup. There can be a pending tasklet in
the queue which might run after the cvm_oct_remove() frees net_device
structures, causing a use-after-free in cvm_oct_tx_do_cleanup() as it
iterates cvm_oct_device[] which is an array of netdevice pointers.
Add tasklet_kill() after free_irq() to ensure the tasklet is no longer
scheduled or running before teardown proceeds.
Fixes: 4898c560103f ("Staging: Octeon: Free transmit SKBs in a timely manner")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260511150931.93382-1-ayushmukkanwar%40gmail.com
Signed-off-by: Ayush Mukkanwar <ayushmukkanwar@gmail.com>
Link: https://patch.msgid.link/20260615172734.42038-1-ayushmukkanwar@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/octeon/ethernet-tx.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/staging/octeon/ethernet-tx.c b/drivers/staging/octeon/ethernet-tx.c
index bbf33b88bb7c2..e54b4a413dc40 100644
--- a/drivers/staging/octeon/ethernet-tx.c
+++ b/drivers/staging/octeon/ethernet-tx.c
@@ -711,4 +711,6 @@ void cvm_oct_tx_shutdown(void)
{
/* Free the interrupt handler */
free_irq(OCTEON_IRQ_TIMER1, cvm_oct_device);
+
+ tasklet_kill(&cvm_oct_tx_cleanup_tasklet);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0426/1376] staging: octeon: fix free_irq dev_id mismatch in cvm_oct_rx_shutdown
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (424 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0425/1376] staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0427/1376] staging: octeon: ethernet-mem: replace pr_warn with dev_warn in free functions Greg Kroah-Hartman
` (572 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yuvraj Singh Chauhan, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuvraj Singh Chauhan <ysinghcin@gmail.com>
[ Upstream commit 41db5b76eeb4cc11a1097384caba7cfc659f7293 ]
In cvm_oct_rx_initialize(), request_irq() is called with
&oct_rx_group[i].napi as the dev_id:
request_irq(oct_rx_group[i].irq, cvm_oct_do_interrupt, 0, "Ethernet",
&oct_rx_group[i].napi);
However, cvm_oct_rx_shutdown() passes cvm_oct_device (an array of
struct net_device pointers) as the dev_id to free_irq():
free_irq(oct_rx_group[i].irq, cvm_oct_device);
Since __free_irq() matches the action to remove by comparing
dev_id pointers, the mismatched cookie means the IRQ handler is
never found, triggering a WARN and leaving the IRQ line permanently
allocated. This prevents proper driver cleanup on module removal.
Fix the mismatch by passing &oct_rx_group[i].napi as the dev_id
to free_irq(), matching what was used during request_irq().
Signed-off-by: Yuvraj Singh Chauhan <ysinghcin@gmail.com>
Link: https://patch.msgid.link/20260212171903.1417804-1-ysinghcin@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: c0a9a8586a63 ("staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/octeon/ethernet-rx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/octeon/ethernet-rx.c b/drivers/staging/octeon/ethernet-rx.c
index 965330eec80a8..d0b43d50b83ce 100644
--- a/drivers/staging/octeon/ethernet-rx.c
+++ b/drivers/staging/octeon/ethernet-rx.c
@@ -535,7 +535,7 @@ void cvm_oct_rx_shutdown(void)
cvmx_write_csr(CVMX_POW_WQ_INT_THRX(i), 0);
/* Free the interrupt handler */
- free_irq(oct_rx_group[i].irq, cvm_oct_device);
+ free_irq(oct_rx_group[i].irq, &oct_rx_group[i].napi);
netif_napi_del(&oct_rx_group[i].napi);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0427/1376] staging: octeon: ethernet-mem: replace pr_warn with dev_warn in free functions
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (425 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0426/1376] staging: octeon: fix free_irq dev_id mismatch in cvm_oct_rx_shutdown Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0428/1376] staging: octeon: replace pr_warn with dev_warn in fill and rx paths Greg Kroah-Hartman
` (571 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ayush Mukkanwar, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ayush Mukkanwar <ayushmukkanwar@gmail.com>
[ Upstream commit be5e8d5f61b31105e0ed7f51cd591653aea5054f ]
Add struct platform_device parameter to cvm_oct_free_hw_skbuff,
cvm_oct_free_hw_memory and cvm_oct_mem_empty_fpa. Replace pr_warn
calls with dev_warn, using &pdev->dev for device-aware logging.
Signed-off-by: Ayush Mukkanwar <ayushmukkanwar@gmail.com>
Link: https://patch.msgid.link/20260511150931.93382-2-ayushmukkanwar@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: c0a9a8586a63 ("staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/octeon/ethernet-mem.c | 31 ++++++++++++++++-----------
drivers/staging/octeon/ethernet-mem.h | 5 ++++-
drivers/staging/octeon/ethernet.c | 6 +++---
3 files changed, 25 insertions(+), 17 deletions(-)
diff --git a/drivers/staging/octeon/ethernet-mem.c b/drivers/staging/octeon/ethernet-mem.c
index 532594957ebcf..af79b2bdac278 100644
--- a/drivers/staging/octeon/ethernet-mem.c
+++ b/drivers/staging/octeon/ethernet-mem.c
@@ -5,6 +5,7 @@
* Copyright (c) 2003-2010 Cavium Networks
*/
+#include <linux/platform_device.h>
#include <linux/kernel.h>
#include <linux/netdevice.h>
#include <linux/slab.h>
@@ -40,11 +41,13 @@ static int cvm_oct_fill_hw_skbuff(int pool, int size, int elements)
/**
* cvm_oct_free_hw_skbuff- free hardware pool skbuffs
+ * @pdev: Platform device for logging
* @pool: Pool to allocate an skbuff for
* @size: Size of the buffer needed for the pool
* @elements: Number of buffers to allocate
*/
-static void cvm_oct_free_hw_skbuff(int pool, int size, int elements)
+static void cvm_oct_free_hw_skbuff(struct platform_device *pdev,
+ int pool, int size, int elements)
{
char *memory;
@@ -59,11 +62,11 @@ static void cvm_oct_free_hw_skbuff(int pool, int size, int elements)
} while (memory);
if (elements < 0)
- pr_warn("Freeing of pool %u had too many skbuffs (%d)\n",
- pool, elements);
+ dev_warn(&pdev->dev, "Freeing of pool %u had too many skbuffs (%d)\n",
+ pool, elements);
else if (elements > 0)
- pr_warn("Freeing of pool %u is missing %d skbuffs\n",
- pool, elements);
+ dev_warn(&pdev->dev, "Freeing of pool %u is missing %d skbuffs\n",
+ pool, elements);
}
/**
@@ -107,11 +110,13 @@ static int cvm_oct_fill_hw_memory(int pool, int size, int elements)
/**
* cvm_oct_free_hw_memory - Free memory allocated by cvm_oct_fill_hw_memory
+ * @pdev: Platform device for logging
* @pool: FPA pool to free
* @size: Size of each buffer in the pool
* @elements: Number of buffers that should be in the pool
*/
-static void cvm_oct_free_hw_memory(int pool, int size, int elements)
+static void cvm_oct_free_hw_memory(struct platform_device *pdev,
+ int pool, int size, int elements)
{
char *memory;
char *fpa;
@@ -127,11 +132,11 @@ static void cvm_oct_free_hw_memory(int pool, int size, int elements)
} while (fpa);
if (elements < 0)
- pr_warn("Freeing of pool %u had too many buffers (%d)\n",
- pool, elements);
+ dev_warn(&pdev->dev, "Freeing of pool %u had too many buffers (%d)\n",
+ pool, elements);
else if (elements > 0)
- pr_warn("Warning: Freeing of pool %u is missing %d buffers\n",
- pool, elements);
+ dev_warn(&pdev->dev, "Freeing of pool %u is missing %d buffers\n",
+ pool, elements);
}
int cvm_oct_mem_fill_fpa(int pool, int size, int elements)
@@ -145,10 +150,10 @@ int cvm_oct_mem_fill_fpa(int pool, int size, int elements)
return freed;
}
-void cvm_oct_mem_empty_fpa(int pool, int size, int elements)
+void cvm_oct_mem_empty_fpa(struct platform_device *pdev, int pool, int size, int elements)
{
if (pool == CVMX_FPA_PACKET_POOL)
- cvm_oct_free_hw_skbuff(pool, size, elements);
+ cvm_oct_free_hw_skbuff(pdev, pool, size, elements);
else
- cvm_oct_free_hw_memory(pool, size, elements);
+ cvm_oct_free_hw_memory(pdev, pool, size, elements);
}
diff --git a/drivers/staging/octeon/ethernet-mem.h b/drivers/staging/octeon/ethernet-mem.h
index 692dcdb7154da..ff10ba4525ee8 100644
--- a/drivers/staging/octeon/ethernet-mem.h
+++ b/drivers/staging/octeon/ethernet-mem.h
@@ -6,4 +6,7 @@
*/
int cvm_oct_mem_fill_fpa(int pool, int size, int elements);
-void cvm_oct_mem_empty_fpa(int pool, int size, int elements);
+struct platform_device;
+
+void cvm_oct_mem_empty_fpa(struct platform_device *pdev, int pool, int size,
+ int elements);
diff --git a/drivers/staging/octeon/ethernet.c b/drivers/staging/octeon/ethernet.c
index a5e99cc78a454..4fb2967598527 100644
--- a/drivers/staging/octeon/ethernet.c
+++ b/drivers/staging/octeon/ethernet.c
@@ -958,12 +958,12 @@ static void cvm_oct_remove(struct platform_device *pdev)
cvmx_ipd_free_ptr();
/* Free the HW pools */
- cvm_oct_mem_empty_fpa(CVMX_FPA_PACKET_POOL, CVMX_FPA_PACKET_POOL_SIZE,
+ cvm_oct_mem_empty_fpa(pdev, CVMX_FPA_PACKET_POOL, CVMX_FPA_PACKET_POOL_SIZE,
num_packet_buffers);
- cvm_oct_mem_empty_fpa(CVMX_FPA_WQE_POOL, CVMX_FPA_WQE_POOL_SIZE,
+ cvm_oct_mem_empty_fpa(pdev, CVMX_FPA_WQE_POOL, CVMX_FPA_WQE_POOL_SIZE,
num_packet_buffers);
if (CVMX_FPA_OUTPUT_BUFFER_POOL != CVMX_FPA_PACKET_POOL)
- cvm_oct_mem_empty_fpa(CVMX_FPA_OUTPUT_BUFFER_POOL,
+ cvm_oct_mem_empty_fpa(pdev, CVMX_FPA_OUTPUT_BUFFER_POOL,
CVMX_FPA_OUTPUT_BUFFER_POOL_SIZE, 128);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0428/1376] staging: octeon: replace pr_warn with dev_warn in fill and rx paths
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (426 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0427/1376] staging: octeon: ethernet-mem: replace pr_warn with dev_warn in free functions Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0429/1376] staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown Greg Kroah-Hartman
` (570 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ayush Mukkanwar, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ayush Mukkanwar <ayushmukkanwar@gmail.com>
[ Upstream commit 2191a8dfd1f5a3091e9f388899beb137686c6532 ]
Add struct platform_device parameter to cvm_oct_fill_hw_memory,
cvm_oct_mem_fill_fpa, cvm_oct_rx_refill_pool and
cvm_oct_rx_initialize to support device-aware logging. Replace
pr_warn with dev_warn using &pdev->dev.
To avoid passing these parameters through global state, introduce
struct octeon_ethernet_platform to hold per-device state including
the rx_refill_work and the oct_rx_group array. This ensures all
receive group state and workers are correctly associated with the
platform device.
Define struct oct_rx_group and struct octeon_ethernet_platform in
octeon-ethernet.h so they are shared across compilation units.
Signed-off-by: Ayush Mukkanwar <ayushmukkanwar@gmail.com>
Link: https://patch.msgid.link/20260511150931.93382-4-ayushmukkanwar@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: c0a9a8586a63 ("staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/octeon/ethernet-mem.c | 12 +++---
drivers/staging/octeon/ethernet-mem.h | 3 +-
drivers/staging/octeon/ethernet-rx.c | 49 ++++++++++++------------
drivers/staging/octeon/ethernet-rx.h | 11 ++++--
drivers/staging/octeon/ethernet.c | 37 +++++++++++-------
drivers/staging/octeon/octeon-ethernet.h | 14 +++++++
6 files changed, 78 insertions(+), 48 deletions(-)
diff --git a/drivers/staging/octeon/ethernet-mem.c b/drivers/staging/octeon/ethernet-mem.c
index af79b2bdac278..68c3ef984e565 100644
--- a/drivers/staging/octeon/ethernet-mem.c
+++ b/drivers/staging/octeon/ethernet-mem.c
@@ -71,13 +71,15 @@ static void cvm_oct_free_hw_skbuff(struct platform_device *pdev,
/**
* cvm_oct_fill_hw_memory - fill a hardware pool with memory.
+ * @pdev: Platform device for logging
* @pool: Pool to populate
* @size: Size of each buffer in the pool
* @elements: Number of buffers to allocate
*
* Returns the actual number of buffers allocated.
*/
-static int cvm_oct_fill_hw_memory(int pool, int size, int elements)
+static int cvm_oct_fill_hw_memory(struct platform_device *pdev, int pool, int size,
+ int elements)
{
char *memory;
char *fpa;
@@ -96,8 +98,8 @@ static int cvm_oct_fill_hw_memory(int pool, int size, int elements)
*/
memory = kmalloc(size + 256, GFP_ATOMIC);
if (unlikely(!memory)) {
- pr_warn("Unable to allocate %u bytes for FPA pool %d\n",
- elements * size, pool);
+ dev_warn(&pdev->dev, "Unable to allocate %u bytes for FPA pool %d\n",
+ elements * size, pool);
break;
}
fpa = (char *)(((unsigned long)memory + 256) & ~0x7fUL);
@@ -139,14 +141,14 @@ static void cvm_oct_free_hw_memory(struct platform_device *pdev,
pool, elements);
}
-int cvm_oct_mem_fill_fpa(int pool, int size, int elements)
+int cvm_oct_mem_fill_fpa(struct platform_device *pdev, int pool, int size, int elements)
{
int freed;
if (pool == CVMX_FPA_PACKET_POOL)
freed = cvm_oct_fill_hw_skbuff(pool, size, elements);
else
- freed = cvm_oct_fill_hw_memory(pool, size, elements);
+ freed = cvm_oct_fill_hw_memory(pdev, pool, size, elements);
return freed;
}
diff --git a/drivers/staging/octeon/ethernet-mem.h b/drivers/staging/octeon/ethernet-mem.h
index ff10ba4525ee8..9279bb0de2db4 100644
--- a/drivers/staging/octeon/ethernet-mem.h
+++ b/drivers/staging/octeon/ethernet-mem.h
@@ -5,8 +5,9 @@
* Copyright (c) 2003-2007 Cavium Networks
*/
-int cvm_oct_mem_fill_fpa(int pool, int size, int elements);
struct platform_device;
+int cvm_oct_mem_fill_fpa(struct platform_device *pdev, int pool, int size,
+ int elements);
void cvm_oct_mem_empty_fpa(struct platform_device *pdev, int pool, int size,
int elements);
diff --git a/drivers/staging/octeon/ethernet-rx.c b/drivers/staging/octeon/ethernet-rx.c
index d0b43d50b83ce..cd36b5ba6f6c2 100644
--- a/drivers/staging/octeon/ethernet-rx.c
+++ b/drivers/staging/octeon/ethernet-rx.c
@@ -5,6 +5,7 @@
* Copyright (c) 2003-2010 Cavium Networks
*/
+#include <linux/platform_device.h>
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/cache.h>
@@ -31,12 +32,6 @@
static atomic_t oct_rx_ready = ATOMIC_INIT(0);
-static struct oct_rx_group {
- int irq;
- int group;
- struct napi_struct napi;
-} oct_rx_group[16];
-
/**
* cvm_oct_do_interrupt - interrupt handler.
* @irq: Interrupt number.
@@ -397,7 +392,7 @@ static int cvm_oct_poll(struct oct_rx_group *rx_group, int budget)
/* Restore the scratch area */
cvmx_scratch_write64(CVMX_SCR_SCRATCH, old_scratch);
}
- cvm_oct_rx_refill_pool(0);
+ cvm_oct_rx_refill_pool(rx_group->pdev, 0);
return rx_count;
}
@@ -434,24 +429,28 @@ static int cvm_oct_napi_poll(struct napi_struct *napi, int budget)
*/
void cvm_oct_poll_controller(struct net_device *dev)
{
+ struct platform_device *pdev = to_platform_device(dev->dev.parent);
+ struct octeon_ethernet_platform *plat = platform_get_drvdata(pdev);
int i;
if (!atomic_read(&oct_rx_ready))
return;
- for (i = 0; i < ARRAY_SIZE(oct_rx_group); i++) {
+ for (i = 0; i < ARRAY_SIZE(plat->rx_group); i++) {
if (!(pow_receive_groups & BIT(i)))
continue;
- cvm_oct_poll(&oct_rx_group[i], 16);
+ cvm_oct_poll(&plat->rx_group[i], 16);
}
}
#endif
-void cvm_oct_rx_initialize(void)
+void cvm_oct_rx_initialize(struct platform_device *pdev)
{
int i;
struct net_device *dev_for_napi = NULL;
+ struct octeon_ethernet_platform *plat = platform_get_drvdata(pdev);
+ struct oct_rx_group *rx_group = plat->rx_group;
for (i = 0; i < TOTAL_NUMBER_OF_PORTS; i++) {
if (cvm_oct_device[i]) {
@@ -463,27 +462,28 @@ void cvm_oct_rx_initialize(void)
if (!dev_for_napi)
panic("No net_devices were allocated.");
- for (i = 0; i < ARRAY_SIZE(oct_rx_group); i++) {
+ for (i = 0; i < ARRAY_SIZE(plat->rx_group); i++) {
int ret;
if (!(pow_receive_groups & BIT(i)))
continue;
- netif_napi_add_weight(dev_for_napi, &oct_rx_group[i].napi,
+ netif_napi_add_weight(dev_for_napi, &rx_group[i].napi,
cvm_oct_napi_poll, rx_napi_weight);
- napi_enable(&oct_rx_group[i].napi);
+ napi_enable(&rx_group[i].napi);
- oct_rx_group[i].irq = OCTEON_IRQ_WORKQ0 + i;
- oct_rx_group[i].group = i;
+ rx_group[i].irq = OCTEON_IRQ_WORKQ0 + i;
+ rx_group[i].group = i;
+ rx_group[i].pdev = pdev;
/* Register an IRQ handler to receive POW interrupts */
- ret = request_irq(oct_rx_group[i].irq, cvm_oct_do_interrupt, 0,
- "Ethernet", &oct_rx_group[i].napi);
+ ret = request_irq(rx_group[i].irq, cvm_oct_do_interrupt, 0,
+ "Ethernet", &rx_group[i].napi);
if (ret)
panic("Could not acquire Ethernet IRQ %d\n",
- oct_rx_group[i].irq);
+ rx_group[i].irq);
- disable_irq_nosync(oct_rx_group[i].irq);
+ disable_irq_nosync(rx_group[i].irq);
/* Enable POW interrupt when our port has at least one packet */
if (OCTEON_IS_MODEL(OCTEON_CN68XX)) {
@@ -515,16 +515,17 @@ void cvm_oct_rx_initialize(void)
/* Schedule NAPI now. This will indirectly enable the
* interrupt.
*/
- napi_schedule(&oct_rx_group[i].napi);
+ napi_schedule(&rx_group[i].napi);
}
atomic_inc(&oct_rx_ready);
}
-void cvm_oct_rx_shutdown(void)
+void cvm_oct_rx_shutdown(struct platform_device *pdev)
{
+ struct octeon_ethernet_platform *plat = platform_get_drvdata(pdev);
int i;
- for (i = 0; i < ARRAY_SIZE(oct_rx_group); i++) {
+ for (i = 0; i < ARRAY_SIZE(plat->rx_group); i++) {
if (!(pow_receive_groups & BIT(i)))
continue;
@@ -535,8 +536,8 @@ void cvm_oct_rx_shutdown(void)
cvmx_write_csr(CVMX_POW_WQ_INT_THRX(i), 0);
/* Free the interrupt handler */
- free_irq(oct_rx_group[i].irq, &oct_rx_group[i].napi);
+ free_irq(plat->rx_group[i].irq, &plat->rx_group[i].napi);
- netif_napi_del(&oct_rx_group[i].napi);
+ netif_napi_del(&plat->rx_group[i].napi);
}
}
diff --git a/drivers/staging/octeon/ethernet-rx.h b/drivers/staging/octeon/ethernet-rx.h
index ff6482fa20d69..6093694326cb6 100644
--- a/drivers/staging/octeon/ethernet-rx.h
+++ b/drivers/staging/octeon/ethernet-rx.h
@@ -5,11 +5,14 @@
* Copyright (c) 2003-2007 Cavium Networks
*/
+struct platform_device;
+
void cvm_oct_poll_controller(struct net_device *dev);
-void cvm_oct_rx_initialize(void);
-void cvm_oct_rx_shutdown(void);
+void cvm_oct_rx_initialize(struct platform_device *pdev);
+void cvm_oct_rx_shutdown(struct platform_device *pdev);
-static inline void cvm_oct_rx_refill_pool(int fill_threshold)
+static inline void cvm_oct_rx_refill_pool(struct platform_device *pdev,
+ int fill_threshold)
{
int number_to_free;
int num_freed;
@@ -20,7 +23,7 @@ static inline void cvm_oct_rx_refill_pool(int fill_threshold)
if (number_to_free > fill_threshold) {
cvmx_fau_atomic_add32(FAU_NUM_PACKET_BUFFERS_TO_FREE,
-number_to_free);
- num_freed = cvm_oct_mem_fill_fpa(CVMX_FPA_PACKET_POOL,
+ num_freed = cvm_oct_mem_fill_fpa(pdev, CVMX_FPA_PACKET_POOL,
CVMX_FPA_PACKET_POOL_SIZE,
number_to_free);
if (num_freed != number_to_free) {
diff --git a/drivers/staging/octeon/ethernet.c b/drivers/staging/octeon/ethernet.c
index 4fb2967598527..b8a528881fca5 100644
--- a/drivers/staging/octeon/ethernet.c
+++ b/drivers/staging/octeon/ethernet.c
@@ -104,11 +104,10 @@ struct net_device *cvm_oct_device[TOTAL_NUMBER_OF_PORTS];
u64 cvm_oct_tx_poll_interval;
-static void cvm_oct_rx_refill_worker(struct work_struct *work);
-static DECLARE_DELAYED_WORK(cvm_oct_rx_refill_work, cvm_oct_rx_refill_worker);
-
static void cvm_oct_rx_refill_worker(struct work_struct *work)
{
+ struct octeon_ethernet_platform *plat = container_of(work,
+ struct octeon_ethernet_platform, rx_refill_work.work);
/*
* FPA 0 may have been drained, try to refill it if we need
* more than num_packet_buffers / 2, otherwise normal receive
@@ -116,10 +115,10 @@ static void cvm_oct_rx_refill_worker(struct work_struct *work)
* could be received so cvm_oct_napi_poll would never be
* invoked to do the refill.
*/
- cvm_oct_rx_refill_pool(num_packet_buffers / 2);
+ cvm_oct_rx_refill_pool(plat->pdev, num_packet_buffers / 2);
if (!atomic_read(&cvm_oct_poll_queue_stopping))
- schedule_delayed_work(&cvm_oct_rx_refill_work, HZ);
+ schedule_delayed_work(&plat->rx_refill_work, HZ);
}
static void cvm_oct_periodic_worker(struct work_struct *work)
@@ -138,16 +137,16 @@ static void cvm_oct_periodic_worker(struct work_struct *work)
schedule_delayed_work(&priv->port_periodic_work, HZ);
}
-static void cvm_oct_configure_common_hw(void)
+static void cvm_oct_configure_common_hw(struct platform_device *pdev)
{
/* Setup the FPA */
cvmx_fpa_enable();
- cvm_oct_mem_fill_fpa(CVMX_FPA_PACKET_POOL, CVMX_FPA_PACKET_POOL_SIZE,
+ cvm_oct_mem_fill_fpa(pdev, CVMX_FPA_PACKET_POOL, CVMX_FPA_PACKET_POOL_SIZE,
num_packet_buffers);
- cvm_oct_mem_fill_fpa(CVMX_FPA_WQE_POOL, CVMX_FPA_WQE_POOL_SIZE,
+ cvm_oct_mem_fill_fpa(pdev, CVMX_FPA_WQE_POOL, CVMX_FPA_WQE_POOL_SIZE,
num_packet_buffers);
if (CVMX_FPA_OUTPUT_BUFFER_POOL != CVMX_FPA_PACKET_POOL)
- cvm_oct_mem_fill_fpa(CVMX_FPA_OUTPUT_BUFFER_POOL,
+ cvm_oct_mem_fill_fpa(pdev, CVMX_FPA_OUTPUT_BUFFER_POOL,
CVMX_FPA_OUTPUT_BUFFER_POOL_SIZE, 1024);
#ifdef __LITTLE_ENDIAN
@@ -678,6 +677,15 @@ static int cvm_oct_probe(struct platform_device *pdev)
int qos;
struct device_node *pip;
int mtu_overhead = ETH_HLEN + ETH_FCS_LEN;
+ struct octeon_ethernet_platform *plat;
+
+ plat = devm_kzalloc(&pdev->dev, sizeof(*plat), GFP_KERNEL);
+ if (!plat)
+ return -ENOMEM;
+
+ plat->pdev = pdev;
+ INIT_DELAYED_WORK(&plat->rx_refill_work, cvm_oct_rx_refill_worker);
+ platform_set_drvdata(pdev, plat);
#if IS_ENABLED(CONFIG_VLAN_8021Q)
mtu_overhead += VLAN_HLEN;
@@ -689,7 +697,7 @@ static int cvm_oct_probe(struct platform_device *pdev)
return -EINVAL;
}
- cvm_oct_configure_common_hw();
+ cvm_oct_configure_common_hw(pdev);
cvmx_helper_initialize_packet_io_global();
@@ -912,28 +920,29 @@ static int cvm_oct_probe(struct platform_device *pdev)
}
cvm_oct_tx_initialize();
- cvm_oct_rx_initialize();
+ cvm_oct_rx_initialize(pdev);
/*
* 150 uS: about 10 1500-byte packets at 1GE.
*/
cvm_oct_tx_poll_interval = 150 * (octeon_get_clock_rate() / 1000000);
- schedule_delayed_work(&cvm_oct_rx_refill_work, HZ);
+ schedule_delayed_work(&plat->rx_refill_work, HZ);
return 0;
}
static void cvm_oct_remove(struct platform_device *pdev)
{
+ struct octeon_ethernet_platform *plat = platform_get_drvdata(pdev);
int port;
cvmx_ipd_disable();
atomic_inc_return(&cvm_oct_poll_queue_stopping);
- cancel_delayed_work_sync(&cvm_oct_rx_refill_work);
+ cancel_delayed_work_sync(&plat->rx_refill_work);
- cvm_oct_rx_shutdown();
+ cvm_oct_rx_shutdown(pdev);
cvm_oct_tx_shutdown();
cvmx_pko_disable();
diff --git a/drivers/staging/octeon/octeon-ethernet.h b/drivers/staging/octeon/octeon-ethernet.h
index a6140705706f4..0ac430db1e6eb 100644
--- a/drivers/staging/octeon/octeon-ethernet.h
+++ b/drivers/staging/octeon/octeon-ethernet.h
@@ -11,6 +11,7 @@
#ifndef OCTEON_ETHERNET_H
#define OCTEON_ETHERNET_H
+#include <linux/netdevice.h>
#include <linux/of.h>
#include <linux/phy.h>
@@ -74,6 +75,19 @@ struct octeon_ethernet {
struct device_node *of_node;
};
+struct oct_rx_group {
+ int irq;
+ int group;
+ struct napi_struct napi;
+ struct platform_device *pdev;
+};
+
+struct octeon_ethernet_platform {
+ struct platform_device *pdev;
+ struct delayed_work rx_refill_work;
+ struct oct_rx_group rx_group[16];
+};
+
int cvm_oct_free_work(void *work_queue_entry);
int cvm_oct_rgmii_open(struct net_device *dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0429/1376] staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (427 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0428/1376] staging: octeon: replace pr_warn with dev_warn in fill and rx paths Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0430/1376] staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() Greg Kroah-Hartman
` (569 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Ayush Mukkanwar,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ayush Mukkanwar <ayushmukkanwar@gmail.com>
[ Upstream commit c0a9a8586a63fda49e61a6b83360feac2a60d898 ]
cvm_oct_rx_shutdown calls free_irq and netif_napi_del without
disabling the napi instance first. As the free_irq only waits
for completion of hard interrupt handlers, the napi poll
function could still be active. If cvm_oct_remove proceeds to
free the plat structure (which holds the NAPI instances), the
active poll function will access freed memory, resulting in a
use-after-free crash.
Fixes: 3368c784bcf7 ("Staging: Octeon Ethernet: Convert to NAPI.")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260511150931.93382-1-ayushmukkanwar%40gmail.com
Signed-off-by: Ayush Mukkanwar <ayushmukkanwar@gmail.com>
Link: https://patch.msgid.link/20260615172734.42038-2-ayushmukkanwar@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/octeon/ethernet-rx.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/staging/octeon/ethernet-rx.c b/drivers/staging/octeon/ethernet-rx.c
index cd36b5ba6f6c2..3e9d58d321560 100644
--- a/drivers/staging/octeon/ethernet-rx.c
+++ b/drivers/staging/octeon/ethernet-rx.c
@@ -535,6 +535,8 @@ void cvm_oct_rx_shutdown(struct platform_device *pdev)
else
cvmx_write_csr(CVMX_POW_WQ_INT_THRX(i), 0);
+ napi_disable(&plat->rx_group[i].napi);
+
/* Free the interrupt handler */
free_irq(plat->rx_group[i].irq, &plat->rx_group[i].napi);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0430/1376] staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (428 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0429/1376] staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0431/1376] ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() Greg Kroah-Hartman
` (568 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zilin Guan, Dawei Feng,
Dan Carpenter, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dawei Feng <dawei.feng@seu.edu.cn>
[ Upstream commit 264676418b726baca7be49171e306b6aa05cceb0 ]
padapter->HalData is allocated via vzalloc(), but incorrectly freed
using kfree() in the rtw_sdio_if1_init() error path. Using kfree() to
release this vmalloc-backed buffer can lead to memory corruption.
Use rtw_hal_data_deinit() to pair the free correctly and free
HalData with vfree().
The bug was first flagged by an experimental static analysis tool we
are developing for kernel memory-management bugs. Manual inspection
confirms that the issue is still present in current mainline.
An x86_64 allyesconfig build showed no new warnings. As we do not have
suitable RTL8723BS SDIO hardware to test with, no runtime testing was
able to be performed.
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
Reviewed-by: Dan Carpenter <error27@gmail.com>
Link: https://patch.msgid.link/20260525091836.812565-1-dawei.feng@seu.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/rtl8723bs/os_dep/sdio_intf.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
index d64998be6b2bb..c9a90d5293b02 100644
--- a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
+++ b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
@@ -309,8 +309,8 @@ static struct adapter *rtw_sdio_if1_init(struct dvobj_priv *dvobj, const struct
status = _SUCCESS;
free_hal_data:
- if (status != _SUCCESS && padapter->HalData)
- kfree(padapter->HalData);
+ if (status != _SUCCESS)
+ rtw_hal_data_deinit(padapter);
if (status != _SUCCESS) {
rtw_wdev_unregister(padapter->rtw_wdev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0431/1376] ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (429 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0430/1376] staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0432/1376] selftests/bpf: Fix memory leak in msg_alloc_iov error path Greg Kroah-Hartman
` (567 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Evgenii Burenchev, Takashi Iwai,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Evgenii Burenchev <evg28bur@yandex.ru>
[ Upstream commit cd3447e1b6425efd1704ed07f1f245c842927eb0 ]
The condition
if (count && size < count)
can never evaluate to true.
The VIA DMA count register is masked with 0x00ffffff before use, while
the DMA buffer size is limited to 0x00fffffe bytes. As a result, 'count'
can never exceed 'size', making the condition permanently false.
This branch has therefore been unreachable since the driver was
introduced. Remove the unreachable branch without changing runtime
behavior.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Evgenii Burenchev <evg28bur@yandex.ru>
Link: https://patch.msgid.link/20260706131638.15311-1-evg28bur@yandex.ru
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/pci/via82xx_modem.c | 26 ++++++++++----------------
1 file changed, 10 insertions(+), 16 deletions(-)
diff --git a/sound/pci/via82xx_modem.c b/sound/pci/via82xx_modem.c
index a0a49b8d15116..60235e953a62d 100644
--- a/sound/pci/via82xx_modem.c
+++ b/sound/pci/via82xx_modem.c
@@ -576,24 +576,18 @@ static inline unsigned int calc_linear_pos(struct via82xx_modem *chip,
viadev->bufsize2, viadev->idx_table[idx].offset,
viadev->idx_table[idx].size, count);
#endif
- if (count && size < count) {
+ if (! count)
+ /* bogus count 0 on the DMA boundary? */
+ res = viadev->idx_table[idx].offset;
+ else
+ /* count register returns full size
+ * when end of buffer is reached
+ */
+ res = viadev->idx_table[idx].offset + size;
+ if (check_invalid_pos(viadev, res)) {
dev_dbg(chip->card->dev,
- "invalid via82xx_cur_ptr, using last valid pointer\n");
+ "invalid via82xx_cur_ptr (2), using last valid pointer\n");
res = viadev->lastpos;
- } else {
- if (! count)
- /* bogus count 0 on the DMA boundary? */
- res = viadev->idx_table[idx].offset;
- else
- /* count register returns full size
- * when end of buffer is reached
- */
- res = viadev->idx_table[idx].offset + size;
- if (check_invalid_pos(viadev, res)) {
- dev_dbg(chip->card->dev,
- "invalid via82xx_cur_ptr (2), using last valid pointer\n");
- res = viadev->lastpos;
- }
}
}
viadev->lastpos = res; /* remember the last position */
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0432/1376] selftests/bpf: Fix memory leak in msg_alloc_iov error path
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (430 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0431/1376] ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0433/1376] selftests/bpf: Fix memory leak in msg_alloc_iov Greg Kroah-Hartman
` (566 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Malaya Kumar Rout, Emil Tsalapatis,
Kumar Kartikeya Dwivedi, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Malaya Kumar Rout <malayarout91@gmail.com>
[ Upstream commit 0bebfaa39deadec21638f6fba553eae12627a26d ]
In msg_alloc_iov(), when calloc() fails for an individual iov_base
allocation, the error path frees all previously allocated iov_base
entries but fails to free the iov array itself that was allocated
with calloc() at the beginning of the function. This results in a
memory leak of the iov array.
Add free(iov) in the unwind_iov error path to ensure proper cleanup
of all allocated memory.
Fixes: 753fb2ee0934 ("bpf: sockmap, add msg_peek tests to test_sockmap")
Signed-off-by: Malaya Kumar Rout <malayarout91@gmail.com>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Link: https://lore.kernel.org/bpf/20260704122936.102394-1-malayarout91@gmail.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/bpf/test_sockmap.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/testing/selftests/bpf/test_sockmap.c b/tools/testing/selftests/bpf/test_sockmap.c
index 61a747afcd05f..a45c96e92a42f 100644
--- a/tools/testing/selftests/bpf/test_sockmap.c
+++ b/tools/testing/selftests/bpf/test_sockmap.c
@@ -515,6 +515,7 @@ static int msg_alloc_iov(struct msghdr *msg,
unwind_iov:
for (i--; i >= 0 ; i--)
free(msg->msg_iov[i].iov_base);
+ free(iov);
return -ENOMEM;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0433/1376] selftests/bpf: Fix memory leak in msg_alloc_iov
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (431 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0432/1376] selftests/bpf: Fix memory leak in msg_alloc_iov error path Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0434/1376] selftests/lsm: Fix memory leak in attr_lsm_count Greg Kroah-Hartman
` (565 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Feng Yang, John Fastabend,
Kumar Kartikeya Dwivedi, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Feng Yang <yangfeng@kylinos.cn>
[ Upstream commit 602701718649936eb287bf6c7ecf870ec54c6f71 ]
In the msg_alloc_iov function, the iov pointer is only assigned to
msg->msg_iov after all memory allocations complete successfully.
Therefore, when a calloc failure triggers the unwind_iov cleanup branch,
we should use the local variable iov instead of msg->msg_iov.
Fixes: 753fb2ee0934 ("bpf: sockmap, add msg_peek tests to test_sockmap")
Signed-off-by: Feng Yang <yangfeng@kylinos.cn>
Reviewed-by: John Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/bpf/20260707081434.539327-1-yangfeng59949@163.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/bpf/test_sockmap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/testing/selftests/bpf/test_sockmap.c b/tools/testing/selftests/bpf/test_sockmap.c
index a45c96e92a42f..7b237f737624f 100644
--- a/tools/testing/selftests/bpf/test_sockmap.c
+++ b/tools/testing/selftests/bpf/test_sockmap.c
@@ -514,7 +514,7 @@ static int msg_alloc_iov(struct msghdr *msg,
return 0;
unwind_iov:
for (i--; i >= 0 ; i--)
- free(msg->msg_iov[i].iov_base);
+ free(iov[i].iov_base);
free(iov);
return -ENOMEM;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0434/1376] selftests/lsm: Fix memory leak in attr_lsm_count
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (432 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0433/1376] selftests/bpf: Fix memory leak in msg_alloc_iov Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0435/1376] irqchip/gic-v3-its: Fix memleak in its_probe_one() Greg Kroah-Hartman
` (564 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wang Yan, William Roberts,
Paul Moore, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Yan <wangyan01@kylinos.cn>
[ Upstream commit 0cee720cfd51402cfcb14d96cb326a36c13b823a ]
The calloc-allocated buffer in attr_lsm_count() is never released on
any exit path, including both the normal return path and the early
return when read_sysfs_lsms fails, resulting in a heap memory leak.
Add free() for the buffer on all return branches to fix the leak.
Fixes: d3d929a8b0cd ("LSM: selftests for Linux Security Module syscalls")
Signed-off-by: Wang Yan <wangyan01@kylinos.cn>
Reviewed-by: William Roberts <bill.c.roberts@gmail.com>
Tested-by: William Roberts <bill.c.roberts@gmail.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/lsm/common.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/lsm/common.c b/tools/testing/selftests/lsm/common.c
index 9ad258912646c..927dce4f04cb2 100644
--- a/tools/testing/selftests/lsm/common.c
+++ b/tools/testing/selftests/lsm/common.c
@@ -76,7 +76,7 @@ int attr_lsm_count(void)
return 0;
if (read_sysfs_lsms(names, sysconf(_SC_PAGESIZE)))
- return 0;
+ goto out;
if (strstr(names, "selinux"))
count++;
@@ -85,5 +85,7 @@ int attr_lsm_count(void)
if (strstr(names, "apparmor"))
count++;
+out:
+ free(names);
return count;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0435/1376] irqchip/gic-v3-its: Fix memleak in its_probe_one()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (433 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0434/1376] selftests/lsm: Fix memory leak in attr_lsm_count Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0436/1376] irqchip/gic-v3-its: Fix its node leak in gic_acpi_parse_madt_its() Greg Kroah-Hartman
` (563 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kemeng Shi, Thomas Gleixner,
Radu Rendec, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kemeng Shi <shikemeng@huaweicloud.com>
[ Upstream commit 1efffab6fe336a5c4fd3c2886f255cd2f998e65f ]
Fix collection leak when its_init_domain() failed in its_probe_one().
Fixes: 4c21f3c26ecc2 ("irqchip: GICv3: ITS: DT probing and initialization")
Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Radu Rendec <radu@rendec.net>
Link: https://patch.msgid.link/20260702033050.1583-2-shikemeng@huaweicloud.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-gic-v3-its.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 95d337978c75f..da9490dc14b92 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -5216,7 +5216,7 @@ static int __init its_probe_one(struct its_node *its)
err = its_init_domain(its);
if (err)
- goto out_free_tables;
+ goto out_free_collection;
raw_spin_lock(&its_lock);
list_add(&its->entry, &its_nodes);
@@ -5224,6 +5224,8 @@ static int __init its_probe_one(struct its_node *its)
return 0;
+out_free_collection:
+ kfree(its->collections);
out_free_tables:
its_free_tables(its);
out_free_cmd:
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0436/1376] irqchip/gic-v3-its: Fix its node leak in gic_acpi_parse_madt_its()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (434 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0435/1376] irqchip/gic-v3-its: Fix memleak in its_probe_one() Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0437/1376] selftests: timers: leap-a-day: Fix -w option and update usage comment Greg Kroah-Hartman
` (562 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kemeng Shi, Thomas Gleixner,
Radu Rendec, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kemeng Shi <shikemeng@huaweicloud.com>
[ Upstream commit 698a8648ca8051d34722b09b8a8088c741120ac3 ]
Fix its node leak when its_probe_one() failed in
gic_acpi_parse_madt_its().
Fixes: 9585a495ac936 ("irqchip/gic-v3-its: Split allocation from initialisation of its_node")
Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Radu Rendec <radu@rendec.net>
Link: https://patch.msgid.link/20260702033050.1583-3-shikemeng@huaweicloud.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-gic-v3-its.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index da9490dc14b92..7050bf88b87d3 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -5638,9 +5638,13 @@ static int __init gic_acpi_parse_madt_its(union acpi_subtable_headers *header,
its->flags |= ITS_FLAGS_FORCE_NON_SHAREABLE;
err = its_probe_one(its);
- if (!err)
- return 0;
+ if (err)
+ goto probe_err;
+
+ return 0;
+probe_err:
+ its_node_destroy(its);
node_err:
iort_deregister_domain_token(its_entry->translation_id);
dom_err:
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0437/1376] selftests: timers: leap-a-day: Fix -w option and update usage comment
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (435 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0436/1376] irqchip/gic-v3-its: Fix its node leak in gic_acpi_parse_madt_its() Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0438/1376] clocksource: Unregister subsystem on device registration failure Greg Kroah-Hartman
` (561 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiangshan Yi, Thomas Gleixner,
John Stultz, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiangshan Yi <yijiangshan@kylinos.cn>
[ Upstream commit b4b66151a71445f3a71574136ddc82968c7b175e ]
Commit 98b74e1f3104 ("kselftests: timers: leap-a-day: Change default
arguments to help test runs") replaced the -s option with -w and made
"wait for the leap second" the non-default behaviour, but it only
updated the switch/case handling. Two things were left inconsistent:
- The getopt() option string still lists 's' instead of 'w', so
passing -w is rejected as an invalid option and the new behaviour
cannot be selected at all.
- The file header comment still documents the removed -s option and
an outdated default for -i.
Fix the getopt() string to accept 'w' (matching the existing case 'w':
handler) and update the header comment to describe -w, -t and the
current -i default.
Fixes: 98b74e1f3104 ("kselftests: timers: leap-a-day: Change default arguments to help test runs")
Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Acked-by: John Stultz <jstultz@google.com>
Link: https://patch.msgid.link/20260702093915.2652638-1-yijiangshan@kylinos.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/timers/leap-a-day.c | 19 +++++++++++--------
1 file changed, 11 insertions(+), 8 deletions(-)
diff --git a/tools/testing/selftests/timers/leap-a-day.c b/tools/testing/selftests/timers/leap-a-day.c
index 986abbdb15217..eb99683e5ced1 100644
--- a/tools/testing/selftests/timers/leap-a-day.c
+++ b/tools/testing/selftests/timers/leap-a-day.c
@@ -9,16 +9,19 @@
* kernel's leap-second behavior, as well as how well applications
* handle the leap-second discontinuity.
*
- * Usage: leap-a-day [-s] [-i <num>]
+ * Usage: leap-a-day [-w] [-i <num>] [-t]
*
* Options:
- * -s: Each iteration, set the date to 10 seconds before midnight GMT.
- * This speeds up the number of leapsecond transitions tested,
- * but because it calls settimeofday frequently, advancing the
- * time by 24 hours every ~16 seconds, it may cause application
- * disruption.
+ * -w: Only set the leap-second flag and wait for the leap second
+ * each iteration, instead of advancing the time. By default the
+ * date is set to 10 seconds before midnight GMT, which speeds up
+ * the number of leapsecond transitions tested, but because it
+ * calls settimeofday frequently, advancing the time by 24 hours
+ * every ~16 seconds, it may cause application disruption.
*
- * -i: Number of iterations to run (default: infinite)
+ * -i: Number of iterations to run (-1 = infinite, default: 10)
+ *
+ * -t: Print TAI time.
*
* Other notes: Disabling NTP prior to running this is advised, as the two
* may conflict in their commands to the kernel.
@@ -186,7 +189,7 @@ int main(int argc, char **argv)
int opt;
/* Process arguments */
- while ((opt = getopt(argc, argv, "sti:")) != -1) {
+ while ((opt = getopt(argc, argv, "wti:")) != -1) {
switch (opt) {
case 'w':
printf("Only setting leap-flag, not changing time. It could take up to a day for leap to trigger.\n");
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0438/1376] clocksource: Unregister subsystem on device registration failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (436 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0437/1376] selftests: timers: leap-a-day: Fix -w option and update usage comment Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0439/1376] y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32 Greg Kroah-Hartman
` (560 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yuho Choi, Thomas Gleixner,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <dbgh9129@gmail.com>
[ Upstream commit 3dee6537e728bd8137fda6eaf859f26e685943f7 ]
init_clocksource_sysfs() registers the clocksource subsystem before
registering the clocksource device. If device_register() fails, the
function returns the error while leaving the subsystem registered.
Unregister the clocksource subsystem on that failure path so the
successful subsystem registration is unwound before returning.
Fixes: d369a5d8fc70 ("clocksource: convert sysdev_class to a regular subsystem")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260702215733.84588-1-dbgh9129@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/time/clocksource.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
index df386912f9613..e69c349a2fef9 100644
--- a/kernel/time/clocksource.c
+++ b/kernel/time/clocksource.c
@@ -1510,8 +1510,12 @@ static int __init init_clocksource_sysfs(void)
{
int error = subsys_system_register(&clocksource_subsys, NULL);
- if (!error)
- error = device_register(&device_clocksource);
+ if (error)
+ return error;
+
+ error = device_register(&device_clocksource);
+ if (error)
+ bus_unregister(&clocksource_subsys);
return error;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0439/1376] y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (437 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0438/1376] clocksource: Unregister subsystem on device registration failure Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0440/1376] timekeeping: Account for monotonicity adjustment in ntp_error Greg Kroah-Hartman
` (559 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Weißschuh,
Thomas Gleixner, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
[ Upstream commit 79ced850e549e8c86b772a79ea417a1425b5c04b ]
'struct __kernel_old_timespec' represents the 'native' time ABI of the
kernel. On 32-bit systems it uses 32-bit fields and on 64-bit systems
it uses 64-bit fields.
However the x86 x32 ABI uses the 64-bit time ABI natively. This is
correctly handled for the 'tv_sec' fields, through the typedefs of
'__kernel_old_time_t' -> '__kernel_long_t' -> 'long long'. The same
treatment was missed for 'tv_nsec'.
In practice this might not make much of a difference as the value of
'tv_nsec' will always fit into 32 bits and the missing bits fall
into the padding of the structure.
When introspecting the structure however, a difference can be observed.
Switch to 64-bit tv_nsec on x32. No other architectures or ABIs are
affected.
While this could be interpreted as violating the POSIX requirement of
'timespec::tv_nsec' being 'long':
* __kernel_old_timespec is not actually the POSIX timespec type
* the requirement is gone in newer versions of POSIX
* this matches glibc
Fixes: 94c467ddb273 ("y2038: add __kernel_old_timespec and __kernel_old_time_t")
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260504-timespec-x32-v2-1-0739c9047fc4@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/uapi/linux/time_types.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/uapi/linux/time_types.h b/include/uapi/linux/time_types.h
index bcc0002115d39..03a0d8aaadca5 100644
--- a/include/uapi/linux/time_types.h
+++ b/include/uapi/linux/time_types.h
@@ -30,7 +30,7 @@ struct __kernel_old_timeval {
struct __kernel_old_timespec {
__kernel_old_time_t tv_sec; /* seconds */
- long tv_nsec; /* nanoseconds */
+ __kernel_long_t tv_nsec; /* nanoseconds */
};
struct __kernel_old_itimerval {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0440/1376] timekeeping: Account for monotonicity adjustment in ntp_error
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (438 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0439/1376] y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32 Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0441/1376] clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status Greg Kroah-Hartman
` (558 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Woodhouse, Thomas Gleixner,
John Stultz, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Woodhouse <dwmw@amazon.co.uk>
[ Upstream commit b7befd6d91207cf3f4cecd68fea0c212093906cf ]
timekeeping_apply_adjustment() modifies xtime_nsec to ensure monotonicity
when mult changes:
xtime_nsec -= offset
This ensures that the time reported to userspace does not jump when the
multiplier is adjusted from one tick to the next. However, the ntp_error
accumulator which tracks the difference between intended and actual
clock position was not being updated to reflect this additional
discrepancy.
An earlier attempt at this compensation existed as:
ntp_error -= (interval - offset) << ntp_error_shift
but was removed in commit c2cda2a5bda9 ("timekeeping/ntp: Don't align
NTP frequency adjustments to ticks") because it was a major source of
NTP error. That's because (interval - offset) was wrong: the subtraction
of "interval" prematurely accounted for the changed xtime_interval of
the next tick, which would be correctly accounted in the next
accumulation anyway — a double subtraction.
What is actually needed is just the "offset" part: ntp_error must be
told that xtime_nsec moved by "offset" without a corresponding change
in the intended position. For the normal ±1 mult dithering this is
negligible (the adjustments cancel over time), but for larger mult
changes — such as when an external reference clock sets a new
frequency — the one-time uncompensated offset is significant.
Fix by adjusting ntp_error by the correct amount:
ntp_error += offset << ntp_error_shift
This keeps ntp_error consistent with the actual xtime_nsec position
after the adjustment, and ensures the discrepancy is correctly smoothed
away over time and the clock returns to where it should have been.
Fixes: c2cda2a5bda9 ("timekeeping/ntp: Don't align NTP frequency adjustments to ticks")
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Assisted-by: Kiro:claude-opus-4.6-1m
Acked-by: John Stultz <jstultz@google.com>
Link: https://patch.msgid.link/20260621220051.1030462-3-dwmw2@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/time/timekeeping.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index b99171e71e0ac..4d8927aeca974 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -2015,6 +2015,11 @@ static __always_inline void timekeeping_apply_adjustment(struct timekeeper *tk,
* xtime_nsec_2 = xtime_nsec_1 - offset
* Which simplifies to:
* xtime_nsec -= offset
+ *
+ * When subtracting offset from xtime_nsec, the same amount
+ * (in appropriate units) has to be added to ntp_error, in
+ * order to correctly track the delta between the time
+ * reported in xtime_nsec, and the intended time.
*/
if ((mult_adj > 0) && (tk->tkr_mono.mult + mult_adj < mult_adj)) {
/* NTP adjustment caused clocksource mult overflow */
@@ -2025,6 +2030,7 @@ static __always_inline void timekeeping_apply_adjustment(struct timekeeper *tk,
tk->tkr_mono.mult += mult_adj;
tk->xtime_interval += interval;
tk->tkr_mono.xtime_nsec -= offset;
+ tk->ntp_error += offset << tk->ntp_error_shift;
}
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0441/1376] clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (439 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0440/1376] timekeeping: Account for monotonicity adjustment in ntp_error Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0442/1376] clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains Greg Kroah-Hartman
` (557 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Herman van Hazendonk,
Dmitry Baryshkov, Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herman van Hazendonk <github.com@herrie.org>
[ Upstream commit d69f0c2b8d292b4890c9f0fbe184dfc26c4de86c ]
gdsc_check_status() returns negative errno when the underlying
regmap_read() fails -- e.g. when a parent regmap dies during system
suspend, a CSR is removed by an HW debug tool, or the bus controller
goes into protection. gdsc_poll_status() treats the result as a plain
boolean ("is the GDSC in the requested state?"), so any negative error
return is truncated to "true" and the poll exits with success even
though the rail's real state is unknown:
do {
if (gdsc_check_status(sc, status))
return 0;
} while (ktime_us_delta(ktime_get(), start) < STATUS_POLL_TIMEOUT_US);
if (gdsc_check_status(sc, status))
return 0;
return -ETIMEDOUT;
This silently misleads gdsc_toggle_logic() (which writes/un-writes
SW_COLLAPSE on the strength of the poll succeeding) and the gdsc_init()
sync path (which assumes the readback represents real silicon state).
Latch the return value, propagate negative errno immediately, and only
treat a strictly-positive value as "reached the target state". Make the
same change in the post-timeout final check so a regmap that comes back
after the deadline does not silently degrade to -ETIMEDOUT.
Signed-off-by: Herman van Hazendonk <github.com@herrie.org>
Fixes: 77b1067a19b4 ("clk: qcom: gdsc: Add support for gdscs with gds hw controller")
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260602140934.796697-2-github.com@herrie.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/gdsc.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/clk/qcom/gdsc.c b/drivers/clk/qcom/gdsc.c
index 208fc430ec98f..c17aebb020706 100644
--- a/drivers/clk/qcom/gdsc.c
+++ b/drivers/clk/qcom/gdsc.c
@@ -103,14 +103,21 @@ static int gdsc_hwctrl(struct gdsc *sc, bool en)
static int gdsc_poll_status(struct gdsc *sc, enum gdsc_status status)
{
ktime_t start;
+ int ret;
start = ktime_get();
do {
- if (gdsc_check_status(sc, status))
+ ret = gdsc_check_status(sc, status);
+ if (ret < 0)
+ return ret;
+ if (ret)
return 0;
} while (ktime_us_delta(ktime_get(), start) < STATUS_POLL_TIMEOUT_US);
- if (gdsc_check_status(sc, status))
+ ret = gdsc_check_status(sc, status);
+ if (ret < 0)
+ return ret;
+ if (ret)
return 0;
return -ETIMEDOUT;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0442/1376] clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (440 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0441/1376] clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0443/1376] clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister() Greg Kroah-Hartman
` (556 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Herman van Hazendonk,
Dmitry Baryshkov, Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herman van Hazendonk <github.com@herrie.org>
[ Upstream commit eea55fc694e132aacbe2cf4be7f345115e3d1801 ]
GENPD_FLAG_ALWAYS_ON requires the underlying domain to be on at
genpd_init() time -- the framework will refuse to register the domain
otherwise. When the cold readback in gdsc_init() finds an ALWAYS_ON
GDSC powered down, the driver tries to bring it back up:
} else if (sc->flags & ALWAYS_ON) {
/* If ALWAYS_ON GDSCs are not ON, turn them ON */
gdsc_enable(&sc->pd);
on = true;
}
but discards the return value: if gdsc_enable() fails (regmap write
error, the long-form sequence's status poll times out, or the
HW_CTRL hand-off errors) the code still sets on=true and falls
through to pm_genpd_init(..., !on) -- which then registers the
domain in the ON state and sets GENPD_FLAG_ALWAYS_ON, even though
the silicon is actually off. Subsequent consumer probes will see
genpd report "on" while accessing dead registers and hang or read
garbage.
Catch the failure and surface it: returning the error from
gdsc_init() makes the provider probe fail with the underlying errno,
which propagates to consumers as -EPROBE_DEFER (or fatal if the
hardware really is broken) rather than silently lying about the
rail state.
Signed-off-by: Herman van Hazendonk <github.com@herrie.org>
Fixes: fb55bea1fe43 ("clk: qcom: gdsc: Add support for ALWAYS_ON gdscs")
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260602140934.796697-3-github.com@herrie.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/gdsc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/clk/qcom/gdsc.c b/drivers/clk/qcom/gdsc.c
index c17aebb020706..119d96dfa853e 100644
--- a/drivers/clk/qcom/gdsc.c
+++ b/drivers/clk/qcom/gdsc.c
@@ -481,7 +481,9 @@ static int gdsc_init(struct gdsc *sc)
} else if (sc->flags & ALWAYS_ON) {
/* If ALWAYS_ON GDSCs are not ON, turn them ON */
- gdsc_enable(&sc->pd);
+ ret = gdsc_enable(&sc->pd);
+ if (ret)
+ return ret;
on = true;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0443/1376] clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (441 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0442/1376] clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0444/1376] arm64: dts: qcom: sc8180x-primus: Rename regulator nodes Greg Kroah-Hartman
` (555 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Herman van Hazendonk,
Dmitry Baryshkov, Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herman van Hazendonk <github.com@herrie.org>
[ Upstream commit 86b23609d5e17a770d03037e53c6a443e742a6e6 ]
gdsc_unregister() removes the OF provider entry and tears down the
parent/subdomain wiring, but never calls pm_genpd_remove() on the
individual generic_pm_domain structures registered by gdsc_init():
void gdsc_unregister(struct gdsc_desc *desc)
{
struct device *dev = desc->dev;
size_t num = desc->num;
gdsc_pm_subdomain_remove(desc, num);
of_genpd_del_provider(dev->of_node);
}
That leaves dangling entries on the global gpd_list. After a provider
unbind/rebind cycle (deferred-probe replay during early boot, real
module unload of a clk driver that owns GDSCs, or an OF-overlay tear-
down) the next gdsc_init() will end up trying to re-register a name
that is still in the list and pm_genpd_init() returns -EEXIST.
While we are here, flip the order so the consumer-facing OF provider
entry is the first thing removed -- otherwise a fresh
of_genpd_get_from_provider() call racing with the teardown could
attach to a domain that is mid-removal.
Iterate the scs[] array and pm_genpd_remove() each registered domain
after the subdomain links are torn down. The regulators stay devm-
managed (devm_regulator_get_optional() in gdsc_register()), so the
release happens automatically when the underlying device is unbound;
just the genpd accounting needs to be undone explicitly.
Signed-off-by: Herman van Hazendonk <github.com@herrie.org>
Fixes: 45dd0e55317c ("clk: qcom: Add support for GDSCs")
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260602140934.796697-4-github.com@herrie.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/gdsc.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/clk/qcom/gdsc.c b/drivers/clk/qcom/gdsc.c
index 119d96dfa853e..83320559d2188 100644
--- a/drivers/clk/qcom/gdsc.c
+++ b/drivers/clk/qcom/gdsc.c
@@ -600,10 +600,18 @@ int gdsc_register(struct gdsc_desc *desc,
void gdsc_unregister(struct gdsc_desc *desc)
{
struct device *dev = desc->dev;
+ struct gdsc **scs = desc->scs;
size_t num = desc->num;
+ int i;
- gdsc_pm_subdomain_remove(desc, num);
of_genpd_del_provider(dev->of_node);
+ gdsc_pm_subdomain_remove(desc, num);
+
+ for (i = 0; i < num; i++) {
+ if (!scs[i])
+ continue;
+ pm_genpd_remove(&scs[i]->pd);
+ }
}
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0444/1376] arm64: dts: qcom: sc8180x-primus: Rename regulator nodes
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (442 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0443/1376] clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister() Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0445/1376] arm64: dts: qcom: sc8180x-primus: Describe the display power net Greg Kroah-Hartman
` (554 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
[ Upstream commit ae51d9396f9318189e91578878409d8ada152edb ]
The nodes would be sorted correctly, if their names started with
"regulator-" (which is the style used in the latest submissions).
Touch that up.
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260616-topic-8180_disp_power-v2-1-167785993231@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Stable-dep-of: 80bf2eb87bfb ("arm64: dts: qcom: sc8180x-primus: Describe the display power net")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sc8180x-primus.dts | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sc8180x-primus.dts b/arch/arm64/boot/dts/qcom/sc8180x-primus.dts
index 79b4d293ea1e7..09dc42f5f2f86 100644
--- a/arch/arm64/boot/dts/qcom/sc8180x-primus.dts
+++ b/arch/arm64/boot/dts/qcom/sc8180x-primus.dts
@@ -165,7 +165,7 @@ reserved-region@9a500000 {
};
};
- vreg_nvme_0p9: nvme-0p9-regulator {
+ vreg_nvme_0p9: regulator-nvme-0p9 {
compatible = "regulator-fixed";
regulator-name = "vreg_nvme_0p9";
@@ -175,7 +175,7 @@ vreg_nvme_0p9: nvme-0p9-regulator {
regulator-always-on;
};
- vreg_nvme_3p3: nvme-3p3-regulator {
+ vreg_nvme_3p3: regulator-nvme-3p3 {
compatible = "regulator-fixed";
regulator-name = "vreg_nvme_3p3";
@@ -188,7 +188,7 @@ vreg_nvme_3p3: nvme-3p3-regulator {
regulator-always-on;
};
- vdd_kb_tp_3v3: vdd-kb-tp-3v3-regulator {
+ vdd_kb_tp_3v3: regulator-vdd-kb-tp-3v3 {
compatible = "regulator-fixed";
regulator-name = "vdd_kb_tp_3v3";
regulator-min-microvolt = <3300000>;
@@ -203,7 +203,7 @@ vdd_kb_tp_3v3: vdd-kb-tp-3v3-regulator {
pinctrl-0 = <&kb_tp_3v3_en_active_state>;
};
- vph_pwr: vph-pwr-regulator {
+ vph_pwr: regulator-vph-pwr {
compatible = "regulator-fixed";
regulator-name = "vph_pwr";
regulator-min-microvolt = <3700000>;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0445/1376] arm64: dts: qcom: sc8180x-primus: Describe the display power net
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (443 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0444/1376] arm64: dts: qcom: sc8180x-primus: Rename regulator nodes Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0446/1376] arm64: dts: qcom: sc8180x-lenovo-flex-5g: Rename regulator nodes Greg Kroah-Hartman
` (553 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Bjorn Andersson,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
[ Upstream commit 80bf2eb87bfbf1b7bc7b12228cbcc710b0a26275 ]
Describe and wire up the power supplies for the eDP panel and its
backlight. Previously, this was only working because of settings
inherited from the bootloader.
Fixes: 2ce38cc1e8fe ("arm64: dts: qcom: sc8180x: Introduce Primus")
Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260616-topic-8180_disp_power-v2-2-167785993231@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sc8180x-primus.dts | 48 ++++++++++++++++++++-
1 file changed, 47 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/sc8180x-primus.dts b/arch/arm64/boot/dts/qcom/sc8180x-primus.dts
index 09dc42f5f2f86..4d1d079a1f37e 100644
--- a/arch/arm64/boot/dts/qcom/sc8180x-primus.dts
+++ b/arch/arm64/boot/dts/qcom/sc8180x-primus.dts
@@ -27,9 +27,10 @@ backlight: backlight {
compatible = "pwm-backlight";
pwms = <&pmc8180c_lpg 4 1000000>;
enable-gpios = <&pmc8180c_gpios 8 GPIO_ACTIVE_HIGH>;
+ power-supply = <&vled_bl_pw>;
- pinctrl-names = "default";
pinctrl-0 = <&bl_pwm_default>;
+ pinctrl-names = "default";
};
chosen {
@@ -165,6 +166,38 @@ reserved-region@9a500000 {
};
};
+ vled_bl_pw: regulator-vled-bl-pw {
+ compatible = "regulator-fixed";
+
+ regulator-name = "VLED_BL_PW";
+ regulator-min-microvolt = <3300000>;
+ regulator-max-microvolt = <3300000>;
+
+ gpio = <&pmc8180_2_gpios 1 GPIO_ACTIVE_HIGH>;
+ enable-active-high;
+
+ pinctrl-0 = <&bl_pwr_en>;
+ pinctrl-names = "default";
+
+ regulator-boot-on;
+ };
+
+ vreg_lcm_3v3: regulator-edp-3p3 {
+ compatible = "regulator-fixed";
+
+ regulator-name = "VREG_LCM_3V3";
+ regulator-min-microvolt = <3300000>;
+ regulator-max-microvolt = <3300000>;
+
+ gpio = <&tlmm 130 GPIO_ACTIVE_HIGH>;
+ enable-active-high;
+
+ pinctrl-0 = <&lcm_3v3_en>;
+ pinctrl-names = "default";
+
+ regulator-boot-on;
+ };
+
vreg_nvme_0p9: regulator-nvme-0p9 {
compatible = "regulator-fixed";
regulator-name = "vreg_nvme_0p9";
@@ -541,6 +574,7 @@ &mdss_edp {
aux-bus {
panel {
compatible = "edp-panel";
+ power-supply = <&vreg_lcm_3v3>;
backlight = <&backlight>;
@@ -778,6 +812,12 @@ &xo_board_clk {
};
/* PINCTRL */
+&pmc8180_2_gpios {
+ bl_pwr_en: bl-pwr-en-state {
+ pins = "gpio1";
+ function = "normal";
+ };
+};
&pmc8180c_gpios {
bl_pwm_default: bl-pwm-default-state {
@@ -959,4 +999,10 @@ rx-pins {
bias-pull-up;
};
};
+
+ lcm_3v3_en: lcm-3v3-en-state {
+ pins = "gpio130";
+ function = "gpio";
+ bias-disable;
+ };
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0446/1376] arm64: dts: qcom: sc8180x-lenovo-flex-5g: Rename regulator nodes
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (444 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0445/1376] arm64: dts: qcom: sc8180x-primus: Describe the display power net Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0447/1376] arm64: dts: qcom: sc8180x-lenovo-flex-5g: Describe the display power net Greg Kroah-Hartman
` (552 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
[ Upstream commit 0b1c6d2a65fc41aa0d5f6617dd04043384678d61 ]
Align with the contemporary way of naming regulator nodes (regulator-
prefix) in preparation for adding more of them.
Reorder the renamed entries to match the expectations of the DT coding
style doc.
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260616-topic-8180_disp_power-v2-3-167785993231@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Stable-dep-of: d5f5c089858f ("arm64: dts: qcom: sc8180x-lenovo-flex-5g: Describe the display power net")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../boot/dts/qcom/sc8180x-lenovo-flex-5g.dts | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sc8180x-lenovo-flex-5g.dts b/arch/arm64/boot/dts/qcom/sc8180x-lenovo-flex-5g.dts
index 62de4774c556d..357b1214c1738 100644
--- a/arch/arm64/boot/dts/qcom/sc8180x-lenovo-flex-5g.dts
+++ b/arch/arm64/boot/dts/qcom/sc8180x-lenovo-flex-5g.dts
@@ -162,14 +162,7 @@ cdsp_mem: cdsp-region@98900000 {
};
};
- vph_pwr: vph-pwr-regulator {
- compatible = "regulator-fixed";
- regulator-name = "vph_pwr";
- regulator-min-microvolt = <3700000>;
- regulator-max-microvolt = <3700000>;
- };
-
- vreg_s4a_1p8: pm8150-s4-regulator {
+ vreg_s4a_1p8: regulator-pm8150-s4 {
compatible = "regulator-fixed";
regulator-name = "vreg_s4a_1p8";
@@ -182,6 +175,13 @@ vreg_s4a_1p8: pm8150-s4-regulator {
vin-supply = <&vph_pwr>;
};
+ vph_pwr: regulator-vph-pwr {
+ compatible = "regulator-fixed";
+ regulator-name = "vph_pwr";
+ regulator-min-microvolt = <3700000>;
+ regulator-max-microvolt = <3700000>;
+ };
+
usbprim-sbu-mux {
compatible = "pericom,pi3usb102", "gpio-sbu-mux";
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0447/1376] arm64: dts: qcom: sc8180x-lenovo-flex-5g: Describe the display power net
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (445 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0446/1376] arm64: dts: qcom: sc8180x-lenovo-flex-5g: Rename regulator nodes Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0448/1376] perf data convert json: Fix trace_seq memory leak in process_sample_event() Greg Kroah-Hartman
` (551 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Bjorn Andersson,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
[ Upstream commit d5f5c089858f7accd1e4574c0c09d811e90eb51f ]
Describe and wire up the power supplies for the eDP panel and its
backlight. Previously, this was only working because of settings
inherited from the bootloader.
Fixes: 20dea72a393c ("arm64: dts: qcom: sc8180x: Introduce Lenovo Flex 5G")
Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260616-topic-8180_disp_power-v2-4-167785993231@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../boot/dts/qcom/sc8180x-lenovo-flex-5g.dts | 47 +++++++++++++++++++
1 file changed, 47 insertions(+)
diff --git a/arch/arm64/boot/dts/qcom/sc8180x-lenovo-flex-5g.dts b/arch/arm64/boot/dts/qcom/sc8180x-lenovo-flex-5g.dts
index 357b1214c1738..debe9fa74724a 100644
--- a/arch/arm64/boot/dts/qcom/sc8180x-lenovo-flex-5g.dts
+++ b/arch/arm64/boot/dts/qcom/sc8180x-lenovo-flex-5g.dts
@@ -26,6 +26,7 @@ backlight: backlight {
compatible = "pwm-backlight";
pwms = <&pmc8180c_lpg 4 1000000>;
enable-gpios = <&pmc8180c_gpios 8 GPIO_ACTIVE_HIGH>;
+ power-supply = <&vled_bl_pw>;
pinctrl-0 = <&bl_pwm_default>;
pinctrl-names = "default";
@@ -162,6 +163,38 @@ cdsp_mem: cdsp-region@98900000 {
};
};
+ vled_bl_pw: regulator-vled-bl-pw {
+ compatible = "regulator-fixed";
+
+ regulator-name = "VLED_BL_PW";
+ regulator-min-microvolt = <3300000>;
+ regulator-max-microvolt = <3300000>;
+
+ gpio = <&pmc8180_2_gpios 1 GPIO_ACTIVE_HIGH>;
+ enable-active-high;
+
+ pinctrl-0 = <&bl_pwr_en>;
+ pinctrl-names = "default";
+
+ regulator-boot-on;
+ };
+
+ vreg_lcm_3v3: regulator-edp-3p3 {
+ compatible = "regulator-fixed";
+
+ regulator-name = "VREG_LCM_3V3";
+ regulator-min-microvolt = <3300000>;
+ regulator-max-microvolt = <3300000>;
+
+ gpio = <&tlmm 130 GPIO_ACTIVE_HIGH>;
+ enable-active-high;
+
+ pinctrl-0 = <&lcm_3v3_en>;
+ pinctrl-names = "default";
+
+ regulator-boot-on;
+ };
+
vreg_s4a_1p8: regulator-pm8150-s4 {
compatible = "regulator-fixed";
regulator-name = "vreg_s4a_1p8";
@@ -446,6 +479,7 @@ &mdss_edp {
aux-bus {
panel {
compatible = "edp-panel";
+ power-supply = <&vreg_lcm_3v3>;
no-hpd;
backlight = <&backlight>;
@@ -484,6 +518,13 @@ &pcie3_phy {
status = "okay";
};
+&pmc8180_2_gpios {
+ bl_pwr_en: bl-pwr-en-state {
+ pins = "gpio1";
+ function = "normal";
+ };
+};
+
&pmc8180_pwrkey {
status = "okay";
};
@@ -781,6 +822,12 @@ ts_int_default: ts-int-default-state {
drive-strength = <2>;
};
+ lcm_3v3_en: lcm-3v3-en-state {
+ pins = "gpio130";
+ function = "gpio";
+ bias-disable;
+ };
+
usbprim_sbu_default: usbprim-sbu-state {
oe-n-pins {
pins = "gpio152";
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0448/1376] perf data convert json: Fix trace_seq memory leak in process_sample_event()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (446 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0447/1376] arm64: dts: qcom: sc8180x-lenovo-flex-5g: Describe the display power net Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0449/1376] thermal/drivers/rcar: Fix error checking in probe() Greg Kroah-Hartman
` (550 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tanushree Shah, Namhyung Kim,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tanushree Shah <tshah@linux.ibm.com>
[ Upstream commit dcb87c88952046ef43cb5ba3a5b95eb29c362a16 ]
Unlike the in-kernel trace_seq which uses a statically allocated buffer,
the userspace traceevent library's trace_seq uses a dynamically allocated
one. Therefore, every trace_seq_init() call must be paired with a
trace_seq_destroy(), otherwise it produces a memory leak.
In process_sample_event(), a trace_seq is initialized for each field when
formatting tracepoint raw_data, but the matching trace_seq_destroy() is
never called, leaking memory for every field of every sample processed.
Add the missing trace_seq_destroy() after using the trace_seq buffer to
properly free the allocated memory.
Detected with Valgrind on a perf.data file with 2,729 tracepoint samples:
Before: definitely lost: 55,537,664 bytes in 13,559 blocks
After: definitely lost: 0 bytes in 0 blocks
Fixes: 9d895e468429 ("perf data: Add tracepoint fields when converting to JSON")
Signed-off-by: Tanushree Shah <tshah@linux.ibm.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/data-convert-json.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/perf/util/data-convert-json.c b/tools/perf/util/data-convert-json.c
index 20bfb0884e9ea..395b231cf16c4 100644
--- a/tools/perf/util/data-convert-json.c
+++ b/tools/perf/util/data-convert-json.c
@@ -242,6 +242,7 @@ static int process_sample_event(const struct perf_tool *tool,
trace_seq_init(&s);
tep_print_field(&s, sample->raw_data, fields[i]);
output_json_key_string(out, true, 3, fields[i]->name, s.buffer);
+ trace_seq_destroy(&s);
i++;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0449/1376] thermal/drivers/rcar: Fix error checking in probe()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (447 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0448/1376] perf data convert json: Fix trace_seq memory leak in process_sample_event() Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0450/1376] usb: typec: ucsi: unregister debugfs entries on teardown Greg Kroah-Hartman
` (549 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven,
Niklas Söderlund, Dan Carpenter, Daniel Lezcano, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <error27@gmail.com>
[ Upstream commit dd04ad1cdabcad51e34b74b4e91b9aeb7180d05d ]
This code accidentally calls thermal_zone_device_enable() before checking
whether thermal_zone_device_register_with_trips() failed. Move the call
until later to avoid an error pointer dereference of "priv->zone".
The driver works differently depending on if we are using OF thermal or
not. We use thermal_add_hwmon_sysfs() if we are using OF thermal and
call thermal_zone_device_enable() if not. We can share same error check
for if either of these fail.
Moving the thermal_zone_device_enable() call is a bit cleaner as well.
The original code used a three step process to cleanup:
1. Call thermal_zone_device_unregister() to cleanup.
2. Set priv->zone to an error pointer to preserve the error code.
3. Set priv->zone to NULL to avoid a second call to
thermal_zone_device_unregister() in the rcar_thermal_remove()
function.
Now we can just do a direct goto error_unregister and rcar_thermal_remove()
handles the cleanup properly.
Fixes: bbcf90c0646a ("thermal: Explicitly enable non-changing thermal zone devices")
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org>
Link: https://patch.msgid.link/aj5WnseULiwgmlWv@stanley.mountain
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/thermal/renesas/rcar_thermal.c | 15 +++++----------
1 file changed, 5 insertions(+), 10 deletions(-)
diff --git a/drivers/thermal/renesas/rcar_thermal.c b/drivers/thermal/renesas/rcar_thermal.c
index ddc8341e5c3fa..00517681a8bb1 100644
--- a/drivers/thermal/renesas/rcar_thermal.c
+++ b/drivers/thermal/renesas/rcar_thermal.c
@@ -492,12 +492,6 @@ static int rcar_thermal_probe(struct platform_device *pdev)
"rcar_thermal", trips, ARRAY_SIZE(trips), priv,
&rcar_thermal_zone_ops, NULL, 0,
idle);
-
- ret = thermal_zone_device_enable(priv->zone);
- if (ret) {
- thermal_zone_device_unregister(priv->zone);
- priv->zone = ERR_PTR(ret);
- }
}
if (IS_ERR(priv->zone)) {
dev_err(dev, "can't register thermal zone\n");
@@ -506,11 +500,12 @@ static int rcar_thermal_probe(struct platform_device *pdev)
goto error_unregister;
}
- if (chip->use_of_thermal) {
+ if (chip->use_of_thermal)
ret = thermal_add_hwmon_sysfs(priv->zone);
- if (ret)
- goto error_unregister;
- }
+ else
+ ret = thermal_zone_device_enable(priv->zone);
+ if (ret)
+ goto error_unregister;
rcar_thermal_irq_enable(priv);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0450/1376] usb: typec: ucsi: unregister debugfs entries on teardown
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (448 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0449/1376] thermal/drivers/rcar: Fix error checking in probe() Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0451/1376] usb: gadget: r8a66597: avoid double free of ep0_req in probe error path Greg Kroah-Hartman
` (548 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bjorn Andersson, Konrad Dybcio,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
[ Upstream commit eed73a65ab609b79d53de88cccc34b36dfe753c4 ]
ucsi_register() creates per-instance debugfs entries, but
ucsi_unregister() keeps them around until ucsi_destroy().
Drivers like ucsi_glink that unregister/register the same UCSI
instance across remoteproc restart then try to create an already
existing debugfs directory and log:
debugfs: 'pmic_glink.ucsi.0' already exists in 'ucsi'
Unregister debugfs entries as part of ucsi_unregister(), and
clear ucsi->debugfs after freeing it so repeated unregister
paths remain safe.
Assisted-by: Codex:GPT-5.5
Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
Fixes: df0383ffad64 ("usb: typec: ucsi: Add debugfs for ucsi commands")
Tested-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> # X1E80100 CRD
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20260611-usci-unregister-debugfs-v1-1-f4a518a94f27@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/typec/ucsi/debugfs.c | 1 +
drivers/usb/typec/ucsi/ucsi.c | 2 ++
2 files changed, 3 insertions(+)
diff --git a/drivers/usb/typec/ucsi/debugfs.c b/drivers/usb/typec/ucsi/debugfs.c
index f67733cecfdf5..2f5a3ae1fd852 100644
--- a/drivers/usb/typec/ucsi/debugfs.c
+++ b/drivers/usb/typec/ucsi/debugfs.c
@@ -89,6 +89,7 @@ void ucsi_debugfs_unregister(struct ucsi *ucsi)
debugfs_remove_recursive(ucsi->debugfs->dentry);
kfree(ucsi->debugfs);
+ ucsi->debugfs = NULL;
}
void ucsi_debugfs_init(void)
diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
index 5e7226aed7005..b80f68e34d21d 100644
--- a/drivers/usb/typec/ucsi/ucsi.c
+++ b/drivers/usb/typec/ucsi/ucsi.c
@@ -2102,6 +2102,8 @@ void ucsi_unregister(struct ucsi *ucsi)
cancel_delayed_work_sync(&ucsi->work);
cancel_work_sync(&ucsi->resume_work);
+ ucsi_debugfs_unregister(ucsi);
+
/* Disable notifications */
ucsi->ops->async_control(ucsi, cmd);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0451/1376] usb: gadget: r8a66597: avoid double free of ep0_req in probe error path
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (449 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0450/1376] usb: typec: ucsi: unregister debugfs entries on teardown Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0452/1376] udf: Mark LVID buffer as uptodate before marking it dirty Greg Kroah-Hartman
` (547 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hongyan Xu, Slavin Liu, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongyan Xu <getshell@seu.edu.cn>
[ Upstream commit 41d541e3718db01668a4cd29815ee4b3b55f76d2 ]
If usb_add_gadget_udc() fails, r8a66597_probe() jumps to err_add_udc
and frees ep0_req, then falls through to clean_up2 where ep0_req is
freed again when it is non-NULL.
Remove the redundant free from err_add_udc and keep the cleanup in
clean_up2 so the request is released exactly once.
Fixes: 776976a67ae2 ("usb: gadget: r8a66597-udc: cleanup error path")
Issue found using a prototype static analysis tool
and confirmed by code review.
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
Signed-off-by: Slavin Liu <220245772@seu.edu.cn>
Link: https://patch.msgid.link/20260624140908.1282-1-getshell@seu.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/udc/r8a66597-udc.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/usb/gadget/udc/r8a66597-udc.c b/drivers/usb/gadget/udc/r8a66597-udc.c
index db4a10a979f9d..813b1e1af4350 100644
--- a/drivers/usb/gadget/udc/r8a66597-udc.c
+++ b/drivers/usb/gadget/udc/r8a66597-udc.c
@@ -1951,7 +1951,6 @@ static int r8a66597_probe(struct platform_device *pdev)
return 0;
err_add_udc:
- r8a66597_free_request(&r8a66597->ep[0].ep, r8a66597->ep0_req);
clean_up2:
if (r8a66597->pdata->on_chip)
clk_disable_unprepare(r8a66597->clk);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0452/1376] udf: Mark LVID buffer as uptodate before marking it dirty
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (450 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0451/1376] usb: gadget: r8a66597: avoid double free of ep0_req in probe error path Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0453/1376] perf vendor events amd: Reintroduce deprecated Zen 5 core events Greg Kroah-Hartman
` (546 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+0306b38d9ed6ef71467d,
Aleksandr Nogikh, Jan Kara, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Nogikh <nogikh@google.com>
[ Upstream commit fb0601134c7e51728bd098abc6909315de1e5d86 ]
When an I/O error occurs while writing the Logical Volume Integrity
Descriptor (LVID) buffer to the block device, the block layer's completion
handler (`end_buffer_write_sync()`) clears the `BH_Uptodate` flag on the
buffer. However, the buffer still contains valid LVID data in memory. If
the filesystem is subsequently remounted read-write or synced,
`udf_open_lvid()` or `udf_sync_fs()` will modify the LVID buffer and call
`mark_buffer_dirty()`. This triggers a spurious
`WARN_ON_ONCE(!buffer_uptodate(bh))` warning in `mark_buffer_dirty()`
because the buffer is not marked uptodate, even though its in-memory
contents are valid and are about to be overwritten.
To prevent this spurious warning, unconditionally set the `BH_Uptodate`
flag before calling `mark_buffer_dirty()` in `udf_open_lvid()` and
`udf_sync_fs()`. This acknowledges that the in-memory buffer is valid and
matches the workaround previously applied to `udf_close_lvid()` in commit
853a0c25baf9 ("udf: Mark LVID buffer as uptodate before marking it dirty").
Extending this workaround ensures consistent behavior across all LVID
updates.
Buffer I/O error on dev loop0, logical block 128, lost sync page write
------------[ cut here ]------------
!buffer_uptodate(bh)
WARNING: fs/buffer.c:1087 at mark_buffer_dirty+0x299/0x410 fs/buffer.c:1087
...
Call Trace:
<TASK>
udf_open_lvid+0x369/0x5b0 fs/udf/super.c:2078
udf_reconfigure+0x336/0x540 fs/udf/super.c:679
reconfigure_super+0x232/0x8f0 fs/super.c:1080
vfs_cmd_reconfigure fs/fsopen.c:268 [inline]
vfs_fsconfig_locked+0x171/0x320 fs/fsopen.c:297
__do_sys_fsconfig fs/fsopen.c:463 [inline]
__se_sys_fsconfig+0x6b9/0x810 fs/fsopen.c:350
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
</TASK>
Fixes: 853a0c25baf9 ("udf: Mark LVID buffer as uptodate before marking it dirty")
Assisted-by: Gemini:gemini-3.1-pro-preview Gemini:gemini-3-flash-preview syzbot
Reported-by: syzbot+0306b38d9ed6ef71467d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=0306b38d9ed6ef71467d
Link: https://syzkaller.appspot.com/ai_job?id=05f8e20f-f080-4c7f-a206-08dbc15cb4a1
Signed-off-by: Aleksandr Nogikh <nogikh@google.com>
Link: https://patch.msgid.link/6ffb2ca8-e22f-4fd6-9f37-7202ec0878bd@mail.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/udf/super.c | 23 ++++++++++++++---------
1 file changed, 14 insertions(+), 9 deletions(-)
diff --git a/fs/udf/super.c b/fs/udf/super.c
index c7c5fd45166b9..f91b231b7d7bd 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -2050,6 +2050,17 @@ static int udf_load_vrs(struct super_block *sb, struct udf_options *uopt,
return 0;
}
+static void udf_mark_buffer_dirty(struct buffer_head *bh)
+{
+ /*
+ * We set buffer uptodate unconditionally here to avoid spurious
+ * warnings from mark_buffer_dirty() when previous EIO has marked
+ * the buffer as !uptodate
+ */
+ set_buffer_uptodate(bh);
+ mark_buffer_dirty(bh);
+}
+
static void udf_finalize_lvid(struct logicalVolIntegrityDesc *lvid)
{
struct timespec64 ts;
@@ -2085,7 +2096,7 @@ static void udf_open_lvid(struct super_block *sb)
UDF_SET_FLAG(sb, UDF_FLAG_INCONSISTENT);
udf_finalize_lvid(lvid);
- mark_buffer_dirty(bh);
+ udf_mark_buffer_dirty(bh);
sbi->s_lvid_dirty = 0;
mutex_unlock(&sbi->s_alloc_mutex);
/* Make opening of filesystem visible on the media immediately */
@@ -2118,14 +2129,8 @@ static void udf_close_lvid(struct super_block *sb)
if (!UDF_QUERY_FLAG(sb, UDF_FLAG_INCONSISTENT))
lvid->integrityType = cpu_to_le32(LVID_INTEGRITY_TYPE_CLOSE);
- /*
- * We set buffer uptodate unconditionally here to avoid spurious
- * warnings from mark_buffer_dirty() when previous EIO has marked
- * the buffer as !uptodate
- */
- set_buffer_uptodate(bh);
udf_finalize_lvid(lvid);
- mark_buffer_dirty(bh);
+ udf_mark_buffer_dirty(bh);
sbi->s_lvid_dirty = 0;
mutex_unlock(&sbi->s_alloc_mutex);
/* Make closing of filesystem visible on the media immediately */
@@ -2407,7 +2412,7 @@ static int udf_sync_fs(struct super_block *sb, int wait)
* Blockdevice will be synced later so we don't have to submit
* the buffer for IO
*/
- mark_buffer_dirty(bh);
+ udf_mark_buffer_dirty(bh);
sbi->s_lvid_dirty = 0;
}
mutex_unlock(&sbi->s_alloc_mutex);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0453/1376] perf vendor events amd: Reintroduce deprecated Zen 5 core events
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (451 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0452/1376] udf: Mark LVID buffer as uptodate before marking it dirty Greg Kroah-Hartman
@ 2026-09-12 6:47 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0454/1376] perf dso: Fix kallsyms DSO detection with fallback logic Greg Kroah-Hartman
` (545 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ian Rogers, Sandipan Das,
Namhyung Kim, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sandipan Das <sandipan.das@amd.com>
[ Upstream commit eda39f98bbc5ce8b7b0be10193d2de38ed59da6c ]
Maintain backward compatibility by reintroducing the events that were
previously removed by commit 047979af3bf6 ("perf vendor events amd:
Update Zen 5 core events"). Also set the deprecated flag and update
the descriptions to point users to the correct alternative.
Reported-by: Ian Rogers <irogers@google.com>
Closes: https://lore.kernel.org/all/CAP-5=fV_czvd-z4N7K+_SabxuOm9UUHRyBxNuchrtAgJL3OqOw@mail.gmail.com/
Fixes: 047979af3bf6 ("perf vendor events amd: Update Zen 5 core events")
Signed-off-by: Sandipan Das <sandipan.das@amd.com>
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../arch/x86/amdzen5/floating-point.json | 42 +++++++++++++++++++
1 file changed, 42 insertions(+)
diff --git a/tools/perf/pmu-events/arch/x86/amdzen5/floating-point.json b/tools/perf/pmu-events/arch/x86/amdzen5/floating-point.json
index 569975b53cc33..50d38434f8d3d 100644
--- a/tools/perf/pmu-events/arch/x86/amdzen5/floating-point.json
+++ b/tools/perf/pmu-events/arch/x86/amdzen5/floating-point.json
@@ -383,6 +383,13 @@
"BriefDescription": "Retired MMX integer VNNI ops.",
"UMask": "0x0c"
},
+ {
+ "EventName": "sse_avx_ops_retired.mmx_pack",
+ "EventCode": "0x0b",
+ "BriefDescription": "This event is deprecated. Refer to new event sse_avx_ops_retired.mmx_vnni",
+ "Deprecated": "1",
+ "UMask": "0x0c"
+ },
{
"EventName": "sse_avx_ops_retired.mmx_logical",
"EventCode": "0x0b",
@@ -449,6 +456,13 @@
"BriefDescription": "Retired SSE and AVX integer convert or pack ops.",
"UMask": "0x80"
},
+ {
+ "EventName": "sse_avx_ops_retired.sse_avx_clm",
+ "EventCode": "0x0b",
+ "BriefDescription": "This event is deprecated. Refer to new event sse_avx_ops_retired.sse_avx_cvt",
+ "Deprecated": "1",
+ "UMask": "0x80"
+ },
{
"EventName": "sse_avx_ops_retired.sse_avx_shift",
"EventCode": "0x0b",
@@ -473,6 +487,13 @@
"BriefDescription": "Retired SSE and AVX integer VNNI ops.",
"UMask": "0xc0"
},
+ {
+ "EventName": "sse_avx_ops_retired.sse_avx_pack",
+ "EventCode": "0x0b",
+ "BriefDescription": "This event is deprecated. Refer to new event sse_avx_ops_retired.sse_avx_vnni",
+ "Deprecated": "1",
+ "UMask": "0xc0"
+ },
{
"EventName": "sse_avx_ops_retired.sse_avx_logical",
"EventCode": "0x0b",
@@ -731,6 +752,13 @@
"BriefDescription": "Retired 128-bit packed integer convert or pack ops.",
"UMask": "0x08"
},
+ {
+ "EventName": "packed_int_op_type.int128_clm",
+ "EventCode": "0x0d",
+ "BriefDescription": "This event is deprecated. Refer to new event packed_int_op_type.int128_cvt",
+ "Deprecated": "1",
+ "UMask": "0x08"
+ },
{
"EventName": "packed_int_op_type.int128_shift",
"EventCode": "0x0d",
@@ -755,6 +783,13 @@
"BriefDescription": "Retired 128-bit packed integer VNNI ops.",
"UMask": "0x0c"
},
+ {
+ "EventName": "packed_int_op_type.int128_pack",
+ "EventCode": "0x0d",
+ "BriefDescription": "This event is deprecated. Refer to new event packed_int_op_type.int128_vnni",
+ "Deprecated": "1",
+ "UMask": "0x0c"
+ },
{
"EventName": "packed_int_op_type.int128_logical",
"EventCode": "0x0d",
@@ -845,6 +880,13 @@
"BriefDescription": "Retired 256-bit packed integer VNNI ops.",
"UMask": "0xc0"
},
+ {
+ "EventName": "packed_int_op_type.int256_pack",
+ "EventCode": "0x0d",
+ "BriefDescription": "This event is deprecated. Refer to new event packed_int_op_type.int256_vnni",
+ "Deprecated": "1",
+ "UMask": "0xc0"
+ },
{
"EventName": "packed_int_op_type.int256_logical",
"EventCode": "0x0d",
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0454/1376] perf dso: Fix kallsyms DSO detection with fallback logic
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (452 preceding siblings ...)
2026-09-12 6:47 ` [PATCH 6.12 0453/1376] perf vendor events amd: Reintroduce deprecated Zen 5 core events Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0455/1376] bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux Greg Kroah-Hartman
` (544 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tanushree Shah, Namhyung Kim,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tanushree Shah <tshah@linux.ibm.com>
[ Upstream commit 8c5f60344b07f839267c0c835962e2206143be85 ]
The current kallsyms detection in dso__is_kallsyms() uses the
dso_binary_type enum which fixes the issue of kallsyms being cached in
the build-id cache for out-of-tree modules.
However, during build-id injection in perf record/inject, dso_binary_type
has not been explicitly set yet,so dso__binary_type() returns
DSO_BINARY_TYPE__NOT_FOUND instead of DSO_BINARY_TYPE__KALLSYMS for the
kernel DSO. The current check then fails to identify it as kallsyms,
causing build-id symlinks to not be created in ~/.debug/.build-id/ and
perf archive to fail with "Cannot stat" errors.
Steps to reproduce the issue:
1. rm -rf ~/.debug/.build-id
2. perf record sleep 1
3. perf archive
Fix by falling back to matching long_name against the known kallsyms
strings explicitly when binary_type is not yet set
(== DSO_BINARY_TYPE__NOT_FOUND). Use strcmp() for exact matching of
fixed names and strict validation for guest kallsyms with embedded PID
to prevent path traversal attacks.
Fixes: ebf0b332732d ("perf dso: fix dso__is_kallsyms() check")
Signed-off-by: Tanushree Shah <tshah@linux.ibm.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/dso.h | 57 ++++++++++++++++++++++++++++++++++++++++++-
1 file changed, 56 insertions(+), 1 deletion(-)
diff --git a/tools/perf/util/dso.h b/tools/perf/util/dso.h
index c0472a41147c3..bb0238acd583d 100644
--- a/tools/perf/util/dso.h
+++ b/tools/perf/util/dso.h
@@ -9,6 +9,7 @@
#include <stdbool.h>
#include <stdio.h>
#include <linux/bitops.h>
+#include <string.h>
#include "build-id.h"
#include "mutex.h"
#include <internal/rc_check.h>
@@ -19,6 +20,40 @@ struct perf_env;
#define DSO__NAME_KALLSYMS "[kernel.kallsyms]"
#define DSO__NAME_KCORE "[kernel.kcore]"
+#define DSO__NAME_GUEST_KALLSYMS "[guest.kernel.kallsyms]"
+#define DSO__NAME_GUEST_KALLSYMS_PID_PREFIX "[guest.kernel.kallsyms."
+
+/*
+ * Validate names of the form "[guest.kernel.kallsyms.<pid>]", where
+ * <pid> is the PID of the guest VM and varies per guest, so it
+ * cannot be matched with strcmp() against a fixed string.
+ *
+ * Every character after the fixed prefix must be a decimal digit,
+ * with ']' immediately terminating the digit run and nothing
+ * following it. This rules out '/', "..", or any other character
+ * being smuggled into the name.
+ */
+static inline bool is_guest_kallsyms_pid_name(const char *name)
+{
+ const size_t prefix_len = sizeof(DSO__NAME_GUEST_KALLSYMS_PID_PREFIX) - 1;
+ size_t digits;
+
+ if (strncmp(name, DSO__NAME_GUEST_KALLSYMS_PID_PREFIX, prefix_len) != 0)
+ return false;
+
+ digits = strspn(name + prefix_len, "0123456789");
+ if (digits == 0)
+ return false;
+
+ /* ']' must terminate the digit run, with nothing trailing it */
+ if (name[prefix_len + digits] != ']')
+ return false;
+
+ if (name[prefix_len + digits + 1] != '\0')
+ return false;
+
+ return true;
+}
enum dso_binary_type {
DSO_BINARY_TYPE__KALLSYMS = 0,
@@ -809,8 +844,28 @@ static inline bool dso__is_kcore(const struct dso *dso)
static inline bool dso__is_kallsyms(const struct dso *dso)
{
enum dso_binary_type bt = dso__binary_type(dso);
+ const char *name;
+
+ if (bt == DSO_BINARY_TYPE__KALLSYMS || bt == DSO_BINARY_TYPE__GUEST_KALLSYMS)
+ return true;
+
+ if (bt != DSO_BINARY_TYPE__NOT_FOUND)
+ return false;
+
+ if (!dso__kernel(dso))
+ return false;
+
+ name = dso__long_name(dso);
+ if (!name)
+ return false;
+
+ if (!strcmp(name, DSO__NAME_KALLSYMS))
+ return true;
+
+ if (!strcmp(name, DSO__NAME_GUEST_KALLSYMS))
+ return true;
- return bt == DSO_BINARY_TYPE__KALLSYMS || bt == DSO_BINARY_TYPE__GUEST_KALLSYMS;
+ return is_guest_kallsyms_pid_name(name);
}
bool dso__is_object_file(const struct dso *dso);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0455/1376] bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (453 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0454/1376] perf dso: Fix kallsyms DSO detection with fallback logic Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0456/1376] efi: fix stale reference to efi_recover_from_page_fault() Greg Kroah-Hartman
` (543 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Borkmann,
Kumar Kartikeya Dwivedi, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <daniel@iogearbox.net>
[ Upstream commit 92863e678070f57c17c868e4bfa2441a5c61ad2b ]
bpf_get_btf_vmlinux() lazily parses the vmlinux BTF under the
bpf_verifier_lock, but publishes the result through a plain store
and re-checks it through a plain lockless load. Nothing orders
the stores initializing the struct btf inside btf_parse_vmlinux()
against the store publishing the pointer: On a weakly ordered
arch, a concurrent first-time caller taking the lockless fast
path could in principle observe the pointer before the parsed
contents are visible. The mutex_unlock() does not help such a
reader given it only synchronizes with a later acquisition of the
same lock. Thus, publish the pointer with smp_store_release()
and read it on the fast path with smp_load_acquire().
Acquire semantics are needed rather than a dependency-ordered
READ_ONCE(): btf_parse_vmlinux() also populates globals outside
the returned object (e.g. bpf_ctx_convert.t). An address
dependency would only order accesses performed through the
pointer and not cover other globals.
Fixes: 8580ac9404f6 ("bpf: Process in-kernel BTF")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20260708211537.371874-2-daniel@iogearbox.net
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/verifier.c | 20 ++++++++++++++++----
1 file changed, 16 insertions(+), 4 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 99b3f539e431f..f9f2095eab4a0 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -22781,13 +22781,25 @@ static int check_attach_btf_id(struct bpf_verifier_env *env)
struct btf *bpf_get_btf_vmlinux(void)
{
- if (!btf_vmlinux && IS_ENABLED(CONFIG_DEBUG_INFO_BTF)) {
+ /* Pairs with the smp_store_release() on the parse path below. */
+ struct btf *btf = smp_load_acquire(&btf_vmlinux);
+
+ if (!btf && IS_ENABLED(CONFIG_DEBUG_INFO_BTF)) {
mutex_lock(&bpf_verifier_lock);
- if (!btf_vmlinux)
- btf_vmlinux = btf_parse_vmlinux();
+ btf = btf_vmlinux;
+ if (!btf) {
+ btf = btf_parse_vmlinux();
+ /*
+ * Order the parsed BTF contents and the globals the
+ * parse populated (e.g. bpf_ctx_convert.t) before
+ * the pointer publication. Pairs with the acquire
+ * on the lockless fast path above.
+ */
+ smp_store_release(&btf_vmlinux, btf);
+ }
mutex_unlock(&bpf_verifier_lock);
}
- return btf_vmlinux;
+ return btf;
}
int bpf_check(struct bpf_prog **prog, union bpf_attr *attr, bpfptr_t uattr, __u32 uattr_size)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0456/1376] efi: fix stale reference to efi_recover_from_page_fault()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (454 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0455/1376] bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0457/1376] bpf: Fix use-after-free on mm_struct in bpf_find_vma() Greg Kroah-Hartman
` (542 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Breno Leitao, Ard Biesheuvel,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <leitao@debian.org>
[ Upstream commit 718ee46ba4d95d28d50d3f6437afbbe2be531175 ]
efi_recover_from_page_fault() was renamed to
efi_crash_gracefully_on_page_fault(), but the comment above enum
efi_rts_ids was not updated. Use the current name.
Fixes: c46f52231e79 ("x86/{fault,efi}: Fix and rename efi_recover_from_page_fault()")
Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/efi.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/include/linux/efi.h b/include/linux/efi.h
index 2f1bfd7562eb2..06e8d3c69f9e6 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -1239,8 +1239,8 @@ efi_call_acpi_prm_handler(efi_status_t (__efiapi *handler_addr)(u64, void *),
/*
* efi_runtime_service() function identifiers.
- * "NONE" is used by efi_recover_from_page_fault() to check if the page
- * fault happened while executing an efi runtime service.
+ * "NONE" is used by efi_crash_gracefully_on_page_fault() to check if the
+ * page fault happened while executing an efi runtime service.
*/
enum efi_rts_ids {
EFI_NONE,
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0457/1376] bpf: Fix use-after-free on mm_struct in bpf_find_vma()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (455 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0456/1376] efi: fix stale reference to efi_recover_from_page_fault() Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0458/1376] bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation Greg Kroah-Hartman
` (541 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sanghyun Park, Puranjay Mohan,
Yonghong Song, Kumar Kartikeya Dwivedi, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanghyun Park <sanghyun.park.cnu@gmail.com>
[ Upstream commit 47b079e2117a2ee52e21f8b72935900c702fc0b5 ]
bpf_find_vma() reads task->mm and calls mmap_read_trylock(mm) without
holding a reference on the mm. On a foreign task, a concurrent exit_mm()
can free the mm_struct between the lockless read and the trylock,
resulting in a use-after-free. mm_struct is not SLAB_TYPESAFE_BY_RCU.
For the current task, task->mm is stable. For a foreign task, pin the mm
under task->alloc_lock and release it with mmput_async(), mirroring commit
d8e27d2d22b6 ("bpf: fix mm lifecycle in open-coded task_vma iterator").
Use spin_trylock() instead of get_task_mm() so BPF context does not block
on alloc_lock. Reject irqs-disabled contexts and !CONFIG_MMU on the
foreign-task path because dropping the mm reference is not safe there.
Race:
CPU0 (BPF program) CPU1 (exiting task)
============================ ==========================
bpf_find_vma(foreign_task):
mm = task->mm
exit_mm():
task->mm = NULL
mmput(mm) -> frees mm_struct
mmap_read_trylock(mm)
// UAF on mm
Fixes: 7c7e3d31e785 ("bpf: Introduce helper bpf_find_vma")
Signed-off-by: Sanghyun Park <sanghyun.park.cnu@gmail.com>
Reviewed-by: Puranjay Mohan <puranjay@kernel.org>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Link: https://lore.kernel.org/bpf/20260708072106.199637-2-sanghyun.park.cnu@gmail.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/task_iter.c | 36 +++++++++++++++++++++++++++++++++---
1 file changed, 33 insertions(+), 3 deletions(-)
diff --git a/kernel/bpf/task_iter.c b/kernel/bpf/task_iter.c
index fc5f463ca529a..f3a7a96a77d7d 100644
--- a/kernel/bpf/task_iter.c
+++ b/kernel/bpf/task_iter.c
@@ -760,6 +760,7 @@ BPF_CALL_5(bpf_find_vma, struct task_struct *, task, u64, start,
struct mmap_unlock_irq_work *work = NULL;
struct vm_area_struct *vma;
bool irq_work_busy = false;
+ bool __maybe_unused mmput_needed = false;
struct mm_struct *mm;
int ret = -ENOENT;
@@ -769,14 +770,38 @@ BPF_CALL_5(bpf_find_vma, struct task_struct *, task, u64, start,
if (!task)
return -ENOENT;
- mm = task->mm;
+ if (task == current) {
+ mm = task->mm;
+ } else {
+ /*
+ * Foreign task: pin task->mm against a concurrent exit_mm().
+ * Use trylock on alloc_lock instead of get_task_mm()'s
+ * blocking task_lock() to avoid deadlocking the target task.
+ */
+ if (!IS_ENABLED(CONFIG_MMU))
+ return -EOPNOTSUPP;
+ if (irqs_disabled())
+ return -EBUSY;
+ if (!spin_trylock(&task->alloc_lock))
+ return -EBUSY;
+ mm = task->mm;
+ if (mm && !(task->flags & PF_KTHREAD)) {
+ mmget(mm);
+ mmput_needed = true;
+ } else {
+ mm = NULL;
+ }
+ spin_unlock(&task->alloc_lock);
+ }
if (!mm)
return -ENOENT;
irq_work_busy = bpf_mmap_unlock_get_irq_work(&work);
- if (irq_work_busy || !mmap_read_trylock(mm))
- return -EBUSY;
+ if (irq_work_busy || !mmap_read_trylock(mm)) {
+ ret = -EBUSY;
+ goto out;
+ }
vma = find_vma(mm, start);
@@ -786,6 +811,11 @@ BPF_CALL_5(bpf_find_vma, struct task_struct *, task, u64, start,
ret = 0;
}
bpf_mmap_unlock_mm(work, mm);
+out:
+#ifdef CONFIG_MMU
+ if (mmput_needed)
+ mmput_async(mm);
+#endif
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0458/1376] bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (456 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0457/1376] bpf: Fix use-after-free on mm_struct in bpf_find_vma() Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0459/1376] iommu/mediatek-v1: Fix off-by-one in MT2701_LARB_NR_MAX Greg Kroah-Hartman
` (540 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuho Choi, Manivannan Sadhasivam,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <dbgh9129@gmail.com>
[ Upstream commit 6f12862600bb70e599a614d706a095ea5f8f9858 ]
mhi_ep_create_device() takes one device reference for the UL channel and
another for the DL channel after allocating the transfer device. These
references are normally released by mhi_ep_destroy_device() before the
device itself is removed.
If dev_set_name() or device_add() fails, the error path currently drops
only one reference. The remaining channel references keep the device
from being released and leave the channels associated with a device that
was never registered.
Route both failures through a common unwind path that drops the DL
channel reference, the UL channel reference, and the initial reference
from device_initialize().
Fixes: 297c77a0f273 ("bus: mhi: ep: Add support for creating and destroying MHI EP devices")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/20260603195142.2189386-1-dbgh9129@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bus/mhi/ep/main.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/drivers/bus/mhi/ep/main.c b/drivers/bus/mhi/ep/main.c
index 2f58ad0f14b65..fd1d7c84fb1c5 100644
--- a/drivers/bus/mhi/ep/main.c
+++ b/drivers/bus/mhi/ep/main.c
@@ -1340,14 +1340,19 @@ static int mhi_ep_create_device(struct mhi_ep_cntrl *mhi_cntrl, u32 ch_id)
ret = dev_set_name(&mhi_dev->dev, "%s_%s",
dev_name(&mhi_cntrl->mhi_dev->dev),
mhi_dev->name);
- if (ret) {
- put_device(&mhi_dev->dev);
- return ret;
- }
+ if (ret)
+ goto err_put_channels;
ret = device_add(&mhi_dev->dev);
if (ret)
- put_device(&mhi_dev->dev);
+ goto err_put_channels;
+
+ return 0;
+
+err_put_channels:
+ put_device(&mhi_dev->dev); /* DL channel reference */
+ put_device(&mhi_dev->dev); /* UL channel reference */
+ put_device(&mhi_dev->dev); /* device_initialize() reference */
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0459/1376] iommu/mediatek-v1: Fix off-by-one in MT2701_LARB_NR_MAX
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (457 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0458/1376] bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0460/1376] iommu/msm: Return -ENOMEM on memory allocation failure in probe Greg Kroah-Hartman
` (539 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Akari Tsuyukusa, Joerg Roedel,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akari Tsuyukusa <akkun11.open@gmail.com>
[ Upstream commit aebaa93f3da1572877579c2e15ebf27be2dcc7fb ]
The mt2701_m4u_in_larb[] array contains 4 (for LARB0 to LARB3)
elements, meaning mt2701_m4u_to_larb() can legitimately return 3.
The current check `if (larbid >= MT2701_LARB_NR_MAX)` incorrectly
rejects valid LARB3 with -EINVAL.
Fix this off-by-one error by updating MT2701_LARB_NR_MAX to 4.
Note that this does not cause immediate issues with the current
mt2701.dtsi and mt7623n.dtsi because it only defines 3 LARBs:
mediatek,larbs = <&larb0 &larb1 &larb2>;
Thus, larbid never reaches 3 in the existing upstream device tree.
Fixes: de78657e16f4 ("iommu/mediatek: Fix NULL pointer dereference when printing dev_name")
Signed-off-by: Akari Tsuyukusa <akkun11.open@gmail.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/mtk_iommu_v1.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iommu/mtk_iommu_v1.c b/drivers/iommu/mtk_iommu_v1.c
index 5a3eb7b587b45..378a09faa04c8 100644
--- a/drivers/iommu/mtk_iommu_v1.c
+++ b/drivers/iommu/mtk_iommu_v1.c
@@ -78,7 +78,7 @@
/* MTK generation one iommu HW only support 4K size mapping */
#define MT2701_IOMMU_PAGE_SHIFT 12
#define MT2701_IOMMU_PAGE_SIZE (1UL << MT2701_IOMMU_PAGE_SHIFT)
-#define MT2701_LARB_NR_MAX 3
+#define MT2701_LARB_NR_MAX 4
/*
* MTK m4u support 4GB iova address space, and only support 4K page
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0460/1376] iommu/msm: Return -ENOMEM on memory allocation failure in probe
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (458 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0459/1376] iommu/mediatek-v1: Fix off-by-one in MT2701_LARB_NR_MAX Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0461/1376] iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors Greg Kroah-Hartman
` (538 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladimir Zapolskiy, Dmitry Baryshkov,
Konrad Dybcio, Joerg Roedel, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <vz@kernel.org>
[ Upstream commit b0d50c9016c4c2959dfa61bf9549cf98f9aa19cd ]
If dynamic memory allocation in driver's probe function execution fails,
it should be reported to the driver's framework with -ENOMEM error code.
Fixes: 109bd48ea2e1 ("iommu/msm: Add DT adaptation")
Signed-off-by: Vladimir Zapolskiy <vz@kernel.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/msm_iommu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iommu/msm_iommu.c b/drivers/iommu/msm_iommu.c
index 989e0869d8055..036bacd162c72 100644
--- a/drivers/iommu/msm_iommu.c
+++ b/drivers/iommu/msm_iommu.c
@@ -720,7 +720,7 @@ static int msm_iommu_probe(struct platform_device *pdev)
iommu = devm_kzalloc(&pdev->dev, sizeof(*iommu), GFP_KERNEL);
if (!iommu)
- return -ENODEV;
+ return -ENOMEM;
iommu->dev = &pdev->dev;
INIT_LIST_HEAD(&iommu->ctx_list);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0461/1376] iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (459 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0460/1376] iommu/msm: Return -ENOMEM on memory allocation failure in probe Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0462/1376] iommu/amd: Add support for Hygon family 18h model 4h IOAPIC Greg Kroah-Hartman
` (537 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wei Wang, Yongwei Xu, Vasant Hegde,
Joerg Roedel, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Wang <wei.w.wang@hotmail.com>
[ Upstream commit 854056480f9217568e3ab5edd81a9347a173ea79 ]
The check_ioapic_information() function validates IOAPICs against the
IVRS table to safely disable Interrupt Remapping (IR) if the BIOS provides
a broken topology.
Currently, the validation loop contains a bug: If an unmapped secondary
IOAPIC is encountered, 'ret' is set to false. But if the Southbridge (SB)
IOAPIC is enumerated after it in the MADT, the loop overwrites 'ret' to
true.
This bypasses the validation failure and leaves IR enabled. When devices
attached to the unmapped secondary IOAPIC fire interrupts, the IOMMU drops
them due to the missing Requestor ID, leading to localized device hangs.
Fix this by initializing 'ret' to true and only toggling it to false
upon encountering a validation error, ensuring failures are never erased.
Fixes: c2ff5cf5294b ("iommu/amd: Work around wrong IOAPIC device-id in IVRS table")
Signed-off-by: Wei Wang <wei.w.wang@hotmail.com>
Tested-by: Yongwei Xu <xuyongwei@open-hieco.net>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/amd/init.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
index 54f3c17520d51..66f30e3883d57 100644
--- a/drivers/iommu/amd/init.c
+++ b/drivers/iommu/amd/init.c
@@ -2973,7 +2973,7 @@ static bool __init check_ioapic_information(void)
int idx;
has_sb_ioapic = false;
- ret = false;
+ ret = true;
/*
* If we have map overrides on the kernel command line the
@@ -2993,7 +2993,6 @@ static bool __init check_ioapic_information(void)
ret = false;
} else if (devid == IOAPIC_SB_DEVID) {
has_sb_ioapic = true;
- ret = true;
}
}
@@ -3007,6 +3006,7 @@ static bool __init check_ioapic_information(void)
* device id for the IOAPIC in the system.
*/
pr_err("%s: No southbridge IOAPIC found\n", fw_bug);
+ ret = false;
}
if (!ret)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0462/1376] iommu/amd: Add support for Hygon family 18h model 4h IOAPIC
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (460 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0461/1376] iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0463/1376] iommu/amd: Fix false positive in SB IOAPIC IVRS validation Greg Kroah-Hartman
` (536 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fu Hao, Tingyin Duan, Joerg Roedel,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fu Hao <fuhao@open-hieco.net>
[ Upstream commit 5beda8cadb1f072140e58b1edb7604444a42d955 ]
The SB IOAPIC is on the device 0xb from Hygon family 18h model 4h.
Signed-off-by: Fu Hao <fuhao@open-hieco.net>
Tested-by: Tingyin Duan <tingyin.duan@gmail.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Stable-dep-of: 04fee302fac7 ("iommu/amd: Fix false positive in SB IOAPIC IVRS validation")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/amd/init.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
index 66f30e3883d57..d0ef7c936fd40 100644
--- a/drivers/iommu/amd/init.c
+++ b/drivers/iommu/amd/init.c
@@ -2966,6 +2966,9 @@ static void __init free_iommu_resources(void)
/* SB IOAPIC is always on this device in AMD systems */
#define IOAPIC_SB_DEVID ((0x00 << 8) | PCI_DEVFN(0x14, 0))
+/* SB IOAPIC for Hygon family 18h model 4h is on the device 0xb */
+#define IOAPIC_SB_DEVID_FAM18H_M4H ((0x00 << 8) | PCI_DEVFN(0xb, 0))
+
static bool __init check_ioapic_information(void)
{
const char *fw_bug = FW_BUG;
@@ -2991,7 +2994,12 @@ static bool __init check_ioapic_information(void)
pr_err("%s: IOAPIC[%d] not in IVRS table\n",
fw_bug, id);
ret = false;
- } else if (devid == IOAPIC_SB_DEVID) {
+ } else if (devid == IOAPIC_SB_DEVID ||
+ (boot_cpu_data.x86_vendor == X86_VENDOR_HYGON &&
+ boot_cpu_data.x86 == 0x18 &&
+ boot_cpu_data.x86_model >= 0x4 &&
+ boot_cpu_data.x86_model <= 0xf &&
+ devid == IOAPIC_SB_DEVID_FAM18H_M4H)) {
has_sb_ioapic = true;
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0463/1376] iommu/amd: Fix false positive in SB IOAPIC IVRS validation
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (461 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0462/1376] iommu/amd: Add support for Hygon family 18h model 4h IOAPIC Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0464/1376] leds: pca9532: Fix inverted GPIO output polarity Greg Kroah-Hartman
` (535 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wei Wang, Yongwei Xu, Vasant Hegde,
Joerg Roedel, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Wang <wei.w.wang@hotmail.com>
[ Upstream commit 04fee302fac762a242ff1ad6810cff90c2a350ba ]
The check_ioapic_information() function is designed to prevent boot hangs
by ensuring the Southbridge (SB) IOAPIC is properly mapped in the IVRS
table before enabling Interrupt Remapping.
Currently, this check passes if *any* enumerated IOAPIC matches the
expected SB IOAPIC device ID. If a buggy BIOS incorrectly assigns the
SB IOAPIC's device ID to a secondary IOAPIC in the IVRS, while scrambling
the true SB IOAPIC's mapping, the check hits a false positive and
succeeds.
This erroneously enables Interrupt Remapping. Consequently, the IOMMU
blocks unmapped interrupts from the actual SB IOAPIC, dropping the system
timer and leading to a silent kernel boot hang.
Tighten the validation to verify the device ID specifically against the SB
IOAPIC by matching their APIC IDs first. This prevents the validation
check from being bypassed via device ID aliasing.
Fixes: c2ff5cf5294b ("iommu/amd: Work around wrong IOAPIC device-id in IVRS table")
Signed-off-by: Wei Wang <wei.w.wang@hotmail.com>
Tested-by: Yongwei Xu <xuyongwei@open-hieco.net>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/amd/init.c | 32 ++++++++++++++++++++++++++++----
1 file changed, 28 insertions(+), 4 deletions(-)
diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
index d0ef7c936fd40..b9a14c3ef4402 100644
--- a/drivers/iommu/amd/init.c
+++ b/drivers/iommu/amd/init.c
@@ -2969,11 +2969,25 @@ static void __init free_iommu_resources(void)
/* SB IOAPIC for Hygon family 18h model 4h is on the device 0xb */
#define IOAPIC_SB_DEVID_FAM18H_M4H ((0x00 << 8) | PCI_DEVFN(0xb, 0))
+/*
+ * The Southbridge IOAPIC is assigned a GSI Base of 0 (handling interrupts
+ * 0 through 23).
+ */
+static int __init get_sb_ioapic_id(void)
+{
+ int idx = mp_find_ioapic(0);
+
+ if (idx < 0)
+ return -ENODEV;
+
+ return mpc_ioapic_id(idx);
+}
+
static bool __init check_ioapic_information(void)
{
const char *fw_bug = FW_BUG;
bool ret, has_sb_ioapic;
- int idx;
+ int idx, sb_apicid;
has_sb_ioapic = false;
ret = true;
@@ -2986,6 +3000,16 @@ static bool __init check_ioapic_information(void)
if (cmdline_maps)
fw_bug = "";
+ sb_apicid = get_sb_ioapic_id();
+ if (sb_apicid < 0) {
+ /*
+ * Lack of SB IOAPIC registration is not a firmware bug,
+ * e.g. kernel booted with noapic or noacpi.
+ */
+ fw_bug = "";
+ goto out;
+ }
+
for (idx = 0; idx < nr_ioapics; idx++) {
int devid, id = mpc_ioapic_id(idx);
@@ -2994,16 +3018,16 @@ static bool __init check_ioapic_information(void)
pr_err("%s: IOAPIC[%d] not in IVRS table\n",
fw_bug, id);
ret = false;
- } else if (devid == IOAPIC_SB_DEVID ||
+ } else if (id == sb_apicid && (devid == IOAPIC_SB_DEVID ||
(boot_cpu_data.x86_vendor == X86_VENDOR_HYGON &&
boot_cpu_data.x86 == 0x18 &&
boot_cpu_data.x86_model >= 0x4 &&
boot_cpu_data.x86_model <= 0xf &&
- devid == IOAPIC_SB_DEVID_FAM18H_M4H)) {
+ devid == IOAPIC_SB_DEVID_FAM18H_M4H))) {
has_sb_ioapic = true;
}
}
-
+out:
if (!has_sb_ioapic) {
/*
* We expect the SB IOAPIC to be listed in the IVRS
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0464/1376] leds: pca9532: Fix inverted GPIO output polarity
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (462 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0463/1376] iommu/amd: Fix false positive in SB IOAPIC IVRS validation Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0465/1376] printk/panic: Add option to allow non-panic CPUs to write to the ring buffer Greg Kroah-Hartman
` (534 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cosmo Chou, Bartosz Golaszewski,
Lee Jones, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cosmo Chou <chou.cosmo@gmail.com>
[ Upstream commit 65a38a28a0b04af19a5e1fbf3869051412eeac96 ]
The pca9532_gpio_set_value() function incorrectly mapped the requested
value to PCA9532_ON and PCA9532_OFF, inverting the GPIO output polarity.
A requested logical high (val=1) incorrectly enabled the LED output
driver, which on this open-drain device pulls the pin low, while a
requested logical low (val=0) released the pin.
Correct the mapping so that val=1 yields PCA9532_OFF (pin released /
high-impedance) and val=0 yields PCA9532_ON (pin driven low).
pca9532_gpio_direction_input() is also updated to pass val=1 to
pca9532_gpio_set_value() to align with the corrected polarity mapping,
ensuring the pin remains not driven when configured as an input.
Fixes: 3c1ab50d0a31 ("drivers/leds/leds-pca9532.c: add gpio capability")
Signed-off-by: Cosmo Chou <chou.cosmo@gmail.com>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Link: https://patch.msgid.link/20260703014201.69829-1-chou.cosmo@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/leds/leds-pca9532.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/leds/leds-pca9532.c b/drivers/leds/leds-pca9532.c
index 1b47acf54720b..66ed6a77961ad 100644
--- a/drivers/leds/leds-pca9532.c
+++ b/drivers/leds/leds-pca9532.c
@@ -324,9 +324,9 @@ static void pca9532_gpio_set_value(struct gpio_chip *gc, unsigned offset, int va
struct pca9532_led *led = &data->leds[offset];
if (val)
- led->state = PCA9532_ON;
- else
led->state = PCA9532_OFF;
+ else
+ led->state = PCA9532_ON;
pca9532_setled(led);
}
@@ -344,7 +344,7 @@ static int pca9532_gpio_get_value(struct gpio_chip *gc, unsigned offset)
static int pca9532_gpio_direction_input(struct gpio_chip *gc, unsigned offset)
{
/* To use as input ensure pin is not driven */
- pca9532_gpio_set_value(gc, offset, 0);
+ pca9532_gpio_set_value(gc, offset, 1);
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0465/1376] printk/panic: Add option to allow non-panic CPUs to write to the ring buffer.
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (463 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0464/1376] leds: pca9532: Fix inverted GPIO output polarity Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0466/1376] panic: introduce helper functions for panic state Greg Kroah-Hartman
` (533 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Donghyeok Choe, Petr Mladek,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Donghyeok Choe <d7271.choe@samsung.com>
[ Upstream commit c1aa3daa517292303d98ff61f0440c354669f948 ]
Commit 779dbc2e78d7 ("printk: Avoid non-panic CPUs writing to ringbuffer")
aimed to isolate panic-related messages. However, when panic() itself
malfunctions, messages from non-panic CPUs become crucial for debugging.
While commit bcc954c6caba ("printk/panic: Allow cpu backtraces to
be written into ringbuffer during panic") enables non-panic CPU
backtraces, it may not provide sufficient diagnostic information.
Introduce the "debug_non_panic_cpus" command-line option, enabling
non-panic CPU messages to be stored in the ring buffer during a panic.
This also prevents discarding non-finalized messages from non-panic CPUs
during console flushing, providing a more comprehensive view of system
state during critical failures.
Link: https://lore.kernel.org/all/Z8cLEkqLL2IOyNIj@pathway/
Signed-off-by: Donghyeok Choe <d7271.choe@samsung.com>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Link: https://lore.kernel.org/r/20250318022320.2428155-1-d7271.choe@samsung.com
[pmladek@suse.com: Added documentation, added module_parameter, removed printk_ prefix.]
Tested-by: Petr Mladek <pmladek@suse.com>
Signed-off-by: Petr Mladek <pmladek@suse.com>
Stable-dep-of: 36630cafbeed ("printk: Fix possible console use-after-free")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../admin-guide/kernel-parameters.txt | 8 ++++++++
kernel/printk/internal.h | 1 +
kernel/printk/printk.c | 20 ++++++++++++++++++-
kernel/printk/printk_ringbuffer.c | 13 +++++++-----
4 files changed, 36 insertions(+), 6 deletions(-)
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index be2957b10d0b0..886095f45290e 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -4860,6 +4860,14 @@
Format: <bool>
default: 0 (auto_verbose is enabled)
+ printk.debug_non_panic_cpus=
+ Allows storing messages from non-panic CPUs into
+ the printk log buffer during panic(). They are
+ flushed to consoles by the panic-CPU on
+ a best-effort basis.
+ Format: <bool> (1/Y/y=enable, 0/N/n=disable)
+ Default: disabled
+
printk.devkmsg={on,off,ratelimit}
Control writing to /dev/kmsg.
on - unlimited logging to /dev/kmsg from userspace
diff --git a/kernel/printk/internal.h b/kernel/printk/internal.h
index 5eef70000b439..2cc13c5597688 100644
--- a/kernel/printk/internal.h
+++ b/kernel/printk/internal.h
@@ -62,6 +62,7 @@ struct dev_printk_info;
extern struct printk_ringbuffer *prb;
extern bool printk_kthreads_running;
+extern bool debug_non_panic_cpus;
__printf(4, 0)
int vprintk_store(int facility, int level,
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index 3a91b739e8f30..aa5c3e91ffd54 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -2350,6 +2350,22 @@ void printk_legacy_allow_panic_sync(void)
}
}
+bool __read_mostly debug_non_panic_cpus;
+
+#ifdef CONFIG_PRINTK_CALLER
+static int __init debug_non_panic_cpus_setup(char *str)
+{
+ debug_non_panic_cpus = true;
+ pr_info("allow messages from non-panic CPUs in panic()\n");
+
+ return 0;
+}
+early_param("debug_non_panic_cpus", debug_non_panic_cpus_setup);
+module_param(debug_non_panic_cpus, bool, 0644);
+MODULE_PARM_DESC(debug_non_panic_cpus,
+ "allow messages from non-panic CPUs in panic()");
+#endif
+
asmlinkage int vprintk_emit(int facility, int level,
const struct dev_printk_info *dev_info,
const char *fmt, va_list args)
@@ -2366,7 +2382,9 @@ asmlinkage int vprintk_emit(int facility, int level,
* non-panic CPUs are generating any messages, they will be
* silently dropped.
*/
- if (other_cpu_in_panic() && !panic_triggering_all_cpu_backtrace)
+ if (other_cpu_in_panic() &&
+ !debug_non_panic_cpus &&
+ !panic_triggering_all_cpu_backtrace)
return 0;
printk_get_console_flush_type(&ft);
diff --git a/kernel/printk/printk_ringbuffer.c b/kernel/printk/printk_ringbuffer.c
index 88e8f3a619229..d9fb053cff67d 100644
--- a/kernel/printk/printk_ringbuffer.c
+++ b/kernel/printk/printk_ringbuffer.c
@@ -2133,9 +2133,9 @@ static bool _prb_read_valid(struct printk_ringbuffer *rb, u64 *seq,
* there may be other finalized records beyond that
* need to be printed for a panic situation. If this
* is the panic CPU, skip this
- * non-existent/non-finalized record unless it is
- * at or beyond the head, in which case it is not
- * possible to continue.
+ * non-existent/non-finalized record unless non-panic
+ * CPUs are still running and their debugging is
+ * explicitly enabled.
*
* Note that new messages printed on panic CPU are
* finalized when we are here. The only exception
@@ -2143,10 +2143,13 @@ static bool _prb_read_valid(struct printk_ringbuffer *rb, u64 *seq,
* But it would have the sequence number returned
* by "prb_next_reserve_seq() - 1".
*/
- if (this_cpu_in_panic() && ((*seq + 1) < prb_next_reserve_seq(rb)))
+ if (this_cpu_in_panic() &&
+ (!debug_non_panic_cpus || legacy_allow_panic_sync) &&
+ ((*seq + 1) < prb_next_reserve_seq(rb))) {
(*seq)++;
- else
+ } else {
return false;
+ }
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0466/1376] panic: introduce helper functions for panic state
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (464 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0465/1376] printk/panic: Add option to allow non-panic CPUs to write to the ring buffer Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0467/1376] panic/printk: replace this_cpu_in_panic() with panic_on_this_cpu() Greg Kroah-Hartman
` (532 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jinchao Wang, Anna Schumaker,
Baoquan He, Darrick J. Wong, Dave Young, Doug Anderson,
Guilherme G. Piccoli, Helge Deller, Ingo Molnar, Jason Gunthorpe,
Joanthan Cameron, Joel Granados, John Ogness, Kees Cook,
Li Huafei, Luck, Tony, Luo Gengkun, Max Kellermann, Nam Cao,
oushixiong, Petr Mladek, Qianqiang Liu, Sergey Senozhatsky,
Sohil Mehta, Steven Rostedt, Tejun Heo, Thomas Gleinxer,
Thomas Zimemrmann, Thorsten Blum, Ville Syrjala, Vivek Goyal,
Yicong Yang, Yunhui Cui, Andrew Morton, Sasha Levin,
Yury Norov (NVIDIA)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinchao Wang <wangjinchao600@gmail.com>
[ Upstream commit d0d9c7235548f1d772f1e48c9d5742c65d81c705 ]
Patch series "panic: introduce panic status function family", v2.
This series introduces a family of helper functions to manage panic state
and updates existing code to use them.
Before this series, panic state helpers were scattered and inconsistent.
For example, panic_in_progress() was defined in printk/printk.c, not in
panic.c or panic.h. As a result, developers had to look in unexpected
places to understand or re-use panic state logic. Other checks were open-
coded, duplicating logic across panic, crash, and watchdog paths.
The new helpers centralize the functionality in panic.c/panic.h:
- panic_try_start()
- panic_reset()
- panic_in_progress()
- panic_on_this_cpu()
- panic_on_other_cpu()
Patches 1–8 add the helpers and convert panic/crash and printk/nbcon
code to use them.
Patch 9 fixes a bug in the watchdog subsystem by skipping checks when a
panic is in progress, avoiding interference with the panic CPU.
Together, this makes panic state handling simpler, more discoverable, and
more robust.
This patch (of 9):
This patch introduces four new helper functions to abstract the management
of the panic_cpu variable. These functions will be used in subsequent
patches to refactor existing code.
The direct use of panic_cpu can be error-prone and ambiguous, as it
requires manual checks to determine which CPU is handling the panic. The
new helpers clarify intent:
panic_try_start():
Atomically sets the current CPU as the panicking CPU.
panic_reset():
Reset panic_cpu to PANIC_CPU_INVALID.
panic_in_progress():
Checks if a panic has been triggered.
panic_on_this_cpu():
Returns true if the current CPU is the panic originator.
panic_on_other_cpu():
Returns true if a panic is on another CPU.
This change lays the groundwork for improved code readability
and robustness in the panic handling subsystem.
Link: https://lkml.kernel.org/r/20250825022947.1596226-1-wangjinchao600@gmail.com
Link: https://lkml.kernel.org/r/20250825022947.1596226-2-wangjinchao600@gmail.com
Signed-off-by: Jinchao Wang <wangjinchao600@gmail.com>
Cc: Anna Schumaker <anna.schumaker@oracle.com>
Cc: Baoquan He <bhe@redhat.com>
Cc: "Darrick J. Wong" <djwong@kernel.org>
Cc: Dave Young <dyoung@redhat.com>
Cc: Doug Anderson <dianders@chromium.org>
Cc: "Guilherme G. Piccoli" <gpiccoli@igalia.com>
Cc: Helge Deller <deller@gmx.de>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Joanthan Cameron <Jonathan.Cameron@huawei.com>
Cc: Joel Granados <joel.granados@kernel.org>
Cc: John Ogness <john.ogness@linutronix.de>
Cc: Kees Cook <kees@kernel.org>
Cc: Li Huafei <lihuafei1@huawei.com>
Cc: "Luck, Tony" <tony.luck@intel.com>
Cc: Luo Gengkun <luogengkun@huaweicloud.com>
Cc: Max Kellermann <max.kellermann@ionos.com>
Cc: Nam Cao <namcao@linutronix.de>
Cc: oushixiong <oushixiong@kylinos.cn>
Cc: Petr Mladek <pmladek@suse.com>
Cc: Qianqiang Liu <qianqiang.liu@163.com>
Cc: Sergey Senozhatsky <senozhatsky@chromium.org>
Cc: Sohil Mehta <sohil.mehta@intel.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Tejun Heo <tj@kernel.org>
Cc: Thomas Gleinxer <tglx@linutronix.de>
Cc: Thomas Zimemrmann <tzimmermann@suse.de>
Cc: Thorsten Blum <thorsten.blum@linux.dev>
Cc: Ville Syrjala <ville.syrjala@linux.intel.com>
Cc: Vivek Goyal <vgoyal@redhat.com>
Cc: Yicong Yang <yangyicong@hisilicon.com>
Cc: Yunhui Cui <cuiyunhui@bytedance.com>
Cc: Yury Norov (NVIDIA) <yury.norov@gmail.com>b
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Stable-dep-of: 36630cafbeed ("printk: Fix possible console use-after-free")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/panic.h | 6 +++++
kernel/panic.c | 53 ++++++++++++++++++++++++++++++++++++++++++
kernel/printk/printk.c | 5 ----
3 files changed, 59 insertions(+), 5 deletions(-)
diff --git a/include/linux/panic.h b/include/linux/panic.h
index 54d90b6c5f47b..f0b779d2915e6 100644
--- a/include/linux/panic.h
+++ b/include/linux/panic.h
@@ -44,6 +44,12 @@ void abort(void);
extern atomic_t panic_cpu;
#define PANIC_CPU_INVALID -1
+bool panic_try_start(void);
+void panic_reset(void);
+bool panic_in_progress(void);
+bool panic_on_this_cpu(void);
+bool panic_on_other_cpu(void);
+
/*
* Only to be used by arch init code. If the user over-wrote the default
* CONFIG_PANIC_TIMEOUT, honor it.
diff --git a/kernel/panic.c b/kernel/panic.c
index ddad0578355bb..b4005d5d3343a 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -187,6 +187,59 @@ void __weak crash_smp_send_stop(void)
atomic_t panic_cpu = ATOMIC_INIT(PANIC_CPU_INVALID);
+bool panic_try_start(void)
+{
+ int old_cpu, this_cpu;
+
+ /*
+ * Only one CPU is allowed to execute the crash_kexec() code as with
+ * panic(). Otherwise parallel calls of panic() and crash_kexec()
+ * may stop each other. To exclude them, we use panic_cpu here too.
+ */
+ old_cpu = PANIC_CPU_INVALID;
+ this_cpu = raw_smp_processor_id();
+
+ return atomic_try_cmpxchg(&panic_cpu, &old_cpu, this_cpu);
+}
+EXPORT_SYMBOL(panic_try_start);
+
+void panic_reset(void)
+{
+ atomic_set(&panic_cpu, PANIC_CPU_INVALID);
+}
+EXPORT_SYMBOL(panic_reset);
+
+bool panic_in_progress(void)
+{
+ return unlikely(atomic_read(&panic_cpu) != PANIC_CPU_INVALID);
+}
+EXPORT_SYMBOL(panic_in_progress);
+
+/* Return true if a panic is in progress on the current CPU. */
+bool panic_on_this_cpu(void)
+{
+ /*
+ * We can use raw_smp_processor_id() here because it is impossible for
+ * the task to be migrated to the panic_cpu, or away from it. If
+ * panic_cpu has already been set, and we're not currently executing on
+ * that CPU, then we never will be.
+ */
+ return unlikely(atomic_read(&panic_cpu) == raw_smp_processor_id());
+}
+EXPORT_SYMBOL(panic_on_this_cpu);
+
+/*
+ * Return true if a panic is in progress on a remote CPU.
+ *
+ * On true, the local CPU should immediately release any printing resources
+ * that may be needed by the panic CPU.
+ */
+bool panic_on_other_cpu(void)
+{
+ return (panic_in_progress() && !this_cpu_in_panic());
+}
+EXPORT_SYMBOL(panic_on_other_cpu);
+
/*
* A variant of panic() called from NMI context. We return if we've already
* panicked on this CPU. If another CPU already panicked, loop in
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index aa5c3e91ffd54..7b7f0fd6adc7f 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -345,11 +345,6 @@ static void __up_console_sem(unsigned long ip)
}
#define up_console_sem() __up_console_sem(_RET_IP_)
-static bool panic_in_progress(void)
-{
- return unlikely(atomic_read(&panic_cpu) != PANIC_CPU_INVALID);
-}
-
/* Return true if a panic is in progress on the current CPU. */
bool this_cpu_in_panic(void)
{
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0467/1376] panic/printk: replace this_cpu_in_panic() with panic_on_this_cpu()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (465 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0466/1376] panic: introduce helper functions for panic state Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0468/1376] panic/printk: replace other_cpu_in_panic() with panic_on_other_cpu() Greg Kroah-Hartman
` (531 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jinchao Wang, Anna Schumaker,
Baoquan He, Darrick J. Wong, Dave Young, Doug Anderson,
Guilherme G. Piccoli, Helge Deller, Ingo Molnar, Jason Gunthorpe,
Joanthan Cameron, Joel Granados, John Ogness, Kees Cook,
Li Huafei, Luck, Tony, Luo Gengkun, Max Kellermann, Nam Cao,
oushixiong, Petr Mladek, Qianqiang Liu, Sergey Senozhatsky,
Sohil Mehta, Steven Rostedt, Tejun Heo, Thomas Gleinxer,
Thomas Zimemrmann, Thorsten Blum, Ville Syrjala, Vivek Goyal,
Yicong Yang, Yunhui Cui, Yury Norov (NVIDIA), Andrew Morton,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinchao Wang <wangjinchao600@gmail.com>
[ Upstream commit c6be36e2997662f423edfa3979a63935873ff648 ]
The helper this_cpu_in_panic() duplicated logic already provided by
panic_on_this_cpu().
Remove this_cpu_in_panic() and switch all users to panic_on_this_cpu().
This simplifies the code and avoids having two helpers for the same check.
Link: https://lkml.kernel.org/r/20250825022947.1596226-8-wangjinchao600@gmail.com
Signed-off-by: Jinchao Wang <wangjinchao600@gmail.com>
Cc: Anna Schumaker <anna.schumaker@oracle.com>
Cc: Baoquan He <bhe@redhat.com>
Cc: "Darrick J. Wong" <djwong@kernel.org>
Cc: Dave Young <dyoung@redhat.com>
Cc: Doug Anderson <dianders@chromium.org>
Cc: "Guilherme G. Piccoli" <gpiccoli@igalia.com>
Cc: Helge Deller <deller@gmx.de>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Joanthan Cameron <Jonathan.Cameron@huawei.com>
Cc: Joel Granados <joel.granados@kernel.org>
Cc: John Ogness <john.ogness@linutronix.de>
Cc: Kees Cook <kees@kernel.org>
Cc: Li Huafei <lihuafei1@huawei.com>
Cc: "Luck, Tony" <tony.luck@intel.com>
Cc: Luo Gengkun <luogengkun@huaweicloud.com>
Cc: Max Kellermann <max.kellermann@ionos.com>
Cc: Nam Cao <namcao@linutronix.de>
Cc: oushixiong <oushixiong@kylinos.cn>
Cc: Petr Mladek <pmladek@suse.com>
Cc: Qianqiang Liu <qianqiang.liu@163.com>
Cc: Sergey Senozhatsky <senozhatsky@chromium.org>
Cc: Sohil Mehta <sohil.mehta@intel.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Tejun Heo <tj@kernel.org>
Cc: Thomas Gleinxer <tglx@linutronix.de>
Cc: Thomas Zimemrmann <tzimmermann@suse.de>
Cc: Thorsten Blum <thorsten.blum@linux.dev>
Cc: Ville Syrjala <ville.syrjala@linux.intel.com>
Cc: Vivek Goyal <vgoyal@redhat.com>
Cc: Yicong Yang <yangyicong@hisilicon.com>
Cc: Yunhui Cui <cuiyunhui@bytedance.com>
Cc: Yury Norov (NVIDIA) <yury.norov@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Stable-dep-of: 36630cafbeed ("printk: Fix possible console use-after-free")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/printk.h | 2 --
kernel/panic.c | 2 +-
kernel/printk/nbcon.c | 2 +-
kernel/printk/printk.c | 15 ++-------------
kernel/printk/printk_ringbuffer.c | 2 +-
lib/dump_stack.c | 2 +-
6 files changed, 6 insertions(+), 19 deletions(-)
diff --git a/include/linux/printk.h b/include/linux/printk.h
index a6c6fd107805b..c2ae39c85a203 100644
--- a/include/linux/printk.h
+++ b/include/linux/printk.h
@@ -312,8 +312,6 @@ static inline bool pr_flush(int timeout_ms, bool reset_on_progress)
#endif
-bool this_cpu_in_panic(void);
-
#ifdef CONFIG_SMP
extern int __printk_cpu_sync_try_get(void);
extern void __printk_cpu_sync_wait(void);
diff --git a/kernel/panic.c b/kernel/panic.c
index b4005d5d3343a..97c472164393b 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -236,7 +236,7 @@ EXPORT_SYMBOL(panic_on_this_cpu);
*/
bool panic_on_other_cpu(void)
{
- return (panic_in_progress() && !this_cpu_in_panic());
+ return (panic_in_progress() && !panic_on_this_cpu());
}
EXPORT_SYMBOL(panic_on_other_cpu);
diff --git a/kernel/printk/nbcon.c b/kernel/printk/nbcon.c
index e7a3af81b1739..68563ed55e203 100644
--- a/kernel/printk/nbcon.c
+++ b/kernel/printk/nbcon.c
@@ -1394,7 +1394,7 @@ enum nbcon_prio nbcon_get_default_prio(void)
{
unsigned int *cpu_emergency_nesting;
- if (this_cpu_in_panic())
+ if (panic_on_this_cpu())
return NBCON_PRIO_PANIC;
cpu_emergency_nesting = nbcon_get_cpu_emergency_nesting();
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index 7b7f0fd6adc7f..a01a5683ecd92 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -17,6 +17,7 @@
* 01Mar01 Andrew Morton
*/
+#include "linux/panic.h"
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/kernel.h>
@@ -345,18 +346,6 @@ static void __up_console_sem(unsigned long ip)
}
#define up_console_sem() __up_console_sem(_RET_IP_)
-/* Return true if a panic is in progress on the current CPU. */
-bool this_cpu_in_panic(void)
-{
- /*
- * We can use raw_smp_processor_id() here because it is impossible for
- * the task to be migrated to the panic_cpu, or away from it. If
- * panic_cpu has already been set, and we're not currently executing on
- * that CPU, then we never will be.
- */
- return unlikely(atomic_read(&panic_cpu) == raw_smp_processor_id());
-}
-
/*
* Return true if a panic is in progress on a remote CPU.
*
@@ -365,7 +354,7 @@ bool this_cpu_in_panic(void)
*/
bool other_cpu_in_panic(void)
{
- return (panic_in_progress() && !this_cpu_in_panic());
+ return (panic_in_progress() && !panic_on_this_cpu());
}
/*
diff --git a/kernel/printk/printk_ringbuffer.c b/kernel/printk/printk_ringbuffer.c
index d9fb053cff67d..e2a1b2d34d2b7 100644
--- a/kernel/printk/printk_ringbuffer.c
+++ b/kernel/printk/printk_ringbuffer.c
@@ -2143,7 +2143,7 @@ static bool _prb_read_valid(struct printk_ringbuffer *rb, u64 *seq,
* But it would have the sequence number returned
* by "prb_next_reserve_seq() - 1".
*/
- if (this_cpu_in_panic() &&
+ if (panic_on_this_cpu() &&
(!debug_non_panic_cpus || legacy_allow_panic_sync) &&
((*seq + 1) < prb_next_reserve_seq(rb))) {
(*seq)++;
diff --git a/lib/dump_stack.c b/lib/dump_stack.c
index 388da1aea14a5..0b41b0a34323c 100644
--- a/lib/dump_stack.c
+++ b/lib/dump_stack.c
@@ -102,7 +102,7 @@ static void __dump_stack(const char *log_lvl)
*/
asmlinkage __visible void dump_stack_lvl(const char *log_lvl)
{
- bool in_panic = this_cpu_in_panic();
+ bool in_panic = panic_on_this_cpu();
unsigned long flags;
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0468/1376] panic/printk: replace other_cpu_in_panic() with panic_on_other_cpu()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (466 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0467/1376] panic/printk: replace this_cpu_in_panic() with panic_on_this_cpu() Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0469/1376] printk: Introduce console_flush_one_record Greg Kroah-Hartman
` (530 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jinchao Wang, Anna Schumaker,
Baoquan He, Darrick J. Wong, Dave Young, Doug Anderson,
Guilherme G. Piccoli, Helge Deller, Ingo Molnar, Jason Gunthorpe,
Joanthan Cameron, Joel Granados, John Ogness, Kees Cook,
Li Huafei, Luck, Tony, Luo Gengkun, Max Kellermann, Nam Cao,
oushixiong, Petr Mladek, Qianqiang Liu, Sergey Senozhatsky,
Sohil Mehta, Steven Rostedt, Tejun Heo, Thomas Gleinxer,
Thomas Zimemrmann, Thorsten Blum, Ville Syrjala, Vivek Goyal,
Yicong Yang, Yunhui Cui, Yury Norov (NVIDIA), Andrew Morton,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinchao Wang <wangjinchao600@gmail.com>
[ Upstream commit d4a36db5639db032a434aef968f9188a600139ec ]
The helper other_cpu_in_panic() duplicated logic already provided by
panic_on_other_cpu().
Remove other_cpu_in_panic() and update all users to call
panic_on_other_cpu() instead.
This removes redundant code and makes panic handling consistent.
Link: https://lkml.kernel.org/r/20250825022947.1596226-9-wangjinchao600@gmail.com
Signed-off-by: Jinchao Wang <wangjinchao600@gmail.com>
Cc: Anna Schumaker <anna.schumaker@oracle.com>
Cc: Baoquan He <bhe@redhat.com>
Cc: "Darrick J. Wong" <djwong@kernel.org>
Cc: Dave Young <dyoung@redhat.com>
Cc: Doug Anderson <dianders@chromium.org>
Cc: "Guilherme G. Piccoli" <gpiccoli@igalia.com>
Cc: Helge Deller <deller@gmx.de>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Joanthan Cameron <Jonathan.Cameron@huawei.com>
Cc: Joel Granados <joel.granados@kernel.org>
Cc: John Ogness <john.ogness@linutronix.de>
Cc: Kees Cook <kees@kernel.org>
Cc: Li Huafei <lihuafei1@huawei.com>
Cc: "Luck, Tony" <tony.luck@intel.com>
Cc: Luo Gengkun <luogengkun@huaweicloud.com>
Cc: Max Kellermann <max.kellermann@ionos.com>
Cc: Nam Cao <namcao@linutronix.de>
Cc: oushixiong <oushixiong@kylinos.cn>
Cc: Petr Mladek <pmladek@suse.com>
Cc: Qianqiang Liu <qianqiang.liu@163.com>
Cc: Sergey Senozhatsky <senozhatsky@chromium.org>
Cc: Sohil Mehta <sohil.mehta@intel.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Tejun Heo <tj@kernel.org>
Cc: Thomas Gleinxer <tglx@linutronix.de>
Cc: Thomas Zimemrmann <tzimmermann@suse.de>
Cc: Thorsten Blum <thorsten.blum@linux.dev>
Cc: Ville Syrjala <ville.syrjala@linux.intel.com>
Cc: Vivek Goyal <vgoyal@redhat.com>
Cc: Yicong Yang <yangyicong@hisilicon.com>
Cc: Yunhui Cui <cuiyunhui@bytedance.com>
Cc: Yury Norov (NVIDIA) <yury.norov@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Stable-dep-of: 36630cafbeed ("printk: Fix possible console use-after-free")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/printk/internal.h | 1 -
kernel/printk/nbcon.c | 8 ++++----
kernel/printk/printk.c | 19 ++++---------------
3 files changed, 8 insertions(+), 20 deletions(-)
diff --git a/kernel/printk/internal.h b/kernel/printk/internal.h
index 2cc13c5597688..53c4b3438a1c6 100644
--- a/kernel/printk/internal.h
+++ b/kernel/printk/internal.h
@@ -328,7 +328,6 @@ struct printk_message {
unsigned long dropped;
};
-bool other_cpu_in_panic(void);
bool printk_get_next_message(struct printk_message *pmsg, u64 seq,
bool is_extended, bool may_supress);
diff --git a/kernel/printk/nbcon.c b/kernel/printk/nbcon.c
index 68563ed55e203..7b4dcb09ce998 100644
--- a/kernel/printk/nbcon.c
+++ b/kernel/printk/nbcon.c
@@ -254,7 +254,7 @@ static int nbcon_context_try_acquire_direct(struct nbcon_context *ctxt,
* opportunity to perform any necessary cleanup if they were
* interrupted by the panic CPU while printing.
*/
- if (other_cpu_in_panic() &&
+ if (panic_on_other_cpu() &&
(!is_reacquire || cur->unsafe_takeover)) {
return -EPERM;
}
@@ -309,7 +309,7 @@ static bool nbcon_waiter_matches(struct nbcon_state *cur, int expected_prio)
* Event #2 implies the new context is PANIC.
* Event #3 occurs when panic() has flushed the console.
* Event #4 occurs when a non-panic CPU reacquires.
- * Event #5 is not possible due to the other_cpu_in_panic() check
+ * Event #5 is not possible due to the panic_on_other_cpu() check
* in nbcon_context_try_acquire_handover().
*/
@@ -348,7 +348,7 @@ static int nbcon_context_try_acquire_requested(struct nbcon_context *ctxt,
struct nbcon_state new;
/* Note that the caller must still remove the request! */
- if (other_cpu_in_panic())
+ if (panic_on_other_cpu())
return -EPERM;
/*
@@ -446,7 +446,7 @@ static int nbcon_context_try_acquire_handover(struct nbcon_context *ctxt,
* nbcon_waiter_matches(). In particular, the assumption that
* lower priorities are ignored during panic.
*/
- if (other_cpu_in_panic())
+ if (panic_on_other_cpu())
return -EPERM;
/* Handover is not possible on the same CPU. */
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index a01a5683ecd92..9434460cff640 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -346,17 +346,6 @@ static void __up_console_sem(unsigned long ip)
}
#define up_console_sem() __up_console_sem(_RET_IP_)
-/*
- * Return true if a panic is in progress on a remote CPU.
- *
- * On true, the local CPU should immediately release any printing resources
- * that may be needed by the panic CPU.
- */
-bool other_cpu_in_panic(void)
-{
- return (panic_in_progress() && !panic_on_this_cpu());
-}
-
/*
* This is used for debugging the mess that is the VT code by
* keeping track if we have the console semaphore held. It's
@@ -2366,7 +2355,7 @@ asmlinkage int vprintk_emit(int facility, int level,
* non-panic CPUs are generating any messages, they will be
* silently dropped.
*/
- if (other_cpu_in_panic() &&
+ if (panic_on_other_cpu() &&
!debug_non_panic_cpus &&
!panic_triggering_all_cpu_backtrace)
return 0;
@@ -2802,7 +2791,7 @@ void console_lock(void)
might_sleep();
/* On panic, the console_lock must be left to the panic cpu. */
- while (other_cpu_in_panic())
+ while (panic_on_other_cpu())
msleep(1000);
down_console_sem();
@@ -2822,7 +2811,7 @@ EXPORT_SYMBOL(console_lock);
int console_trylock(void)
{
/* On panic, the console_lock must be left to the panic cpu. */
- if (other_cpu_in_panic())
+ if (panic_on_other_cpu())
return 0;
if (down_trylock_console_sem())
return 0;
@@ -3197,7 +3186,7 @@ static bool console_flush_all(bool do_cond_resched, u64 *next_seq, bool *handove
any_progress = true;
/* Allow panic_cpu to take over the consoles safely. */
- if (other_cpu_in_panic())
+ if (panic_on_other_cpu())
goto abandon;
if (do_cond_resched)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0469/1376] printk: Introduce console_flush_one_record
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (467 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0468/1376] panic/printk: replace other_cpu_in_panic() with panic_on_other_cpu() Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0470/1376] printk: Fix possible console use-after-free Greg Kroah-Hartman
` (529 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Petr Mladek, Andrew Murray,
John Ogness, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Murray <amurray@thegoodpenguin.co.uk>
[ Upstream commit 741ea7aa95dd9ac77f861e7d0961d8d231ac8448 ]
console_flush_all prints all remaining records to all usable consoles
whilst its caller holds console_lock. This can result in large waiting
times for those waiting for console_lock especially where there is a
large volume of records or where the console is slow (e.g. serial).
Let's extract the parts of this function which print a single record
into a new function named console_flush_one_record. This can later
be used for functions that will release and reacquire console_lock
between records.
This commit should not change existing functionality.
Reviewed-by: Petr Mladek <pmladek@suse.com>
Signed-off-by: Andrew Murray <amurray@thegoodpenguin.co.uk>
Reviewed-by: John Ogness <john.ogness@linutronix.de>
Link: https://patch.msgid.link/20251020-printk_legacy_thread_console_lock-v3-1-00f1f0ac055a@thegoodpenguin.co.uk
Signed-off-by: Petr Mladek <pmladek@suse.com>
Stable-dep-of: 36630cafbeed ("printk: Fix possible console use-after-free")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/printk/printk.c | 158 ++++++++++++++++++++++++++---------------
1 file changed, 99 insertions(+), 59 deletions(-)
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index 9434460cff640..464227c82b08d 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -3104,6 +3104,99 @@ static inline void printk_kthreads_check_locked(void) { }
#endif /* CONFIG_PRINTK */
+
+/*
+ * Print out one record for each console.
+ *
+ * @do_cond_resched is set by the caller. It can be true only in schedulable
+ * context.
+ *
+ * @next_seq is set to the sequence number after the last available record.
+ * The value is valid only when there is at least one usable console and all
+ * usable consoles were flushed.
+ *
+ * @handover will be set to true if a printk waiter has taken over the
+ * console_lock, in which case the caller is no longer holding the
+ * console_lock. Otherwise it is set to false.
+ *
+ * @any_usable will be set to true if there are any usable consoles.
+ *
+ * Returns true when there was at least one usable console and a record was
+ * flushed. A returned false indicates there were no records to flush for any
+ * of the consoles. It may also indicate that there were no usable consoles,
+ * the context has been lost or there is a panic suitation. Regardless the
+ * reason, the caller should assume it is not useful to immediately try again.
+ *
+ * Requires the console_lock.
+ */
+static bool console_flush_one_record(bool do_cond_resched, u64 *next_seq, bool *handover,
+ bool *any_usable)
+{
+ struct console_flush_type ft;
+ bool any_progress = false;
+ struct console *con;
+ int cookie;
+
+ printk_get_console_flush_type(&ft);
+
+ cookie = console_srcu_read_lock();
+ for_each_console_srcu(con) {
+ short flags = console_srcu_read_flags(con);
+ u64 printk_seq;
+ bool progress;
+
+ /*
+ * console_flush_one_record() is only responsible for
+ * nbcon consoles when the nbcon consoles cannot print via
+ * their atomic or threaded flushing.
+ */
+ if ((flags & CON_NBCON) && (ft.nbcon_atomic || ft.nbcon_offload))
+ continue;
+
+ if (!console_is_usable(con, flags, !do_cond_resched))
+ continue;
+ *any_usable = true;
+
+ if (flags & CON_NBCON) {
+ progress = nbcon_legacy_emit_next_record(con, handover, cookie,
+ !do_cond_resched);
+ printk_seq = nbcon_seq_read(con);
+ } else {
+ progress = console_emit_next_record(con, handover, cookie);
+ printk_seq = con->seq;
+ }
+
+ /*
+ * If a handover has occurred, the SRCU read lock
+ * is already released.
+ */
+ if (*handover)
+ return false;
+
+ /* Track the next of the highest seq flushed. */
+ if (printk_seq > *next_seq)
+ *next_seq = printk_seq;
+
+ if (!progress)
+ continue;
+ any_progress = true;
+
+ /* Allow panic_cpu to take over the consoles safely. */
+ if (panic_on_other_cpu())
+ goto abandon;
+
+ if (do_cond_resched)
+ cond_resched();
+ }
+ console_srcu_read_unlock(cookie);
+
+ return any_progress;
+
+abandon:
+ console_srcu_read_unlock(cookie);
+ return false;
+}
+
/*
* Print out all remaining records to all consoles.
*
@@ -3129,77 +3222,24 @@ static inline void printk_kthreads_check_locked(void) { }
*/
static bool console_flush_all(bool do_cond_resched, u64 *next_seq, bool *handover)
{
- struct console_flush_type ft;
bool any_usable = false;
- struct console *con;
bool any_progress;
- int cookie;
*next_seq = 0;
*handover = false;
do {
- any_progress = false;
+ any_progress = console_flush_one_record(do_cond_resched, next_seq, handover,
+ &any_usable);
- printk_get_console_flush_type(&ft);
-
- cookie = console_srcu_read_lock();
- for_each_console_srcu(con) {
- short flags = console_srcu_read_flags(con);
- u64 printk_seq;
- bool progress;
+ if (*handover)
+ return false;
- /*
- * console_flush_all() is only responsible for nbcon
- * consoles when the nbcon consoles cannot print via
- * their atomic or threaded flushing.
- */
- if ((flags & CON_NBCON) && (ft.nbcon_atomic || ft.nbcon_offload))
- continue;
-
- if (!console_is_usable(con, flags, !do_cond_resched))
- continue;
- any_usable = true;
-
- if (flags & CON_NBCON) {
- progress = nbcon_legacy_emit_next_record(con, handover, cookie,
- !do_cond_resched);
- printk_seq = nbcon_seq_read(con);
- } else {
- progress = console_emit_next_record(con, handover, cookie);
- printk_seq = con->seq;
- }
-
- /*
- * If a handover has occurred, the SRCU read lock
- * is already released.
- */
- if (*handover)
- return false;
-
- /* Track the next of the highest seq flushed. */
- if (printk_seq > *next_seq)
- *next_seq = printk_seq;
-
- if (!progress)
- continue;
- any_progress = true;
-
- /* Allow panic_cpu to take over the consoles safely. */
- if (panic_on_other_cpu())
- goto abandon;
-
- if (do_cond_resched)
- cond_resched();
- }
- console_srcu_read_unlock(cookie);
+ if (panic_on_other_cpu())
+ return false;
} while (any_progress);
return any_usable;
-
-abandon:
- console_srcu_read_unlock(cookie);
- return false;
}
static void __console_flush_and_unlock(void)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0470/1376] printk: Fix possible console use-after-free
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (468 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0469/1376] printk: Introduce console_flush_one_record Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0471/1376] ACPI: RISC-V: Fix riscv_acpi_irq_get_dep() loop termination Greg Kroah-Hartman
` (528 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, John Ogness, Petr Mladek,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Ogness <john.ogness@linutronix.de>
[ Upstream commit 36630cafbeede0b64c370edb2f7b4094327ee1e0 ]
When emitting a record via legacy printing, it is possible that a handover
to another legacy printing context occurs. When a context has performed a
handover, the console SRCU read lock is released and the pointer to the
console struct might now be invalid. Therefore, after calling
nbcon_legacy_emit_next_record() or console_emit_next_record(), it is
necessary to check if a handover occurred _before_ further @con usage.
Sashiko pointed out that console_flush_one_record() was not doing this.
In console_flush_one_record(), after emitting a record, move the further
usage of @con after the handover check.
Fixes: c158834b223f ("printk: nbcon: Use nbcon consoles in console_flush_all()")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/lkml/20260630170903.099D61F000E9@smtp.kernel.org
Signed-off-by: John Ogness <john.ogness@linutronix.de>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Link: https://patch.msgid.link/20260703141521.202813-1-john.ogness@linutronix.de
Signed-off-by: Petr Mladek <pmladek@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/printk/printk.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index 464227c82b08d..37f1d4637d90c 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -3160,10 +3160,8 @@ static bool console_flush_one_record(bool do_cond_resched, u64 *next_seq, bool *
if (flags & CON_NBCON) {
progress = nbcon_legacy_emit_next_record(con, handover, cookie,
!do_cond_resched);
- printk_seq = nbcon_seq_read(con);
} else {
progress = console_emit_next_record(con, handover, cookie);
- printk_seq = con->seq;
}
/*
@@ -3173,6 +3171,15 @@ static bool console_flush_one_record(bool do_cond_resched, u64 *next_seq, bool *
if (*handover)
return false;
+ /*
+ * @con can be used here now that it is certain that this
+ * context is still holding the SRCU read lock.
+ */
+ if (flags & CON_NBCON)
+ printk_seq = nbcon_seq_read(con);
+ else
+ printk_seq = con->seq;
+
/* Track the next of the highest seq flushed. */
if (printk_seq > *next_seq)
*next_seq = printk_seq;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0471/1376] ACPI: RISC-V: Fix riscv_acpi_irq_get_dep() loop termination
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (469 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0470/1376] printk: Fix possible console use-after-free Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0472/1376] ACPI: RISC-V: Check acpi_get_handle() status in riscv_acpi_add_prt_dep() Greg Kroah-Hartman
` (527 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Pieralisi, Sunil V L,
Rafael J. Wysocki, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Pieralisi <lpieralisi@kernel.org>
[ Upstream commit 64ae310bffa477cd11029c818bec489f4b8a845e ]
In riscv_acpi_add_irq_dep() the main loop condition would currently stop
the loop if an interrupt descriptor contains an interrupt for which the
respective GSI handle is NULL, which is not correct because subsequent
interrupts in the interrupt descriptor might still have a GSI dependency
that must not be skipped.
Rework riscv_acpi_add_irq_dep() and the riscv_acpi_irq_get_dep() call chain
to fix it - by not forcing the loop to stop in order to guarantee
dependency detection for all the interrupt entries in the CRS descriptor.
Fixes: 1b173cc4bfcd ("ACPI: RISC-V: Implement function to add implicit dependencies")
Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Tested-by: Sunil V L <sunilvl@oss.qualcomm.com>
Reviewed-by: Sunil V L <sunilvl@oss.qualcomm.com>
Link: https://patch.msgid.link/20260709-gic-v5-acpi-iwb-probe-deferral-v4-2-48dae790f871@kernel.org
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/riscv/irq.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/acpi/riscv/irq.c b/drivers/acpi/riscv/irq.c
index cced960c2aeff..e24266ce8a14f 100644
--- a/drivers/acpi/riscv/irq.c
+++ b/drivers/acpi/riscv/irq.c
@@ -230,6 +230,7 @@ static acpi_status riscv_acpi_irq_get_parent(struct acpi_resource *ares, void *c
return AE_OK;
ctx->handle = riscv_acpi_get_gsi_handle(eirq->interrupts[ctx->index]);
+ ctx->rc = 0;
return AE_CTRL_TERMINATE;
}
@@ -245,10 +246,8 @@ static int riscv_acpi_irq_get_dep(acpi_handle handle, unsigned int index, acpi_h
acpi_walk_resources(handle, METHOD_NAME__CRS, riscv_acpi_irq_get_parent, &ctx);
*gsi_handle = ctx.handle;
- if (*gsi_handle)
- return 1;
- return 0;
+ return ctx.rc;
}
static u32 riscv_acpi_add_prt_dep(acpi_handle handle)
@@ -310,8 +309,11 @@ static u32 riscv_acpi_add_irq_dep(acpi_handle handle)
int i;
for (i = 0;
- riscv_acpi_irq_get_dep(handle, i, &gsi_handle);
+ !riscv_acpi_irq_get_dep(handle, i, &gsi_handle);
i++) {
+ if (!gsi_handle)
+ continue;
+
dep_devices.count = 1;
dep_devices.handles = kcalloc(1, sizeof(*dep_devices.handles), GFP_KERNEL);
if (!dep_devices.handles) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0472/1376] ACPI: RISC-V: Check acpi_get_handle() status in riscv_acpi_add_prt_dep()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (470 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0471/1376] ACPI: RISC-V: Fix riscv_acpi_irq_get_dep() loop termination Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0473/1376] ACPI: RISC-V: Fix riscv_acpi_add_prt_dep() loop handling Greg Kroah-Hartman
` (526 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Pieralisi, Sunil V L,
Rafael J. Wysocki, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Pieralisi <lpieralisi@kernel.org>
[ Upstream commit 20435bda13f1219891ed0ce41207e320a916ff9c ]
In riscv_acpi_add_prt_dep(), the acpi_get_handle() call can fail which
would leave link_handle uninitialized.
Fix it by checking the acpi_get_handle() return status and skip the entry
if it fails.
Fixes: 1b173cc4bfcd ("ACPI: RISC-V: Implement function to add implicit dependencies")
Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Tested-by: Sunil V L <sunilvl@oss.qualcomm.com>
Reviewed-by: Sunil V L <sunilvl@oss.qualcomm.com>
Link: https://patch.msgid.link/20260709-gic-v5-acpi-iwb-probe-deferral-v4-3-48dae790f871@kernel.org
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/riscv/irq.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/acpi/riscv/irq.c b/drivers/acpi/riscv/irq.c
index e24266ce8a14f..e97417ab94ce9 100644
--- a/drivers/acpi/riscv/irq.c
+++ b/drivers/acpi/riscv/irq.c
@@ -270,7 +270,9 @@ static u32 riscv_acpi_add_prt_dep(acpi_handle handle)
entry = buffer.pointer;
while (entry && (entry->length > 0)) {
if (entry->source[0]) {
- acpi_get_handle(handle, entry->source, &link_handle);
+ status = acpi_get_handle(handle, entry->source, &link_handle);
+ if (ACPI_FAILURE(status))
+ continue;
dep_devices.count = 1;
dep_devices.handles = kcalloc(1, sizeof(*dep_devices.handles), GFP_KERNEL);
if (!dep_devices.handles) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0473/1376] ACPI: RISC-V: Fix riscv_acpi_add_prt_dep() loop handling
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (471 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0472/1376] ACPI: RISC-V: Check acpi_get_handle() status in riscv_acpi_add_prt_dep() Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0474/1376] platform/x86: dell-privacy: Fix race condition Greg Kroah-Hartman
` (525 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Pieralisi, Sunil V L,
Rafael J. Wysocki, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Pieralisi <lpieralisi@kernel.org>
[ Upstream commit 3a56321d0aceee2a0bd80d23366401c131ff8350 ]
The loop in riscv_acpi_add_prt_dep() includes error conditions that are
handled in a dubious - if not outright wrong - way, by continuining the
loop (which skips and misses the entry pointer update to point to the next
entry).
Rewrite the loop as a for loop (that handles the continuation correctly)
and wrap the condition and update statements using helper functions to make
it cleaner.
Fixes: 1b173cc4bfcd ("ACPI: RISC-V: Implement function to add implicit dependencies")
Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Tested-by: Sunil V L <sunilvl@oss.qualcomm.com>
Reviewed-by: Sunil V L <sunilvl@oss.qualcomm.com>
Link: https://patch.msgid.link/20260709-gic-v5-acpi-iwb-probe-deferral-v4-4-48dae790f871@kernel.org
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/riscv/irq.c | 19 +++++++++++++++----
1 file changed, 15 insertions(+), 4 deletions(-)
diff --git a/drivers/acpi/riscv/irq.c b/drivers/acpi/riscv/irq.c
index e97417ab94ce9..9c8185ca9f8c5 100644
--- a/drivers/acpi/riscv/irq.c
+++ b/drivers/acpi/riscv/irq.c
@@ -250,6 +250,20 @@ static int riscv_acpi_irq_get_dep(acpi_handle handle, unsigned int index, acpi_h
return ctx.rc;
}
+static bool acpi_prt_entry_valid(void *prt_entry)
+{
+ struct acpi_pci_routing_table *entry = prt_entry;
+
+ return entry && entry->length > 0;
+}
+
+static void *acpi_prt_next_entry(void *prt_entry)
+{
+ struct acpi_pci_routing_table *entry = prt_entry;
+
+ return prt_entry + entry->length;
+}
+
static u32 riscv_acpi_add_prt_dep(acpi_handle handle)
{
struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
@@ -268,7 +282,7 @@ static u32 riscv_acpi_add_prt_dep(acpi_handle handle)
}
entry = buffer.pointer;
- while (entry && (entry->length > 0)) {
+ for (; acpi_prt_entry_valid(entry); entry = acpi_prt_next_entry(entry)) {
if (entry->source[0]) {
status = acpi_get_handle(handle, entry->source, &link_handle);
if (ACPI_FAILURE(status))
@@ -294,9 +308,6 @@ static u32 riscv_acpi_add_prt_dep(acpi_handle handle)
dep_devices.handles[0] = gsi_handle;
count += acpi_scan_add_dep(handle, &dep_devices);
}
-
- entry = (struct acpi_pci_routing_table *)
- ((unsigned long)entry + entry->length);
}
kfree(buffer.pointer);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0474/1376] platform/x86: dell-privacy: Fix race condition
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (472 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0473/1376] ACPI: RISC-V: Fix riscv_acpi_add_prt_dep() loop handling Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0475/1376] platform/x86: dell-wmi-base: Fix resource leak on module load failure Greg Kroah-Hartman
` (524 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Armin Wolf, Ilpo Järvinen,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <W_Armin@gmx.de>
[ Upstream commit ca9338dbc64759b30741b12017c050b33c94dfa2 ]
Accessing priv->features_present needs to happen with the list mutex
being held, otherwise priv can be freed at any moment.
Fixes: 8af9fa37b8a3 ("platform/x86: dell-privacy: Add support for Dell hardware privacy")
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260612173451.467629-2-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/dell/dell-wmi-privacy.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/platform/x86/dell/dell-wmi-privacy.c b/drivers/platform/x86/dell/dell-wmi-privacy.c
index 4b65e1655d42a..7c2b6fae96c52 100644
--- a/drivers/platform/x86/dell/dell-wmi-privacy.c
+++ b/drivers/platform/x86/dell/dell-wmi-privacy.c
@@ -69,11 +69,11 @@ bool dell_privacy_has_mic_mute(void)
{
struct privacy_wmi_data *priv;
- mutex_lock(&list_mutex);
+ guard(mutex)(&list_mutex);
+
priv = list_first_entry_or_null(&wmi_list,
struct privacy_wmi_data,
list);
- mutex_unlock(&list_mutex);
return priv && (priv->features_present & BIT(DELL_PRIVACY_TYPE_AUDIO));
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0475/1376] platform/x86: dell-wmi-base: Fix resource leak on module load failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (473 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0474/1376] platform/x86: dell-privacy: Fix race condition Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0476/1376] platform/x86: lg-laptop: Drop debug-only ACPI notify handler Greg Kroah-Hartman
` (523 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Armin Wolf, Ilpo Järvinen,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <W_Armin@gmx.de>
[ Upstream commit 072841e02cf9c00a7e8a9c567a14239e02ca47ad ]
We need to properly clean up the SMBIOS request and the privacy driver
when the module load fails.
Fixes: 8af9fa37b8a3 ("platform/x86: dell-privacy: Add support for Dell hardware privacy")
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260612173451.467629-3-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/dell/dell-wmi-base.c | 17 +++++++++++++++--
1 file changed, 15 insertions(+), 2 deletions(-)
diff --git a/drivers/platform/x86/dell/dell-wmi-base.c b/drivers/platform/x86/dell/dell-wmi-base.c
index 01f3ff21c8884..713ec2c12a04e 100644
--- a/drivers/platform/x86/dell/dell-wmi-base.c
+++ b/drivers/platform/x86/dell/dell-wmi-base.c
@@ -839,9 +839,22 @@ static int __init dell_wmi_init(void)
err = dell_privacy_register_driver();
if (err)
- return err;
+ goto out_smbios;
- return wmi_driver_register(&dell_wmi_driver);
+ err = wmi_driver_register(&dell_wmi_driver);
+ if (err)
+ goto out_privacy;
+
+ return 0;
+
+out_privacy:
+ dell_privacy_unregister_driver();
+
+out_smbios:
+ if (wmi_requires_smbios_request)
+ dell_wmi_events_set_enabled(false);
+
+ return err;
}
late_initcall(dell_wmi_init);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0476/1376] platform/x86: lg-laptop: Drop debug-only ACPI notify handler
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (474 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0475/1376] platform/x86: dell-wmi-base: Fix resource leak on module load failure Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0477/1376] platform/x86: lg-laptop: Convert ACPI driver to a platform one Greg Kroah-Hartman
` (522 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rafael J. Wysocki,
Ilpo Järvinen, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
[ Upstream commit c12fe0b2c12195e0d1c56e0f670a6bd792b0567e ]
To facilitate subsequent conversion of the driver to using struct
platform_driver instead of struct acpi_driver, drop the debug-only
notify handler method from the driver.
No intentional functional impact beyond debug.
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/3346280.5fSG56mABF@rafael.j.wysocki
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Stable-dep-of: 3e91964aa74a ("platform/x86: lg-laptop: Fix LED resource handling")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/lg-laptop.c | 6 ------
1 file changed, 6 deletions(-)
diff --git a/drivers/platform/x86/lg-laptop.c b/drivers/platform/x86/lg-laptop.c
index 6af6cf477c5b5..6a45e6270941a 100644
--- a/drivers/platform/x86/lg-laptop.c
+++ b/drivers/platform/x86/lg-laptop.c
@@ -269,11 +269,6 @@ static void wmi_input_setup(void)
}
}
-static void acpi_notify(struct acpi_device *device, u32 event)
-{
- acpi_handle_debug(device->handle, "notify: %d\n", event);
-}
-
static ssize_t fan_mode_store(struct device *dev,
struct device_attribute *attr,
const char *buffer, size_t count)
@@ -886,7 +881,6 @@ static struct acpi_driver acpi_driver = {
.ops = {
.add = acpi_add,
.remove = acpi_remove,
- .notify = acpi_notify,
},
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0477/1376] platform/x86: lg-laptop: Convert ACPI driver to a platform one
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (475 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0476/1376] platform/x86: lg-laptop: Drop debug-only ACPI notify handler Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0478/1376] platform/x86: lg-laptop: Fix LED resource handling Greg Kroah-Hartman
` (521 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rafael J. Wysocki,
Ilpo Järvinen, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
[ Upstream commit 2d9cb20610f75ca48c1cac064aede90196787507 ]
In all cases in which a struct acpi_driver is used for binding a driver
to an ACPI device object, a corresponding platform device is created by
the ACPI core and that device is regarded as a proper representation of
underlying hardware. Accordingly, a struct platform_driver should be
used by driver code to bind to that device. There are multiple reasons
why drivers should not bind directly to ACPI device objects [1].
Overall, it is better to bind drivers to platform devices than to their
ACPI companions, so convert the LG Gram ACPI features and hotkeys driver
from an ACPI driver to a platform one.
While this is not expected to alter functionality, it changes sysfs
layout and so it will be visible to user space.
Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/1868365.VLH7GnMWUR@rafael.j.wysocki
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Stable-dep-of: 3e91964aa74a ("platform/x86: lg-laptop: Fix LED resource handling")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/lg-laptop.c | 45 +++++++++-----------------------
1 file changed, 13 insertions(+), 32 deletions(-)
diff --git a/drivers/platform/x86/lg-laptop.c b/drivers/platform/x86/lg-laptop.c
index 6a45e6270941a..a68c4867e696b 100644
--- a/drivers/platform/x86/lg-laptop.c
+++ b/drivers/platform/x86/lg-laptop.c
@@ -748,8 +748,9 @@ static void lg_laptop_remove_address_space_handler(void *data)
&lg_laptop_address_space_handler);
}
-static int acpi_add(struct acpi_device *device)
+static int acpi_probe(struct platform_device *pdev)
{
+ struct acpi_device *device = ACPI_COMPANION(&pdev->dev);
struct platform_device_info pdev_info = {
.fwnode = acpi_fwnode_handle(device),
.name = PLATFORM_NAME,
@@ -765,11 +766,11 @@ static int acpi_add(struct acpi_device *device)
status = acpi_install_address_space_handler(device->handle, LG_ADDRESS_SPACE_ID,
&lg_laptop_address_space_handler,
- NULL, &device->dev);
+ NULL, &pdev->dev);
if (ACPI_FAILURE(status))
return -ENODEV;
- ret = devm_add_action_or_reset(&device->dev, lg_laptop_remove_address_space_handler,
+ ret = devm_add_action_or_reset(&pdev->dev, lg_laptop_remove_address_space_handler,
device);
if (ret < 0)
return ret;
@@ -854,7 +855,7 @@ static int acpi_add(struct acpi_device *device)
return ret;
}
-static void acpi_remove(struct acpi_device *device)
+static void acpi_remove(struct platform_device *pdev)
{
sysfs_remove_group(&pf_device->dev.kobj, &dev_attribute_group);
@@ -874,33 +875,13 @@ static const struct acpi_device_id device_ids[] = {
};
MODULE_DEVICE_TABLE(acpi, device_ids);
-static struct acpi_driver acpi_driver = {
- .name = "LG Gram Laptop Support",
- .class = "lg-laptop",
- .ids = device_ids,
- .ops = {
- .add = acpi_add,
- .remove = acpi_remove,
- },
+static struct platform_driver acpi_driver = {
+ .probe = acpi_probe,
+ .remove = acpi_remove,
+ .driver = {
+ .name = "LG Gram Laptop Support",
+ .acpi_match_table = device_ids,
+ },
};
-static int __init acpi_init(void)
-{
- int result;
-
- result = acpi_bus_register_driver(&acpi_driver);
- if (result < 0) {
- pr_debug("Error registering driver\n");
- return -ENODEV;
- }
-
- return 0;
-}
-
-static void __exit acpi_exit(void)
-{
- acpi_bus_unregister_driver(&acpi_driver);
-}
-
-module_init(acpi_init);
-module_exit(acpi_exit);
+module_platform_driver(acpi_driver);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0478/1376] platform/x86: lg-laptop: Fix LED resource handling
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (476 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0477/1376] platform/x86: lg-laptop: Convert ACPI driver to a platform one Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0479/1376] remoteproc: qcom_q6v5_adsp: Fix reference leak for device node Greg Kroah-Hartman
` (520 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Armin Wolf, Ilpo Järvinen,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <W_Armin@gmx.de>
[ Upstream commit 3e91964aa74ab261aa15d9d96318eded2fd9d22a ]
The event notification callback might access kbd_backlight even
when it was not successfully registered with the LED subsystem.
The same happens inside acpi_remove(), where the LED devices are
unregistered unconditionally.
Fix this by tracking the availability of the kbd_backlight LED
device and use devm_led_classdev_register() to let devres take
care of unregistering the LED devices during removal. For this
the parent device of the LED devices is changed to the native
platform device.
Fixes: ae26278829a8 ("platform/x86: lg-laptop: Use correct event for keyboard backlight FN-key")
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260708195553.7762-2-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/lg-laptop.c | 21 ++++++++++++++-------
1 file changed, 14 insertions(+), 7 deletions(-)
diff --git a/drivers/platform/x86/lg-laptop.c b/drivers/platform/x86/lg-laptop.c
index a68c4867e696b..0a5c8f0471823 100644
--- a/drivers/platform/x86/lg-laptop.c
+++ b/drivers/platform/x86/lg-laptop.c
@@ -98,6 +98,7 @@ static u32 inited;
#define INIT_SPARSE_KEYMAP 0x80
static int battery_limit_use_wmbb;
+static bool kbd_backlight_available;
static struct led_classdev kbd_backlight;
static enum led_brightness get_kbd_backlight_level(struct device *dev);
@@ -212,6 +213,7 @@ static union acpi_object *lg_wmbb(struct device *dev, u32 method_id, u32 arg1, u
static void wmi_notify(union acpi_object *obj, void *context)
{
long data = (long)context;
+ unsigned int brightness;
pr_debug("event guid %li\n", data);
if (!obj)
@@ -222,8 +224,11 @@ static void wmi_notify(union acpi_object *obj, void *context)
struct key_entry *key;
if (eventcode == 0x10000000) {
- led_classdev_notify_brightness_hw_changed(
- &kbd_backlight, get_kbd_backlight_level(kbd_backlight.dev->parent));
+ if (kbd_backlight_available) {
+ brightness = get_kbd_backlight_level(kbd_backlight.dev->parent);
+ led_classdev_notify_brightness_hw_changed(&kbd_backlight,
+ brightness);
+ }
} else {
key = sparse_keymap_entry_from_scancode(
wmi_input_dev, eventcode);
@@ -840,8 +845,13 @@ static int acpi_probe(struct platform_device *pdev)
goto out_platform_device;
/* LEDs are optional */
- led_classdev_register(&pf_device->dev, &kbd_backlight);
- led_classdev_register(&pf_device->dev, &tpad_led);
+ ret = devm_led_classdev_register(&pdev->dev, &kbd_backlight);
+ if (ret < 0)
+ kbd_backlight_available = false;
+ else
+ kbd_backlight_available = true;
+
+ devm_led_classdev_register(&pdev->dev, &tpad_led);
wmi_input_setup();
battery_hook_register(&battery_hook);
@@ -859,9 +869,6 @@ static void acpi_remove(struct platform_device *pdev)
{
sysfs_remove_group(&pf_device->dev.kobj, &dev_attribute_group);
- led_classdev_unregister(&tpad_led);
- led_classdev_unregister(&kbd_backlight);
-
battery_hook_unregister(&battery_hook);
wmi_input_destroy();
platform_device_unregister(pf_device);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0479/1376] remoteproc: qcom_q6v5_adsp: Fix reference leak for device node
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (477 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0478/1376] platform/x86: lg-laptop: Fix LED resource handling Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0480/1376] hwspinlock: propagate errno when registering single lock Greg Kroah-Hartman
` (519 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Felix Gu, Bjorn Andersson,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <gu_0233@qq.com>
[ Upstream commit 8c952807c2cebd5e9e9b37146c9383229794c129 ]
When calling of_parse_phandle_with_args(), the caller is responsible
to call of_node_put() to release the reference of device node.
In adsp_map_carveout, it does not release the reference.
Fixes: f22eedff28af ("remoteproc: qcom: Add support for memory sandbox")
Signed-off-by: Felix Gu <gu_0233@qq.com>
Link: https://lore.kernel.org/r/tencent_EDC2253D3B1C22217E1259E07765D269100A@qq.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/remoteproc/qcom_q6v5_adsp.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/remoteproc/qcom_q6v5_adsp.c b/drivers/remoteproc/qcom_q6v5_adsp.c
index 223f6ca0745d3..80ac739621bed 100644
--- a/drivers/remoteproc/qcom_q6v5_adsp.c
+++ b/drivers/remoteproc/qcom_q6v5_adsp.c
@@ -355,6 +355,7 @@ static int adsp_map_carveout(struct rproc *rproc)
return ret;
sid = args.args[0] & SID_MASK_DEFAULT;
+ of_node_put(args.np);
/* Add SID configuration for ADSP Firmware to SMMU */
iova = adsp->mem_phys | (sid << 32);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0480/1376] hwspinlock: propagate errno when registering single lock
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (478 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0479/1376] remoteproc: qcom_q6v5_adsp: Fix reference leak for device node Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0481/1376] selftests/sched_ext: Fix bpf_link leak on early return in prog_run Greg Kroah-Hartman
` (518 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wolfram Sang, Bjorn Andersson,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <wsa+renesas@sang-engineering.com>
[ Upstream commit e088ffa9a00eaaaf90da74763e774ca160969c26 ]
hwspin_lock_register_single() always returns 0 despite checking the
result from radix_tree_insert(). Propagate the errno to make sanity
checks in callers of this function actually meaningful.
Fixes: 300bab9770e2 ("hwspinlock/core: register a bank of hwspinlocks in a single API call")
Link: https://sashiko.dev/#/patchset/20260319105947.6237-1-wsa%2Brenesas%40sang-engineering.com # review of patch 14
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Link: https://lore.kernel.org/r/20260512084856.30497-2-wsa+renesas@sang-engineering.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwspinlock/hwspinlock_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hwspinlock/hwspinlock_core.c b/drivers/hwspinlock/hwspinlock_core.c
index 6505261e60686..b27a2e33a6117 100644
--- a/drivers/hwspinlock/hwspinlock_core.c
+++ b/drivers/hwspinlock/hwspinlock_core.c
@@ -472,7 +472,7 @@ static int hwspin_lock_register_single(struct hwspinlock *hwlock, int id)
out:
mutex_unlock(&hwspinlock_tree_lock);
- return 0;
+ return ret;
}
static struct hwspinlock *hwspin_lock_unregister_single(unsigned int id)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0481/1376] selftests/sched_ext: Fix bpf_link leak on early return in prog_run
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (479 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0480/1376] hwspinlock: propagate errno when registering single lock Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0482/1376] serial: ma35d1: Fix OF node reference leaks in console init Greg Kroah-Hartman
` (517 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Liang Luo, Andrea Righi, Tejun Heo,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liang Luo <luoliang@kylinos.cn>
[ Upstream commit e655c1f1bd14804f398df7da029c4a7e3f9ccd7f ]
In prog_run's run(), the bpf_link is attached early but only destroyed
on the success path. The three SCX_EQ assertions between attach and
destroy expand to a direct 'return SCX_TEST_FAIL', so if any of them
triggers, bpf_link__destroy() is never reached and the BPF scheduler
stays loaded. All subsequent tests then fail to attach because SCX is
not in the DISABLED state.
Convert those assertions to explicit checks that jump to a unified
'out' label which always runs the cleanup, matching the pattern used
in cyclic_kick_wait.c.
Fixes: a5db7817af78 ("sched_ext: Add selftests")
Signed-off-by: Liang Luo <luoliang@kylinos.cn>
Reviewed-by: Andrea Righi <arighi@nvidia.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/sched_ext/prog_run.c | 34 +++++++++++++++-----
1 file changed, 26 insertions(+), 8 deletions(-)
diff --git a/tools/testing/selftests/sched_ext/prog_run.c b/tools/testing/selftests/sched_ext/prog_run.c
index 3cd57ef8daaa5..a75323fe8a2c7 100644
--- a/tools/testing/selftests/sched_ext/prog_run.c
+++ b/tools/testing/selftests/sched_ext/prog_run.c
@@ -28,7 +28,8 @@ static enum scx_test_status setup(void **ctx)
static enum scx_test_status run(void *ctx)
{
struct prog_run *skel = ctx;
- struct bpf_link *link;
+ struct bpf_link *link = NULL;
+ enum scx_test_status status = SCX_TEST_PASS;
int prog_fd, err = 0;
prog_fd = bpf_program__fd(skel->progs.prog_run_syscall);
@@ -42,23 +43,40 @@ static enum scx_test_status run(void *ctx)
link = bpf_map__attach_struct_ops(skel->maps.prog_run_ops);
if (!link) {
SCX_ERR("Failed to attach scheduler");
- close(prog_fd);
- return SCX_TEST_FAIL;
+ status = SCX_TEST_FAIL;
+ goto out;
}
err = bpf_prog_test_run_opts(prog_fd, &topts);
- SCX_EQ(err, 0);
+ if (err) {
+ SCX_ERR("BPF_PROG_RUN failed (%d)", err);
+ status = SCX_TEST_FAIL;
+ goto out;
+ }
/* Assumes uei.kind is written last */
while (skel->data->uei.kind == EXIT_KIND(SCX_EXIT_NONE))
sched_yield();
- SCX_EQ(skel->data->uei.kind, EXIT_KIND(SCX_EXIT_UNREG_BPF));
- SCX_EQ(skel->data->uei.exit_code, 0xdeadbeef);
+ if (skel->data->uei.kind != EXIT_KIND(SCX_EXIT_UNREG_BPF)) {
+ SCX_ERR("Unexpected exit kind: %llu",
+ (unsigned long long)skel->data->uei.kind);
+ status = SCX_TEST_FAIL;
+ goto out;
+ }
+ if (skel->data->uei.exit_code != 0xdeadbeef) {
+ SCX_ERR("Unexpected exit code: %lld",
+ (long long)skel->data->uei.exit_code);
+ status = SCX_TEST_FAIL;
+ goto out;
+ }
+
+out:
close(prog_fd);
- bpf_link__destroy(link);
+ if (link)
+ bpf_link__destroy(link);
- return SCX_TEST_PASS;
+ return status;
}
static void cleanup(void *ctx)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0482/1376] serial: ma35d1: Fix OF node reference leaks in console init
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (480 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0481/1376] selftests/sched_ext: Fix bpf_link leak on early return in prog_run Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0483/1376] serial: qcom-geni: do not advance stale DMA completions Greg Kroah-Hartman
` (516 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yuho Choi, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <dbgh9129@gmail.com>
[ Upstream commit 8dfea56f350b3dc826f35711802ad6ae8fae0748 ]
ma35d1serial_console_init_port() stores matching UART device nodes in
ma35d1serial_uart_nodes[] with an extra of_node_get() so that console
setup can later read the "reg" property. However, the stored references
are never released after console setup has finished using them.
Drop the stored node reference after ma35d1serial_console_setup() reads
the "reg" property, and clear the array slot to avoid leaving a stale
pointer behind. Also release the iterator reference before breaking out
of for_each_matching_node(), since the normal iterator advance will not
run in that path.
Fixes: 930cbf92db01 ("tty: serial: Add Nuvoton ma35d1 serial driver support")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Link: https://patch.msgid.link/20260630214043.1887351-1-dbgh9129@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/ma35d1_serial.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/drivers/tty/serial/ma35d1_serial.c b/drivers/tty/serial/ma35d1_serial.c
index 3b4206e815fe9..2c1c8d7480230 100644
--- a/drivers/tty/serial/ma35d1_serial.c
+++ b/drivers/tty/serial/ma35d1_serial.c
@@ -608,8 +608,14 @@ static int __init ma35d1serial_console_setup(struct console *co, char *options)
if (!np || !p)
return -ENODEV;
- if (of_property_read_u32_array(np, "reg", val32, ARRAY_SIZE(val32)) != 0)
+ if (of_property_read_u32_array(np, "reg", val32, ARRAY_SIZE(val32)) != 0) {
+ of_node_put(np);
+ ma35d1serial_uart_nodes[co->index] = NULL;
return -EINVAL;
+ }
+
+ of_node_put(np);
+ ma35d1serial_uart_nodes[co->index] = NULL;
p->port.iobase = val32[1];
p->port.membase = ioremap(p->port.iobase, MA35_UART_REG_SIZE);
@@ -648,8 +654,10 @@ static void ma35d1serial_console_init_port(void)
of_node_get(np);
ma35d1serial_uart_nodes[i] = np;
i++;
- if (i == MA35_UART_NR)
+ if (i == MA35_UART_NR) {
+ of_node_put(np);
break;
+ }
}
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0483/1376] serial: qcom-geni: do not advance stale DMA completions
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (481 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0482/1376] serial: ma35d1: Fix OF node reference leaks in console init Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0484/1376] usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths Greg Kroah-Hartman
` (515 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 7ea38c49e7178960926657863299face6dc0e1b0 ]
The qcom GENI serial DMA TX completion path advances the transmit fifo by
the number of bytes recorded in port->tx_remaining.
If uart_flush_buffer() runs after the hardware has completed a DMA
transfer but before the DMA completion interrupt has been handled, the
serial core resets the transmit fifo while port->tx_remaining still
describes the old DMA transfer.
A previous fix avoided advancing an empty fifo by checking that the fifo
length is at least tx_remaining. That still does not distinguish the old
DMA payload from new bytes written after the flush. If userspace writes
new data before the stale DMA completion interrupt is handled, the fifo
can again contain at least tx_remaining bytes and the stale completion
can advance and discard those new bytes.
Mark an in-flight DMA transfer stale when the transmit fifo is flushed.
The later completion still unprepares the original DMA mapping using the
saved length, but it no longer advances the transmit fifo.
Fixes: 2aaa43c70778 ("tty: serial: qcom-geni-serial: add support for serial engine DMA")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Link: https://patch.msgid.link/20260708131726.768692-1-lgs201920130244@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/qcom_geni_serial.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c
index 6e5b31ebd5d64..0cccc26e932b2 100644
--- a/drivers/tty/serial/qcom_geni_serial.c
+++ b/drivers/tty/serial/qcom_geni_serial.c
@@ -132,6 +132,7 @@ struct qcom_geni_serial_port {
unsigned int tx_remaining;
unsigned int tx_queued;
+ bool tx_dma_stale;
int wakeup_irq;
bool rx_tx_swap;
bool cts_rts_swap;
@@ -659,6 +660,7 @@ static void qcom_geni_serial_start_tx_dma(struct uart_port *uport)
}
port->tx_remaining = xmit_size;
+ port->tx_dma_stale = false;
}
static void qcom_geni_serial_start_tx_fifo(struct uart_port *uport)
@@ -991,6 +993,7 @@ static void qcom_geni_serial_handle_tx_dma(struct uart_port *uport)
struct qcom_geni_serial_port *port = to_dev_port(uport);
struct tty_port *tport = &uport->state->port;
unsigned int fifo_len = kfifo_len(&tport->xmit_fifo);
+ bool tx_dma_stale = port->tx_dma_stale;
/*
* Only advance the kfifo if it still contains the bytes that were
@@ -1001,12 +1004,13 @@ static void qcom_geni_serial_handle_tx_dma(struct uart_port *uport)
* kfifo->in, making kfifo_len() wrap to UART_XMIT_SIZE - tx_remaining
* and triggering a spurious large DMA transfer of stale data.
*/
- if (fifo_len >= port->tx_remaining)
+ if (!tx_dma_stale && fifo_len >= port->tx_remaining)
uart_xmit_advance(uport, port->tx_remaining);
geni_se_tx_dma_unprep(&port->se, port->tx_dma_addr, port->tx_remaining);
port->tx_dma_addr = 0;
port->tx_remaining = 0;
+ port->tx_dma_stale = false;
if (!kfifo_is_empty(&tport->xmit_fifo))
qcom_geni_serial_start_tx_dma(uport);
@@ -1142,6 +1146,10 @@ static void qcom_geni_serial_shutdown(struct uart_port *uport)
static void qcom_geni_serial_flush_buffer_fifo(struct uart_port *uport)
{
+ struct qcom_geni_serial_port *port = to_dev_port(uport);
+
+ if (port->tx_dma_addr)
+ port->tx_dma_stale = true;
qcom_geni_serial_cancel_tx_cmd(uport);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0484/1376] usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (482 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0483/1376] serial: qcom-geni: do not advance stale DMA completions Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0485/1376] usb: gadget: configfs: fix out-of-bounds read of qw_sign Greg Kroah-Hartman
` (514 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nuno Sá, Paul Cercueil,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nuno Sá <nuno.sa@analog.com>
[ Upstream commit 621707dc67c9846fd876d7579ec951d92aa033f1 ]
The error paths for endpoint-disabled (ESHUTDOWN) and request-allocation
failure (ENOMEM) in ffs_dmabuf_transfer() jump to err_fence_put which
calls dma_fence_put() on the fence. However, at that point the fence has
only been kmalloc'd — dma_fence_init() has not been called yet, so the
refcount and the fence ops are uninitialized. Calling dma_fence_put() on
such an object leads to undefined behavior.
Use kfree() instead, since the fence is just a plain allocation at this
stage, and rename the label to err_fence_free to reflect the actual
cleanup action.
Fixes: 7b07a2a7ca02 ("usb: gadget: functionfs: Add DMABUF import interface")
Signed-off-by: Nuno Sá <nuno.sa@analog.com>
Reviewed-by: Paul Cercueil <paul@crapouillou.net>
Link: https://patch.msgid.link/20260612-fix-f_fs-fence-cleanup-v1-1-79f489b0efe9@analog.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/function/f_fs.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index cbed66a528269..24bfde82c385b 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1678,13 +1678,13 @@ static int ffs_dmabuf_transfer(struct file *file,
/* In the meantime, endpoint got disabled or changed. */
if (epfile->ep != ep) {
ret = -ESHUTDOWN;
- goto err_fence_put;
+ goto err_fence_free;
}
usb_req = usb_ep_alloc_request(ep->ep, GFP_ATOMIC);
if (!usb_req) {
ret = -ENOMEM;
- goto err_fence_put;
+ goto err_fence_free;
}
/*
@@ -1733,9 +1733,9 @@ static int ffs_dmabuf_transfer(struct file *file,
return ret;
-err_fence_put:
+err_fence_free:
spin_unlock_irq(&epfile->ffs->eps_lock);
- dma_fence_put(&fence->base);
+ kfree(fence);
err_resv_unlock:
dma_resv_unlock(dmabuf->resv);
err_attachment_put:
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0485/1376] usb: gadget: configfs: fix out-of-bounds read of qw_sign
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (483 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0484/1376] usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0486/1376] usb: ljca: bound bank_num in ljca_enumerate_gpio() Greg Kroah-Hartman
` (513 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Bommarito, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
[ Upstream commit f63edb54d8f738f9c21e2068c777ae1c097df6b7 ]
os_desc_qw_sign_show() passes OS_STRING_QW_SIGN_LEN as the input
length to utf16s_to_utf8s(), but that argument counts UTF-16 code
units while OS_STRING_QW_SIGN_LEN (14) is the byte size of qw_sign[].
The array holds only OS_STRING_QW_SIGN_LEN / 2 (7) code units, so the
conversion reads up to 7 units (14 bytes) past the end of qw_sign[]
into the following members of struct gadget_info when the stored
signature fills the array without a NUL terminator, exposing those
bytes through the configfs attribute.
The store path halves the count for its input bound but passes the
full byte count as the utf8s_to_utf16s() output limit; use the
destination code-unit count in both directions.
Fixes: 76180d716f91 ("usb: gadget: configfs: make qw_sign attribute symmetric")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Link: https://patch.msgid.link/20260618005043.1581707-1-michael.bommarito@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/configfs.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 82282373c786b..6b3713066ac65 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -1177,7 +1177,7 @@ static ssize_t os_desc_qw_sign_show(struct config_item *item, char *page)
struct gadget_info *gi = os_desc_item_to_gadget_info(item);
int res;
- res = utf16s_to_utf8s((wchar_t *) gi->qw_sign, OS_STRING_QW_SIGN_LEN,
+ res = utf16s_to_utf8s((wchar_t *) gi->qw_sign, OS_STRING_QW_SIGN_LEN / 2,
UTF16_LITTLE_ENDIAN, page, PAGE_SIZE - 1);
page[res++] = '\n';
@@ -1199,7 +1199,7 @@ static ssize_t os_desc_qw_sign_store(struct config_item *item, const char *page,
mutex_lock(&gi->lock);
res = utf8s_to_utf16s(page, l,
UTF16_LITTLE_ENDIAN, (wchar_t *) gi->qw_sign,
- OS_STRING_QW_SIGN_LEN);
+ OS_STRING_QW_SIGN_LEN / 2);
if (res > 0)
res = len;
mutex_unlock(&gi->lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0486/1376] usb: ljca: bound bank_num in ljca_enumerate_gpio()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (484 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0485/1376] usb: gadget: configfs: fix out-of-bounds read of qw_sign Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0487/1376] usb: gadget: aspeed_udc: check endpoint DMA allocation Greg Kroah-Hartman
` (512 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Maoyi Xie, Sakari Ailus, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <maoyixie.tju@gmail.com>
[ Upstream commit dd9483726d0f16c1a56879c3edb65128259a4e2b ]
ljca_enumerate_gpio() reads desc->bank_num from the device and loops
valid_pin[i] = get_unaligned_le32(...) for i < bank_num. valid_pin[]
holds only LJCA_MAX_GPIO_NUM / 32 = 2 entries.
Two checks run before the loop. The reply length must match
struct_size(desc, bank_desc, bank_num). The product
pins_per_bank * bank_num must not exceed LJCA_MAX_GPIO_NUM. Neither one
bounds bank_num against the size of valid_pin[]. The reply is capped at
LJCA_MAX_PAYLOAD_SIZE (60) bytes, so the struct_size check limits
bank_num to 9. A device that reports bank_num 9 with pins_per_bank 7
still passes both checks. gpio_num is 63 and the reply is 56 bytes. The
loop then writes nine u32 into the two entry array and overruns
valid_pin[] on the stack.
A broken or malicious LJCA device can therefore overflow the stack.
Reject a bank_num that does not fit valid_pin[].
Fixes: acd6199f195d ("usb: Add support for Intel LJCA device")
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Link: https://patch.msgid.link/178176358875.3352358.6059116660356914900@maoyixie.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/misc/usb-ljca.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/misc/usb-ljca.c b/drivers/usb/misc/usb-ljca.c
index d9c21f7830557..e6e3888451fa2 100644
--- a/drivers/usb/misc/usb-ljca.c
+++ b/drivers/usb/misc/usb-ljca.c
@@ -585,6 +585,9 @@ static int ljca_enumerate_gpio(struct ljca_adapter *adap)
if (gpio_num > LJCA_MAX_GPIO_NUM)
return -EINVAL;
+ if (desc->bank_num > ARRAY_SIZE(valid_pin))
+ return -EINVAL;
+
/* construct platform data */
gpio_info = kzalloc(sizeof *gpio_info, GFP_KERNEL);
if (!gpio_info)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0487/1376] usb: gadget: aspeed_udc: check endpoint DMA allocation
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (485 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0486/1376] usb: ljca: bound bank_num in ljca_enumerate_gpio() Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0488/1376] USB: make single lock for all usb dynamic id lists Greg Kroah-Hartman
` (511 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ruoyu Wang, Andrew Jeffery,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <ruoyuw560@gmail.com>
[ Upstream commit 97cee53a94be3bd4fd8fbed6071bd2f32dad1ab1 ]
ast_udc_probe() allocates a coherent DMA buffer used as the backing store
for endpoint buffers. ast_udc_init_ep() derives per-endpoint buffer
pointers from udc->ep0_buf, so a failed allocation is dereferenced during
probe.
Check the allocation before endpoint setup. The existing probe error path
called ast_udc_remove(), which unregisters the gadget unconditionally and
is not safe before usb_add_gadget_udc() succeeds. Add a local cleanup
helper for probe failures so pre-registration failures only unwind the
resources that were actually initialized.
This was found by a local static analysis checker for unchecked allocator
returns while scanning Linux 6.16. The change was checked by applying it
to current mainline and by running checkpatch. I do not have access to
Aspeed UDC hardware, so no runtime testing was performed.
Fixes: 055276c13205 ("usb: gadget: add Aspeed ast2600 udc driver")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Reviewed-by: Andrew Jeffery <andrew@codeconstruct.com.au>
Link: https://patch.msgid.link/20260610121022.3-1-ruoyuw560@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/udc/aspeed_udc.c | 50 ++++++++++++++++++-----------
1 file changed, 32 insertions(+), 18 deletions(-)
diff --git a/drivers/usb/gadget/udc/aspeed_udc.c b/drivers/usb/gadget/udc/aspeed_udc.c
index f4781e611aaa2..efcceb886bb40 100644
--- a/drivers/usb/gadget/udc/aspeed_udc.c
+++ b/drivers/usb/gadget/udc/aspeed_udc.c
@@ -1434,25 +1434,12 @@ static void ast_udc_init_hw(struct ast_udc_dev *udc)
ast_udc_write(udc, 0, AST_UDC_EP0_CTRL);
}
-static void ast_udc_remove(struct platform_device *pdev)
+static void ast_udc_cleanup(struct platform_device *pdev)
{
struct ast_udc_dev *udc = platform_get_drvdata(pdev);
unsigned long flags;
u32 ctrl;
- usb_del_gadget_udc(&udc->gadget);
- if (udc->driver) {
- /*
- * This is broken as only some cleanup is skipped, *udev is
- * freed and the register mapping goes away. Any further usage
- * probably crashes. Also the device is unbound, so the skipped
- * cleanup is never catched up later.
- */
- dev_alert(&pdev->dev,
- "Driver is busy and still going away. Fasten your seat belts!\n");
- return;
- }
-
spin_lock_irqsave(&udc->lock, flags);
/* Disable upstream port connection */
@@ -1472,6 +1459,26 @@ static void ast_udc_remove(struct platform_device *pdev)
udc->ep0_buf = NULL;
}
+static void ast_udc_remove(struct platform_device *pdev)
+{
+ struct ast_udc_dev *udc = platform_get_drvdata(pdev);
+
+ usb_del_gadget_udc(&udc->gadget);
+ if (udc->driver) {
+ /*
+ * This is broken as only some cleanup is skipped, *udev is
+ * freed and the register mapping goes away. Any further usage
+ * probably crashes. Also the device is unbound, so the skipped
+ * cleanup is never catched up later.
+ */
+ dev_alert(&pdev->dev,
+ "Driver is busy and still going away. Fasten your seat belts!\n");
+ return;
+ }
+
+ ast_udc_cleanup(pdev);
+}
+
static int ast_udc_probe(struct platform_device *pdev)
{
enum usb_device_speed max_speed;
@@ -1524,6 +1531,12 @@ static int ast_udc_probe(struct platform_device *pdev)
AST_UDC_NUM_ENDPOINTS,
&udc->ep0_buf_dma, GFP_KERNEL);
+ if (!udc->ep0_buf) {
+ clk_disable_unprepare(udc->clk);
+ rc = -ENOMEM;
+ goto err;
+ }
+
udc->gadget.speed = USB_SPEED_UNKNOWN;
udc->gadget.max_speed = USB_SPEED_HIGH;
udc->creq = udc->reg + AST_UDC_SETUP0;
@@ -1553,20 +1566,20 @@ static int ast_udc_probe(struct platform_device *pdev)
udc->irq = platform_get_irq(pdev, 0);
if (udc->irq < 0) {
rc = udc->irq;
- goto err;
+ goto err_cleanup;
}
rc = devm_request_irq(&pdev->dev, udc->irq, ast_udc_isr, 0,
KBUILD_MODNAME, udc);
if (rc) {
dev_err(&pdev->dev, "Failed to request interrupt\n");
- goto err;
+ goto err_cleanup;
}
rc = usb_add_gadget_udc(&pdev->dev, &udc->gadget);
if (rc) {
dev_err(&pdev->dev, "Failed to add gadget udc\n");
- goto err;
+ goto err_cleanup;
}
dev_info(&pdev->dev, "Initialized udc in USB%s mode\n",
@@ -1574,9 +1587,10 @@ static int ast_udc_probe(struct platform_device *pdev)
return 0;
+err_cleanup:
+ ast_udc_cleanup(pdev);
err:
dev_err(&pdev->dev, "Failed to udc probe, rc:0x%x\n", rc);
- ast_udc_remove(pdev);
return rc;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0488/1376] USB: make single lock for all usb dynamic id lists
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (486 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0487/1376] usb: gadget: aspeed_udc: check endpoint DMA allocation Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0489/1376] USB: make to_usb_driver() use container_of_const() Greg Kroah-Hartman
` (510 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johan Hovold, Herve Codina,
Rob Herring, Alan Stern, Grant Grundler, Oliver Neukum,
Yajun Deng, Douglas Anderson, linux-usb, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit 0b3144da31f855fce652303f588416a60991bdef ]
There are a number of places where we accidentally pass in a constant
structure to later cast it off to a dynamic one, and then attempt to
grab a lock on it, which is not a good idea. To help resolve this, move
the dynamic id lock out of the dynamic id structure for the driver and
into one single lock for all USB dynamic ids. As this lock should never
have any real contention (it's only every accessed when a device is
added or removed, which is always serialized) there should not be any
difference except for some memory savings.
Note, this just converts the existing use of the dynamic id lock to the
new static lock, there is one place that is accessing the dynamic id
list without grabbing the lock, that will be fixed up in a follow-on
change.
Cc: Johan Hovold <johan@kernel.org>
Cc: Herve Codina <herve.codina@bootlin.com>
Cc: Rob Herring <robh@kernel.org>
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: Grant Grundler <grundler@chromium.org>
Cc: Oliver Neukum <oneukum@suse.com>
Cc: Yajun Deng <yajun.deng@linux.dev>
Cc: Douglas Anderson <dianders@chromium.org>
Cc: linux-usb@vger.kernel.org
Link: https://lore.kernel.org/r/2024111322-kindly-finalist-d247@gregkh
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: ef8154d8b52d ("usb: fix UAF when probe runs concurrent to dyn ID removal")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/common/common.c | 3 +++
drivers/usb/core/driver.c | 15 +++++----------
drivers/usb/serial/bus.c | 4 +---
drivers/usb/serial/usb-serial.c | 4 +---
include/linux/usb.h | 2 +-
5 files changed, 11 insertions(+), 17 deletions(-)
diff --git a/drivers/usb/common/common.c b/drivers/usb/common/common.c
index b7bea1015d7c1..871cf199b6bf1 100644
--- a/drivers/usb/common/common.c
+++ b/drivers/usb/common/common.c
@@ -415,6 +415,9 @@ EXPORT_SYMBOL_GPL(usb_of_get_companion_dev);
struct dentry *usb_debug_root;
EXPORT_SYMBOL_GPL(usb_debug_root);
+DEFINE_MUTEX(usb_dynids_lock);
+EXPORT_SYMBOL_GPL(usb_dynids_lock);
+
static int __init usb_common_init(void)
{
usb_debug_root = debugfs_create_dir("usb", NULL);
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index 0c3f12daac79e..bc3c00580238d 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -95,9 +95,9 @@ ssize_t usb_store_new_id(struct usb_dynids *dynids,
}
}
- spin_lock(&dynids->lock);
+ mutex_lock(&usb_dynids_lock);
list_add_tail(&dynid->node, &dynids->list);
- spin_unlock(&dynids->lock);
+ mutex_unlock(&usb_dynids_lock);
retval = driver_attach(driver);
@@ -160,7 +160,7 @@ static ssize_t remove_id_store(struct device_driver *driver, const char *buf,
if (fields < 2)
return -EINVAL;
- spin_lock(&usb_driver->dynids.lock);
+ guard(mutex)(&usb_dynids_lock);
list_for_each_entry_safe(dynid, n, &usb_driver->dynids.list, node) {
struct usb_device_id *id = &dynid->id;
@@ -171,7 +171,6 @@ static ssize_t remove_id_store(struct device_driver *driver, const char *buf,
break;
}
}
- spin_unlock(&usb_driver->dynids.lock);
return count;
}
@@ -220,12 +219,11 @@ static void usb_free_dynids(struct usb_driver *usb_drv)
{
struct usb_dynid *dynid, *n;
- spin_lock(&usb_drv->dynids.lock);
+ guard(mutex)(&usb_dynids_lock);
list_for_each_entry_safe(dynid, n, &usb_drv->dynids.list, node) {
list_del(&dynid->node);
kfree(dynid);
}
- spin_unlock(&usb_drv->dynids.lock);
}
static const struct usb_device_id *usb_match_dynamic_id(struct usb_interface *intf,
@@ -233,14 +231,12 @@ static const struct usb_device_id *usb_match_dynamic_id(struct usb_interface *in
{
struct usb_dynid *dynid;
- spin_lock(&drv->dynids.lock);
+ guard(mutex)(&usb_dynids_lock);
list_for_each_entry(dynid, &drv->dynids.list, node) {
if (usb_match_one_id(intf, &dynid->id)) {
- spin_unlock(&drv->dynids.lock);
return &dynid->id;
}
}
- spin_unlock(&drv->dynids.lock);
return NULL;
}
@@ -1076,7 +1072,6 @@ int usb_register_driver(struct usb_driver *new_driver, struct module *owner,
new_driver->driver.owner = owner;
new_driver->driver.mod_name = mod_name;
new_driver->driver.dev_groups = new_driver->dev_groups;
- spin_lock_init(&new_driver->dynids.lock);
INIT_LIST_HEAD(&new_driver->dynids.list);
retval = driver_register(&new_driver->driver);
diff --git a/drivers/usb/serial/bus.c b/drivers/usb/serial/bus.c
index d200e2c29a8ff..2fea1b1db4a26 100644
--- a/drivers/usb/serial/bus.c
+++ b/drivers/usb/serial/bus.c
@@ -136,12 +136,11 @@ static void free_dynids(struct usb_serial_driver *drv)
{
struct usb_dynid *dynid, *n;
- spin_lock(&drv->dynids.lock);
+ guard(mutex)(&usb_dynids_lock);
list_for_each_entry_safe(dynid, n, &drv->dynids.list, node) {
list_del(&dynid->node);
kfree(dynid);
}
- spin_unlock(&drv->dynids.lock);
}
const struct bus_type usb_serial_bus_type = {
@@ -157,7 +156,6 @@ int usb_serial_bus_register(struct usb_serial_driver *driver)
int retval;
driver->driver.bus = &usb_serial_bus_type;
- spin_lock_init(&driver->dynids.lock);
INIT_LIST_HEAD(&driver->dynids.list);
retval = driver_register(&driver->driver);
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 2ee0b64b8be0a..c78ff40b1e5f8 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -706,14 +706,12 @@ static const struct usb_device_id *match_dynamic_id(struct usb_interface *intf,
{
struct usb_dynid *dynid;
- spin_lock(&drv->dynids.lock);
+ guard(mutex)(&usb_dynids_lock);
list_for_each_entry(dynid, &drv->dynids.list, node) {
if (usb_match_one_id(intf, &dynid->id)) {
- spin_unlock(&drv->dynids.lock);
return &dynid->id;
}
}
- spin_unlock(&drv->dynids.lock);
return NULL;
}
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 049b012638bea..06eb0a62895d3 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -1132,8 +1132,8 @@ static inline int usb_make_path(struct usb_device *dev, char *buf, size_t size)
/* ----------------------------------------------------------------------- */
/* Stuff for dynamic usb ids */
+extern struct mutex usb_dynids_lock;
struct usb_dynids {
- spinlock_t lock;
struct list_head list;
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0489/1376] USB: make to_usb_driver() use container_of_const()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (487 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0488/1376] USB: make single lock for all usb dynamic id lists Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0490/1376] usb: fix UAF when probe runs concurrent to dyn ID removal Greg Kroah-Hartman
` (509 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johan Hovold, Alan Stern,
Grant Grundler, Yajun Deng, Oliver Neukum, Douglas Anderson,
linux-usb, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit 2f3aab7aecb827ba93c6222646eb0faa8228d590 ]
Turns out that we have some const pointers being passed to
to_usb_driver() but were not catching this. Change the macro to
properly propagate the const-ness of the pointer so that we will notice
when we try to write to memory that we shouldn't be writing to.
This requires fixing up the usb_match_dynamic_id() function as well,
because it can handle a const * to struct usb_driver.
Cc: Johan Hovold <johan@kernel.org>
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: Grant Grundler <grundler@chromium.org>
Cc: Yajun Deng <yajun.deng@linux.dev>
Cc: Oliver Neukum <oneukum@suse.com>
Cc: Douglas Anderson <dianders@chromium.org>
Cc: linux-usb@vger.kernel.org
Link: https://lore.kernel.org/r/2024111339-shaky-goldsmith-b233@gregkh
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: ef8154d8b52d ("usb: fix UAF when probe runs concurrent to dyn ID removal")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/core/driver.c | 4 ++--
include/linux/usb.h | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index bc3c00580238d..f0f13554709e0 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -227,7 +227,7 @@ static void usb_free_dynids(struct usb_driver *usb_drv)
}
static const struct usb_device_id *usb_match_dynamic_id(struct usb_interface *intf,
- struct usb_driver *drv)
+ const struct usb_driver *drv)
{
struct usb_dynid *dynid;
@@ -889,7 +889,7 @@ static int usb_device_match(struct device *dev, const struct device_driver *drv)
} else if (is_usb_interface(dev)) {
struct usb_interface *intf;
- struct usb_driver *usb_drv;
+ const struct usb_driver *usb_drv;
const struct usb_device_id *id;
/* device drivers never match interfaces */
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 06eb0a62895d3..2004a2db81ced 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -1246,7 +1246,7 @@ struct usb_driver {
unsigned int disable_hub_initiated_lpm:1;
unsigned int soft_unbind:1;
};
-#define to_usb_driver(d) container_of(d, struct usb_driver, driver)
+#define to_usb_driver(d) container_of_const(d, struct usb_driver, driver)
/**
* struct usb_device_driver - identifies USB device driver to usbcore
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0490/1376] usb: fix UAF when probe runs concurrent to dyn ID removal
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (488 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0489/1376] USB: make to_usb_driver() use container_of_const() Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0491/1376] platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL Greg Kroah-Hartman
` (508 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gary Guo, Danilo Krummrich,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gary Guo <gary@garyguo.net>
[ Upstream commit ef8154d8b52d60338c1fd8d793cd8e891c604c14 ]
Dynamic IDs are only guaranteed to be valid when usb_dynids_lock is held,
as remove_id_store can free the node. Thus, make a copy in
usb_probe_interface. Clarify the documentation that the id parameter is
only valid during the probe.
USB serial has the same pattern, but it does not need fixing as the IDs
cannot be removed via sysfs.
Fixes: 0c7a2b72746a ("USB: add remove_id sysfs attr for usb drivers")
Signed-off-by: Gary Guo <gary@garyguo.net>
Reviewed-by: Danilo Krummrich <dakr@kernel.org>
Link: https://patch.msgid.link/20260707-usb_dyn_id_uaf-v2-7-632dcf3adfba@garyguo.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/core/driver.c | 12 ++++++++----
include/linux/usb.h | 3 ++-
2 files changed, 10 insertions(+), 5 deletions(-)
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index f0f13554709e0..528274e3cd7ad 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -227,14 +227,16 @@ static void usb_free_dynids(struct usb_driver *usb_drv)
}
static const struct usb_device_id *usb_match_dynamic_id(struct usb_interface *intf,
- const struct usb_driver *drv)
+ const struct usb_driver *drv,
+ struct usb_device_id *id_copy)
{
struct usb_dynid *dynid;
guard(mutex)(&usb_dynids_lock);
list_for_each_entry(dynid, &drv->dynids.list, node) {
if (usb_match_one_id(intf, &dynid->id)) {
- return &dynid->id;
+ *id_copy = dynid->id;
+ return id_copy;
}
}
return NULL;
@@ -320,6 +322,7 @@ static int usb_probe_interface(struct device *dev)
struct usb_interface *intf = to_usb_interface(dev);
struct usb_device *udev = interface_to_usbdev(intf);
const struct usb_device_id *id;
+ struct usb_device_id id_copy;
int error = -ENODEV;
int lpm_disable_error = -ENODEV;
@@ -339,7 +342,7 @@ static int usb_probe_interface(struct device *dev)
return error;
}
- id = usb_match_dynamic_id(intf, driver);
+ id = usb_match_dynamic_id(intf, driver, &id_copy);
if (!id)
id = usb_match_id(intf, driver->id_table);
if (!id)
@@ -891,6 +894,7 @@ static int usb_device_match(struct device *dev, const struct device_driver *drv)
struct usb_interface *intf;
const struct usb_driver *usb_drv;
const struct usb_device_id *id;
+ struct usb_device_id id_copy;
/* device drivers never match interfaces */
if (is_usb_device_driver(drv))
@@ -903,7 +907,7 @@ static int usb_device_match(struct device *dev, const struct device_driver *drv)
if (id)
return 1;
- id = usb_match_dynamic_id(intf, usb_drv);
+ id = usb_match_dynamic_id(intf, usb_drv, &id_copy);
if (id)
return 1;
}
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 2004a2db81ced..0012259ac910c 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -1159,7 +1159,8 @@ extern ssize_t usb_show_dynids(struct usb_dynids *dynids, char *buf);
* interface. It may also use usb_set_interface() to specify the
* appropriate altsetting. If unwilling to manage the interface,
* return -ENODEV, if genuine IO errors occurred, an appropriate
- * negative errno value.
+ * negative errno value. The usb_device_id parameter is only valid during
+ * probe.
* @disconnect: Called when the interface is no longer accessible, usually
* because its device has been (or is being) disconnected or the
* driver module is being unloaded.
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0491/1376] platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (489 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0490/1376] usb: fix UAF when probe runs concurrent to dyn ID removal Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0492/1376] platform/surface: acpi-notify: Check ACPI companion before use Greg Kroah-Hartman
` (507 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linmao Li, Ilpo Järvinen,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linmao Li <lilinmao@kylinos.cn>
[ Upstream commit c38cce70adef874c2a7b5132c14d6c221401deff ]
Every platform driver can be forced to match a device that doesn't match
its list of device IDs because of device_match_driver_override(), so
platform drivers that rely on the existence of a device's ACPI companion
object need to verify its presence.
mlxbf_pmc_probe() passes the result of ACPI_COMPANION() to
acpi_device_hid(), which dereferences it, so force-binding the driver to
a device without an ACPI companion leads to a NULL pointer dereference.
Accordingly, add a requisite ACPI_COMPANION() check against NULL to the
mlxbf-pmc driver and return -ENODEV when the companion is missing.
Fixes: 1a218d312e65 ("platform/mellanox: mlxbf-pmc: Add Mellanox BlueField PMC driver")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Link: https://patch.msgid.link/20260706012056.524096-1-lilinmao@kylinos.cn
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/mellanox/mlxbf-pmc.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/platform/mellanox/mlxbf-pmc.c b/drivers/platform/mellanox/mlxbf-pmc.c
index 67d9b19731edf..fcc8d9eaf37c1 100644
--- a/drivers/platform/mellanox/mlxbf-pmc.c
+++ b/drivers/platform/mellanox/mlxbf-pmc.c
@@ -2021,13 +2021,19 @@ static int mlxbf_pmc_map_counters(struct device *dev)
static int mlxbf_pmc_probe(struct platform_device *pdev)
{
- struct acpi_device *acpi_dev = ACPI_COMPANION(&pdev->dev);
- const char *hid = acpi_device_hid(acpi_dev);
struct device *dev = &pdev->dev;
+ struct acpi_device *acpi_dev;
struct arm_smccc_res res;
+ const char *hid;
guid_t guid;
int ret;
+ acpi_dev = ACPI_COMPANION(&pdev->dev);
+ if (!acpi_dev)
+ return -ENODEV;
+
+ hid = acpi_device_hid(acpi_dev);
+
/* Ensure we have the UUID we expect for this service. */
arm_smccc_smc(MLXBF_PMC_SIP_SVC_UID, 0, 0, 0, 0, 0, 0, 0, &res);
guid_parse(mlxbf_pmc_svc_uuid_str, &guid);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0492/1376] platform/surface: acpi-notify: Check ACPI companion before use
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (490 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0491/1376] platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0493/1376] usb: mtu3: allow system suspend during active gadget connection Greg Kroah-Hartman
` (506 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linmao Li, Ilpo Järvinen,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linmao Li <lilinmao@kylinos.cn>
[ Upstream commit 2b3a5dabe89e330413af403246b648c1890f368f ]
Since every platform driver can be forced to match a device that doesn't
match its list of device IDs because of device_match_driver_override(),
platform drivers that rely on the existence of a device's ACPI companion
object should verify its presence.
san_probe() dereferences the result of ACPI_COMPANION() when installing
the GSBUS address space handler, so force-binding the driver to a device
without an ACPI companion leads to a NULL pointer dereference. The
dereference was introduced when the probe function was switched from
ACPI_HANDLE() to ACPI_COMPANION().
Check the ACPI companion against NULL and return -ENODEV when it is
missing, like commit e4865a56d013 ("ACPI: driver: Check ACPI_COMPANION()
against NULL during probe") does for the core ACPI platform drivers.
Fixes: a9e10e587304 ("ACPI: scan: Extend acpi_walk_dep_device_list()")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Link: https://patch.msgid.link/20260706012512.524359-2-lilinmao@kylinos.cn
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/surface/surface_acpi_notify.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/platform/surface/surface_acpi_notify.c b/drivers/platform/surface/surface_acpi_notify.c
index 14a9d8a267cbb..7651075572d6e 100644
--- a/drivers/platform/surface/surface_acpi_notify.c
+++ b/drivers/platform/surface/surface_acpi_notify.c
@@ -777,12 +777,16 @@ static int san_consumer_links_setup(struct platform_device *pdev)
static int san_probe(struct platform_device *pdev)
{
- struct acpi_device *san = ACPI_COMPANION(&pdev->dev);
struct ssam_controller *ctrl;
+ struct acpi_device *san;
struct san_data *data;
acpi_status astatus;
int status;
+ san = ACPI_COMPANION(&pdev->dev);
+ if (!san)
+ return -ENODEV;
+
ctrl = ssam_client_bind(&pdev->dev);
if (IS_ERR(ctrl))
return PTR_ERR(ctrl) == -ENODEV ? -EPROBE_DEFER : PTR_ERR(ctrl);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0493/1376] usb: mtu3: allow system suspend during active gadget connection
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (491 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0492/1376] platform/surface: acpi-notify: Check ACPI companion before use Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0494/1376] usb: renesas_usbhs: Fix power-off ordering on unbind Greg Kroah-Hartman
` (505 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fei Shao, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fei Shao <fshao@chromium.org>
[ Upstream commit e69027c25361b6044c7928715667586cc5469063 ]
When operating in gadget mode connected to a USB host, system suspend
fails with -EBUSY because active peripheral connections block suspend
entry.
Fix this by restricting the -EBUSY check to runtime autosuspend
(PMSG_IS_AUTO). For system suspend (!PMSG_IS_AUTO), perform soft
disconnect to disconnect from the bus and allow MAC sleep.
Fixes: 427c66422e14 ("usb: mtu3: support suspend/resume for device mode")
Signed-off-by: Fei Shao <fshao@chromium.org>
Link: https://patch.msgid.link/20260626082218.2750459-2-fshao@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/mtu3/mtu3_core.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/mtu3/mtu3_core.c b/drivers/usb/mtu3/mtu3_core.c
index a3a6282893d09..ca8cb6c3a01bf 100644
--- a/drivers/usb/mtu3/mtu3_core.c
+++ b/drivers/usb/mtu3/mtu3_core.c
@@ -1037,9 +1037,14 @@ int ssusb_gadget_suspend(struct ssusb_mtk *ssusb, pm_message_t msg)
if (!mtu->gadget_driver)
return 0;
- if (mtu->connected)
+ /* Prevent runtime suspend when active connection exists */
+ if (mtu->connected && PMSG_IS_AUTO(msg))
return -EBUSY;
+ /* Perform soft disconnect for system suspend */
+ if (mtu->softconnect && !PMSG_IS_AUTO(msg))
+ mtu3_dev_on_off(mtu, 0);
+
mtu3_dev_suspend(mtu);
synchronize_irq(mtu->irq);
@@ -1055,5 +1060,9 @@ int ssusb_gadget_resume(struct ssusb_mtk *ssusb, pm_message_t msg)
mtu3_dev_resume(mtu);
+ /* Restore soft connect for system resume */
+ if (mtu->softconnect && !PMSG_IS_AUTO(msg))
+ mtu3_dev_on_off(mtu, 1);
+
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0494/1376] usb: renesas_usbhs: Fix power-off ordering on unbind
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (492 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0493/1376] usb: mtu3: allow system suspend during active gadget connection Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0495/1376] drm/panel: samsung-s6d16d0: Power off on prepare failure Greg Kroah-Hartman
` (504 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Biju Das, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <biju.das.jz@bp.renesas.com>
[ Upstream commit 589b9e6f96be6bd8dd0d45fda8e948c31dc2fe94 ]
Move the usbhsc_power_ctrl() call to before hardware_exit() and
reset_control_assert() in usbhs_remove(), so the PHY is powered off
while priv->phy is still valid, rather than after hardware_exit()
has already cleared it.
Fixes: eb9ac779830b ("usb: renesas_usbhs: Fix synchronous external abort on unbind")
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Link: https://patch.msgid.link/20260702073832.175047-1-biju.das.jz@bp.renesas.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/renesas_usbhs/common.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/renesas_usbhs/common.c b/drivers/usb/renesas_usbhs/common.c
index ef9c3bd950ca4..75600dc6703d2 100644
--- a/drivers/usb/renesas_usbhs/common.c
+++ b/drivers/usb/renesas_usbhs/common.c
@@ -809,9 +809,6 @@ static void usbhs_remove(struct platform_device *pdev)
flush_delayed_work(&priv->notify_hotplug_work);
- usbhs_platform_call(priv, hardware_exit, pdev);
- reset_control_assert(priv->rsts);
-
/*
* Explicitly free the IRQ to ensure the interrupt handler is
* disabled and synchronized before freeing resources.
@@ -828,6 +825,9 @@ static void usbhs_remove(struct platform_device *pdev)
if (!usbhs_get_dparam(priv, runtime_pwctrl))
usbhsc_power_ctrl(priv, 0);
+ usbhs_platform_call(priv, hardware_exit, pdev);
+ reset_control_assert(priv->rsts);
+
usbhsc_clk_put(priv);
pm_runtime_disable(&pdev->dev);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0495/1376] drm/panel: samsung-s6d16d0: Power off on prepare failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (493 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0494/1376] usb: renesas_usbhs: Fix power-off ordering on unbind Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0496/1376] perf metricgroup: Fix metric expression copy leaks Greg Kroah-Hartman
` (503 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Laxman Acharya Padhya, Linus Walleij,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
[ Upstream commit a9f950adfe2147318d75e7a6eab5e814851802ac ]
If enabling tearing mode or exiting sleep mode fails after the
regulator is enabled, s6d16d0_prepare() returns without asserting
reset or disabling the supply. Since the DRM panel core leaves the
panel unprepared, a later unprepare call skips the driver callback
and the supply remains enabled.
Assert reset and disable the supply before returning the DSI command error.
Fixes: ac1d6d74884e ("drm/panel: Add driver for Samsung S6D16D0 panel")
Assisted-by: Codex:gpt-5
Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260704070648.35249-1-acharyalaxman8848@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panel/panel-samsung-s6d16d0.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/panel/panel-samsung-s6d16d0.c b/drivers/gpu/drm/panel/panel-samsung-s6d16d0.c
index 79f611963c618..f73b603be0b0b 100644
--- a/drivers/gpu/drm/panel/panel-samsung-s6d16d0.c
+++ b/drivers/gpu/drm/panel/panel-samsung-s6d16d0.c
@@ -89,16 +89,22 @@ static int s6d16d0_prepare(struct drm_panel *panel)
MIPI_DSI_DCS_TEAR_MODE_VBLANK);
if (ret) {
dev_err(s6->dev, "failed to enable vblank TE (%d)\n", ret);
- return ret;
+ goto err_power_off;
}
/* Exit sleep mode and power on */
ret = mipi_dsi_dcs_exit_sleep_mode(dsi);
if (ret) {
dev_err(s6->dev, "failed to exit sleep mode (%d)\n", ret);
- return ret;
+ goto err_power_off;
}
return 0;
+
+err_power_off:
+ gpiod_set_value_cansleep(s6->reset_gpio, 1);
+ regulator_disable(s6->supply);
+
+ return ret;
}
static int s6d16d0_enable(struct drm_panel *panel)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0496/1376] perf metricgroup: Fix metric expression copy leaks
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (494 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0495/1376] drm/panel: samsung-s6d16d0: Power off on prepare failure Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0497/1376] soc: qcom: rpmh-rsc: manage PM notifiers with devres Greg Kroah-Hartman
` (502 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yu Peng, Namhyung Kim, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Peng <pengyu@kylinos.cn>
[ Upstream commit ef3af1df4f3372bd8ad47619452a283048b3bc8d ]
metricgroup__copy_metric_events() allocates a new metric expression and
duplicates metric_name before linking the expression into the destination
metric event.
Free new_expr when strdup() fails, and free the duplicated metric_name on
the later error paths.
Fixes: b85a4d61d302 ("perf metric: Allow modifiers on metrics")
Signed-off-by: Yu Peng <pengyu@kylinos.cn>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/metricgroup.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/tools/perf/util/metricgroup.c b/tools/perf/util/metricgroup.c
index 4dff3e925a47b..6d6bfcebb97a8 100644
--- a/tools/perf/util/metricgroup.c
+++ b/tools/perf/util/metricgroup.c
@@ -1814,8 +1814,10 @@ int metricgroup__copy_metric_events(struct evlist *evlist, struct cgroup *cgrp,
new_expr->metric_expr = old_expr->metric_expr;
new_expr->metric_threshold = old_expr->metric_threshold;
new_expr->metric_name = strdup(old_expr->metric_name);
- if (!new_expr->metric_name)
+ if (!new_expr->metric_name) {
+ free(new_expr);
return -ENOMEM;
+ }
new_expr->metric_unit = old_expr->metric_unit;
new_expr->runtime = old_expr->runtime;
@@ -1827,6 +1829,7 @@ int metricgroup__copy_metric_events(struct evlist *evlist, struct cgroup *cgrp,
alloc_size = sizeof(*new_expr->metric_refs);
new_expr->metric_refs = calloc(nr + 1, alloc_size);
if (!new_expr->metric_refs) {
+ zfree(&new_expr->metric_name);
free(new_expr);
return -ENOMEM;
}
@@ -1843,6 +1846,7 @@ int metricgroup__copy_metric_events(struct evlist *evlist, struct cgroup *cgrp,
alloc_size = sizeof(*new_expr->metric_events);
new_expr->metric_events = calloc(nr + 1, alloc_size);
if (!new_expr->metric_events) {
+ zfree(&new_expr->metric_name);
zfree(&new_expr->metric_refs);
free(new_expr);
return -ENOMEM;
@@ -1853,6 +1857,7 @@ int metricgroup__copy_metric_events(struct evlist *evlist, struct cgroup *cgrp,
evsel = old_expr->metric_events[idx];
evsel = evlist__find_evsel(evlist, evsel->core.idx);
if (evsel == NULL) {
+ zfree(&new_expr->metric_name);
zfree(&new_expr->metric_events);
zfree(&new_expr->metric_refs);
free(new_expr);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0497/1376] soc: qcom: rpmh-rsc: manage PM notifiers with devres
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (495 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0496/1376] perf metricgroup: Fix metric expression copy leaks Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0498/1376] bus: qcom-ebi2: use managed resources for clocks and children Greg Kroah-Hartman
` (501 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ Upstream commit 75e918aa876440d8ad559a11d6ab87bddb1ed79a ]
rpmh_rsc_probe() registers CPU PM or genpd notifiers before populating
child devices. If child population fails, the CPU PM notifier path is not
unwound and the genpd path needs open-coded cleanup.
Use devm_pm_runtime_enable() for the genpd path and
devm_add_action_or_reset() for both notifier registrations. This makes
probe failure and driver detach use the same cleanup model while keeping
devm_of_platform_populate() responsible for child devices.
Fixes: 25092e6100ac ("soc: qcom: rpmh-rsc: Attach RSC to cluster PM domain")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260623015501.31129-1-pengpeng@iscas.ac.cn
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/qcom/rpmh-rsc.c | 37 ++++++++++++++++++++++++++-----------
1 file changed, 26 insertions(+), 11 deletions(-)
diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c
index cc72a31a450e4..1b0b7081c9515 100644
--- a/drivers/soc/qcom/rpmh-rsc.c
+++ b/drivers/soc/qcom/rpmh-rsc.c
@@ -944,17 +944,30 @@ static int rpmh_rsc_pd_callback(struct notifier_block *nfb,
return NOTIFY_OK;
}
+static void rpmh_rsc_pd_detach(void *data)
+{
+ dev_pm_genpd_remove_notifier(data);
+}
+
static int rpmh_rsc_pd_attach(struct rsc_drv *drv, struct device *dev)
{
int ret;
- pm_runtime_enable(dev);
+ ret = devm_pm_runtime_enable(dev);
+ if (ret)
+ return ret;
+
drv->genpd_nb.notifier_call = rpmh_rsc_pd_callback;
ret = dev_pm_genpd_add_notifier(dev, &drv->genpd_nb);
if (ret)
- pm_runtime_disable(dev);
+ return ret;
- return ret;
+ return devm_add_action_or_reset(dev, rpmh_rsc_pd_detach, dev);
+}
+
+static void rpmh_rsc_cpu_pm_unregister(void *data)
+{
+ cpu_pm_unregister_notifier(data);
}
static int rpmh_probe_tcs_config(struct platform_device *pdev, struct rsc_drv *drv)
@@ -1110,7 +1123,15 @@ static int rpmh_rsc_probe(struct platform_device *pdev)
return ret;
} else {
drv->rsc_pm.notifier_call = rpmh_rsc_cpu_pm_callback;
- cpu_pm_register_notifier(&drv->rsc_pm);
+ ret = cpu_pm_register_notifier(&drv->rsc_pm);
+ if (ret)
+ return ret;
+
+ ret = devm_add_action_or_reset(&pdev->dev,
+ rpmh_rsc_cpu_pm_unregister,
+ &drv->rsc_pm);
+ if (ret)
+ return ret;
}
}
@@ -1125,13 +1146,7 @@ static int rpmh_rsc_probe(struct platform_device *pdev)
dev_set_drvdata(&pdev->dev, drv);
drv->dev = &pdev->dev;
- ret = devm_of_platform_populate(&pdev->dev);
- if (ret && pdev->dev.pm_domain) {
- dev_pm_genpd_remove_notifier(&pdev->dev);
- pm_runtime_disable(&pdev->dev);
- }
-
- return ret;
+ return devm_of_platform_populate(&pdev->dev);
}
static const struct of_device_id rpmh_drv_match[] = {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0498/1376] bus: qcom-ebi2: use managed resources for clocks and children
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (496 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0497/1376] soc: qcom: rpmh-rsc: manage PM notifiers with devres Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0499/1376] clk: qcom: camcc-sc8280xp: unregister CAMCC_GDSC_CLK Greg Kroah-Hartman
` (500 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Konrad Dybcio,
Linus Walleij, Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ Upstream commit d19a46f7ed8eb54fea61e0eaf7db53ff7babb03c ]
qcom_ebi2_probe() enables the EBI2 clocks manually and populates child
devices manually. Several later failure paths can then return without
disabling the clocks or without relying on the driver core to undo child
population.
Use devm_clk_get_enabled() for both clocks and
devm_of_platform_populate() for children. This lets the driver core
unwind the resources automatically and removes the hand-written error
labels.
Fixes: 335a12754808 ("bus: qcom: add EBI2 driver")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Link: https://lore.kernel.org/r/20260623015415.26975-1-pengpeng@iscas.ac.cn
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bus/qcom-ebi2.c | 50 +++++++++--------------------------------
1 file changed, 11 insertions(+), 39 deletions(-)
diff --git a/drivers/bus/qcom-ebi2.c b/drivers/bus/qcom-ebi2.c
index ab00c75b9e953..8d2eb955dc921 100644
--- a/drivers/bus/qcom-ebi2.c
+++ b/drivers/bus/qcom-ebi2.c
@@ -302,41 +302,23 @@ static int qcom_ebi2_probe(struct platform_device *pdev)
u32 val;
int ret;
- ebi2xclk = devm_clk_get(dev, "ebi2x");
+ ebi2xclk = devm_clk_get_enabled(dev, "ebi2x");
if (IS_ERR(ebi2xclk))
return PTR_ERR(ebi2xclk);
- ret = clk_prepare_enable(ebi2xclk);
- if (ret) {
- dev_err(dev, "could not enable EBI2X clk (%d)\n", ret);
- return ret;
- }
-
- ebi2clk = devm_clk_get(dev, "ebi2");
- if (IS_ERR(ebi2clk)) {
- ret = PTR_ERR(ebi2clk);
- goto err_disable_2x_clk;
- }
-
- ret = clk_prepare_enable(ebi2clk);
- if (ret) {
- dev_err(dev, "could not enable EBI2 clk\n");
- goto err_disable_2x_clk;
- }
+ ebi2clk = devm_clk_get_enabled(dev, "ebi2");
+ if (IS_ERR(ebi2clk))
+ return PTR_ERR(ebi2clk);
res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
ebi2_base = devm_ioremap_resource(dev, res);
- if (IS_ERR(ebi2_base)) {
- ret = PTR_ERR(ebi2_base);
- goto err_disable_clk;
- }
+ if (IS_ERR(ebi2_base))
+ return PTR_ERR(ebi2_base);
res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
ebi2_xmem = devm_ioremap_resource(dev, res);
- if (IS_ERR(ebi2_xmem)) {
- ret = PTR_ERR(ebi2_xmem);
- goto err_disable_clk;
- }
+ if (IS_ERR(ebi2_xmem))
+ return PTR_ERR(ebi2_xmem);
/* Allegedly this turns the power save mode off */
writel(0UL, ebi2_xmem + EBI2_XMEM_CFG);
@@ -353,7 +335,7 @@ static int qcom_ebi2_probe(struct platform_device *pdev)
/* Figure out the chipselect */
ret = of_property_read_u32(child, "reg", &csindex);
if (ret)
- goto err_disable_clk;
+ return ret;
if (csindex > 5) {
dev_err(dev,
@@ -372,20 +354,10 @@ static int qcom_ebi2_probe(struct platform_device *pdev)
have_children = true;
}
- if (have_children) {
- ret = of_platform_default_populate(np, NULL, dev);
- if (ret)
- goto err_disable_clk;
- }
+ if (have_children)
+ return devm_of_platform_populate(dev);
return 0;
-
-err_disable_clk:
- clk_disable_unprepare(ebi2clk);
-err_disable_2x_clk:
- clk_disable_unprepare(ebi2xclk);
-
- return ret;
}
static const struct of_device_id qcom_ebi2_of_match[] = {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0499/1376] clk: qcom: camcc-sc8280xp: unregister CAMCC_GDSC_CLK
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (497 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0498/1376] bus: qcom-ebi2: use managed resources for clocks and children Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0500/1376] iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE Greg Kroah-Hartman
` (499 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jagadeesh Kona, Brian Masney,
Konrad Dybcio, Dmitry Baryshkov, Bryan ODonoghue, Bjorn Andersson,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Masney <bmasney@redhat.com>
[ Upstream commit 499b4cb6710f9a351d8b57a2132f9b4389d8464a ]
With the introduction of sync_state support in the clk and pmdomain
subsystems, the following warning happens when the unused clocks are
shutdown in camcc-sc8280xp:
[ 15.408367] titan_top_gdsc status stuck at 'on'
[ 15.408429] WARNING: drivers/clk/qcom/gdsc.c:178 at gdsc_toggle_logic+0x14c/0x160, CPU#2: kworker/u32:1/14
[ 15.408462] Modules linked in: bnep vfat fat ath11k_pci(+) ath11k mac80211 cfg80211 mhi libarc4 snd_soc_wcd938x snd_soc_wcd938x_sdw snd_soc_wcd_classh hci_uart snd_soc_wcd_common
snd_soc_sc8280xp soundwire_qcom snd_soc_wcd_mbhc snd_soc_qcom_sdw slimbus snd_soc_qcom_common regmap_sdw btqca btrtl qcom_camss soundwire_bus btbcm btintel snd_soc_sdca snd_soc_lpass_wsa_macro
bluetooth snd_soc_lpass_tx_macro snd_soc_lpass_va_macro snd_soc_lpass_rx_macro snd_soc_hdmi_codec snd_soc_lpass_macro_common videobuf2_dma_sg ov5675 v4l2_fwnode videobuf2_memops
qcom_spmi_adc5 snd_soc_core qcom_spmi_adc_tm5 videobuf2_v4l2 snd_seq snd_seq_device videobuf2_common v4l2_async qcom_vadc_common qcom_spmi_temp_alarm pm8941_pwrkey industrialio videodev
snd_compress rfkill ac97_bus snd_pcm_dmaengine qcom_tsens mc qcom_edac snd_pcm pci_pwrctrl_pwrseq qcom_cpufreq_hw snd_timer snd qcomtee soundcore tee leds_gpio joydev binfmt_misc zram
lz4hc_compress governor_simpleondemand panel_edp msm xhci_plat_hcd nvme nvme_core dwc3 qcom_pm8008_regulator
[ 15.408688] ucsi_glink nvme_keyring nvme_auth pmic_glink_altmode udc_core typec_ucsi aux_hpd_bridge qcom_battmgr ulpi ubwc_config socinfo ocmem drm_gpuvm qcom_q6v5_pas drm_exec
qcom_pil_info leds_qcom_lpg gpu_sched led_class_multicolor rtc_pm8xxx qcom_pbs qcom_common drm_display_helper qcom_pon qcom_glink_smem qcom_glink ghash_ce pwrseq_qcom_wcn gpio_sbu_mux
qcom_stats phy_qcom_qmp_combo qcom_q6v5 gf128mul cec dispcc_sc8280xp phy_qcom_edp camcc_sc8280xp i2c_qcom_cci qcom_sysmon drm_dp_aux_bus mdt_loader aux_bridge qcom_pm8008 i2c_hid_of_elan
dwc3_qcom_legacy llcc_qcom icc_bwmon gpi typec qcom_refgen_regulator phy_qcom_qmp_usb nvmem_qfprom qcom_ipcc phy_qcom_snps_femto_v2 gpucc_sc8280xp pinctrl_sc8280xp_lpass_lpi qcom_hwspinlock
pinctrl_lpass_lpi lpasscc_sc8280xp qrtr qcom_aoss pmic_glink pdr_interface phy_qcom_qmp_pcie qcom_smd qcom_pdr_msg icc_osm_l3 qcom_wdt qmi_helpers qcom_rng smp2p rpmsg_core gpio_keys pwm_bl
smem hid_multitouch fuse i2c_dev
[ 15.408928] CPU: 2 UID: 0 PID: 14 Comm: kworker/u32:1 Not tainted 7.1.0+ #2 PREEMPT(lazy)
[ 15.408937] Hardware name: LENOVO 21BX0016US/21BX0016US, BIOS N3HET88W (1.60 ) 03/14/2024
[ 15.408942] Workqueue: pm pm_runtime_work
[ 15.408959] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 15.408967] pc : gdsc_toggle_logic+0x14c/0x160
[ 15.408978] lr : gdsc_toggle_logic+0x14c/0x160
[ 15.408987] sp : ffff8000800f3b40
[ 15.408991] x29: ffff8000800f3b40 x28: 0000000000000000 x27: 0000000000000000
[ 15.409003] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
[ 15.409014] x23: 0000000000000000 x22: 0000000000000001 x21: ffffa33f298fca88
[ 15.409024] x20: 0000000000000000 x19: ffffa33f298fc5b0 x18: 00cd15db75dacefd
[ 15.409035] x17: 000000040044ffff x16: ffffa33f3b1a3d88 x15: 726f776b80000002
[ 15.409045] x14: ffffffffffffffff x13: 0000000000000028 x12: 0101010101010101
[ 15.409056] x11: 7f7f7f7f7f7f7f7f x10: fefeff3039313274 x9 : ffffa33f3a5edafc
[ 15.409067] x8 : ffff8000800f3780 x7 : 0000000000000001 x6 : 0000000000000001
[ 15.409078] x5 : ffff000bf3ca1288 x4 : 0000000000000000 x3 : ffff5cccb6a3f000
[ 15.409088] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000080ae0000
[ 15.409098] Call trace:
[ 15.409103] gdsc_toggle_logic+0x14c/0x160 (P)
[ 15.409115] gdsc_disable+0x4c/0x190
[ 15.409126] _genpd_power_off+0xa0/0x1a8
[ 15.409137] genpd_power_off.part.0+0x180/0x2a0
[ 15.409149] genpd_runtime_suspend+0x218/0x310
[ 15.409155] __rpm_callback+0x50/0x1f8
[ 15.409166] rpm_callback+0x7c/0x90
[ 15.409175] rpm_suspend+0xe8/0x690
[ 15.409185] pm_runtime_work+0xd0/0xe0
[ 15.409195] process_one_work+0x18c/0x518
[ 15.409208] worker_thread+0x190/0x320
[ 15.409218] kthread+0x110/0x130
[ 15.409227] ret_from_fork+0x10/0x20
This clock is force enabled to be on in the probe, and registered with
the Common Clk Framework, resulting in them being toggled off after
unused clocks are shutdown. This clock is required for the GDSC
transitions.
Similar to the fix in commit b60521eff227 ("clk: qcom: gcc-x1e80100:
Unregister GCC_GPU_CFG_AHB_CLK/GCC_DISP_XO_CLK"), let's just unregister
this clock.
Link: https://lore.kernel.org/linux-clk/20260626-camcc-sc8280xp-titan-top-v1-1-2ca246886493@redhat.com/
Fixes: ff93872a9c616 ("clk: qcom: camcc-sc8280xp: Add sc8280xp CAMCC")
Suggested-by: Jagadeesh Kona <jagadeesh.kona@oss.qualcomm.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Link: https://lore.kernel.org/r/20260708-camcc-sc8280xp-remove-gdsc-v1-1-dfaab98a3bf5@redhat.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/camcc-sc8280xp.c | 19 -------------------
1 file changed, 19 deletions(-)
diff --git a/drivers/clk/qcom/camcc-sc8280xp.c b/drivers/clk/qcom/camcc-sc8280xp.c
index 479964f916086..cf170fc7baf1b 100644
--- a/drivers/clk/qcom/camcc-sc8280xp.c
+++ b/drivers/clk/qcom/camcc-sc8280xp.c
@@ -1754,24 +1754,6 @@ static struct clk_branch camcc_csiphy3_clk = {
},
};
-static struct clk_branch camcc_gdsc_clk = {
- .halt_reg = 0xc1e4,
- .halt_check = BRANCH_HALT,
- .clkr = {
- .enable_reg = 0xc1e4,
- .enable_mask = BIT(0),
- .hw.init = &(struct clk_init_data){
- .name = "camcc_gdsc_clk",
- .parent_hws = (const struct clk_hw*[]){
- &camcc_xo_clk_src.clkr.hw,
- },
- .num_parents = 1,
- .flags = CLK_SET_RATE_PARENT,
- .ops = &clk_branch2_ops,
- },
- },
-};
-
static struct clk_branch camcc_icp_ahb_clk = {
.halt_reg = 0xc0d8,
.halt_check = BRANCH_HALT,
@@ -2840,7 +2822,6 @@ static struct clk_regmap *camcc_sc8280xp_clocks[] = {
[CAMCC_CSIPHY2_CLK] = &camcc_csiphy2_clk.clkr,
[CAMCC_CSIPHY3_CLK] = &camcc_csiphy3_clk.clkr,
[CAMCC_FAST_AHB_CLK_SRC] = &camcc_fast_ahb_clk_src.clkr,
- [CAMCC_GDSC_CLK] = &camcc_gdsc_clk.clkr,
[CAMCC_ICP_AHB_CLK] = &camcc_icp_ahb_clk.clkr,
[CAMCC_ICP_CLK] = &camcc_icp_clk.clkr,
[CAMCC_ICP_CLK_SRC] = &camcc_icp_clk_src.clkr,
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0500/1376] iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (498 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0499/1376] clk: qcom: camcc-sc8280xp: unregister CAMCC_GDSC_CLK Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0501/1376] RDMA/core: Wait for RCU callbacks before unloading ib_core Greg Kroah-Hartman
` (498 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mert Seftali, Joshua Crofts,
Jonathan Cameron, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mert Seftali <mertsftl@gmail.com>
[ Upstream commit aa58ecc73466d0cb8c418de98e2225490bf600e3 ]
Reading the in_accel_scale attribute on the DMARD09 has always returned
-EINVAL: the channels advertise scale via info_mask_shared_by_type so the
IIO core exposes the attribute, but dmard09_read_raw() only handles
IIO_CHAN_INFO_RAW, so a SCALE read falls through to 'default: return
-EINVAL':
$ cat .../iio:deviceX/in_accel_scale
cat: in_accel_scale: Invalid argument
leaving userspace with raw counts it cannot convert to m/s^2.
The driver was written from a vendor source [1] without a datasheet, and
the scale was declared but never implemented. The vendor source carries
the sensitivity: its conversion is
acc = raw * GRAVITY_EARTH_1000 / sensitivity (then / 1000 -> m/s^2)
with sensitivity = 32 and GRAVITY_EARTH_1000 = 9807 ("about
(9.80665)*1000"), i.e. 32 counts correspond to 1 g.
That sensitivity applies to the value this driver already reports as raw:
the vendor reduces each 16-bit sample to a signed 9-bit value, and the
preparation in dmard09_read_raw() yields the same value. It is
self-consistent: 256 counts / 32 = 8 g full scale, matching the +/-8g
range.
Implement the scale derived from that sensitivity using standard gravity:
scale = 9.80665 / 32 = 0.3064578125 m/s^2 per LSB
Link: https://github.com/minstrelsy/mediatek/blob/1f49d8c87b839651bc89afc870277e8e0f2e2d55/custom/common/kernel/accelerometer/dmard09/dmard09.c [1]
Fixes: a4fa6509dda4 ("iio: accel: add support for the Domintech DMARD09 3-axis accelerometer")
Signed-off-by: Mert Seftali <mertsftl@gmail.com>
Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/accel/dmard09.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/iio/accel/dmard09.c b/drivers/iio/accel/dmard09.c
index 4ec70ca6910d5..117cebbeb1387 100644
--- a/drivers/iio/accel/dmard09.c
+++ b/drivers/iio/accel/dmard09.c
@@ -8,6 +8,7 @@
#include <linux/unaligned.h>
#include <linux/module.h>
#include <linux/i2c.h>
+#include <linux/units.h>
#include <linux/iio/iio.h>
#define DMARD09_DRV_NAME "dmard09"
@@ -79,6 +80,12 @@ static int dmard09_read_raw(struct iio_dev *indio_dev,
*val = accel;
return IIO_VAL_INT;
+ case IIO_CHAN_INFO_SCALE:
+ *val = 0;
+ /* 1 g / 32 LSB, in m/s^2 */
+ *val2 = IIO_G_TO_M_S_2(NANO / 32);
+
+ return IIO_VAL_INT_PLUS_NANO;
default:
return -EINVAL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0501/1376] RDMA/core: Wait for RCU callbacks before unloading ib_core
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (499 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0500/1376] iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0502/1376] RDMA/mlx5: Drain RCU callbacks during module teardown Greg Kroah-Hartman
` (497 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sebastian Andrzej Siewior,
Leon Romanovsky, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <leonro@nvidia.com>
[ Upstream commit 7d75592114d1664623c8cf191a12b38052c04483 ]
put_gid_ndev() is queued with call_rcu() and implemented in ib_core.
Stopping the workqueues does not drain callbacks already queued, so RCU
could invoke it after the module code has been unloaded.
synchronize_rcu() does not wait for callbacks. Wait for them after all
producers have stopped.
Fixes: 943bd984b108 ("RDMA/core: Allow detaching gid attribute netdevice for RoCE")
Reported-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Closes: https://lore.kernel.org/linux-rdma/20260708092316.Qb39F_B0@linutronix.de/
Link: https://patch.msgid.link/20260709-unload-rcu-v1-1-fccd27211e5a@nvidia.com
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/core/device.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 666ce83cc35c4..cd53e9c4f913b 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -3017,6 +3017,7 @@ static void __exit ib_core_cleanup(void)
/* Make sure that any pending umem accounting work is done. */
destroy_workqueue(ib_wq);
destroy_workqueue(ib_unreg_wq);
+ rcu_barrier();
WARN_ON(!xa_empty(&clients));
WARN_ON(!xa_empty(&devices));
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0502/1376] RDMA/mlx5: Drain RCU callbacks during module teardown
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (500 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0501/1376] RDMA/core: Wait for RCU callbacks before unloading ib_core Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0503/1376] RDMA/ipoib: " Greg Kroah-Hartman
` (496 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sebastian Andrzej Siewior,
Leon Romanovsky, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <leonro@nvidia.com>
[ Upstream commit e37cdd75f8d61c1123d324ae5667ac3da562290e ]
devx_free_subscription() can remain queued after the last DevX event file
drops its module reference or an auxiliary driver detaches its devices.
mlx5_ib can then unload before the callback runs.
Registration error unwind has the same risk because driver registration
can attach existing devices before failing. Wait after all drivers have
stopped.
Fixes: 6898d1c661d7 ("RDMA/mlx5: Use RCU and direct refcounts to keep memory alive")
Reported-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Closes: https://lore.kernel.org/linux-rdma/20260708092316.Qb39F_B0@linutronix.de/
Link: https://patch.msgid.link/20260709-unload-rcu-v1-2-fccd27211e5a@nvidia.com
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/mlx5/main.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index edd38510c0259..a0b3086381951 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -5101,6 +5101,7 @@ static int __init mlx5_ib_init(void)
dd_err:
mlx5r_rep_cleanup();
rep_err:
+ rcu_barrier();
mlx5_ib_qp_event_cleanup();
qp_event_err:
destroy_workqueue(mlx5_ib_event_wq);
@@ -5114,6 +5115,7 @@ static void __exit mlx5_ib_cleanup(void)
auxiliary_driver_unregister(&mlx5r_driver);
auxiliary_driver_unregister(&mlx5r_mp_driver);
mlx5r_rep_cleanup();
+ rcu_barrier();
mlx5_ib_qp_event_cleanup();
destroy_workqueue(mlx5_ib_event_wq);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0503/1376] RDMA/ipoib: Drain RCU callbacks during module teardown
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (501 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0502/1376] RDMA/mlx5: Drain RCU callbacks during module teardown Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0504/1376] RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state Greg Kroah-Hartman
` (495 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sebastian Andrzej Siewior,
Leon Romanovsky, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <leonro@nvidia.com>
[ Upstream commit 31b7c700670830a0e8a4cdcd451c88a13cc5dc48 ]
IPoIB reclamation completions can be signaled from inside an RCU callback.
Teardown can wake before the callback returns and unload ib_ipoib while its
code is still executing.
Client registration failure can also remove already-added devices and queue
callbacks. Wait after client and workqueue teardown.
Fixes: b63b70d87741 ("IPoIB: Use a private hash table for path lookup in xmit path")
Reported-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Closes: https://lore.kernel.org/linux-rdma/20260708092316.Qb39F_B0@linutronix.de/
Link: https://patch.msgid.link/20260709-unload-rcu-v1-3-fccd27211e5a@nvidia.com
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/ulp/ipoib/ipoib_main.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index d65f3a5963651..bbb00fdc12db3 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -2703,6 +2703,7 @@ static int __init ipoib_init_module(void)
err_sa:
ib_sa_unregister_client(&ipoib_sa_client);
destroy_workqueue(ipoib_workqueue);
+ rcu_barrier();
err_fs:
ipoib_unregister_debugfs();
@@ -2720,6 +2721,7 @@ static void __exit ipoib_cleanup_module(void)
ib_sa_unregister_client(&ipoib_sa_client);
ipoib_unregister_debugfs();
destroy_workqueue(ipoib_workqueue);
+ rcu_barrier();
}
module_init(ipoib_init_module);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0504/1376] RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (502 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0503/1376] RDMA/ipoib: " Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0505/1376] crypto: ccp - Fix memory leak in SEV INIT_EX path Greg Kroah-Hartman
` (494 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Allison Henderson, Zhu Yanjun,
Leon Romanovsky, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Allison Henderson <achender@kernel.org>
[ Upstream commit 15ae32c4a3551c4c9da457370bdfdd65d171e512 ]
When do_complete() finds the QP in the error state it returns
RESPST_CHK_RESOURCE. Before commit 49dc9c1f0c7e ("RDMA/rxe: Cleanup
reset state handling in rxe_resp.c") this was the flush loop:
check_resource() had an error-state branch that fetched each remaining
recv WQE and completed it with IB_WC_WR_FLUSH_ERR, without touching
the current packet. That commit removed the error-state branch from
check_resource() (draining is now done at rxe_receiver() entry) but
kept the do_complete() error-state return.
As a result, when a QP moves to the error state while a packet is
being completed - e.g. an rdma_cm disconnect racing with receive
processing - the responder state machine loops back into the request
processing chain with the already-completed packet still in hand:
check_resource() fetches a fresh recv WQE, execute()/send_data_in()
copies the same packet payload again, do_complete() posts another
IB_WC_SUCCESS CQE (qp->resp.status is still 0), and control returns
to the error-state check. The loop re-executes the same packet once
per posted recv WQE (observed: ~1000 duplicate IB_WC_SUCCESS
completions of one SEND, one per ~8us, matching the RQ occupancy)
until the RQ is exhausted, after which qp->resp.wqe is NULL and
send_data_in() dereferences it:
BUG: kernel NULL pointer dereference, address: 0000000000000014
Workqueue: rxe_wq do_work
RIP: copy_data+0x29/0x1f0
Call Trace:
send_data_in+0x25/0x50
rxe_receiver+0xf36/0x1dd0
The duplicate completions are indistinguishable from real receives to
the ULP. During an rds stress test, the message was accepted as new and
delivered the same datagram to user space hundreds of times, corrupting
the stream; any ULP that relies on RC exactly-once delivery is affected.
A live packet reaching the error-state check in do_complete() has
been executed and completed exactly once and must be consumed, not
re-processed. Return RESPST_CLEANUP for it (dequeue and free); keep
returning RESPST_CHK_RESOURCE for the pkt == NULL case.
Fixes: 49dc9c1f0c7e ("RDMA/rxe: Cleanup reset state handling in rxe_resp.c")
Assisted-by: Claude-Code:claude-fable-5
Signed-off-by: Allison Henderson <achender@kernel.org>
Link: https://patch.msgid.link/20260711165419.13486-1-achender@kernel.org
Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/sw/rxe/rxe_resp.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
index 5611f63a1115c..abf6cf3ce986b 100644
--- a/drivers/infiniband/sw/rxe/rxe_resp.c
+++ b/drivers/infiniband/sw/rxe/rxe_resp.c
@@ -1188,7 +1188,14 @@ static enum resp_states do_complete(struct rxe_qp *qp,
spin_lock_irqsave(&qp->state_lock, flags);
if (unlikely(qp_state(qp) == IB_QPS_ERR)) {
spin_unlock_irqrestore(&qp->state_lock, flags);
- return RESPST_CHK_RESOURCE;
+ /* The packet was executed and completed before the QP
+ * moved to ERROR; it must be consumed exactly once.
+ * Re-entering the request chain with the stale packet
+ * would copy it into every remaining recv WQE as a new
+ * completion. Remaining WQEs are flushed by the drain
+ * path at rxe_receiver() entry.
+ */
+ return pkt ? RESPST_CLEANUP : RESPST_CHK_RESOURCE;
}
spin_unlock_irqrestore(&qp->state_lock, flags);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0505/1376] crypto: ccp - Fix memory leak in SEV INIT_EX path
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (503 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0504/1376] RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0506/1376] hwrng: ks-sa - Fix runtime PM cleanup on registration failure Greg Kroah-Hartman
` (493 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Tom Lendacky, Atish Patra,
Herbert Xu, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Atish Patra <atishp@meta.com>
[ Upstream commit c8e53ada20d352b0f1bdc3e58405a9edab897a2e ]
allocated pages in _init_ext_path are never freed and sev_init_ex_buffer
is left pointing at the leaked memory in case of any failures during the
function..
Fix by adding an error path that frees the pages and clears
sev_init_ex_buffer. Make sure we only free the memory if the failure
happens before the conversion. Otherwise, we may end up trying to free
up converted pages in case of reclaim failure. rmp_mark_pages_firmware
failures should be rare enough to avoid more code complexity to track
down which pages were reclaimed/leaked vs which are not.
Fixes: 7364a6fbca45 ("crypto: ccp: Handle non-volatile INIT_EX data when SNP is enabled")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Atish Patra <atishp@meta.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/ccp/sev-dev.c | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)
diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c
index d6a0773d6da8f..6dc380537ece9 100644
--- a/drivers/crypto/ccp/sev-dev.c
+++ b/drivers/crypto/ccp/sev-dev.c
@@ -1244,7 +1244,7 @@ static int __sev_platform_init_handle_init_ex_path(struct sev_device *sev)
if (sev_init_ex_buffer)
return 0;
- page = alloc_pages(GFP_KERNEL, get_order(NV_LENGTH));
+ page = alloc_pages(GFP_KERNEL | __GFP_ZERO, get_order(NV_LENGTH));
if (!page) {
dev_err(sev->dev, "SEV: INIT_EX NV memory allocation failed\n");
return -ENOMEM;
@@ -1254,7 +1254,7 @@ static int __sev_platform_init_handle_init_ex_path(struct sev_device *sev)
rc = sev_read_init_ex_file();
if (rc)
- return rc;
+ goto err_free;
/* If SEV-SNP is initialized, transition to firmware page. */
if (sev->snp_initialized) {
@@ -1263,11 +1263,22 @@ static int __sev_platform_init_handle_init_ex_path(struct sev_device *sev)
npages = 1UL << get_order(NV_LENGTH);
if (rmp_mark_pages_firmware(__pa(sev_init_ex_buffer), npages, false)) {
dev_err(sev->dev, "SEV: INIT_EX NV memory page state change failed.\n");
- return -ENOMEM;
+ rc = -ENOMEM;
+ /*
+ * Pages can be in an inconsistent state, don't release them back to the
+ * system.
+ */
+ goto err_reset;
}
}
return 0;
+
+err_free:
+ __free_pages(page, get_order(NV_LENGTH));
+err_reset:
+ sev_init_ex_buffer = NULL;
+ return rc;
}
static int __sev_platform_init_locked(int *error)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0506/1376] hwrng: ks-sa - Fix runtime PM cleanup on registration failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (504 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0505/1376] crypto: ccp - Fix memory leak in SEV INIT_EX path Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0507/1376] xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full Greg Kroah-Hartman
` (492 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yuho Choi, Herbert Xu, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <dbgh9129@gmail.com>
[ Upstream commit 1c17b601fafb09c9ec074fd097737d20eafe7d63 ]
ks_sa_rng_probe() enables runtime PM and resumes the device before
registering the hwrng. If devm_hwrng_register() fails, probe returns
without dropping the runtime PM usage count or disabling runtime PM.
Unwind the runtime PM state on the registration failure path, matching
the cleanup done by remove().
Fixes: eb428ee0e3ca ("hwrng: ks-sa - add hw_random driver")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/hw_random/ks-sa-rng.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/char/hw_random/ks-sa-rng.c b/drivers/char/hw_random/ks-sa-rng.c
index 3c514b4fbc8ae..64369d4f1644c 100644
--- a/drivers/char/hw_random/ks-sa-rng.c
+++ b/drivers/char/hw_random/ks-sa-rng.c
@@ -242,7 +242,14 @@ static int ks_sa_rng_probe(struct platform_device *pdev)
return dev_err_probe(dev, ret, "Failed to enable SA power-domain\n");
}
- return devm_hwrng_register(&pdev->dev, &ks_sa_rng->rng);
+ ret = devm_hwrng_register(dev, &ks_sa_rng->rng);
+ if (ret) {
+ pm_runtime_put_sync(dev);
+ pm_runtime_disable(dev);
+ return ret;
+ }
+
+ return 0;
}
static void ks_sa_rng_remove(struct platform_device *pdev)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0507/1376] xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (505 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0506/1376] hwrng: ks-sa - Fix runtime PM cleanup on registration failure Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0508/1376] ALSA: hpi: Check transport errors during HPI6000 adapter initialization Greg Kroah-Hartman
` (491 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei,
Steffen Klassert, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
[ Upstream commit 5d9e3bf34fec9a5d237e4b7cef4a707bc2e091bc ]
The depth check in xfrm6_input_addr() is off by one:
if (1 + sp->len == XFRM_MAX_DEPTH)
goto drop;
...
sp->xvec[sp->len++] = x;
xfrm_input() can leave sp->len == XFRM_MAX_DEPTH, and the transport-mode
receive path re-enters IPv6 input via xfrm_trans_reinject() with that
secpath preserved. If the inner packet carries a destination-options HAO
option or a type-2 routing header, xfrm6_input_addr() is called with
sp->len == XFRM_MAX_DEPTH; the check (1 + 6 == 6) is false, so
sp->xvec[sp->len++] writes one slot past the 6-element xvec[]. The write
stays within the sec_path allocation (invisible to KASAN); UBSAN_BOUNDS
flags it and panics under panic_on_warn.
Use "sp->len >= XFRM_MAX_DEPTH", matching xfrm_input(). This also
restores one chain level the old check rejected at sp->len == 5.
UBSAN: array-index-out-of-bounds in net/ipv6/xfrm6_input.c:309:10
index 6 is out of range for type 'xfrm_state *[6]'
Fixes: 9473e1f631de ("[XFRM] MIPv6: Fix to input RO state correctly.")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/xfrm6_input.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ipv6/xfrm6_input.c b/net/ipv6/xfrm6_input.c
index 699a001ac1662..c9e208c57a6b5 100644
--- a/net/ipv6/xfrm6_input.c
+++ b/net/ipv6/xfrm6_input.c
@@ -249,7 +249,7 @@ int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
goto drop;
}
- if (1 + sp->len == XFRM_MAX_DEPTH) {
+ if (sp->len >= XFRM_MAX_DEPTH) {
XFRM_INC_STATS(net, LINUX_MIB_XFRMINBUFFERERROR);
goto drop;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0508/1376] ALSA: hpi: Check transport errors during HPI6000 adapter initialization
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (506 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0507/1376] xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0509/1376] pmdomain: bcm: bcm2835: handle genpd provider registration errors Greg Kroah-Hartman
` (490 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Evgenii Burenchev, Takashi Iwai,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Evgenii Burenchev <evg28bur@yandex.ru>
[ Upstream commit cc15c329663e3ef1aeed0b68e49a5d5ce4ae0d5c ]
create_adapter_obj() retrieves adapter information by calling
hpi6000_message_response_sequence(). This function reports transport-level
errors through its return value and DSP-reported errors via hr0.error.
The current code only checks hr0.error, causing transport-level errors to
be ignored. As a result, adapter initialization may continue with an
invalid response.
Check the return value of hpi6000_message_response_sequence() before
examining hr0.error.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 719f82d3987a ("ALSA: Add support of AudioScience ASI boards")
Signed-off-by: Evgenii Burenchev <evg28bur@yandex.ru>
Link: https://patch.msgid.link/20260708141147.18253-1-evg28bur@yandex.ru
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/pci/asihpi/hpi6000.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/sound/pci/asihpi/hpi6000.c b/sound/pci/asihpi/hpi6000.c
index 72aa135d69f85..8aa5832f1f2a5 100644
--- a/sound/pci/asihpi/hpi6000.c
+++ b/sound/pci/asihpi/hpi6000.c
@@ -537,6 +537,11 @@ static short create_adapter_obj(struct hpi_adapter_obj *pao,
hr1.size = sizeof(hr1);
error = hpi6000_message_response_sequence(pao, 0, &hm, &hr0);
+ if (error) {
+ HPI_DEBUG_LOG(ERROR, "message transport error %d\n",
+ error);
+ return error;
+ }
if (hr0.error) {
HPI_DEBUG_LOG(DEBUG, "message error %d\n", hr0.error);
return hr0.error;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0509/1376] pmdomain: bcm: bcm2835: handle genpd provider registration errors
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (507 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0508/1376] ALSA: hpi: Check transport errors during HPI6000 adapter initialization Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0510/1376] misc: rtsx_usb: avoid USB I/O in runtime autosuspend Greg Kroah-Hartman
` (489 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Stefan Wahren,
Ulf Hansson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ Upstream commit a1d9d3b958d69a13783613304f524f489fecdd1f ]
bcm2835_power_probe() initializes all power domains and then registers
the onecell genpd provider, but ignores of_genpd_add_provider_onecell()
failures. Probe can therefore return success even though no provider was
published.
Check the provider registration return value and jump to the existing
cleanup path on failure.
Fixes: 670c672608a1 ("soc: bcm: bcm2835-pm: Add support for power domains under a new binding.")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Stefan Wahren <wahrenst@gmx.net>
Signed-off-by: Ulf Hansson <ulfh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pmdomain/bcm/bcm2835-power.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/pmdomain/bcm/bcm2835-power.c b/drivers/pmdomain/bcm/bcm2835-power.c
index 20130549a7a53..85406b4a99b06 100644
--- a/drivers/pmdomain/bcm/bcm2835-power.c
+++ b/drivers/pmdomain/bcm/bcm2835-power.c
@@ -682,7 +682,12 @@ static int bcm2835_power_probe(struct platform_device *pdev)
if (ret)
goto fail;
- of_genpd_add_provider_onecell(dev->parent->of_node, &power->pd_xlate);
+ ret = of_genpd_add_provider_onecell(dev->parent->of_node,
+ &power->pd_xlate);
+ if (ret) {
+ dev_err_probe(dev, ret, "failed to add genpd provider\n");
+ goto fail;
+ }
dev_info(dev, "Broadcom BCM2835 power domains driver");
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0510/1376] misc: rtsx_usb: avoid USB I/O in runtime autosuspend
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (508 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0509/1376] pmdomain: bcm: bcm2835: handle genpd provider registration errors Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0511/1376] RDMA/hfi1: Preserve unit 0 on allocation failure Greg Kroah-Hartman
` (488 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Rhodes, Ulf Hansson,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Rhodes <sean@starlabs.systems>
[ Upstream commit 483c948324a3823871c004560a92545759d3253c ]
The runtime autosuspend callback currently queries card status and
clears OCP by issuing USB register accesses. This can run from the
USB runtime-PM path itself, which is the wrong place to start more
device I/O.
Keep a cached copy of the card-status bits from normal status reads
instead. During runtime autosuspend, use that cached value only to
preserve the existing Memory Stick autosuspend deferral.
Do not treat raw SD_CD as an autosuspend blocker, because tray-based
SD readers can assert SD_CD with an empty tray. A real SD card is
protected by the SD/MMC child runtime-PM usage once powered.
Also stop clearing OCP from the runtime autosuspend callback, so the
callback does not issue USB commands.
Fixes: bb400d2120bd ("mfd: rtsx_usb: Defer autosuspend while card exists")
Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ulf Hansson <ulfh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/misc/cardreader/rtsx_usb.c | 23 ++++++++++++++++++++---
include/linux/rtsx_usb.h | 3 +++
2 files changed, 23 insertions(+), 3 deletions(-)
diff --git a/drivers/misc/cardreader/rtsx_usb.c b/drivers/misc/cardreader/rtsx_usb.c
index f546b050cb495..0a585be7f0860 100644
--- a/drivers/misc/cardreader/rtsx_usb.c
+++ b/drivers/misc/cardreader/rtsx_usb.c
@@ -312,6 +312,9 @@ int rtsx_usb_get_card_status(struct rtsx_ucr *ucr, u16 *status)
if (ret < 0)
return ret;
+ ucr->card_status_cache = *status;
+ ucr->card_status_valid = true;
+
return 0;
}
EXPORT_SYMBOL_GPL(rtsx_usb_get_card_status);
@@ -619,6 +622,7 @@ static int rtsx_usb_probe(struct usb_interface *intf,
{
struct usb_device *usb_dev = interface_to_usbdev(intf);
struct rtsx_ucr *ucr;
+ u16 status;
int ret;
dev_dbg(&intf->dev,
@@ -655,6 +659,9 @@ static int rtsx_usb_probe(struct usb_interface *intf,
if (ret)
goto out_init_fail;
+ /* Prime cached status for runtime autosuspend decisions. */
+ rtsx_usb_get_card_status(ucr, &status);
+
/* initialize USB SG transfer timer */
timer_setup(&ucr->sg_timer, rtsx_usb_sg_timed_out, 0);
@@ -709,17 +716,27 @@ static int rtsx_usb_suspend(struct usb_interface *intf, pm_message_t message)
struct rtsx_ucr *ucr =
(struct rtsx_ucr *)usb_get_intfdata(intf);
u16 val = 0;
+ bool valid = false;
dev_dbg(&intf->dev, "%s called with pm message 0x%04x\n",
__func__, message.event);
if (PMSG_IS_AUTO(message)) {
if (mutex_trylock(&ucr->dev_mutex)) {
- rtsx_usb_get_card_status(ucr, &val);
+ valid = ucr->card_status_valid;
+ if (valid)
+ val = ucr->card_status_cache;
mutex_unlock(&ucr->dev_mutex);
- /* Defer the autosuspend if card exists */
- if (val & (SD_CD | MS_CD)) {
+ /*
+ * Do not issue USB commands from runtime autosuspend.
+ * Raw SD_CD is not authoritative on tray-based readers,
+ * while a real SD card is protected by the SD/MMC child
+ * runtime-PM reference once the card is powered. Keep
+ * the historical Memory Stick autosuspend deferral when
+ * the cached status says MS media is present.
+ */
+ if (valid && (val & MS_CD)) {
device_for_each_child(&intf->dev, NULL, rtsx_usb_resume_child);
return -EAGAIN;
}
diff --git a/include/linux/rtsx_usb.h b/include/linux/rtsx_usb.h
index 3247ed8e9ff0f..5933751cf7219 100644
--- a/include/linux/rtsx_usb.h
+++ b/include/linux/rtsx_usb.h
@@ -57,6 +57,9 @@ struct rtsx_ucr {
struct timer_list sg_timer;
struct mutex dev_mutex;
+
+ u16 card_status_cache;
+ bool card_status_valid;
};
/* buffer size */
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0511/1376] RDMA/hfi1: Preserve unit 0 on allocation failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (509 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0510/1376] misc: rtsx_usb: avoid USB I/O in runtime autosuspend Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0512/1376] RDMA/hfi1: Free RX data on late probe failure Greg Kroah-Hartman
` (487 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Leon Romanovsky, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <leonro@nvidia.com>
[ Upstream commit 2e3809ad8911f5d5581b3f046bd628417bface76 ]
hfi1_free_devdata() assumes that the device was inserted into the unit
table and unconditionally erases dd->unit. If xa_alloc_irq() fails, the
zero-initialized unit remains zero, so full cleanup can remove an
unrelated device from index 0.
Release only the rdmavt allocation and return immediately while the unit
table has not acquired the device.
Fixes: 03b92789e5cf ("hfi1: Convert hfi1_unit_table to XArray")
Link: https://patch.msgid.link/20260708-clean-init-one-hfi1-v1-2-b9e9641268a5@nvidia.com
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/hfi1/init.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c
index cbac4a442d9ec..e84616bc4fa99 100644
--- a/drivers/infiniband/hw/hfi1/init.c
+++ b/drivers/infiniband/hw/hfi1/init.c
@@ -1227,8 +1227,9 @@ static struct hfi1_devdata *hfi1_alloc_devdata(struct pci_dev *pdev,
GFP_KERNEL);
if (ret < 0) {
dev_err(&pdev->dev,
- "Could not allocate unit ID: error %d\n", -ret);
- goto bail;
+ "Could not allocate unit ID: error %pe\n", ERR_PTR(ret));
+ rvt_dealloc_device(&dd->verbs_dev.rdi);
+ return ERR_PTR(ret);
}
rvt_set_ibdev_name(&dd->verbs_dev.rdi, "%s_%d", class_name(), dd->unit);
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0512/1376] RDMA/hfi1: Free RX data on late probe failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (510 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0511/1376] RDMA/hfi1: Preserve unit 0 on allocation failure Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0513/1376] RDMA/hfi1: Remove redundant PCI device ID validation Greg Kroah-Hartman
` (486 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kalesh AP, Leon Romanovsky,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <leonro@nvidia.com>
[ Upstream commit 8e17e101e04a3dc062e2719da57ff78c1c060632 ]
hfi1_init_dd() allocates the shared AIP/VNIC RX support before returning.
If hfi1_init() or hfi1_register_ib_device() later fails, init_one() tears
down the device data without calling hfi1_free_rx(). This leaks netdev_rx
and its dummy netdev.
Free the RX support after IB unregistration and before postinit_cleanup(),
as done on normal device removal.
Fixes: 4730f4a6c6b2 ("IB/hfi1: Activate the dummy netdev")
Link: https://patch.msgid.link/20260708-clean-init-one-hfi1-v1-7-b9e9641268a5@nvidia.com
Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/hfi1/init.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c
index e84616bc4fa99..d6331f90222d8 100644
--- a/drivers/infiniband/hw/hfi1/init.c
+++ b/drivers/infiniband/hw/hfi1/init.c
@@ -1678,6 +1678,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
hfi1_device_remove(dd);
if (!ret)
hfi1_unregister_ib_device(dd);
+ hfi1_free_rx(dd);
postinit_cleanup(dd);
if (initfail)
ret = initfail;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0513/1376] RDMA/hfi1: Remove redundant PCI device ID validation
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (511 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0512/1376] RDMA/hfi1: Free RX data on late probe failure Greg Kroah-Hartman
@ 2026-09-12 6:48 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0514/1376] RDMA/hfi1: Create workqueues before device initialization Greg Kroah-Hartman
` (485 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Leon Romanovsky, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <leonro@nvidia.com>
[ Upstream commit af9117d02f50514c998714b23820de71d0aa5d24 ]
The PCI core calls init_one() only after pci_match_device() has selected
an ID. For normal probing, hfi1_pci_tbl already restricts matches to the
two supported Intel device IDs. Dynamic IDs and driver_override are
explicit requests to attempt binding, so the probe should not second-guess
the PCI core's decision.
Remove the redundant check.
Link: https://patch.msgid.link/20260708-clean-init-one-hfi1-v1-3-b9e9641268a5@nvidia.com
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Stable-dep-of: 9f674ba674a0 ("RDMA/hfi1: Allocate device data after PCI initialization")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/hfi1/init.c | 9 ---------
1 file changed, 9 deletions(-)
diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c
index d6331f90222d8..fc6c01d64050e 100644
--- a/drivers/infiniband/hw/hfi1/init.c
+++ b/drivers/infiniband/hw/hfi1/init.c
@@ -1563,15 +1563,6 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
/* First, lock the non-writable module parameters */
HFI1_CAP_LOCK();
- /* Validate dev ids */
- if (!(ent->device == PCI_DEVICE_ID_INTEL0 ||
- ent->device == PCI_DEVICE_ID_INTEL1)) {
- dev_err(&pdev->dev, "Failing on unknown Intel deviceid 0x%x\n",
- ent->device);
- ret = -ENODEV;
- goto bail;
- }
-
/* Allocate the dd so we can get to work */
dd = hfi1_alloc_devdata(pdev, NUM_IB_PORTS *
sizeof(struct hfi1_pportdata));
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0514/1376] RDMA/hfi1: Create workqueues before device initialization
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (512 preceding siblings ...)
2026-09-12 6:48 ` [PATCH 6.12 0513/1376] RDMA/hfi1: Remove redundant PCI device ID validation Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0515/1376] RDMA/hfi1: Stop flushing the global IB workqueue Greg Kroah-Hartman
` (484 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Leon Romanovsky, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <leonro@nvidia.com>
[ Upstream commit 0d5618c1b2fc9dd4fc086f0226acd8a077ab6c1b ]
create_workqueues() only needs fields set up by hfi1_alloc_devdata().
Call it before hfi1_init_dd() so a workqueue allocation failure happens
before chip resources are initialized.
To keep the reordered error paths safe, make init_one() own hfi1_devdata.
hfi1_init_dd() unwinds its partial setup but leaves the allocation for the
caller to free. If device initialization fails, destroy the workqueues
before freeing the device data.
Link: https://patch.msgid.link/20260708-clean-init-one-hfi1-v1-6-b9e9641268a5@nvidia.com
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Stable-dep-of: 9f674ba674a0 ("RDMA/hfi1: Allocate device data after PCI initialization")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/hfi1/chip.c | 4 +---
drivers/infiniband/hw/hfi1/hfi.h | 2 --
drivers/infiniband/hw/hfi1/init.c | 19 ++++++++++---------
3 files changed, 11 insertions(+), 14 deletions(-)
diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
index c52e6b2c9914d..db96a7547fb7c 100644
--- a/drivers/infiniband/hw/hfi1/chip.c
+++ b/drivers/infiniband/hw/hfi1/chip.c
@@ -15065,7 +15065,7 @@ int hfi1_init_dd(struct hfi1_devdata *dd)
*/
ret = hfi1_pcie_ddinit(dd, pdev);
if (ret < 0)
- goto bail_free;
+ goto bail;
/* Save PCI space registers to rewrite after device reset */
ret = save_pci_variables(dd);
@@ -15320,8 +15320,6 @@ int hfi1_init_dd(struct hfi1_devdata *dd)
bail_cleanup:
hfi1_free_rx(dd);
hfi1_pcie_ddcleanup(dd);
-bail_free:
- hfi1_free_devdata(dd);
bail:
return ret;
}
diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h
index eb38f81aeeb1e..67df5c65c6e51 100644
--- a/drivers/infiniband/hw/hfi1/hfi.h
+++ b/drivers/infiniband/hw/hfi1/hfi.h
@@ -2044,9 +2044,7 @@ struct cc_state *get_cc_state_protected(struct hfi1_pportdata *ppd)
/* waiting for an urgent packet to arrive */
#define HFI1_CTXT_WAITING_URG 4
-/* free up any allocated data at closes */
int hfi1_init_dd(struct hfi1_devdata *dd);
-void hfi1_free_devdata(struct hfi1_devdata *dd);
/* LED beaconing functions */
void hfi1_start_led_override(struct hfi1_pportdata *ppd, unsigned int timeon,
diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c
index fc6c01d64050e..904a426115c54 100644
--- a/drivers/infiniband/hw/hfi1/init.c
+++ b/drivers/infiniband/hw/hfi1/init.c
@@ -630,8 +630,6 @@ void hfi1_init_pportdata(struct pci_dev *pdev, struct hfi1_pportdata *ppd,
ppd->sm_trap_qp = 0x0;
ppd->sa_qp = 0x1;
- ppd->hfi1_wq = NULL;
-
spin_lock_init(&ppd->cca_timer_lock);
for (i = 0; i < OPA_MAX_SLS; i++) {
@@ -1164,7 +1162,7 @@ static void finalize_asic_data(struct hfi1_devdata *dd,
* It cleans up and frees all data structures set up by
* by hfi1_alloc_devdata().
*/
-void hfi1_free_devdata(struct hfi1_devdata *dd)
+static void hfi1_free_devdata(struct hfi1_devdata *dd)
{
struct hfi1_asic_data *ad;
unsigned long flags;
@@ -1616,17 +1614,17 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
if (ret)
goto bail;
+ ret = create_workqueues(dd);
+ if (ret)
+ goto free_devdata;
+
/*
* Do device-specific initialization, function table setup, dd
* allocation, etc.
*/
ret = hfi1_init_dd(dd);
if (ret)
- goto clean_bail; /* error already printed */
-
- ret = create_workqueues(dd);
- if (ret)
- goto clean_bail;
+ goto destroy_workqueues; /* error already printed */
/* do the generic initialization */
initfail = hfi1_init(dd, 0);
@@ -1680,7 +1678,10 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
return 0;
-clean_bail:
+destroy_workqueues:
+ destroy_workqueues(dd);
+free_devdata:
+ hfi1_free_devdata(dd);
hfi1_pcie_cleanup(pdev);
bail:
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0515/1376] RDMA/hfi1: Stop flushing the global IB workqueue
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (513 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0514/1376] RDMA/hfi1: Create workqueues before device initialization Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0516/1376] RDMA/hfi1: Initialize debugfs after probe completes Greg Kroah-Hartman
` (483 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Leon Romanovsky, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <leonro@nvidia.com>
[ Upstream commit d43b1c17f9e1b9d34a0d742f569c00d84147ebc0 ]
hfi1 does not queue work on ib_wq. QSFP and link work run on the per-port
link_wq, while the remaining device work uses hfi1_wq or dedicated queues.
The probe failure path destroys both per-port workqueues, and normal device
removal flushes them in shutdown_device() before destroying them.
Remove the flushes of the core-owned global workqueue. Waiting for
unrelated core or other device work is not part of hfi1 teardown.
Fixes: 71d47008ca1b ("IB/hfi1: Create workqueue for link events")
Link: https://patch.msgid.link/20260708-clean-init-one-hfi1-v1-10-b9e9641268a5@nvidia.com
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/hfi1/init.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c
index 904a426115c54..d6846d77f9479 100644
--- a/drivers/infiniband/hw/hfi1/init.c
+++ b/drivers/infiniband/hw/hfi1/init.c
@@ -1650,7 +1650,6 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
if (initfail || ret) {
msix_clean_up_interrupts(dd);
stop_timers(dd);
- flush_workqueue(ib_wq);
for (pidx = 0; pidx < dd->num_pports; ++pidx) {
hfi1_quiet_serdes(dd->pport + pidx);
ppd = dd->pport + pidx;
@@ -1727,9 +1726,6 @@ static void remove_one(struct pci_dev *pdev)
stop_timers(dd);
- /* wait until all of our (qsfp) queue_work() calls complete */
- flush_workqueue(ib_wq);
-
postinit_cleanup(dd);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0516/1376] RDMA/hfi1: Initialize debugfs after probe completes
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (514 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0515/1376] RDMA/hfi1: Stop flushing the global IB workqueue Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0517/1376] ASoC: apple: mca: increase SERDES reset delay Greg Kroah-Hartman
` (482 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kalesh AP, Leon Romanovsky,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <leonro@nvidia.com>
[ Upstream commit bb18740b302f6f222ce3d5a7e5c45a52a90df805 ]
Commit ed6f653fe430 ("staging/rdma/hfi1: Fix debugfs access race") moved
debugfs creation after device initialization and IB registration so users
cannot access the files before the driver is ready. However, init_one()
still creates them before character device creation and SDMA startup
finish.
Move hfi1_dbg_ibdev_init() to the end of the successful probe path,
matching hfi1_dbg_ibdev_exit() as the first action in remove_one().
Fixes: ed6f653fe430 ("staging/rdma/hfi1: Fix debugfs access race")
Link: https://patch.msgid.link/20260708-clean-init-one-hfi1-v1-12-b9e9641268a5@nvidia.com
Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/hfi1/init.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c
index d6846d77f9479..c862ae679c9ca 100644
--- a/drivers/infiniband/hw/hfi1/init.c
+++ b/drivers/infiniband/hw/hfi1/init.c
@@ -1637,11 +1637,8 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
* we still create devices, so diags, etc. can be used
* to determine cause of problem.
*/
- if (!initfail && !ret) {
+ if (!initfail && !ret)
dd->flags |= HFI1_INITTED;
- /* create debufs files after init and ib register */
- hfi1_dbg_ibdev_init(&dd->verbs_dev);
- }
j = hfi1_device_create(dd);
if (j)
@@ -1674,6 +1671,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
}
sdma_start(dd);
+ hfi1_dbg_ibdev_init(&dd->verbs_dev);
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0517/1376] ASoC: apple: mca: increase SERDES reset delay
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (515 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0516/1376] RDMA/hfi1: Initialize debugfs after probe completes Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0518/1376] isofs: fix out-of-bounds page array access on empty zisofs block Greg Kroah-Hartman
` (481 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, James Calligeros, Mark Brown,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Calligeros <jcalligeros99@gmail.com>
[ Upstream commit cccd721e5aab03e92234faee72b363c9ba60611c ]
The SERDES clusters in this peripheral take a long time to warm up.
We tried polling the reset bit until cleared, however this is not
a reliable signal of readiness to be configured. Only waiting
~25 us to give the cluster a chance to settle makes it work
reliably.
Increase the 2 us delay to 25 us and hope we never have to do this
again.
Fixes: d8b3e396088d ("ASoC: apple: mca: Fix SERDES reset sequence")
Signed-off-by: James Calligeros <jcalligeros99@gmail.com>
Link: https://patch.msgid.link/20260711-apple-audio-redux-v4-1-2994d87c2f24@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/apple/mca.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/sound/soc/apple/mca.c b/sound/soc/apple/mca.c
index 4a4ec1c09e132..d89e57414a5da 100644
--- a/sound/soc/apple/mca.c
+++ b/sound/soc/apple/mca.c
@@ -210,10 +210,10 @@ static void mca_fe_early_trigger(struct snd_pcm_substream *substream, int cmd,
SERDES_STATUS_EN | SERDES_STATUS_RST,
SERDES_STATUS_RST);
/*
- * Experiments suggest that it takes at most ~1 us
- * for the bit to clear, so wait 2 us for good measure.
+ * The SERDES cluster needs a bit of time to reset itself
+ * and settle before we start poking it. This is... slow...
*/
- udelay(2);
+ udelay(25);
WARN_ON(readl_relaxed(cl->base + serdes_unit + REG_SERDES_STATUS) &
SERDES_STATUS_RST);
mca_modify(cl, serdes_conf, SERDES_CONF_SYNC_SEL,
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0518/1376] isofs: fix out-of-bounds page array access on empty zisofs block
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (516 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0517/1376] ASoC: apple: mca: increase SERDES reset delay Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0519/1376] iommufd/selftest: Avoid selftest dirty bitmap size wrap Greg Kroah-Hartman
` (480 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei, Jan Kara,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
[ Upstream commit 68d4d3e78150c7ed7d1195af63ad1e6ace30c661 ]
zisofs_uncompress_block()'s empty-block fast path returns
pcount << PAGE_SHIFT, ignoring the incoming poffset, unlike the
decompression path which returns bytes produced relative to poffset.
zisofs_fill_pages() uses that return to advance its page cursor, so when
the zisofs block size is below PAGE_SIZE and a sub-page block leaves
poffset partway into a page, a following empty block over-counts and
advances pages[] one element past its end, after which
"if (poffset && *pages)" reads pages[1] out of bounds. rock.c only
rejects a block-size shift > 17, so a crafted "ZF" Rock Ridge record can
set it below PAGE_SHIFT; the bug is reached by an ordinary read() of a
compressed file on such a mounted ISO9660 image.
Return the byte count relative to poffset and zero only
[poffset, PAGE_SIZE) of the first page, matching the decompression path.
The page-aligned case (poffset == 0) is unaffected.
BUG: KASAN: slab-out-of-bounds in zisofs_read_folio (fs/isofs/compress.c:290)
Read of size 8 at addr ffff88800f5eac48 by task exploit/142
zisofs_read_folio (fs/isofs/compress.c:290)
read_pages (mm/readahead.c:184)
...
filemap_read (mm/filemap.c:2814)
vfs_read (fs/read_write.c:574)
__x64_sys_pread64 (fs/read_write.c:769)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
The buggy address is located 0 bytes to the right of the
allocated 8-byte region in the kmalloc-8 cache
Fixes: 59bc055211b8 ("zisofs: Implement reading of compressed files when PAGE_CACHE_SIZE > compress block size")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Link: https://patch.msgid.link/20260712234150.3213467-1-xmei5@asu.edu
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/isofs/compress.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/fs/isofs/compress.c b/fs/isofs/compress.c
index 34d5baa5d88a0..05b9fa80ba9c2 100644
--- a/fs/isofs/compress.c
+++ b/fs/isofs/compress.c
@@ -65,12 +65,14 @@ static loff_t zisofs_uncompress_block(struct inode *inode, loff_t block_start,
/* Empty block? */
if (block_size == 0) {
for ( i = 0 ; i < pcount ; i++ ) {
+ unsigned int off = i ? 0 : poffset;
+
if (!pages[i])
continue;
- memzero_page(pages[i], 0, PAGE_SIZE);
+ memzero_page(pages[i], off, PAGE_SIZE - off);
SetPageUptodate(pages[i]);
}
- return ((loff_t)pcount) << PAGE_SHIFT;
+ return (((loff_t)pcount) << PAGE_SHIFT) - poffset;
}
/* Because zlib is not thread-safe, do all the I/O at the top. */
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0519/1376] iommufd/selftest: Avoid selftest dirty bitmap size wrap
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (517 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0518/1376] isofs: fix out-of-bounds page array access on empty zisofs block Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0520/1376] media: v4l2-async: Unregister sub-device if asc_list is empty Greg Kroah-Hartman
` (479 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Samuel Moelius, Jason Gunthorpe,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Moelius <sam.moelius@trailofbits.com>
[ Upstream commit 4132ba2ae2cf14c289e3fabc1c95ac244d643356 ]
IOMMU_TEST_OP_DIRTY sizes its temporary dirty bitmap from length /
page_size. Very large selftest ranges can make the DIV_ROUND_UP()
additions wrap before allocation, producing a zero-length allocation while
the later test_bit() loop still walks the original number of bits.
The selftest helper does not need to support unbounded dirty bitmap sizes.
Reject requests that would allocate more than SZ_16M for the temporary
buffer.
Fixes: 79ea4a496ab5 ("iommufd/selftest: Fix buffer read overrrun in the dirty test")
Link: https://patch.msgid.link/r/20260628152331.82122.408afd7b466c.iommufd-test-dirty-bitmap-size-wrap@trailofbits.com
Assisted-by: Codex:gpt-5.5-cyber-preview
Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/iommufd/selftest.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/iommu/iommufd/selftest.c b/drivers/iommu/iommufd/selftest.c
index aed260d4a93cc..8ec251acd9238 100644
--- a/drivers/iommu/iommufd/selftest.c
+++ b/drivers/iommu/iommufd/selftest.c
@@ -10,6 +10,7 @@
#include <linux/iommu.h>
#include <linux/platform_device.h>
#include <linux/slab.h>
+#include <linux/sizes.h>
#include <linux/xarray.h>
#include <uapi/linux/iommufd.h>
@@ -1359,6 +1360,9 @@ static int iommufd_test_dirty(struct iommufd_ucmd *ucmd, unsigned int mockpt_id,
if (!page_size || !length || iova % page_size || length % page_size ||
!uptr)
return -EINVAL;
+ max = length / page_size;
+ if (max > SZ_16M * BITS_PER_BYTE)
+ return -EOVERFLOW;
hwpt = get_md_pagetable(ucmd, mockpt_id, &mock);
if (IS_ERR(hwpt))
@@ -1369,7 +1373,6 @@ static int iommufd_test_dirty(struct iommufd_ucmd *ucmd, unsigned int mockpt_id,
goto out_put;
}
- max = length / page_size;
tmp = kvzalloc(DIV_ROUND_UP(max, BITS_PER_LONG) * sizeof(unsigned long),
GFP_KERNEL_ACCOUNT);
if (!tmp) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0520/1376] media: v4l2-async: Unregister sub-device if asc_list is empty
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (518 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0519/1376] iommufd/selftest: Avoid selftest dirty bitmap size wrap Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0521/1376] rpmsg: glink: remove duplicate code for rpmsg device remove Greg Kroah-Hartman
` (478 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans Verkuil, Sakari Ailus,
Mauro Carvalho Chehab, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <hverkuil+cisco@kernel.org>
[ Upstream commit 4e72f13d58c4245c177a9d5f54579345554f354d ]
When my em28xx USB device that uses the i2c tvp5150 driver is
disconnected, it crashes.
The cause is that the tvp5150 i2c module uses v4l2_async, but
the em28xx driver does not since it predates v4l2_async.
In that corner case sd->asc_list is empty, so
v4l2_async_unregister_subdev() never calls v4l2_device_unregister_subdev().
Modify the code so that, if sd->asc_list is empty,
v4l2_device_unregister_subdev() is still called.
Fixes: 28a1295795d8 ("media: v4l: async: Allow multiple connections between entities")
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Tested-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/v4l2-core/v4l2-async.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
diff --git a/drivers/media/v4l2-core/v4l2-async.c b/drivers/media/v4l2-core/v4l2-async.c
index 70284f50e1f93..5f6685e34d90f 100644
--- a/drivers/media/v4l2-core/v4l2-async.c
+++ b/drivers/media/v4l2-core/v4l2-async.c
@@ -897,9 +897,18 @@ void v4l2_async_unregister_subdev(struct v4l2_subdev *sd)
sd->subdev_notifier = NULL;
if (sd->asc_list.next) {
- list_for_each_entry_safe(asc, asc_tmp, &sd->asc_list,
- asc_subdev_entry) {
- v4l2_async_unbind_subdev_one(asc->notifier, asc);
+ if (list_empty(&sd->asc_list)) {
+ /*
+ * If the sub-device was registered through other means
+ * than v4l2-async, there are no async connections but
+ * the sub-device may still well be registered.
+ * Unregister it now.
+ */
+ v4l2_device_unregister_subdev(sd);
+ } else {
+ list_for_each_entry_safe(asc, asc_tmp, &sd->asc_list,
+ asc_subdev_entry)
+ v4l2_async_unbind_subdev_one(asc->notifier, asc);
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0521/1376] rpmsg: glink: remove duplicate code for rpmsg device remove
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (519 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0520/1376] media: v4l2-async: Unregister sub-device if asc_list is empty Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0522/1376] rpmsg: glink: fix deadlock in endpoint destroy during driver detach Greg Kroah-Hartman
` (477 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srinivas Kandagatla, Bjorn Andersson,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
[ Upstream commit 112766cdf2e5ea0a0f72b0304d57a6f74c066670 ]
rpmsg device remove code is duplicated in at-least 2-3 places, add a
helper function to remove this duplicated code.
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250822100043.2604794-3-srinivas.kandagatla@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Stable-dep-of: 5a5a48e788e0 ("rpmsg: glink: fix deadlock in endpoint destroy during driver detach")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rpmsg/qcom_glink_native.c | 43 ++++++++++++-------------------
1 file changed, 16 insertions(+), 27 deletions(-)
diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c
index c2d39a3bcea7e..9d4fee6409423 100644
--- a/drivers/rpmsg/qcom_glink_native.c
+++ b/drivers/rpmsg/qcom_glink_native.c
@@ -1395,11 +1395,23 @@ static int qcom_glink_announce_create(struct rpmsg_device *rpdev)
return 0;
}
+static void qcom_glink_remove_rpmsg_device(struct qcom_glink *glink, struct glink_channel *channel)
+{
+ struct rpmsg_channel_info chinfo;
+
+ if (channel->rpdev) {
+ strscpy_pad(chinfo.name, channel->name, sizeof(chinfo.name));
+ chinfo.src = RPMSG_ADDR_ANY;
+ chinfo.dst = RPMSG_ADDR_ANY;
+ rpmsg_unregister_device(glink->dev, &chinfo);
+ }
+ channel->rpdev = NULL;
+}
+
static void qcom_glink_destroy_ept(struct rpmsg_endpoint *ept)
{
struct glink_channel *channel = to_glink_channel(ept);
struct qcom_glink *glink = channel->glink;
- struct rpmsg_channel_info chinfo;
unsigned long flags;
spin_lock_irqsave(&channel->recv_lock, flags);
@@ -1407,14 +1419,7 @@ static void qcom_glink_destroy_ept(struct rpmsg_endpoint *ept)
spin_unlock_irqrestore(&channel->recv_lock, flags);
/* Decouple the potential rpdev from the channel */
- if (channel->rpdev) {
- strscpy_pad(chinfo.name, channel->name, sizeof(chinfo.name));
- chinfo.src = RPMSG_ADDR_ANY;
- chinfo.dst = RPMSG_ADDR_ANY;
-
- rpmsg_unregister_device(glink->dev, &chinfo);
- }
- channel->rpdev = NULL;
+ qcom_glink_remove_rpmsg_device(glink, channel);
qcom_glink_send_close_req(glink, channel);
}
@@ -1704,7 +1709,6 @@ static int qcom_glink_rx_open(struct qcom_glink *glink, unsigned int rcid,
static void qcom_glink_rx_close(struct qcom_glink *glink, unsigned int rcid)
{
- struct rpmsg_channel_info chinfo;
struct glink_channel *channel;
unsigned long flags;
@@ -1720,14 +1724,7 @@ static void qcom_glink_rx_close(struct qcom_glink *glink, unsigned int rcid)
/* cancel pending rx_done work */
cancel_work_sync(&channel->intent_work);
- if (channel->rpdev) {
- strscpy_pad(chinfo.name, channel->name, sizeof(chinfo.name));
- chinfo.src = RPMSG_ADDR_ANY;
- chinfo.dst = RPMSG_ADDR_ANY;
-
- rpmsg_unregister_device(glink->dev, &chinfo);
- }
- channel->rpdev = NULL;
+ qcom_glink_remove_rpmsg_device(glink, channel);
qcom_glink_send_close_ack(glink, channel);
@@ -1741,7 +1738,6 @@ static void qcom_glink_rx_close(struct qcom_glink *glink, unsigned int rcid)
static void qcom_glink_rx_close_ack(struct qcom_glink *glink, unsigned int lcid)
{
- struct rpmsg_channel_info chinfo;
struct glink_channel *channel;
unsigned long flags;
@@ -1763,14 +1759,7 @@ static void qcom_glink_rx_close_ack(struct qcom_glink *glink, unsigned int lcid)
spin_unlock_irqrestore(&glink->idr_lock, flags);
/* Decouple the potential rpdev from the channel */
- if (channel->rpdev) {
- strscpy(chinfo.name, channel->name, sizeof(chinfo.name));
- chinfo.src = RPMSG_ADDR_ANY;
- chinfo.dst = RPMSG_ADDR_ANY;
-
- rpmsg_unregister_device(glink->dev, &chinfo);
- }
- channel->rpdev = NULL;
+ qcom_glink_remove_rpmsg_device(glink, channel);
kref_put(&channel->refcount, qcom_glink_channel_release);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0522/1376] rpmsg: glink: fix deadlock in endpoint destroy during driver detach
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (520 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0521/1376] rpmsg: glink: remove duplicate code for rpmsg device remove Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0523/1376] cxl/memdev: Fix firmware upload exact-fit handling Greg Kroah-Hartman
` (476 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Deepak Kumar Singh, Vishnu Santhosh,
Bjorn Andersson, Dmitry Baryshkov, Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vishnu Santhosh <vishnu.santhosh@oss.qualcomm.com>
[ Upstream commit 5a5a48e788e02fd8a8eb7188ce440572d6c12418 ]
During driver detach, the device core holds the device mutex throughout
the driver's remove callback chain. When the rpmsg endpoint is
destroyed as part of that teardown, the GLINK endpoint destroy
implementation attempts to unregister the underlying rpmsg device.
That unregistration calls device_del(), which tries to re-acquire the
same device mutex already held higher up the stack, causing rmmod to
hang indefinitely.
The deadlock manifests with the following call chain:
[<0>] device_del+0x44/0x414 <- tries to acquire same mutex
[<0>] device_unregister+0x18/0x34
[<0>] rpmsg_unregister_device+0x28/0x4c
[<0>] qcom_glink_remove_rpmsg_device+0x70/0xc0
[<0>] qcom_glink_destroy_ept+0x58/0xbc
[<0>] rpmsg_dev_remove+0x50/0x60
[<0>] device_remove+0x4c/0x80
[<0>] device_release_driver_internal+0x1cc/0x228 <- acquires device mutex
[<0>] driver_detach+0x4c/0x98
[<0>] bus_remove_driver+0x6c/0xbc
[<0>] driver_unregister+0x30/0x60
[<0>] unregister_rpmsg_driver+0x10/0x1c
[<0>] fastrpc_exit+0x28/0x38 [fastrpc]
[<0>] __arm64_sys_delete_module+0x1b8/0x294
[<0>] invoke_syscall+0x48/0x10c
[<0>] el0_svc_common.constprop.0+0xc0/0xe0
[<0>] do_el0_svc+0x1c/0x28
[<0>] el0_svc+0x34/0x108
[<0>] el0t_64_sync_handler+0xa0/0xe4
[<0>] el0t_64_sync+0x198/0x19c
The rpmsg device unregistration inside endpoint destroy is redundant.
In both contexts where endpoint destruction is triggered:
- Driver detach path: the driver core already tears down the rpmsg
device.
- Channel close path: the rpmsg device is already unregistered before
endpoint destruction is reached.
Remove the redundant unregistration to fix the deadlock.
Co-developed-by: Deepak Kumar Singh <deepak.singh@oss.qualcomm.com>
Signed-off-by: Deepak Kumar Singh <deepak.singh@oss.qualcomm.com>
Signed-off-by: Vishnu Santhosh <vishnu.santhosh@oss.qualcomm.com>
Tested-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
Fixes: a53e356df548 ("rpmsg: glink: fix rpmsg device leak")
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260604-rpmsg-glink-fix-deadlock-destroy-ept-v1-1-b8a54ad1e4fd@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rpmsg/qcom_glink_native.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c
index 9d4fee6409423..c21a5e4da0f68 100644
--- a/drivers/rpmsg/qcom_glink_native.c
+++ b/drivers/rpmsg/qcom_glink_native.c
@@ -1418,9 +1418,6 @@ static void qcom_glink_destroy_ept(struct rpmsg_endpoint *ept)
channel->ept.cb = NULL;
spin_unlock_irqrestore(&channel->recv_lock, flags);
- /* Decouple the potential rpdev from the channel */
- qcom_glink_remove_rpmsg_device(glink, channel);
-
qcom_glink_send_close_req(glink, channel);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0523/1376] cxl/memdev: Fix firmware upload exact-fit handling
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (521 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0522/1376] rpmsg: glink: fix deadlock in endpoint destroy during driver detach Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0524/1376] cxl/mbox: Break poison list loop on an empty payload Greg Kroah-Hartman
` (475 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guzebing, Dave Jiang, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guzebing <Guzebing1612@gmail.com>
[ Upstream commit af5035e1b3e400067bb003975936e5407377e7a3 ]
cxl_fw_prepare() classifies a firmware image as a one-shot transfer
only when its Transfer FW input payload is smaller than the mailbox
payload size. An image that exactly fills the payload is therefore
treated as a multi-part transfer.
The firmware loader invokes cxl_fw_write() only once for that image.
Since both offset == 0 and remaining == 0, the multi-part action
selection sends INITIATE, never sends END, and then attempts to activate
the target slot.
Include equality in the one-shot classification so exact-fit images use
the FULL action.
Fixes: 9521875bbe00 ("cxl: add a firmware update mechanism using the sysfs firmware loader")
Signed-off-by: Guzebing <Guzebing1612@gmail.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Link: https://patch.msgid.link/20260713112744.2543829-1-guzebing1612@gmail.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cxl/core/memdev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/cxl/core/memdev.c b/drivers/cxl/core/memdev.c
index 4d544a55ac3e8..d2a554c2f92b0 100644
--- a/drivers/cxl/core/memdev.c
+++ b/drivers/cxl/core/memdev.c
@@ -845,7 +845,7 @@ static enum fw_upload_err cxl_fw_prepare(struct fw_upload *fwl, const u8 *data,
if (!size)
return FW_UPLOAD_ERR_INVALID_SIZE;
- mds->fw.oneshot = struct_size(transfer, data, size) <
+ mds->fw.oneshot = struct_size(transfer, data, size) <=
cxl_mbox->payload_size;
if (cxl_mem_get_fw_info(mds))
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0524/1376] cxl/mbox: Break poison list loop on an empty payload
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (522 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0523/1376] cxl/memdev: Fix firmware upload exact-fit handling Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0525/1376] cxl/pci: Honor -EPROBE_DEFER from component register setup Greg Kroah-Hartman
` (474 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alison Schofield, Dave Jiang,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Jiang <dave.jiang@intel.com>
[ Upstream commit 8b301c4afbce4bc3f94528441d8d5ce1366504ad ]
A device that returns count == 0 with CXL_POISON_FLAG_MORE set on every
iteration never advances nr_records, so the max_errors guard never
trips and the do/while loops forever while holding poison.mutex. That
hangs the sysfs-triggered scan thread and blocks all subsequent poison
operations on the device. The existing "Protect against an uncleared
_FLAG_MORE" guard was intended to bound a misbehaving device but does
not cover the count == 0 case.
Stop the loop on an empty payload so a malfunctioning or malicious
device cannot wedge the poison scan.
Link: https://sashiko.dev/#/patchset/20260702090849.47501-1-icheng@nvidia.com?part=3
Fixes: ed83f7ca398b ("cxl/mbox: Add GET_POISON_LIST mailbox command")
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Link: https://patch.msgid.link/20260709155714.1893280-1-dave.jiang@intel.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cxl/core/mbox.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/cxl/core/mbox.c b/drivers/cxl/core/mbox.c
index 9b178abd1528e..b094aac78ca15 100644
--- a/drivers/cxl/core/mbox.c
+++ b/drivers/cxl/core/mbox.c
@@ -1358,6 +1358,11 @@ int cxl_mem_get_poison(struct cxl_memdev *cxlmd, u64 offset, u64 len,
if (rc)
break;
+ if (!le16_to_cpu(po->count)) {
+ dev_dbg(&cxlmd->dev, "Poison empty payload!\n");
+ break;
+ }
+
for (int i = 0; i < le16_to_cpu(po->count); i++)
trace_cxl_poison(cxlmd, cxlr, &po->record[i],
po->flags, po->overflow_ts,
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0525/1376] cxl/pci: Honor -EPROBE_DEFER from component register setup
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (523 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0524/1376] cxl/mbox: Break poison list loop on an empty payload Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0526/1376] fs/ntfs3: Add more checks in mi_enum_attr (part 2) Greg Kroah-Hartman
` (473 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Alison Schofield,
Dave Jiang, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Jiang <dave.jiang@intel.com>
[ Upstream commit 430c502c80e542e77bcf97db13ec0e8cdf9addb0 ]
cxl_pci_setup_regs() for CXL_REGLOC_RBI_COMPONENT can return
-EPROBE_DEFER on a Restricted CXL Host (RCD) when the upstream port
has not yet been enumerated and the Component Registers must be
extracted from the RCRB. cxl_pci_probe() treats every non-zero return
from that call as the benign "component registers not found" case,
logs a warning, and continues. The rc is then immediately overwritten
by the subsequent cxl_pci_type3_init_mailbox() call, so the deferral
is silently swallowed.
Return -EPROBE_DEFER instead of continuing so the probe is retried
once the upstream port is available.
Fixes: 733b57f262b0 ("cxl/pci: Early setup RCH dport component registers from RCRB")
Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/linux-cxl/ajzhsubot_PSYtHQ@MWDK4CY14F/T/#m063bbf76b1c9c293ade52ab311018ae6bba11a44
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Link: https://lore.kernel.org/linux-cxl/ajzhsubot_PSYtHQ@MWDK4CY14F/T/#m063bbf76b1c9c293ade52ab311018ae6bba11a44
Link: https://patch.msgid.link/20260706224322.714934-1-dave.jiang@intel.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cxl/pci.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/cxl/pci.c b/drivers/cxl/pci.c
index 02040b51f44ec..82cbacb3e2ca1 100644
--- a/drivers/cxl/pci.c
+++ b/drivers/cxl/pci.c
@@ -851,10 +851,13 @@ static int cxl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
*/
rc = cxl_pci_setup_regs(pdev, CXL_REGLOC_RBI_COMPONENT,
&cxlds->reg_map);
- if (rc)
+ if (rc) {
+ if (rc == -EPROBE_DEFER)
+ return rc;
dev_warn(&pdev->dev, "No component registers (%d)\n", rc);
- else if (!cxlds->reg_map.component_map.ras.valid)
+ } else if (!cxlds->reg_map.component_map.ras.valid) {
dev_dbg(&pdev->dev, "RAS registers not found\n");
+ }
rc = cxl_map_component_regs(&cxlds->reg_map, &cxlds->regs.component,
BIT(CXL_CM_CAP_CAP_ID_RAS));
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0526/1376] fs/ntfs3: Add more checks in mi_enum_attr (part 2)
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (524 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0525/1376] cxl/pci: Honor -EPROBE_DEFER from component register setup Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0527/1376] fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr() Greg Kroah-Hartman
` (472 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, lei lu, Konstantin Komarov,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
[ Upstream commit a8f659ce14f8f734894227ba2c5ca78c8451501e ]
Add offset check before access to attr->non_res field as mentioned in [1].
[1] https://lore.kernel.org/ntfs3/20241010110005.42792-1-llfamsec@gmail.com/
Suggested-by: lei lu <llfamsec@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Stable-dep-of: 7c4841e2a627 ("fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/record.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c
index f810f0419d25e..61d53d39f3b9f 100644
--- a/fs/ntfs3/record.c
+++ b/fs/ntfs3/record.c
@@ -212,7 +212,7 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
return NULL;
if (off >= used || off < MFTRECORD_FIXUP_OFFSET_1 ||
- !IS_ALIGNED(off, 4)) {
+ !IS_ALIGNED(off, 8)) {
return NULL;
}
@@ -236,8 +236,11 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
off += asize;
}
- /* Can we use the first field (attr->type). */
- /* NOTE: this code also checks attr->size availability. */
+ /*
+ * Can we use the first fields:
+ * attr->type,
+ * attr->size
+ */
if (off + 8 > used) {
static_assert(ALIGN(sizeof(enum ATTR_TYPE), 8) == 8);
return NULL;
@@ -259,10 +262,17 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
asize = le32_to_cpu(attr->size);
+ if (!IS_ALIGNED(asize, 8))
+ return NULL;
+
/* Check overflow and boundary. */
if (off + asize < off || off + asize > used)
return NULL;
+ /* Can we use the field attr->non_res. */
+ if (off + 9 > used)
+ return NULL;
+
/* Check size of attribute. */
if (!attr->non_res) {
/* Check resident fields. */
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0527/1376] fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (525 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0526/1376] fs/ntfs3: Add more checks in mi_enum_attr (part 2) Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0528/1376] fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list Greg Kroah-Hartman
` (471 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+73d8fc29ec7cba8286fa,
Konstantin Komarov, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
[ Upstream commit 2afd4d267e6dbaec8d3ccd4f5396cb84bc67aa2e ]
Extended the `mi_enum_attr()` function interface with an additional
parameter, `struct ntfs_inode *ni`, to allow marking the inode
as bad as soon as an error is detected.
Reported-by: syzbot+73d8fc29ec7cba8286fa@syzkaller.appspotmail.com
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Stable-dep-of: 7c4841e2a627 ("fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/attrib.c | 11 ++++---
fs/ntfs3/frecord.c | 59 ++++++++++++++++++----------------
fs/ntfs3/ntfs_fs.h | 21 ++++++------
fs/ntfs3/record.c | 79 ++++++++++++++++++++++++----------------------
4 files changed, 90 insertions(+), 80 deletions(-)
diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c
index 940a8293abe9c..526f86a6fe518 100644
--- a/fs/ntfs3/attrib.c
+++ b/fs/ntfs3/attrib.c
@@ -789,7 +789,8 @@ int attr_set_size(struct ntfs_inode *ni, enum ATTR_TYPE type,
if (err)
goto out;
- attr = mi_find_attr(mi, NULL, type, name, name_len, &le->id);
+ attr = mi_find_attr(ni, mi, NULL, type, name, name_len,
+ &le->id);
if (!attr) {
err = -EINVAL;
goto bad_inode;
@@ -1197,7 +1198,7 @@ int attr_data_get_block(struct ntfs_inode *ni, CLST vcn, CLST clen, CLST *lcn,
goto out;
}
- attr = mi_find_attr(mi, NULL, ATTR_DATA, NULL, 0, &le->id);
+ attr = mi_find_attr(ni, mi, NULL, ATTR_DATA, NULL, 0, &le->id);
if (!attr) {
err = -EINVAL;
goto out;
@@ -1821,7 +1822,7 @@ int attr_allocate_frame(struct ntfs_inode *ni, CLST frame, size_t compr_size,
goto out;
}
- attr = mi_find_attr(mi, NULL, ATTR_DATA, NULL, 0,
+ attr = mi_find_attr(ni, mi, NULL, ATTR_DATA, NULL, 0,
&le->id);
if (!attr) {
err = -EINVAL;
@@ -2066,8 +2067,8 @@ int attr_collapse_range(struct ntfs_inode *ni, u64 vbo, u64 bytes)
}
/* Look for required attribute. */
- attr = mi_find_attr(mi, NULL, ATTR_DATA, NULL,
- 0, &le->id);
+ attr = mi_find_attr(ni, mi, NULL, ATTR_DATA,
+ NULL, 0, &le->id);
if (!attr) {
err = -EINVAL;
goto out;
diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c
index 65daa4f31d378..b2791327af22f 100644
--- a/fs/ntfs3/frecord.c
+++ b/fs/ntfs3/frecord.c
@@ -75,7 +75,7 @@ struct ATTR_STD_INFO *ni_std(struct ntfs_inode *ni)
{
const struct ATTRIB *attr;
- attr = mi_find_attr(&ni->mi, NULL, ATTR_STD, NULL, 0, NULL);
+ attr = mi_find_attr(ni, &ni->mi, NULL, ATTR_STD, NULL, 0, NULL);
return attr ? resident_data_ex(attr, sizeof(struct ATTR_STD_INFO)) :
NULL;
}
@@ -89,7 +89,7 @@ struct ATTR_STD_INFO5 *ni_std5(struct ntfs_inode *ni)
{
const struct ATTRIB *attr;
- attr = mi_find_attr(&ni->mi, NULL, ATTR_STD, NULL, 0, NULL);
+ attr = mi_find_attr(ni, &ni->mi, NULL, ATTR_STD, NULL, 0, NULL);
return attr ? resident_data_ex(attr, sizeof(struct ATTR_STD_INFO5)) :
NULL;
@@ -203,7 +203,8 @@ struct ATTRIB *ni_find_attr(struct ntfs_inode *ni, struct ATTRIB *attr,
*mi = &ni->mi;
/* Look for required attribute in primary record. */
- return mi_find_attr(&ni->mi, attr, type, name, name_len, NULL);
+ return mi_find_attr(ni, &ni->mi, attr, type, name, name_len,
+ NULL);
}
/* First look for list entry of required type. */
@@ -219,7 +220,7 @@ struct ATTRIB *ni_find_attr(struct ntfs_inode *ni, struct ATTRIB *attr,
return NULL;
/* Look for required attribute. */
- attr = mi_find_attr(m, NULL, type, name, name_len, &le->id);
+ attr = mi_find_attr(ni, m, NULL, type, name, name_len, &le->id);
if (!attr)
goto out;
@@ -260,7 +261,7 @@ struct ATTRIB *ni_enum_attr_ex(struct ntfs_inode *ni, struct ATTRIB *attr,
if (mi)
*mi = &ni->mi;
/* Enum attributes in primary record. */
- return mi_enum_attr(&ni->mi, attr);
+ return mi_enum_attr(ni, &ni->mi, attr);
}
/* Get next list entry. */
@@ -276,7 +277,7 @@ struct ATTRIB *ni_enum_attr_ex(struct ntfs_inode *ni, struct ATTRIB *attr,
*mi = mi2;
/* Find attribute in loaded record. */
- return rec_find_attr_le(mi2, le2);
+ return rec_find_attr_le(ni, mi2, le2);
}
/*
@@ -294,7 +295,8 @@ struct ATTRIB *ni_load_attr(struct ntfs_inode *ni, enum ATTR_TYPE type,
if (!ni->attr_list.size) {
if (pmi)
*pmi = &ni->mi;
- return mi_find_attr(&ni->mi, NULL, type, name, name_len, NULL);
+ return mi_find_attr(ni, &ni->mi, NULL, type, name, name_len,
+ NULL);
}
le = al_find_ex(ni, NULL, type, name, name_len, NULL);
@@ -320,7 +322,7 @@ struct ATTRIB *ni_load_attr(struct ntfs_inode *ni, enum ATTR_TYPE type,
if (pmi)
*pmi = mi;
- attr = mi_find_attr(mi, NULL, type, name, name_len, &le->id);
+ attr = mi_find_attr(ni, mi, NULL, type, name, name_len, &le->id);
if (!attr)
return NULL;
@@ -402,7 +404,8 @@ int ni_remove_attr(struct ntfs_inode *ni, enum ATTR_TYPE type,
int diff;
if (base_only || type == ATTR_LIST || !ni->attr_list.size) {
- attr = mi_find_attr(&ni->mi, NULL, type, name, name_len, id);
+ attr = mi_find_attr(ni, &ni->mi, NULL, type, name, name_len,
+ id);
if (!attr)
return -ENOENT;
@@ -441,7 +444,7 @@ int ni_remove_attr(struct ntfs_inode *ni, enum ATTR_TYPE type,
al_remove_le(ni, le);
- attr = mi_find_attr(mi, NULL, type, name, name_len, id);
+ attr = mi_find_attr(ni, mi, NULL, type, name, name_len, id);
if (!attr)
return -ENOENT;
@@ -489,7 +492,7 @@ ni_ins_new_attr(struct ntfs_inode *ni, struct mft_inode *mi,
name = le->name;
}
- attr = mi_insert_attr(mi, type, name, name_len, asize, name_off);
+ attr = mi_insert_attr(ni, mi, type, name, name_len, asize, name_off);
if (!attr) {
if (le_added)
al_remove_le(ni, le);
@@ -677,7 +680,7 @@ static int ni_try_remove_attr_list(struct ntfs_inode *ni)
if (err)
return err;
- attr_list = mi_find_attr(&ni->mi, NULL, ATTR_LIST, NULL, 0, NULL);
+ attr_list = mi_find_attr(ni, &ni->mi, NULL, ATTR_LIST, NULL, 0, NULL);
if (!attr_list)
return 0;
@@ -699,7 +702,7 @@ static int ni_try_remove_attr_list(struct ntfs_inode *ni)
if (!mi)
return 0;
- attr = mi_find_attr(mi, NULL, le->type, le_name(le),
+ attr = mi_find_attr(ni, mi, NULL, le->type, le_name(le),
le->name_len, &le->id);
if (!attr)
return 0;
@@ -735,7 +738,7 @@ static int ni_try_remove_attr_list(struct ntfs_inode *ni)
goto out;
}
- attr = mi_find_attr(mi, NULL, le->type, le_name(le),
+ attr = mi_find_attr(ni, mi, NULL, le->type, le_name(le),
le->name_len, &le->id);
if (!attr) {
/* Should never happened, 'cause already checked. */
@@ -744,7 +747,7 @@ static int ni_try_remove_attr_list(struct ntfs_inode *ni)
asize = le32_to_cpu(attr->size);
/* Insert into primary record. */
- attr_ins = mi_insert_attr(&ni->mi, le->type, le_name(le),
+ attr_ins = mi_insert_attr(ni, &ni->mi, le->type, le_name(le),
le->name_len, asize,
le16_to_cpu(attr->name_off));
if (!attr_ins) {
@@ -772,7 +775,7 @@ static int ni_try_remove_attr_list(struct ntfs_inode *ni)
if (!mi)
continue;
- attr = mi_find_attr(mi, NULL, le->type, le_name(le),
+ attr = mi_find_attr(ni, mi, NULL, le->type, le_name(le),
le->name_len, &le->id);
if (!attr)
continue;
@@ -835,7 +838,7 @@ int ni_create_attr_list(struct ntfs_inode *ni)
free_b = 0;
attr = NULL;
- for (; (attr = mi_enum_attr(&ni->mi, attr)); le = Add2Ptr(le, sz)) {
+ for (; (attr = mi_enum_attr(ni, &ni->mi, attr)); le = Add2Ptr(le, sz)) {
sz = le_size(attr->name_len);
le->type = attr->type;
le->size = cpu_to_le16(sz);
@@ -890,7 +893,7 @@ int ni_create_attr_list(struct ntfs_inode *ni)
u32 asize = le32_to_cpu(b->size);
u16 name_off = le16_to_cpu(b->name_off);
- attr = mi_insert_attr(mi, b->type, Add2Ptr(b, name_off),
+ attr = mi_insert_attr(ni, mi, b->type, Add2Ptr(b, name_off),
b->name_len, asize, name_off);
if (!attr)
goto out;
@@ -913,7 +916,7 @@ int ni_create_attr_list(struct ntfs_inode *ni)
goto out;
}
- attr = mi_insert_attr(&ni->mi, ATTR_LIST, NULL, 0,
+ attr = mi_insert_attr(ni, &ni->mi, ATTR_LIST, NULL, 0,
lsize + SIZEOF_RESIDENT, SIZEOF_RESIDENT);
if (!attr)
goto out;
@@ -997,13 +1000,13 @@ static int ni_ins_attr_ext(struct ntfs_inode *ni, struct ATTR_LIST_ENTRY *le,
mi = rb_entry(node, struct mft_inode, node);
if (is_mft_data &&
- (mi_enum_attr(mi, NULL) ||
+ (mi_enum_attr(ni, mi, NULL) ||
vbo <= ((u64)mi->rno << sbi->record_bits))) {
/* We can't accept this record 'cause MFT's bootstrapping. */
continue;
}
if (is_mft &&
- mi_find_attr(mi, NULL, ATTR_DATA, NULL, 0, NULL)) {
+ mi_find_attr(ni, mi, NULL, ATTR_DATA, NULL, 0, NULL)) {
/*
* This child record already has a ATTR_DATA.
* So it can't accept any other records.
@@ -1012,7 +1015,7 @@ static int ni_ins_attr_ext(struct ntfs_inode *ni, struct ATTR_LIST_ENTRY *le,
}
if ((type != ATTR_NAME || name_len) &&
- mi_find_attr(mi, NULL, type, name, name_len, NULL)) {
+ mi_find_attr(ni, mi, NULL, type, name, name_len, NULL)) {
/* Only indexed attributes can share same record. */
continue;
}
@@ -1161,7 +1164,7 @@ static int ni_insert_attr(struct ntfs_inode *ni, enum ATTR_TYPE type,
/* Estimate the result of moving all possible attributes away. */
attr = NULL;
- while ((attr = mi_enum_attr(&ni->mi, attr))) {
+ while ((attr = mi_enum_attr(ni, &ni->mi, attr))) {
if (attr->type == ATTR_STD)
continue;
if (attr->type == ATTR_LIST)
@@ -1179,7 +1182,7 @@ static int ni_insert_attr(struct ntfs_inode *ni, enum ATTR_TYPE type,
attr = NULL;
for (;;) {
- attr = mi_enum_attr(&ni->mi, attr);
+ attr = mi_enum_attr(ni, &ni->mi, attr);
if (!attr) {
/* We should never be here 'cause we have already check this case. */
err = -EINVAL;
@@ -1263,7 +1266,7 @@ static int ni_expand_mft_list(struct ntfs_inode *ni)
for (node = rb_first(&ni->mi_tree); node; node = rb_next(node)) {
mi = rb_entry(node, struct mft_inode, node);
- attr = mi_enum_attr(mi, NULL);
+ attr = mi_enum_attr(ni, mi, NULL);
if (!attr) {
mft_min = mi->rno;
@@ -1284,7 +1287,7 @@ static int ni_expand_mft_list(struct ntfs_inode *ni)
ni_remove_mi(ni, mi_new);
}
- attr = mi_find_attr(&ni->mi, NULL, ATTR_DATA, NULL, 0, NULL);
+ attr = mi_find_attr(ni, &ni->mi, NULL, ATTR_DATA, NULL, 0, NULL);
if (!attr) {
err = -EINVAL;
goto out;
@@ -1401,7 +1404,7 @@ int ni_expand_list(struct ntfs_inode *ni)
continue;
/* Find attribute in primary record. */
- attr = rec_find_attr_le(&ni->mi, le);
+ attr = rec_find_attr_le(ni, &ni->mi, le);
if (!attr) {
err = -EINVAL;
goto out;
@@ -3430,7 +3433,7 @@ int ni_write_inode(struct inode *inode, int sync, const char *hint)
if (!mi->dirty)
continue;
- is_empty = !mi_enum_attr(mi, NULL);
+ is_empty = !mi_enum_attr(ni, mi, NULL);
if (is_empty)
clear_rec_inuse(mi->mrec);
diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h
index 919fb3f36af0e..11be9a6f041cf 100644
--- a/fs/ntfs3/ntfs_fs.h
+++ b/fs/ntfs3/ntfs_fs.h
@@ -746,23 +746,24 @@ int mi_get(struct ntfs_sb_info *sbi, CLST rno, struct mft_inode **mi);
void mi_put(struct mft_inode *mi);
int mi_init(struct mft_inode *mi, struct ntfs_sb_info *sbi, CLST rno);
int mi_read(struct mft_inode *mi, bool is_mft);
-struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr);
-// TODO: id?
-struct ATTRIB *mi_find_attr(struct mft_inode *mi, struct ATTRIB *attr,
- enum ATTR_TYPE type, const __le16 *name,
- u8 name_len, const __le16 *id);
-static inline struct ATTRIB *rec_find_attr_le(struct mft_inode *rec,
+struct ATTRIB *mi_enum_attr(struct ntfs_inode *ni, struct mft_inode *mi,
+ struct ATTRIB *attr);
+struct ATTRIB *mi_find_attr(struct ntfs_inode *ni, struct mft_inode *mi,
+ struct ATTRIB *attr, enum ATTR_TYPE type,
+ const __le16 *name, u8 name_len, const __le16 *id);
+static inline struct ATTRIB *rec_find_attr_le(struct ntfs_inode *ni,
+ struct mft_inode *rec,
struct ATTR_LIST_ENTRY *le)
{
- return mi_find_attr(rec, NULL, le->type, le_name(le), le->name_len,
+ return mi_find_attr(ni, rec, NULL, le->type, le_name(le), le->name_len,
&le->id);
}
int mi_write(struct mft_inode *mi, int wait);
int mi_format_new(struct mft_inode *mi, struct ntfs_sb_info *sbi, CLST rno,
__le16 flags, bool is_mft);
-struct ATTRIB *mi_insert_attr(struct mft_inode *mi, enum ATTR_TYPE type,
- const __le16 *name, u8 name_len, u32 asize,
- u16 name_off);
+struct ATTRIB *mi_insert_attr(struct ntfs_inode *ni, struct mft_inode *mi,
+ enum ATTR_TYPE type, const __le16 *name,
+ u8 name_len, u32 asize, u16 name_off);
bool mi_remove_attr(struct ntfs_inode *ni, struct mft_inode *mi,
struct ATTRIB *attr);
diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c
index 61d53d39f3b9f..714c7ecedca83 100644
--- a/fs/ntfs3/record.c
+++ b/fs/ntfs3/record.c
@@ -31,7 +31,7 @@ static inline int compare_attr(const struct ATTRIB *left, enum ATTR_TYPE type,
*
* Return: Unused attribute id that is less than mrec->next_attr_id.
*/
-static __le16 mi_new_attt_id(struct mft_inode *mi)
+static __le16 mi_new_attt_id(struct ntfs_inode *ni, struct mft_inode *mi)
{
u16 free_id, max_id, t16;
struct MFT_REC *rec = mi->mrec;
@@ -52,7 +52,7 @@ static __le16 mi_new_attt_id(struct mft_inode *mi)
attr = NULL;
for (;;) {
- attr = mi_enum_attr(mi, attr);
+ attr = mi_enum_attr(ni, mi, attr);
if (!attr) {
rec->next_attr_id = cpu_to_le16(max_id + 1);
mi->dirty = true;
@@ -195,7 +195,8 @@ int mi_read(struct mft_inode *mi, bool is_mft)
* NOTE: mi->mrec - memory of size sbi->record_size
* here we sure that mi->mrec->total == sbi->record_size (see mi_read)
*/
-struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
+struct ATTRIB *mi_enum_attr(struct ntfs_inode *ni, struct mft_inode *mi,
+ struct ATTRIB *attr)
{
const struct MFT_REC *rec = mi->mrec;
u32 used = le32_to_cpu(rec->used);
@@ -209,11 +210,11 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
off = le16_to_cpu(rec->attr_off);
if (used > total)
- return NULL;
+ goto out;
if (off >= used || off < MFTRECORD_FIXUP_OFFSET_1 ||
!IS_ALIGNED(off, 8)) {
- return NULL;
+ goto out;
}
/* Skip non-resident records. */
@@ -243,7 +244,7 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
*/
if (off + 8 > used) {
static_assert(ALIGN(sizeof(enum ATTR_TYPE), 8) == 8);
- return NULL;
+ goto out;
}
if (attr->type == ATTR_END) {
@@ -254,112 +255,116 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
/* 0x100 is last known attribute for now. */
t32 = le32_to_cpu(attr->type);
if (!t32 || (t32 & 0xf) || (t32 > 0x100))
- return NULL;
+ goto out;
/* attributes in record must be ordered by type */
if (t32 < prev_type)
- return NULL;
+ goto out;
asize = le32_to_cpu(attr->size);
if (!IS_ALIGNED(asize, 8))
- return NULL;
+ goto out;
/* Check overflow and boundary. */
if (off + asize < off || off + asize > used)
- return NULL;
+ goto out;
/* Can we use the field attr->non_res. */
if (off + 9 > used)
- return NULL;
+ goto out;
/* Check size of attribute. */
if (!attr->non_res) {
/* Check resident fields. */
if (asize < SIZEOF_RESIDENT)
- return NULL;
+ goto out;
t16 = le16_to_cpu(attr->res.data_off);
if (t16 > asize)
- return NULL;
+ goto out;
if (le32_to_cpu(attr->res.data_size) > asize - t16)
- return NULL;
+ goto out;
t32 = sizeof(short) * attr->name_len;
if (t32 && le16_to_cpu(attr->name_off) + t32 > t16)
- return NULL;
+ goto out;
return attr;
}
/* Check nonresident fields. */
if (attr->non_res != 1)
- return NULL;
+ goto out;
/* Can we use memory including attr->nres.valid_size? */
if (asize < SIZEOF_NONRESIDENT)
- return NULL;
+ goto out;
t16 = le16_to_cpu(attr->nres.run_off);
if (t16 > asize)
- return NULL;
+ goto out;
t32 = sizeof(short) * attr->name_len;
if (t32 && le16_to_cpu(attr->name_off) + t32 > t16)
- return NULL;
+ goto out;
/* Check start/end vcn. */
if (le64_to_cpu(attr->nres.svcn) > le64_to_cpu(attr->nres.evcn) + 1)
- return NULL;
+ goto out;
data_size = le64_to_cpu(attr->nres.data_size);
if (le64_to_cpu(attr->nres.valid_size) > data_size)
- return NULL;
+ goto out;
alloc_size = le64_to_cpu(attr->nres.alloc_size);
if (data_size > alloc_size)
- return NULL;
+ goto out;
t32 = mi->sbi->cluster_mask;
if (alloc_size & t32)
- return NULL;
+ goto out;
if (!attr->nres.svcn && is_attr_ext(attr)) {
/* First segment of sparse/compressed attribute */
/* Can we use memory including attr->nres.total_size? */
if (asize < SIZEOF_NONRESIDENT_EX)
- return NULL;
+ goto out;
tot_size = le64_to_cpu(attr->nres.total_size);
if (tot_size & t32)
- return NULL;
+ goto out;
if (tot_size > alloc_size)
- return NULL;
+ goto out;
} else {
if (attr->nres.c_unit)
- return NULL;
+ goto out;
if (alloc_size > mi->sbi->volume.size)
- return NULL;
+ goto out;
}
return attr;
+
+out:
+ _ntfs_bad_inode(&ni->vfs_inode);
+ return NULL;
}
/*
* mi_find_attr - Find the attribute by type and name and id.
*/
-struct ATTRIB *mi_find_attr(struct mft_inode *mi, struct ATTRIB *attr,
- enum ATTR_TYPE type, const __le16 *name,
- u8 name_len, const __le16 *id)
+struct ATTRIB *mi_find_attr(struct ntfs_inode *ni, struct mft_inode *mi,
+ struct ATTRIB *attr, enum ATTR_TYPE type,
+ const __le16 *name, u8 name_len, const __le16 *id)
{
u32 type_in = le32_to_cpu(type);
u32 atype;
next_attr:
- attr = mi_enum_attr(mi, attr);
+ attr = mi_enum_attr(ni, mi, attr);
if (!attr)
return NULL;
@@ -467,9 +472,9 @@ int mi_format_new(struct mft_inode *mi, struct ntfs_sb_info *sbi, CLST rno,
*
* Return: Not full constructed attribute or NULL if not possible to create.
*/
-struct ATTRIB *mi_insert_attr(struct mft_inode *mi, enum ATTR_TYPE type,
- const __le16 *name, u8 name_len, u32 asize,
- u16 name_off)
+struct ATTRIB *mi_insert_attr(struct ntfs_inode *ni, struct mft_inode *mi,
+ enum ATTR_TYPE type, const __le16 *name,
+ u8 name_len, u32 asize, u16 name_off)
{
size_t tail;
struct ATTRIB *attr;
@@ -488,7 +493,7 @@ struct ATTRIB *mi_insert_attr(struct mft_inode *mi, enum ATTR_TYPE type,
* at which we should insert it.
*/
attr = NULL;
- while ((attr = mi_enum_attr(mi, attr))) {
+ while ((attr = mi_enum_attr(ni, mi, attr))) {
int diff = compare_attr(attr, type, name, name_len, upcase);
if (diff < 0)
@@ -508,7 +513,7 @@ struct ATTRIB *mi_insert_attr(struct mft_inode *mi, enum ATTR_TYPE type,
tail = used - PtrOffset(rec, attr);
}
- id = mi_new_attt_id(mi);
+ id = mi_new_attt_id(ni, mi);
memmove(Add2Ptr(attr, asize), attr, tail);
memset(attr, 0, asize);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0528/1376] fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (526 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0527/1376] fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr() Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0529/1376] fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list() Greg Kroah-Hartman
` (470 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+83c9dd5c0dcf6184fdbf,
Nirbhay Sharma, Konstantin Komarov, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nirbhay Sharma <nirbhay.lkd@gmail.com>
[ Upstream commit 5f33da04e6ceee849e76e6592cc283c72fef7af9 ]
The call to kmalloc() to allocate the attribute list buffer is given a
size of al_aligned(rs). This size can be larger than the data
subsequently copied into the buffer, leaving trailing bytes uninitialized.
This can trigger a KMSAN "uninit-value" warning if that memory is
later accessed.
Fix this by using kzalloc() instead, which ensures the entire
allocated buffer is zero-initialized, preventing the warning.
Reported-by: syzbot+83c9dd5c0dcf6184fdbf@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=83c9dd5c0dcf6184fdbf
Signed-off-by: Nirbhay Sharma <nirbhay.lkd@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Stable-dep-of: 7c4841e2a627 ("fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/frecord.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c
index b2791327af22f..162a6c038000e 100644
--- a/fs/ntfs3/frecord.c
+++ b/fs/ntfs3/frecord.c
@@ -826,7 +826,7 @@ int ni_create_attr_list(struct ntfs_inode *ni)
* Skip estimating exact memory requirement.
* Looks like one record_size is always enough.
*/
- le = kmalloc(al_aligned(rs), GFP_NOFS);
+ le = kzalloc(al_aligned(rs), GFP_NOFS);
if (!le)
return -ENOMEM;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0529/1376] fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (527 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0528/1376] fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0530/1376] hfsplus: validate thread record before delete key rebuild Greg Kroah-Hartman
` (469 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches,
HE WEI（ギカク）,
Konstantin Komarov, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: HE WEI（ギカク） <skyexpoc@gmail.com>
[ Upstream commit 7c4841e2a62794a3bab7c1ff0540580f387e377f ]
ni_create_attr_list() allocates a fixed buffer of al_aligned(record_size)
(== record_size) bytes and then walks every attribute of the primary MFT
record, writing one ATTR_LIST_ENTRY per attribute and advancing the cursor
by le_size(name_len), with no check against the end of the buffer; the
total size is only computed after the loop.
A minimum-size resident attribute occupies SIZEOF_RESIDENT (0x18 = 24)
bytes on disk, but an unnamed attribute expands to le_size(0) (0x20 = 32)
bytes in the list. Because the number of attributes in a record is not
bounded (mi_enum_attr() accepts arbitrarily many equal-type, nameless
minimum-size attributes), a crafted record packed with such attributes
produces a list larger than record_size and overflows the heap buffer.
This is reachable from a crafted, loop-mounted NTFS image: opening the file
and adding an attribute (e.g. via setxattr) drives ntfs_set_ea() ->
ni_insert_resident() -> ni_insert_attr() -> ni_ins_attr_ext() ->
ni_create_attr_list().
BUG: KASAN: slab-out-of-bounds in ni_create_attr_list+0xc48/0x1058
Write of size 4 at addr ffff000008984c00 by task setfattr/345
ni_create_attr_list+0xc48/0x1058
ni_ins_attr_ext+0x510/0x7c0
ni_insert_attr+0x3f8/0x70c
ni_insert_resident+0xc8/0x3b0
ntfs_set_ea+0x66c/0xd28
ntfs_setxattr+0x4d8/0x5b0
__arm64_sys_setxattr+0xa4/0x124
Allocated by task 345:
ni_create_attr_list+0x188/0x1058
The buggy address belongs to the cache kmalloc-1k of size 1024
(the write lands at object+1024).
Size the buffer from the actual attributes instead of assuming a single
record_size is always enough.
Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation")
Reported-by: HE WEI（ギカク） <skyexpoc@gmail.com>
Signed-off-by: HE WEI（ギカク） <skyexpoc@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/frecord.c | 20 ++++++++++++++++----
1 file changed, 16 insertions(+), 4 deletions(-)
diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c
index 162a6c038000e..45e8d73d38f8f 100644
--- a/fs/ntfs3/frecord.c
+++ b/fs/ntfs3/frecord.c
@@ -823,10 +823,23 @@ int ni_create_attr_list(struct ntfs_inode *ni)
rs = sbi->record_size;
/*
- * Skip estimating exact memory requirement.
- * Looks like one record_size is always enough.
+ * Compute the exact size of the attribute list. Each attribute in the
+ * record yields one ATTR_LIST_ENTRY of le_size(name_len) bytes. The
+ * minimum on-disk attribute is SIZEOF_RESIDENT (0x18) bytes, but an
+ * unnamed one expands to le_size(0) (0x20) here, so a record crafted
+ * with many such attributes needs more than a single record_size; the
+ * previous fixed kzalloc(record_size) could therefore be overflowed by
+ * an attacker-controlled record.
*/
- le = kzalloc(al_aligned(rs), GFP_NOFS);
+ lsize = 0;
+ attr = NULL;
+ while ((attr = mi_enum_attr(ni, &ni->mi, attr)))
+ lsize += le_size(attr->name_len);
+
+ if (!lsize)
+ return -EINVAL;
+
+ le = kzalloc(al_aligned(lsize), GFP_NOFS);
if (!le)
return -ENOMEM;
@@ -836,7 +849,6 @@ int ni_create_attr_list(struct ntfs_inode *ni)
attr = NULL;
nb = 0;
free_b = 0;
- attr = NULL;
for (; (attr = mi_enum_attr(ni, &ni->mi, attr)); le = Add2Ptr(le, sz)) {
sz = le_size(attr->name_len);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0530/1376] hfsplus: validate thread record before delete key rebuild
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (528 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0529/1376] fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list() Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0531/1376] wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate Greg Kroah-Hartman
` (468 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kyle Zeng, Viacheslav Dubeyko,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kyle Zeng <kylebot@openai.com>
[ Upstream commit e2ea5cac61acfc11dad22f1d2d4bc71d56c52a20 ]
hfsplus_delete_cat() is called with str == NULL when the last open
reference to an unlinked HFS+ hardlink backing inode is closed. In that
case, the function finds the catalog thread by CNID and rebuilds the
catalog key from thread.nodeName.
That reconstruction path reads thread.nodeName.length directly from the
catalog B-tree into fd.search_key and then copies length * 2 bytes into
fd.search_key->cat.name.unicode. It does not first check that the found
record is a thread record or that its size matches the thread name.
A corrupted image can therefore provide an oversized thread name length
and make hfs_bnode_read() write past the catalog search-key allocation.
Read the CNID record through hfsplus_brec_read_cat(), which bounds the
record read to sizeof(hfsplus_cat_entry) and verifies that a thread
record's size exactly matches nodeName.length. Together, these checks
ensure an accepted thread name fits HFSPLUS_MAX_STRLEN. Reject non-thread
records before building the delete key from the validated thread name.
Share the thread-record-type helper between hfsplus_find_cat() and
hfsplus_delete_cat().
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Assisted-by: Codex:gpt-5.6
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Link: https://lore.kernel.org/r/20260709010203.49664-1-kylebot@openai.com
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/hfsplus/catalog.c | 25 ++++++++++++-------------
fs/hfsplus/hfsplus_fs.h | 6 ++++++
2 files changed, 18 insertions(+), 13 deletions(-)
diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c
index dc3f98ec5e2d2..7a9c72e4e4f2a 100644
--- a/fs/hfsplus/catalog.c
+++ b/fs/hfsplus/catalog.c
@@ -204,7 +204,7 @@ int hfsplus_find_cat(struct super_block *sb, u32 cnid,
return err;
type = be16_to_cpu(tmp.type);
- if (type != HFSPLUS_FOLDER_THREAD && type != HFSPLUS_FILE_THREAD) {
+ if (!is_hfs_thread_record_type(type)) {
pr_err("found bad thread record in catalog\n");
return -EIO;
}
@@ -350,23 +350,22 @@ int hfsplus_delete_cat(u32 cnid, struct inode *dir, const struct qstr *str)
goto out;
if (!str) {
- int len;
+ hfsplus_cat_entry entry = {0};
hfsplus_cat_build_key_with_cnid(sb, fd.search_key, cnid);
- err = hfs_brec_find(&fd, hfs_find_rec_by_key);
+ err = hfsplus_brec_read_cat(&fd, &entry);
if (err)
goto out;
- off = fd.entryoffset +
- offsetof(struct hfsplus_cat_thread, nodeName);
- fd.search_key->cat.parent = cpu_to_be32(dir->i_ino);
- hfs_bnode_read(fd.bnode,
- &fd.search_key->cat.name.length, off, 2);
- len = be16_to_cpu(fd.search_key->cat.name.length) * 2;
- hfs_bnode_read(fd.bnode,
- &fd.search_key->cat.name.unicode,
- off + 2, len);
- fd.search_key->key_len = cpu_to_be16(6 + len);
+ type = be16_to_cpu(entry.type);
+ if (!is_hfs_thread_record_type(type)) {
+ pr_err("found bad thread record in catalog\n");
+ err = -EIO;
+ goto out;
+ }
+
+ hfsplus_cat_build_key_uni(fd.search_key, dir->i_ino,
+ &entry.thread.nodeName);
} else {
err = hfsplus_cat_build_key(sb, fd.search_key, dir->i_ino, str);
if (unlikely(err))
diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h
index 11cef30803d5a..f4b9c7e2491c9 100644
--- a/fs/hfsplus/hfsplus_fs.h
+++ b/fs/hfsplus/hfsplus_fs.h
@@ -543,6 +543,12 @@ static inline u32 hfsplus_cat_thread_size(const struct hfsplus_cat_thread *threa
be16_to_cpu(thread->nodeName.length) * sizeof(hfsplus_unichr);
}
+static inline
+bool is_hfs_thread_record_type(u16 type)
+{
+ return type == HFSPLUS_FOLDER_THREAD || type == HFSPLUS_FILE_THREAD;
+}
+
int hfsplus_brec_read_cat(struct hfs_find_data *fd, hfsplus_cat_entry *entry);
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0531/1376] wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (529 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0530/1376] hfsplus: validate thread record before delete key rebuild Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0532/1376] x86/entry/fred: Encode frame pointer on entry Greg Kroah-Hartman
` (467 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baochen Qiang, Rameshkumar Sundaram,
Jeff Johnson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
[ Upstream commit 12b09e478aa7459b7893a695ef77682202f2da83 ]
ath11k can receive HT/VHT/HE frames whose reported MCS is above the
maximum that can be expressed in the corresponding mac80211 rate space
(e.g. an HE frame reported with MCS 12, while HE tops out at MCS 11).
The frame itself is valid and decodes correctly, but for such a frame
ath11k_dp_rx_h_rate() leaves rx_status->rate_idx set to the out-of-range
value and never assigns rx_status->encoding, so it stays RX_ENC_LEGACY
from the ath11k_dp_rx_h_ppdu() initialization. Once that frame reaches
mac80211 it trips the rate sanity check and the frame is dropped with a
splat:
ath11k_pci 0000:03:00.0: Received with invalid mcs in HE mode 12
WARNING: CPU: 0 PID: 0 at net/mac80211/rx.c:5433 ieee80211_rx_list+0xb0a/0xe90 [mac80211]
Dropping the frame would discard otherwise valid data, so instead cap the
reported MCS to the maximum the rate space can express and deliver the
frame. Set rx_status->encoding before the range check and assign rate_idx
from the capped value, so a frame with an out-of-range MCS no longer
leaves partial or bogus rate metadata behind. Also downgrade the logging
level since they are not treated as invalid frames now. The only loss is
that such a frame is reported as the capped MCS in the rx rate statistics.
Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Link: https://patch.msgid.link/20260701-ath11k-invalid-he-mcs-v1-1-7d963080c079@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath11k/dp_rx.c | 30 ++++++++++++-------------
1 file changed, 15 insertions(+), 15 deletions(-)
diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c
index 6cc252d00ef13..4935cfdc9adc4 100644
--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
+++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
@@ -2332,10 +2332,10 @@ static void ath11k_dp_rx_h_rate(struct ath11k *ar, struct hal_rx_desc *rx_desc,
case RX_MSDU_START_PKT_TYPE_11N:
rx_status->encoding = RX_ENC_HT;
if (rate_mcs > ATH11K_HT_MCS_MAX) {
- ath11k_warn(ar->ab,
- "Received with invalid mcs in HT mode %d\n",
- rate_mcs);
- break;
+ ath11k_dbg(ar->ab, ATH11K_DBG_DP_RX,
+ "Received HT frame with out-of-range mcs %d, capping to %d\n",
+ rate_mcs, ATH11K_HT_MCS_MAX);
+ rate_mcs = ATH11K_HT_MCS_MAX;
}
rx_status->rate_idx = rate_mcs + (8 * (nss - 1));
if (sgi)
@@ -2344,13 +2344,13 @@ static void ath11k_dp_rx_h_rate(struct ath11k *ar, struct hal_rx_desc *rx_desc,
break;
case RX_MSDU_START_PKT_TYPE_11AC:
rx_status->encoding = RX_ENC_VHT;
- rx_status->rate_idx = rate_mcs;
if (rate_mcs > ATH11K_VHT_MCS_MAX) {
- ath11k_warn(ar->ab,
- "Received with invalid mcs in VHT mode %d\n",
- rate_mcs);
- break;
+ ath11k_dbg(ar->ab, ATH11K_DBG_DP_RX,
+ "Received VHT frame with out-of-range mcs %d, capping to %d\n",
+ rate_mcs, ATH11K_VHT_MCS_MAX);
+ rate_mcs = ATH11K_VHT_MCS_MAX;
}
+ rx_status->rate_idx = rate_mcs;
rx_status->nss = nss;
if (sgi)
rx_status->enc_flags |= RX_ENC_FLAG_SHORT_GI;
@@ -2360,14 +2360,14 @@ static void ath11k_dp_rx_h_rate(struct ath11k *ar, struct hal_rx_desc *rx_desc,
rx_status->enc_flags |= RX_ENC_FLAG_LDPC;
break;
case RX_MSDU_START_PKT_TYPE_11AX:
- rx_status->rate_idx = rate_mcs;
+ rx_status->encoding = RX_ENC_HE;
if (rate_mcs > ATH11K_HE_MCS_MAX) {
- ath11k_warn(ar->ab,
- "Received with invalid mcs in HE mode %d\n",
- rate_mcs);
- break;
+ ath11k_dbg(ar->ab, ATH11K_DBG_DP_RX,
+ "Received HE frame with out-of-range mcs %d, capping to %d\n",
+ rate_mcs, ATH11K_HE_MCS_MAX);
+ rate_mcs = ATH11K_HE_MCS_MAX;
}
- rx_status->encoding = RX_ENC_HE;
+ rx_status->rate_idx = rate_mcs;
rx_status->nss = nss;
rx_status->he_gi = ath11k_mac_he_gi_to_nl80211_he_gi(sgi);
rx_status->bw = ath11k_mac_bw_to_mac80211_bw(bw);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0532/1376] x86/entry/fred: Encode frame pointer on entry
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (530 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0531/1376] wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0533/1376] firmware: arm_scmi: Publish channel state before callbacks Greg Kroah-Hartman
` (466 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Stevens, Dave Hansen,
H. Peter Anvin (Intel), Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Stevens <stevensd@google.com>
[ Upstream commit dab01c597f6bd40e0efe7da967b8374ca1971b79 ]
Add missing ENCODE_FRAME_POINTER macro invocation into FRED_ENTER macro,
to prevent the unwinder from encountering a NULL stack frame pointer
when CONFIG_UNWINDER_FRAME_POINTER is enabled
Fixes: 14619d912b65 ("x86/fred: FRED entry/exit and dispatch code")
Signed-off-by: David Stevens <stevensd@google.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: H. Peter Anvin (Intel) <hpa@zytor.com>
Link: https://patch.msgid.link/20260424191456.2679717-12-stevensd@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/entry/entry_64_fred.S | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/x86/entry/entry_64_fred.S b/arch/x86/entry/entry_64_fred.S
index 0ca9db540b16d..3c1bf47af56c2 100644
--- a/arch/x86/entry/entry_64_fred.S
+++ b/arch/x86/entry/entry_64_fred.S
@@ -6,6 +6,7 @@
#include <linux/export.h>
#include <asm/asm.h>
+#include <asm/frame.h>
#include <asm/fred.h>
#include <asm/segment.h>
@@ -18,6 +19,7 @@
UNWIND_HINT_END_OF_STACK
ANNOTATE_NOENDBR
PUSH_AND_CLEAR_REGS
+ ENCODE_FRAME_POINTER
movq %rsp, %rdi /* %rdi -> pt_regs */
.endm
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0533/1376] firmware: arm_scmi: Publish channel state before callbacks
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (531 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0532/1376] x86/entry/fred: Encode frame pointer on entry Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0534/1376] firmware: arm_scmi: Unregister device notifier before IDR teardown Greg Kroah-Hartman
` (465 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Sudeep Holla, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <sudeep.holla@kernel.org>
[ Upstream commit 0314900dcdde044af0208fed212035dbfaa55843 ]
Transport setup can enable callbacks before the setup routine returns.
mailbox_chan_setup() registers the mailbox client with
mbox_request_channel(), and the mailbox controller startup path can enable
interrupt delivery before SCMI mailbox channel state has been published.
Similarly, smc_chan_setup() requests the optional A2P completion IRQ before
the SMC transport has made its cinfo pointer visible.
If a pending or spurious callback fires in those windows, the transport RX
callback can dereference a NULL transport cinfo pointer. Publishing only
the transport-private pointer is not sufficient either: an early callback
can enter the SCMI core before scmi_chan_setup() has assigned
cinfo->handle.
The core derives scmi_info from cinfo->handle in the RX path, so a NULL
handle can still fault even when the transport-private cinfo is valid.
Assign cinfo->handle before invoking the transport setup callback. Publish
the mailbox and SMC transport-private channel state before requesting the
mailbox channels or IRQ, and clear the early-published pointers again on
setup failure. Also unwind mailbox setup devres resources on failure so an
optional RX setup error that is ignored by the core does not leave stale
transport state behind.
Fixes: 5c8a47a5a91d ("firmware: arm_scmi: Make scmi core independent of the transport type")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-1-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/arm_scmi/driver.c | 2 +-
drivers/firmware/arm_scmi/transports/mailbox.c | 18 +++++++++++++-----
drivers/firmware/arm_scmi/transports/smc.c | 15 +++++++++------
3 files changed, 23 insertions(+), 12 deletions(-)
diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c
index 79866f3b6b3e7..1901cc1ec8dd0 100644
--- a/drivers/firmware/arm_scmi/driver.c
+++ b/drivers/firmware/arm_scmi/driver.c
@@ -2657,6 +2657,7 @@ static int scmi_chan_setup(struct scmi_info *info, struct device_node *of_node,
cinfo->id = prot_id;
cinfo->dev = &tdev->dev;
+ cinfo->handle = &info->handle;
ret = info->desc->ops->chan_setup(cinfo, info->dev, tx);
if (ret) {
of_node_put(of_node);
@@ -2689,7 +2690,6 @@ static int scmi_chan_setup(struct scmi_info *info, struct device_node *of_node,
return ret;
}
- cinfo->handle = &info->handle;
return 0;
}
diff --git a/drivers/firmware/arm_scmi/transports/mailbox.c b/drivers/firmware/arm_scmi/transports/mailbox.c
index e3d5f75609905..f4847569b42c8 100644
--- a/drivers/firmware/arm_scmi/transports/mailbox.c
+++ b/drivers/firmware/arm_scmi/transports/mailbox.c
@@ -208,13 +208,18 @@ static int mailbox_chan_setup(struct scmi_chan_info *cinfo, struct device *dev,
cl->tx_block = false;
cl->knows_txdone = tx;
+ cinfo->transport_info = smbox;
+ smbox->cinfo = cinfo;
+ mutex_init(&smbox->chan_lock);
+
smbox->chan = mbox_request_channel(cl, tx ? 0 : p2a_chan);
if (IS_ERR(smbox->chan)) {
ret = PTR_ERR(smbox->chan);
+ smbox->chan = NULL;
if (ret != -EPROBE_DEFER)
dev_err(cdev,
"failed to request SCMI %s mailbox\n", desc);
- return ret;
+ goto err_clear_cinfo;
}
/* Additional unidirectional channel for TX if needed */
@@ -238,11 +243,14 @@ static int mailbox_chan_setup(struct scmi_chan_info *cinfo, struct device *dev,
}
}
- cinfo->transport_info = smbox;
- smbox->cinfo = cinfo;
- mutex_init(&smbox->chan_lock);
-
return 0;
+
+err_clear_cinfo:
+ cinfo->transport_info = NULL;
+ smbox->cinfo = NULL;
+ devm_iounmap(dev, smbox->shmem);
+ devm_kfree(dev, smbox);
+ return ret;
}
static int mailbox_chan_free(int id, void *p, void *data)
diff --git a/drivers/firmware/arm_scmi/transports/smc.c b/drivers/firmware/arm_scmi/transports/smc.c
index f8dd108777f9b..2a35434a2b7f5 100644
--- a/drivers/firmware/arm_scmi/transports/smc.c
+++ b/drivers/firmware/arm_scmi/transports/smc.c
@@ -169,6 +169,13 @@ static int smc_chan_setup(struct scmi_chan_info *cinfo, struct device *dev,
scmi_info->param_page = SHMEM_PAGE(res.start);
scmi_info->param_offset = SHMEM_OFFSET(res.start);
}
+
+ scmi_info->func_id = func_id;
+ scmi_info->cap_id = cap_id;
+ scmi_info->cinfo = cinfo;
+ smc_channel_lock_init(scmi_info);
+ cinfo->transport_info = scmi_info;
+
/*
* If there is an interrupt named "a2p", then the service and
* completion of a message is signaled by an interrupt rather than by
@@ -180,18 +187,14 @@ static int smc_chan_setup(struct scmi_chan_info *cinfo, struct device *dev,
IRQF_NO_SUSPEND, dev_name(dev), scmi_info);
if (ret) {
dev_err(dev, "failed to setup SCMI smc irq\n");
+ cinfo->transport_info = NULL;
+ scmi_info->cinfo = NULL;
return ret;
}
} else {
cinfo->no_completion_irq = true;
}
- scmi_info->func_id = func_id;
- scmi_info->cap_id = cap_id;
- scmi_info->cinfo = cinfo;
- smc_channel_lock_init(scmi_info);
- cinfo->transport_info = scmi_info;
-
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0534/1376] firmware: arm_scmi: Unregister device notifier before IDR teardown
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (532 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0533/1376] firmware: arm_scmi: Publish channel state before callbacks Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0535/1376] firmware: arm_scmi: Quiesce notifications before teardown Greg Kroah-Hartman
` (464 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Sudeep Holla, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <sudeep.holla@kernel.org>
[ Upstream commit 66a0bbf30cc14140fe13f63cd594a7c1ee352b75 ]
The requested-devices notifier looks up protocol fwnodes from the
active_protocols IDR. During remove, unregister the notifier before
releasing and destroying active_protocols so no notifier callback can race
with the IDR teardown.
Keep the bus notifier registered until after the protocol state is torn
down, matching the existing remove ordering for SCMI bus users.
Fixes: 53b8c25df708 ("firmware: arm_scmi: Add common notifier helpers")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-2-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/arm_scmi/driver.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c
index 1901cc1ec8dd0..bb503028c1f5e 100644
--- a/drivers/firmware/arm_scmi/driver.c
+++ b/drivers/firmware/arm_scmi/driver.c
@@ -3250,6 +3250,9 @@ static void scmi_remove(struct platform_device *pdev)
list_del(&info->node);
mutex_unlock(&scmi_list_mutex);
+ blocking_notifier_chain_unregister(&scmi_requested_devices_nh,
+ &info->dev_req_nb);
+
scmi_notification_exit(&info->handle);
mutex_lock(&info->protocols_mtx);
@@ -3260,8 +3263,6 @@ static void scmi_remove(struct platform_device *pdev)
of_node_put(child);
idr_destroy(&info->active_protocols);
- blocking_notifier_chain_unregister(&scmi_requested_devices_nh,
- &info->dev_req_nb);
bus_unregister_notifier(&scmi_bus_type, &info->bus_nb);
/* Safe to free channels since no more users */
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0535/1376] firmware: arm_scmi: Quiesce notifications before teardown
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (533 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0534/1376] firmware: arm_scmi: Unregister device notifier before IDR teardown Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0536/1376] firmware: arm_scmi: Clean up channels on setup failure Greg Kroah-Hartman
` (463 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Sudeep Holla, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <sudeep.holla@kernel.org>
[ Upstream commit 8e49055d0d495c9c07575ad8e111d9eaf0efb13f ]
scmi_notification_exit() clears and releases the notification instance,
but transport callbacks can still deliver incoming notifications until
the TX/RX channels are freed. During remove, an RX interrupt in that
window can enter scmi_notify() while notification state is being torn
down and then dereference freed memory. The same ordering exists on the
probe error path after notification initialization.
The notification late-init worker has a separate lifetime issue: protocol
event registration queues ni->init_work on the system workqueue, so
destroying ni->notify_wq does not drain that work. If the devres group is
released while init_work is still pending or running, the late-init worker
can dereference the freed notification instance.
Quiesce the notification core before TX/RX channels are torn down, then
clean up the channels before releasing the notification core resources.
Use disable_work_sync() so future late-init queueing is rejected and any
already queued or running late-init work has completed before channel
teardown starts.
Fixes: 1e7cbfaa66d3 ("firmware: arm_scmi: Free mailbox channels if probe fails")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-3-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/arm_scmi/driver.c | 13 +++++++------
drivers/firmware/arm_scmi/notify.c | 21 +++++++++++++++++++++
drivers/firmware/arm_scmi/notify.h | 1 +
3 files changed, 29 insertions(+), 6 deletions(-)
diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c
index bb503028c1f5e..f69b8e2697415 100644
--- a/drivers/firmware/arm_scmi/driver.c
+++ b/drivers/firmware/arm_scmi/driver.c
@@ -3176,7 +3176,7 @@ static int scmi_probe(struct platform_device *pdev)
dev_err(dev, "%s", err_str);
return 0;
}
- goto notification_exit;
+ goto raw_mode_cleanup;
}
mutex_lock(&scmi_list_mutex);
@@ -3216,17 +3216,18 @@ static int scmi_probe(struct platform_device *pdev)
return 0;
-notification_exit:
+raw_mode_cleanup:
if (IS_ENABLED(CONFIG_ARM_SCMI_RAW_MODE_SUPPORT))
scmi_raw_mode_cleanup(info->raw);
- scmi_notification_exit(&info->handle);
clear_dev_req_notifier:
blocking_notifier_chain_unregister(&scmi_requested_devices_nh,
&info->dev_req_nb);
clear_bus_notifier:
bus_unregister_notifier(&scmi_bus_type, &info->bus_nb);
clear_txrx_setup:
+ scmi_notification_quiesce(&info->handle);
scmi_cleanup_txrx_channels(info);
+ scmi_notification_exit(&info->handle);
clear_ida:
ida_free(&scmi_id, info->id);
@@ -3253,6 +3254,9 @@ static void scmi_remove(struct platform_device *pdev)
blocking_notifier_chain_unregister(&scmi_requested_devices_nh,
&info->dev_req_nb);
+ /* Stop transport callbacks before tearing down notifications. */
+ scmi_notification_quiesce(&info->handle);
+ scmi_cleanup_txrx_channels(info);
scmi_notification_exit(&info->handle);
mutex_lock(&info->protocols_mtx);
@@ -3265,9 +3269,6 @@ static void scmi_remove(struct platform_device *pdev)
bus_unregister_notifier(&scmi_bus_type, &info->bus_nb);
- /* Safe to free channels since no more users */
- scmi_cleanup_txrx_channels(info);
-
ida_free(&scmi_id, info->id);
}
diff --git a/drivers/firmware/arm_scmi/notify.c b/drivers/firmware/arm_scmi/notify.c
index f042fb8a05026..c4d4337ac3a34 100644
--- a/drivers/firmware/arm_scmi/notify.c
+++ b/drivers/firmware/arm_scmi/notify.c
@@ -1685,6 +1685,25 @@ int scmi_notification_init(struct scmi_handle *handle)
return -ENOMEM;
}
+/**
+ * scmi_notification_quiesce() - Stop notification late initialization
+ * @handle: The handle identifying the platform instance to quiesce
+ *
+ * Prevent new late-init work from being queued and wait for any already queued
+ * or running late-init work to complete before transport channels are torn
+ * down.
+ */
+void scmi_notification_quiesce(struct scmi_handle *handle)
+{
+ struct scmi_notify_instance *ni;
+
+ ni = scmi_notification_instance_data_get(handle);
+ if (!ni)
+ return;
+
+ disable_work_sync(&ni->init_work);
+}
+
/**
* scmi_notification_exit() - Shutdown and clean Notification core
* @handle: The handle identifying the platform instance to shutdown
@@ -1696,6 +1715,8 @@ void scmi_notification_exit(struct scmi_handle *handle)
ni = scmi_notification_instance_data_get(handle);
if (!ni)
return;
+
+ scmi_notification_quiesce(handle);
scmi_notification_instance_data_set(handle, NULL);
/* Destroy while letting pending work complete */
diff --git a/drivers/firmware/arm_scmi/notify.h b/drivers/firmware/arm_scmi/notify.h
index 76758a736cf47..f18f98c5ab3ba 100644
--- a/drivers/firmware/arm_scmi/notify.h
+++ b/drivers/firmware/arm_scmi/notify.h
@@ -82,6 +82,7 @@ struct scmi_protocol_events {
};
int scmi_notification_init(struct scmi_handle *handle);
+void scmi_notification_quiesce(struct scmi_handle *handle);
void scmi_notification_exit(struct scmi_handle *handle);
int scmi_register_protocol_events(const struct scmi_handle *handle, u8 proto_id,
const struct scmi_protocol_handle *ph,
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0536/1376] firmware: arm_scmi: Clean up channels on setup failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (534 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0535/1376] firmware: arm_scmi: Quiesce notifications before teardown Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0537/1376] firmware: arm_scmi: Free transport channel on IDR failure Greg Kroah-Hartman
` (462 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Sudeep Holla, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <sudeep.holla@kernel.org>
[ Upstream commit 687d67be3d87894ef12e8a164434612e0b53cfae ]
scmi_channels_setup() can fail after the common BASE channel or earlier
protocol channels have already been registered in the TX/RX IDRs.
Route this failure through the existing channel cleanup label so the
transport channels, transport devices and IDR state created before the
failure are released before the probe error path frees the SCMI instance
ID.
Fixes: 05a2801d8b90 ("firmware: arm_scmi: Use dedicated devices to initialize channels")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-4-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/arm_scmi/driver.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c
index f69b8e2697415..5a44e10ed6041 100644
--- a/drivers/firmware/arm_scmi/driver.c
+++ b/drivers/firmware/arm_scmi/driver.c
@@ -3114,7 +3114,7 @@ static int scmi_probe(struct platform_device *pdev)
ret = scmi_channels_setup(info);
if (ret) {
err_str = "failed to setup channels\n";
- goto clear_ida;
+ goto clear_txrx_setup;
}
ret = bus_register_notifier(&scmi_bus_type, &info->bus_nb);
@@ -3228,7 +3228,6 @@ static int scmi_probe(struct platform_device *pdev)
scmi_notification_quiesce(&info->handle);
scmi_cleanup_txrx_channels(info);
scmi_notification_exit(&info->handle);
-clear_ida:
ida_free(&scmi_id, info->id);
out_err:
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0537/1376] firmware: arm_scmi: Free transport channel on IDR failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (535 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0536/1376] firmware: arm_scmi: Clean up channels on setup failure Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0538/1376] firmware: arm_scmi: Avoid IDR updates while cleaning channels Greg Kroah-Hartman
` (461 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Sudeep Holla, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <sudeep.holla@kernel.org>
[ Upstream commit d72e7e5f24687c0490aabf317653caffe0447aeb ]
If transport channel setup succeeds but the following IDR insertion fails,
the error path destroys the transport device and frees the channel info
without invoking the transport cleanup callback.
Call chan_free() before destroying the device so transport specific
resources such as IRQs, mailbox channels and mapped shared memory are
released consistently with the normal teardown path.
Fixes: 05a2801d8b90 ("firmware: arm_scmi: Use dedicated devices to initialize channels")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-5-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/arm_scmi/driver.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c
index 5a44e10ed6041..c0be4584397d3 100644
--- a/drivers/firmware/arm_scmi/driver.c
+++ b/drivers/firmware/arm_scmi/driver.c
@@ -2683,6 +2683,7 @@ static int scmi_chan_setup(struct scmi_info *info, struct device_node *of_node,
"unable to allocate SCMI idr slot err %d\n", ret);
/* Destroy channel and device only if created by this call. */
if (tdev) {
+ info->desc->ops->chan_free(prot_id, cinfo, idr);
of_node_put(of_node);
scmi_device_destroy(info->dev, prot_id, name);
devm_kfree(info->dev, cinfo);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0538/1376] firmware: arm_scmi: Avoid IDR updates while cleaning channels
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (536 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0537/1376] firmware: arm_scmi: Free transport channel on IDR failure Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0539/1376] firmware: arm_scmi: Reject out of range DT protocol IDs Greg Kroah-Hartman
` (460 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Sudeep Holla, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <sudeep.holla@kernel.org>
[ Upstream commit c38b1e19485aaa820e52cfe162525a8af67563da ]
scmi_cleanup_channels() walks the TX/RX channel IDRs with
idr_for_each() to free transport resources and destroy the dedicated
transport devices before calling idr_destroy().
The destroy callback removed each entry from the same IDR being walked.
That is not needed for this cleanup path, and it is unsafe because
idr_for_each() has not advanced its radix-tree iterator while the
callback is running. Removing the current entry from the callback can
invalidate the iterator state. The callback also cannot be protected by
rcu_read_lock(), because scmi_device_destroy() may sleep.
Leave IDR teardown to the following idr_destroy() call and keep the
callback limited to device destruction.
Fixes: 05a2801d8b90 ("firmware: arm_scmi: Use dedicated devices to initialize channels")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-6-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/arm_scmi/driver.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c
index c0be4584397d3..0c30e2ddbd1e3 100644
--- a/drivers/firmware/arm_scmi/driver.c
+++ b/drivers/firmware/arm_scmi/driver.c
@@ -2760,7 +2760,7 @@ static int scmi_channels_setup(struct scmi_info *info)
return 0;
}
-static int scmi_chan_destroy(int id, void *p, void *idr)
+static int scmi_chan_destroy(int id, void *p, void *data)
{
struct scmi_chan_info *cinfo = p;
@@ -2773,8 +2773,6 @@ static int scmi_chan_destroy(int id, void *p, void *idr)
cinfo->dev = NULL;
}
- idr_remove(idr, id);
-
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0539/1376] firmware: arm_scmi: Reject out of range DT protocol IDs
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (537 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0538/1376] firmware: arm_scmi: Avoid IDR updates while cleaning channels Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0540/1376] firmware: arm_scmi: Use channel ID for transport teardown Greg Kroah-Hartman
` (459 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Sudeep Holla, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <sudeep.holla@kernel.org>
[ Upstream commit 59407ccb52130f2c81f4b3cbe4f14114afceb54f ]
SCMI protocol IDs carried in message headers are limited by
MSG_PROTOCOL_ID_MASK. The DT parsing paths noticed protocol IDs
outside that range, but only logged an error and then kept processing
the invalid value.
That lets a malformed 32-bit DT reg value reach helpers which take a u8
protocol ID, where it can be truncated and/or treated as a different
protocol.
For channel setup, two different out-of-range values can also be used as
distinct IDR keys while aliasing the generated SCMI protocol identity.
Skip DT protocol nodes whose reg value does not fit the SCMI protocol ID
field before setting up channels or creating protocol devices.
Fixes: 05a2801d8b90 ("firmware: arm_scmi: Use dedicated devices to initialize channels")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-7-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/arm_scmi/driver.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c
index 0c30e2ddbd1e3..f9d6b5eb89191 100644
--- a/drivers/firmware/arm_scmi/driver.c
+++ b/drivers/firmware/arm_scmi/driver.c
@@ -2748,9 +2748,11 @@ static int scmi_channels_setup(struct scmi_info *info)
if (of_property_read_u32(child, "reg", &prot_id))
continue;
- if (!FIELD_FIT(MSG_PROTOCOL_ID_MASK, prot_id))
+ if (!FIELD_FIT(MSG_PROTOCOL_ID_MASK, prot_id)) {
dev_err(info->dev,
"Out of range protocol %d\n", prot_id);
+ continue;
+ }
ret = scmi_txrx_setup(info, child, prot_id);
if (ret)
@@ -3188,8 +3190,10 @@ static int scmi_probe(struct platform_device *pdev)
if (of_property_read_u32(child, "reg", &prot_id))
continue;
- if (!FIELD_FIT(MSG_PROTOCOL_ID_MASK, prot_id))
+ if (!FIELD_FIT(MSG_PROTOCOL_ID_MASK, prot_id)) {
dev_err(dev, "Out of range protocol %d\n", prot_id);
+ continue;
+ }
if (!scmi_is_protocol_implemented(handle, prot_id)) {
dev_err(dev, "SCMI protocol %d not implemented\n",
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0540/1376] firmware: arm_scmi: Use channel ID for transport teardown
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (538 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0539/1376] firmware: arm_scmi: Reject out of range DT protocol IDs Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0541/1376] firmware: arm_scmi: Protect device request lookup with RCU Greg Kroah-Hartman
` (458 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Sudeep Holla, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <sudeep.holla@kernel.org>
[ Upstream commit a71a3d4d8a6e9e399fd988c0e6da47a6ee21c99e ]
SCMI protocols can share the BASE transport channel when firmware does
not describe a dedicated channel for the protocol. In that case multiple
IDR entries can point at the same scmi_chan_info, whose owning transport
device was created with cinfo->id.
scmi_chan_destroy() used the IDR iterator key when destroying the
transport device. If an alias entry is visited before the owning channel
entry, the lookup can miss the device because the iterator key does not
match the protocol ID used when the transport device was created. The
code then clears cinfo->dev, so the later owning entry skips teardown and
leaks the transport device.
Destroy the transport device using cinfo->id, which is the protocol ID
that owns the channel and was used when creating the transport device.
Fixes: 05a2801d8b90 ("firmware: arm_scmi: Use dedicated devices to initialize channels")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-8-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/arm_scmi/driver.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c
index f9d6b5eb89191..17f0a461cb96f 100644
--- a/drivers/firmware/arm_scmi/driver.c
+++ b/drivers/firmware/arm_scmi/driver.c
@@ -2771,7 +2771,7 @@ static int scmi_chan_destroy(int id, void *p, void *data)
struct scmi_device *sdev = to_scmi_dev(cinfo->dev);
of_node_put(cinfo->dev->of_node);
- scmi_device_destroy(info->dev, id, sdev->name);
+ scmi_device_destroy(info->dev, cinfo->id, sdev->name);
cinfo->dev = NULL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0541/1376] firmware: arm_scmi: Protect device request lookup with RCU
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (539 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0540/1376] firmware: arm_scmi: Use channel ID for transport teardown Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0542/1376] firmware: arm_scmi: Drop handle on protocol bind failures Greg Kroah-Hartman
` (457 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Sudeep Holla, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <sudeep.holla@kernel.org>
[ Upstream commit e6a0e7a49d83e4fa4e1db68d74f99282eb97aa49 ]
The SCMI device request notifier looks up protocol OF nodes from the
active_protocols IDR. The IDR lookup can run concurrently with protocol
activation while probe is still registering protocols and creating their
SCMI devices.
Wrap the lookup in an RCU read-side critical section as required by the
IDR API for lockless readers.
Fixes: 53b8c25df708 ("firmware: arm_scmi: Add common notifier helpers")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-9-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/arm_scmi/driver.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c
index 17f0a461cb96f..179005c64aa5c 100644
--- a/drivers/firmware/arm_scmi/driver.c
+++ b/drivers/firmware/arm_scmi/driver.c
@@ -31,6 +31,7 @@
#include <linux/of.h>
#include <linux/platform_device.h>
#include <linux/processor.h>
+#include <linux/rcupdate.h>
#include <linux/refcount.h>
#include <linux/slab.h>
#include <linux/xarray.h>
@@ -2834,7 +2835,9 @@ static int scmi_device_request_notifier(struct notifier_block *nb,
struct scmi_device_id *id_table = data;
struct scmi_info *info = req_nb_to_scmi_info(nb);
+ rcu_read_lock();
np = idr_find(&info->active_protocols, id_table->protocol_id);
+ rcu_read_unlock();
if (!np)
return NOTIFY_DONE;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0542/1376] firmware: arm_scmi: Drop handle on protocol bind failures
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (540 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0541/1376] firmware: arm_scmi: Protect device request lookup with RCU Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0543/1376] firmware: arm_scmi: Unwind TX receiver mailbox setup failure Greg Kroah-Hartman
` (456 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Sudeep Holla, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <sudeep.holla@kernel.org>
[ Upstream commit e3a5c30d233ca5d3e799a80da806554c703bda13 ]
The SCMI bus notifier acquires an SCMI handle when the driver core emits
BUS_NOTIFY_BIND_DRIVER, before invoking the protocol driver probe
callback. The protocol probe path only checks whether sdev->handle is
set.
If device_link_add() fails after the handle has been acquired, the
protocol device can still bind with a valid handle but without the
dependency link to the SCMI parent. A concurrent parent unbind can then
miss the child and tear down the SCMI instance while the child still
holds a handle into it.
If the protocol driver probe later fails, for example with
-EPROBE_DEFER, the driver core emits BUS_NOTIFY_DRIVER_NOT_BOUND rather
than BUS_NOTIFY_UNBOUND_DRIVER. The SCMI notifier only released the
handle on BUS_NOTIFY_UNBOUND_DRIVER, so each failed protocol-device bind
leaked the SCMI instance users refcount and left sdev->handle set after
the failed probe.
Make the link helper report failure and drop the acquired handle if the
link cannot be created. Also handle BUS_NOTIFY_DRIVER_NOT_BOUND in the
same cleanup path used for unbind so failed probes balance the earlier
BUS_NOTIFY_BIND_DRIVER acquisition.
Fixes: 971fc0665f13 ("firmware: arm_scmi: Move handle get/set helpers")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-10-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/arm_scmi/driver.c | 31 ++++++++++++++++++++++--------
1 file changed, 23 insertions(+), 8 deletions(-)
diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c
index 179005c64aa5c..ce441bbb5d5d3 100644
--- a/drivers/firmware/arm_scmi/driver.c
+++ b/drivers/firmware/arm_scmi/driver.c
@@ -2506,21 +2506,31 @@ static int scmi_handle_put(const struct scmi_handle *handle)
return 0;
}
-static void scmi_device_link_add(struct device *consumer,
+static bool scmi_device_link_add(struct device *consumer,
struct device *supplier)
{
struct device_link *link;
link = device_link_add(consumer, supplier, DL_FLAG_AUTOREMOVE_CONSUMER);
- WARN_ON(!link);
+ return !WARN_ON(!link);
+}
+
+static void scmi_clear_handle(struct scmi_device *scmi_dev)
+{
+ if (!scmi_dev->handle)
+ return;
+
+ scmi_handle_put(scmi_dev->handle);
+ scmi_dev->handle = NULL;
}
static void scmi_set_handle(struct scmi_device *scmi_dev)
{
scmi_dev->handle = scmi_handle_get(&scmi_dev->dev);
- if (scmi_dev->handle)
- scmi_device_link_add(&scmi_dev->dev, scmi_dev->handle->dev);
+ if (scmi_dev->handle &&
+ !scmi_device_link_add(&scmi_dev->dev, scmi_dev->handle->dev))
+ scmi_clear_handle(scmi_dev);
}
static int __scmi_xfer_info_init(struct scmi_info *sinfo,
@@ -2802,6 +2812,7 @@ static int scmi_bus_notifier(struct notifier_block *nb,
{
struct scmi_info *info = bus_nb_to_scmi_info(nb);
struct scmi_device *sdev = to_scmi_dev(data);
+ const char *status;
/* Skip transport devices and devices of different SCMI instances */
if (!strncmp(sdev->name, "__scmi_transport_device", 23) ||
@@ -2812,18 +2823,22 @@ static int scmi_bus_notifier(struct notifier_block *nb,
case BUS_NOTIFY_BIND_DRIVER:
/* setup handle now as the transport is ready */
scmi_set_handle(sdev);
+ status = "about to be BOUND.";
+ break;
+ case BUS_NOTIFY_DRIVER_NOT_BOUND:
+ scmi_clear_handle(sdev);
+ status = "NOT BOUND.";
break;
case BUS_NOTIFY_UNBOUND_DRIVER:
- scmi_handle_put(sdev->handle);
- sdev->handle = NULL;
+ scmi_clear_handle(sdev);
+ status = "UNBOUND.";
break;
default:
return NOTIFY_DONE;
}
dev_dbg(info->dev, "Device %s (%s) is now %s\n", dev_name(&sdev->dev),
- sdev->name, action == BUS_NOTIFY_BIND_DRIVER ?
- "about to be BOUND." : "UNBOUND.");
+ sdev->name, status);
return NOTIFY_OK;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0543/1376] firmware: arm_scmi: Unwind TX receiver mailbox setup failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (541 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0542/1376] firmware: arm_scmi: Drop handle on protocol bind failures Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0544/1376] firmware: arm_scmi: Unwind P2A " Greg Kroah-Hartman
` (455 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Sudeep Holla, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <sudeep.holla@kernel.org>
[ Upstream commit 6f7c06744d53dc8e047725d411d7f915d9ec35ae ]
mailbox_chan_setup() can request an additional unidirectional TX
receiver channel after successfully acquiring the primary channel. If
that second request fails, the function returns immediately and leaves
the primary channel allocated.
Unwind the primary mailbox channel before returning the error so probe
deferral or other setup failures do not leave the channel busy for later
probe attempts.
Fixes: 9f68ff79ec2c ("firmware: arm_scmi: Add support for unidirectional mailbox channels")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-13-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/arm_scmi/transports/mailbox.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/firmware/arm_scmi/transports/mailbox.c b/drivers/firmware/arm_scmi/transports/mailbox.c
index f4847569b42c8..3e662ec063c3d 100644
--- a/drivers/firmware/arm_scmi/transports/mailbox.c
+++ b/drivers/firmware/arm_scmi/transports/mailbox.c
@@ -227,9 +227,10 @@ static int mailbox_chan_setup(struct scmi_chan_info *cinfo, struct device *dev,
smbox->chan_receiver = mbox_request_channel(cl, a2p_rx_chan);
if (IS_ERR(smbox->chan_receiver)) {
ret = PTR_ERR(smbox->chan_receiver);
+ smbox->chan_receiver = NULL;
if (ret != -EPROBE_DEFER)
dev_err(cdev, "failed to request SCMI Tx Receiver mailbox\n");
- return ret;
+ goto err_free_chan;
}
}
@@ -245,6 +246,8 @@ static int mailbox_chan_setup(struct scmi_chan_info *cinfo, struct device *dev,
return 0;
+err_free_chan:
+ mbox_free_channel(smbox->chan);
err_clear_cinfo:
cinfo->transport_info = NULL;
smbox->cinfo = NULL;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0544/1376] firmware: arm_scmi: Unwind P2A receiver mailbox setup failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (542 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0543/1376] firmware: arm_scmi: Unwind TX receiver mailbox setup failure Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0545/1376] libnvdimm/labels: Bound the on-media label size before the shift Greg Kroah-Hartman
` (454 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Sudeep Holla, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <sudeep.holla@kernel.org>
[ Upstream commit f3e3773c4e5e96549d7540d8ddeb4fcd534f6f1d ]
mailbox_chan_setup() can request an additional P2A receiver channel after
successfully acquiring the primary P2A channel. If that later request
fails, the function returns immediately and leaves the primary channel
allocated.
Unwind the primary mailbox channel before returning the error so probe
deferral or other setup failures do not leave the channel busy for later
probe attempts.
Fixes: fa8b28ba22d9 ("firmware: arm_scmi: Add support for platform to agent channel completion")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-14-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/arm_scmi/transports/mailbox.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/firmware/arm_scmi/transports/mailbox.c b/drivers/firmware/arm_scmi/transports/mailbox.c
index 3e662ec063c3d..f43e00c46115e 100644
--- a/drivers/firmware/arm_scmi/transports/mailbox.c
+++ b/drivers/firmware/arm_scmi/transports/mailbox.c
@@ -238,9 +238,10 @@ static int mailbox_chan_setup(struct scmi_chan_info *cinfo, struct device *dev,
smbox->chan_platform_receiver = mbox_request_channel(cl, p2a_rx_chan);
if (IS_ERR(smbox->chan_platform_receiver)) {
ret = PTR_ERR(smbox->chan_platform_receiver);
+ smbox->chan_platform_receiver = NULL;
if (ret != -EPROBE_DEFER)
dev_err(cdev, "failed to request SCMI P2A Receiver mailbox\n");
- return ret;
+ goto err_free_chan;
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0545/1376] libnvdimm/labels: Bound the on-media label size before the shift
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (543 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0544/1376] firmware: arm_scmi: Unwind P2A " Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0546/1376] dax: read holder_ops once in dax_holder_notify_failure() Greg Kroah-Hartman
` (453 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Alison Schofield,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
[ Upstream commit 18f9124248ed7a9da1c31973b629dceef76a9b0c ]
For a v1.2+ index, __nd_label_validate() computes the label size as
1 << (7 + nsindex[i]->labelsize), where labelsize is a u8 read from
the label storage medium. A value of 25 or more makes the shift count
reach or exceed the width of int -- undefined behavior -- and 24 already
shifts into the sign bit. Only 0 (128-byte) and 1 (256-byte) are valid.
Reject a labelsize above 1 before the shift. The result was rejected by
the following size comparison anyway, so this only removes the undefined
shift on a crafted or corrupted medium; conforming labels are unaffected.
Fixes: 564e871aa66f ("libnvdimm, label: add v1.2 nvdimm label definitions")
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Link: https://patch.msgid.link/20260624-b4-disp-d8279485-v3-2-cdb6cab28b41@proton.me
Signed-off-by: Alison Schofield <alison.schofield@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvdimm/label.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
diff --git a/drivers/nvdimm/label.c b/drivers/nvdimm/label.c
index 584a9c27ce4bf..93ff219d91fc5 100644
--- a/drivers/nvdimm/label.c
+++ b/drivers/nvdimm/label.c
@@ -145,10 +145,21 @@ static int __nd_label_validate(struct nvdimm_drvdata *ndd)
/* label sizes larger than 128 arrived with v1.2 */
version = __le16_to_cpu(nsindex[i]->major) * 100
+ __le16_to_cpu(nsindex[i]->minor);
- if (version >= 102)
+ if (version >= 102) {
+ /*
+ * labelsize feeds the shift below; only 0 (128-byte)
+ * and 1 (256-byte) are valid -- a larger value would
+ * overflow or exceed the width of int.
+ */
+ if (nsindex[i]->labelsize > 1) {
+ dev_dbg(dev, "nsindex%d labelsize: %d invalid\n",
+ i, nsindex[i]->labelsize);
+ continue;
+ }
labelsize = 1 << (7 + nsindex[i]->labelsize);
- else
+ } else {
labelsize = 128;
+ }
if (labelsize != sizeof_namespace_label(ndd)) {
dev_dbg(dev, "nsindex%d labelsize %d invalid\n",
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0546/1376] dax: read holder_ops once in dax_holder_notify_failure()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (544 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0545/1376] libnvdimm/labels: Bound the on-media label size before the shift Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0547/1376] cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate() Greg Kroah-Hartman
` (452 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Richard Cheng, John Groves,
Alison Schofield, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Groves <John@Groves.net>
[ Upstream commit 7ae9d15bdcde0f2955ae13b6a95587f9e23b2359 ]
dax_holder_notify_failure() reads dax_dev->holder_ops twice without
READ_ONCE() -- once for the NULL check and once for the indirect
notify_failure() call. A concurrent fs_put_dax() can clear holder_ops
between the two reads, so the check can observe a non-NULL pointer while
the call dereferences NULL. (kill_dax() also clears holder_ops, but only
after synchronize_srcu(), so it cannot race a reader that is inside
dax_read_lock(); fs_put_dax() does no such synchronization.)
Fetch holder_ops once into a local with READ_ONCE() so the NULL check and
the indirect call observe the same value.
Fixes: 8012b86608552 ("dax: introduce holder for dax_device")
Suggested-by: Richard Cheng <icheng@nvidia.com>
Reviewed-by: Richard Cheng <icheng@nvidia.com>
Signed-off-by: John Groves <john@groves.net>
Link: https://patch.msgid.link/0100019ecc09bb56-5ecc9c6b-35ba-44f8-b112-921b01b34478-000000@email.amazonses.com
Signed-off-by: Alison Schofield <alison.schofield@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dax/super.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/drivers/dax/super.c b/drivers/dax/super.c
index e16d1d40d7738..6eb7ecd233840 100644
--- a/drivers/dax/super.c
+++ b/drivers/dax/super.c
@@ -233,6 +233,7 @@ EXPORT_SYMBOL_GPL(dax_recovery_write);
int dax_holder_notify_failure(struct dax_device *dax_dev, u64 off,
u64 len, int mf_flags)
{
+ const struct dax_holder_operations *ops;
int rc, id;
id = dax_read_lock();
@@ -241,12 +242,19 @@ int dax_holder_notify_failure(struct dax_device *dax_dev, u64 off,
goto out;
}
- if (!dax_dev->holder_ops) {
+ /*
+ * Read holder_ops once: a concurrent fs_put_dax() can clear it without
+ * synchronizing against readers. Without the single fetch the compiler
+ * could reload between the NULL check and the call and dereference a
+ * NULL ops.
+ */
+ ops = READ_ONCE(dax_dev->holder_ops);
+ if (!ops) {
rc = -EOPNOTSUPP;
goto out;
}
- rc = dax_dev->holder_ops->notify_failure(dax_dev, off, len, mf_flags);
+ rc = ops->notify_failure(dax_dev, off, len, mf_flags);
out:
dax_read_unlock(id);
return rc;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0547/1376] cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (545 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0546/1376] dax: read holder_ops once in dax_holder_notify_failure() Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0548/1376] PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN Greg Kroah-Hartman
` (451 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Zhongqiu Han,
Viresh Kumar, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <error27@gmail.com>
[ Upstream commit 6a9e0e0f7592313ace66303cf5eca68e04c10f30 ]
The clk_get_parent() function doesn't return error pointers, it returns
NULL on error. Update the error checking to match.
Fixes: 420993221175 ("cpufreq: SPEAr: Add CPUFreq driver")
Signed-off-by: Dan Carpenter <error27@gmail.com>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/spear-cpufreq.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/cpufreq/spear-cpufreq.c b/drivers/cpufreq/spear-cpufreq.c
index c032dd5d12d3c..ae038eec35bc1 100644
--- a/drivers/cpufreq/spear-cpufreq.c
+++ b/drivers/cpufreq/spear-cpufreq.c
@@ -79,9 +79,9 @@ static int spear1340_set_cpu_rate(struct clk *sys_pclk, unsigned long newfreq)
int ret = 0;
sys_clk = clk_get_parent(spear_cpufreq.clk);
- if (IS_ERR(sys_clk)) {
+ if (!sys_clk) {
pr_err("failed to get cpu's parent (sys) clock\n");
- return PTR_ERR(sys_clk);
+ return -EINVAL;
}
/* Set the rate of the source clock before changing the parent */
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0548/1376] PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (546 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0547/1376] cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate() Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0549/1376] PCI: xgene: Drop unnecessary OF node reference Greg Kroah-Hartman
` (450 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marc Zyngier, Lorenzo Pieralisi,
Bjorn Helgaas, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <maz@kernel.org>
[ Upstream commit fddf72ed7b52c91da37fe5f1d4faed11251b714f ]
XGENE_PCIE_IP_VER_UNKN is only refered to when probing for the
original XGene PCIe implementation, and get immediately overridden
if the device has the "apm,xgene-pcie" compatible string.
Given that the only way to get there is by finding this very string in
the DT, it is obvious that we will always overwrite the version with
XGENE_PCIE_IP_VER_1.
Drop the whole thing.
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://lore.kernel.org/r/20250708173404.1278635-5-maz@kernel.org
Stable-dep-of: 4869db344e76 ("PCI: xgene: Drop unnecessary OF node reference")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/pci-xgene.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/drivers/pci/controller/pci-xgene.c b/drivers/pci/controller/pci-xgene.c
index 1e2ebbfa36d19..16d4fd2364e35 100644
--- a/drivers/pci/controller/pci-xgene.c
+++ b/drivers/pci/controller/pci-xgene.c
@@ -53,7 +53,6 @@
#define XGENE_V1_PCI_EXP_CAP 0x40
/* PCIe IP version */
-#define XGENE_PCIE_IP_VER_UNKN 0
#define XGENE_PCIE_IP_VER_1 1
#define XGENE_PCIE_IP_VER_2 2
@@ -610,10 +609,7 @@ static int xgene_pcie_probe(struct platform_device *pdev)
port->node = of_node_get(dn);
port->dev = dev;
-
- port->version = XGENE_PCIE_IP_VER_UNKN;
- if (of_device_is_compatible(port->node, "apm,xgene-pcie"))
- port->version = XGENE_PCIE_IP_VER_1;
+ port->version = XGENE_PCIE_IP_VER_1;
ret = xgene_pcie_map_reg(port, pdev);
if (ret)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0549/1376] PCI: xgene: Drop unnecessary OF node reference
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (547 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0548/1376] PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0550/1376] irqchip/renesas-irqc: Fix generic interrupt chip leak on remove Greg Kroah-Hartman
` (449 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuho Choi, Manivannan Sadhasivam,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <dbgh9129@gmail.com>
[ Upstream commit 4869db344e76c9adfb1d9654df442db5371fac71 ]
xgene_pcie_probe() stores dev->of_node in port->node with
of_node_get(), but the cached node is only used during probe by
xgene_pcie_parse_map_dma_ranges(). The driver never releases the extra
reference, so the node reference is leaked.
There is no need for private OF node ownership here. Use the device's
existing of_node directly in xgene_pcie_parse_map_dma_ranges() and remove
the cached port->node pointer.
Fixes: 5f6b6ccdbe1c ("PCI: xgene: Add APM X-Gene PCIe driver")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/20260630195234.1871951-1-dbgh9129@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/pci-xgene.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/drivers/pci/controller/pci-xgene.c b/drivers/pci/controller/pci-xgene.c
index 16d4fd2364e35..7028d4b6abe6c 100644
--- a/drivers/pci/controller/pci-xgene.c
+++ b/drivers/pci/controller/pci-xgene.c
@@ -58,7 +58,6 @@
#if defined(CONFIG_PCI_XGENE) || (defined(CONFIG_ACPI) && defined(CONFIG_PCI_QUIRKS))
struct xgene_pcie {
- struct device_node *node;
struct device *dev;
struct clk *clk;
void __iomem *csr_base;
@@ -528,7 +527,7 @@ static void xgene_pcie_setup_ib_reg(struct xgene_pcie *port,
static int xgene_pcie_parse_map_dma_ranges(struct xgene_pcie *port)
{
- struct device_node *np = port->node;
+ struct device_node *np = port->dev->of_node;
struct of_pci_range range;
struct of_pci_range_parser parser;
struct device *dev = port->dev;
@@ -596,7 +595,6 @@ static struct pci_ops xgene_pcie_ops = {
static int xgene_pcie_probe(struct platform_device *pdev)
{
struct device *dev = &pdev->dev;
- struct device_node *dn = dev->of_node;
struct xgene_pcie *port;
struct pci_host_bridge *bridge;
int ret;
@@ -607,7 +605,6 @@ static int xgene_pcie_probe(struct platform_device *pdev)
port = pci_host_bridge_priv(bridge);
- port->node = of_node_get(dn);
port->dev = dev;
port->version = XGENE_PCIE_IP_VER_1;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0550/1376] irqchip/renesas-irqc: Fix generic interrupt chip leak on remove
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (548 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0549/1376] PCI: xgene: Drop unnecessary OF node reference Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0551/1376] media: i2c: rdacm21: Fix missing media_entity_cleanup() Greg Kroah-Hartman
` (448 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qingshuang Fu, Thomas Gleixner,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qingshuang Fu <fuqingshuang@kylinos.cn>
[ Upstream commit 616dd89d81ad9a3cf1cfff4088a4c43e4e00d6ba ]
The driver allocates domain generic chips probe. However, on driver
removal, the generic chips are not automatically freed when the interrupt
domain is removed because the domain flags do not include
IRQ_DOMAIN_FLAG_DESTROY_GC.
This causes both the domain generic chips structure and the associated
generic chips to be leaked. Additionally, the generic chips remain on the
global list and may later be accessed by generic interrupt chip suspend,
resume, or shutdown callbacks after the driver has been removed,
potentially resulting in a use-after-free and kernel crash.
Fix the resource leak by setting IRQ_DOMAIN_FLAG_DESTROY_GC on the
interrupt domain; this lets the interrupt domain core automatically
release all generic chips when irq_domain_remove() is invoked, removing
the need for manual cleanup calls in error paths and remove callback.
Fixes: 99c221df33fbfa1b ("irqchip/renesas-irqc: Move over to nested generic chip")
Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260708100846.506314-1-fffsqian@163.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-renesas-irqc.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/irqchip/irq-renesas-irqc.c b/drivers/irqchip/irq-renesas-irqc.c
index 76026e0b8e201..53ab8662a63bc 100644
--- a/drivers/irqchip/irq-renesas-irqc.c
+++ b/drivers/irqchip/irq-renesas-irqc.c
@@ -176,6 +176,7 @@ static int irqc_probe(struct platform_device *pdev)
goto err_runtime_pm_disable;
}
+ p->irq_domain->flags |= IRQ_DOMAIN_FLAG_DESTROY_GC;
ret = irq_alloc_domain_generic_chips(p->irq_domain, p->number_of_irqs,
1, "irqc", handle_level_irq,
0, 0, IRQ_GC_INIT_NESTED_LOCK);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0551/1376] media: i2c: rdacm21: Fix missing media_entity_cleanup()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (549 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0550/1376] irqchip/renesas-irqc: Fix generic interrupt chip leak on remove Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0552/1376] media: bcm2835-unicam: Fix asc leaked in error/remove path Greg Kroah-Hartman
` (447 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Biren Pandya, Sakari Ailus,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biren Pandya <birenpandya@gmail.com>
[ Upstream commit 04c053379c3a33460b581953c4f5b36de39439ac ]
The driver misses calling media_entity_cleanup() on the probe error path
and during remove, leaking resources if probe fails after entity
initialization or when the driver is unloaded.
Fix this by adding media_entity_cleanup() to the rdacm21_probe() error
handling path and to rdacm21_remove().
Fixes: a59f853b3b4b ("media: i2c: Add driver for RDACM21 camera module")
Signed-off-by: Biren Pandya <birenpandya@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/rdacm21.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/media/i2c/rdacm21.c b/drivers/media/i2c/rdacm21.c
index 3e22df36354fd..e8196ea737393 100644
--- a/drivers/media/i2c/rdacm21.c
+++ b/drivers/media/i2c/rdacm21.c
@@ -589,10 +589,12 @@ static int rdacm21_probe(struct i2c_client *client)
ret = v4l2_async_register_subdev(&dev->sd);
if (ret)
- goto error_free_ctrls;
+ goto error_entity_cleanup;
return 0;
+error_entity_cleanup:
+ media_entity_cleanup(&dev->sd.entity);
error_free_ctrls:
v4l2_ctrl_handler_free(&dev->ctrls);
error:
@@ -607,6 +609,7 @@ static void rdacm21_remove(struct i2c_client *client)
v4l2_async_unregister_subdev(&dev->sd);
v4l2_ctrl_handler_free(&dev->ctrls);
+ media_entity_cleanup(&dev->sd.entity);
i2c_unregister_device(dev->isp);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0552/1376] media: bcm2835-unicam: Fix asc leaked in error/remove path
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (550 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0551/1376] media: i2c: rdacm21: Fix missing media_entity_cleanup() Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0553/1376] media: ipu6: Do not free aux device pdata after init Greg Kroah-Hartman
` (446 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eugen Hristev, Laurent Pinchart,
Sakari Ailus, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eugen Hristev <ehristev@kernel.org>
[ Upstream commit 253c9659e25131b0169f718e7d094ac1aa0d9279 ]
v4l2_async_nf_add_fwnode_remote() allocates the asc, which is freed when
v4l2_async_nf_cleanup() is called.
Call v4l2_async_nf_cleanup() properly in the driver paths.
Discovered with kmemleak after rmmod:
unreferenced object 0xffff000084526b80 (size 64):
comm "modprobe", pid 185, jiffies 4295013512
hex dump (first 32 bytes):
01 00 00 00 00 00 00 00 e8 0d ff bf 00 00 ff ff ................
40 83 bc 84 00 00 ff ff 60 83 bc 84 00 00 ff ff @.......`.......
backtrace (crc ac584083):
[<00000000ffb081a7>] kmemleak_alloc+0x38/0x44
[<00000000d2fd9301>] __kmalloc+0x1b0/0x250
[<000000004dd5354d>] __v4l2_async_nf_add_fwnode+0x28/0x9c
[<0000000067587657>] __v4l2_async_nf_add_fwnode_remote+0x3c/0x64
Fixes: 392cd78d495f ("media: bcm2835-unicam: Add support for CCP2/CSI2 camera interface")
Signed-off-by: Eugen Hristev <ehristev@kernel.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/broadcom/bcm2835-unicam.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/platform/broadcom/bcm2835-unicam.c b/drivers/media/platform/broadcom/bcm2835-unicam.c
index 9f81e1582a300..d94703ac1022a 100644
--- a/drivers/media/platform/broadcom/bcm2835-unicam.c
+++ b/drivers/media/platform/broadcom/bcm2835-unicam.c
@@ -2570,6 +2570,7 @@ static int unicam_async_nf_init(struct unicam_device *unicam)
return 0;
error:
+ v4l2_async_nf_cleanup(&unicam->notifier);
fwnode_handle_put(ep_handle);
return ret;
}
@@ -2702,6 +2703,7 @@ static void unicam_remove(struct platform_device *pdev)
v4l2_device_unregister(&unicam->v4l2_dev);
media_device_unregister(&unicam->mdev);
v4l2_async_nf_unregister(&unicam->notifier);
+ v4l2_async_nf_cleanup(&unicam->notifier);
unicam_subdev_cleanup(unicam);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0553/1376] media: ipu6: Do not free aux device pdata after init
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (551 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0552/1376] media: bcm2835-unicam: Fix asc leaked in error/remove path Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0554/1376] drm/amd/display: Remove unused-but-set variable hubp from Greg Kroah-Hartman
` (445 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ruoyu Wang, Sakari Ailus,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <ruoyuw560@gmail.com>
[ Upstream commit 9be07216af4cfc4813e1a46ce26407d31ea845de ]
ipu6_bus_initialize_device() stores the isys/psys pdata pointer in
struct ipu6_bus_device and initializes the auxiliary device. After that
point, error unwinding must drop the auxiliary device reference and let
ipu6_bus_release() free both the bus device and adev->pdata.
The isys and psys init paths already call put_device() when MMU
initialization fails, and ipu6_bus_add_device() calls
auxiliary_device_uninit() on auxiliary_device_add() failure. Both paths
therefore run the bus release callback. The extra kfree(pdata) in the
callers can release the same object a second time.
Remove the manual pdata frees after the auxiliary device has been
initialized.
This issue was found by a static analysis checker and confirmed by
manual source review.
Fixes: cb3117b074ae ("media: intel/ipu6: add IPU auxiliary devices")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/intel/ipu6/ipu6.c | 10 ++--------
1 file changed, 2 insertions(+), 8 deletions(-)
diff --git a/drivers/media/pci/intel/ipu6/ipu6.c b/drivers/media/pci/intel/ipu6/ipu6.c
index 40566b652b2de..8b45ff0c22b65 100644
--- a/drivers/media/pci/intel/ipu6/ipu6.c
+++ b/drivers/media/pci/intel/ipu6/ipu6.c
@@ -399,7 +399,6 @@ ipu6_isys_init(struct pci_dev *pdev, struct device *parent,
&ipdata->hw_variant);
if (IS_ERR(isys_adev->mmu)) {
put_device(&isys_adev->auxdev.dev);
- kfree(pdata);
return dev_err_cast_probe(dev, isys_adev->mmu,
"ipu6_mmu_init(isys_adev->mmu) failed\n");
}
@@ -407,10 +406,8 @@ ipu6_isys_init(struct pci_dev *pdev, struct device *parent,
isys_adev->mmu->dev = &isys_adev->auxdev.dev;
ret = ipu6_bus_add_device(isys_adev);
- if (ret) {
- kfree(pdata);
+ if (ret)
return ERR_PTR(ret);
- }
return isys_adev;
}
@@ -443,7 +440,6 @@ ipu6_psys_init(struct pci_dev *pdev, struct device *parent,
&ipdata->hw_variant);
if (IS_ERR(psys_adev->mmu)) {
put_device(&psys_adev->auxdev.dev);
- kfree(pdata);
return dev_err_cast_probe(&pdev->dev, psys_adev->mmu,
"ipu6_mmu_init(psys_adev->mmu) failed\n");
}
@@ -451,10 +447,8 @@ ipu6_psys_init(struct pci_dev *pdev, struct device *parent,
psys_adev->mmu->dev = &psys_adev->auxdev.dev;
ret = ipu6_bus_add_device(psys_adev);
- if (ret) {
- kfree(pdata);
+ if (ret)
return ERR_PTR(ret);
- }
return psys_adev;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0554/1376] drm/amd/display: Remove unused-but-set variable hubp from
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (552 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0553/1376] media: ipu6: Do not free aux device pdata after init Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0555/1376] cpufreq: intel_pstate: Fix setting minimum P-state at init time Greg Kroah-Hartman
` (444 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gleb Markov, George Zhang,
Alex Deucher, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gleb Markov <markov.gi@npc-ksb.ru>
[ Upstream commit b736792e5bd4a62f24e8d1e310bf4a75bfbeaaaa ]
The final check of hubp for NULL covers all remaining lines of code, since
the value of hubp does not change until the end of the method.
This check is redundant because hubp1 is already dereferenced within the
macro.
If it were NULL, the program would have already failed to proceed.
Remove the left part of the expression with the logical "&&".
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: be1fb44389ca ("drm/amd/display: Check null pointers before used").
Signed-off-by: Gleb Markov <markov.gi@npc-ksb.ru>
Reviewed-by: George Zhang <george.zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/hubp/dcn10/dcn10_hubp.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/hubp/dcn10/dcn10_hubp.c b/drivers/gpu/drm/amd/display/dc/hubp/dcn10/dcn10_hubp.c
index da963f73829f6..c8ae19b37d844 100644
--- a/drivers/gpu/drm/amd/display/dc/hubp/dcn10/dcn10_hubp.c
+++ b/drivers/gpu/drm/amd/display/dc/hubp/dcn10/dcn10_hubp.c
@@ -755,8 +755,7 @@ bool hubp1_is_flip_pending(struct hubp *hubp)
if (flip_pending)
return true;
- if (hubp &&
- earliest_inuse_address.grph.addr.quad_part != hubp->request_address.grph.addr.quad_part)
+ if (earliest_inuse_address.grph.addr.quad_part != hubp->request_address.grph.addr.quad_part)
return true;
return false;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0555/1376] cpufreq: intel_pstate: Fix setting minimum P-state at init time
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (553 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0554/1376] drm/amd/display: Remove unused-but-set variable hubp from Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0556/1376] cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply() Greg Kroah-Hartman
` (443 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Rafael J. Wysocki, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
[ Upstream commit db53c573d31d07d5d782c5312d37cb33be788eba ]
If HWP is enabled, writes to MSR_IA32_PERF_CTL have no effect,
so intel_pstate_get_cpu_pstates() should not attempt to call
intel_pstate_set_min_pstate() to set the minimum P-state for the
given CPU in that case.
Accordingly, remove the intel_pstate_set_min_pstate()
call from intel_pstate_get_cpu_pstates() and make both
intel_pstate_cpu_init() and intel_cpufreq_cpu_init() call
that function in their non-HWP code paths.
The HWP code path in intel_pstate_cpu_init() does not need to update
the current P-state of the CPU directly at all because it is taken
care of the processor automatically, but the HWP code path of
intel_cpufreq_cpu_init() should update it in principle to
initialize the DESIRED_PERF field in MSR_HWP_REQUEST. For this
purpose, make it call intel_cpufreq_hwp_update() and pass
the minimum P-state limit to it as the current target value along
with the current minimum and maximum limits.
Fixes: f6ebbcf08f37 ("cpufreq: intel_pstate: Implement passive mode with HWP enabled")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/5090465.GXAFRqVoOG@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/intel_pstate.c | 19 +++++++++++--------
1 file changed, 11 insertions(+), 8 deletions(-)
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 818507586cd93..f1910f9109f01 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -2300,8 +2300,6 @@ static void intel_pstate_get_cpu_pstates(struct cpudata *cpu)
if (pstate_funcs.get_vid)
pstate_funcs.get_vid(cpu);
-
- intel_pstate_set_min_pstate(cpu);
}
/*
@@ -3008,6 +3006,7 @@ static int __intel_pstate_cpu_init(struct cpufreq_policy *policy)
static int intel_pstate_cpu_init(struct cpufreq_policy *policy)
{
int ret = __intel_pstate_cpu_init(policy);
+ struct cpudata *cpu;
if (ret)
return ret;
@@ -3018,11 +3017,11 @@ static int intel_pstate_cpu_init(struct cpufreq_policy *policy)
*/
policy->policy = CPUFREQ_POLICY_POWERSAVE;
- if (hwp_active) {
- struct cpudata *cpu = all_cpu_data[policy->cpu];
-
+ cpu = all_cpu_data[policy->cpu];
+ if (hwp_active)
cpu->epp_cached = intel_pstate_get_epp(cpu, 0);
- }
+ else
+ intel_pstate_set_min_pstate(cpu);
return 0;
}
@@ -3246,8 +3245,6 @@ static int intel_cpufreq_cpu_init(struct cpufreq_policy *policy)
return ret;
policy->cpuinfo.transition_latency = INTEL_CPUFREQ_TRANSITION_LATENCY;
- /* This reflects the intel_pstate_get_cpu_pstates() setting. */
- policy->cur = policy->cpuinfo.min_freq;
req = kcalloc(2, sizeof(*req), GFP_KERNEL);
if (!req) {
@@ -3268,9 +3265,15 @@ static int intel_cpufreq_cpu_init(struct cpufreq_policy *policy)
WRITE_ONCE(cpu->hwp_req_cached, value);
cpu->epp_cached = intel_pstate_get_epp(cpu, value);
+
+ intel_cpufreq_hwp_update(cpu, cpu->pstate.min_pstate,
+ cpu->pstate.max_pstate,
+ cpu->pstate.min_pstate, false);
} else {
policy->transition_delay_us = INTEL_CPUFREQ_TRANSITION_DELAY;
+ intel_pstate_set_min_pstate(cpu);
}
+ policy->cur = policy->cpuinfo.min_freq;
freq = DIV_ROUND_UP(cpu->pstate.turbo_freq * global.min_perf_pct, 100);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0556/1376] cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (554 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0555/1376] cpufreq: intel_pstate: Fix setting minimum P-state at init time Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0557/1376] remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev Greg Kroah-Hartman
` (442 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhongqiu Han, Christian Loehle,
Rafael J. Wysocki, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
[ Upstream commit db6a017c91b774c15b1b890db45981eacfff540e ]
The kerneldoc of sugov_iowait_apply() says the IO boost value is increased
in sugov_iowait_apply() and, in the same sentence, that it is decreased by
the same function. That is self-contradictory, and the first part is wrong:
sugov_iowait_apply() only decreases the boost.
The boost is actually increased in sugov_iowait_boost(). Fix the comment to
name sugov_iowait_boost() as the place where the boost is increased, so it
matches the code.
No functional change.
Fixes: fd7d5287fd65 ("cpufreq: schedutil: Cleanup and document iowait boost")
Signed-off-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Reviewed-by: Christian Loehle <christian.loehle@arm.com>
Link: https://patch.msgid.link/20260703092433.4080165-1-zhongqiu.han@oss.qualcomm.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sched/cpufreq_schedutil.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
index 3d9606c2f32c6..7c41ed3ec9175 100644
--- a/kernel/sched/cpufreq_schedutil.c
+++ b/kernel/sched/cpufreq_schedutil.c
@@ -320,7 +320,7 @@ static void sugov_iowait_boost(struct sugov_cpu *sg_cpu, u64 time,
* A CPU running a task which woken up after an IO operation can have its
* utilization boosted to speed up the completion of those IO operations.
* The IO boost value is increased each time a task wakes up from IO, in
- * sugov_iowait_apply(), and it's instead decreased by this function,
+ * sugov_iowait_boost(), and it's instead decreased by this function,
* each time an increase has not been requested (!iowait_boost_pending).
*
* A CPU which also appears to have been idle for at least one tick has also
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0557/1376] remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (555 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0556/1376] cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply() Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0558/1376] drm/bridge: tc358767: clamp the reported AUX read size to the request Greg Kroah-Hartman
` (441 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Uday Khare, Bjorn Andersson,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uday Khare <udaykhare77@gmail.com>
[ Upstream commit 44f4911ab8e6f4d69afad5f2571bbd2da421c918 ]
In qcom_add_glink_subdev(), the device node reference acquired via
of_get_child_by_name() is stored in glink->node. If the subsequent
kstrdup_const() allocation for glink->ssr_name fails, the function
returns early without calling of_node_put() on glink->node, leaking
the reference count.
Fix this by adding of_node_put(glink->node) on the error path before
returning.
Fixes: cd9fc8f1b35b ("remoteproc: qcom: Pass ssr_name to glink subdevice")
Signed-off-by: Uday Khare <udaykhare77@gmail.com>
Link: https://lore.kernel.org/r/20260618132054.11010-1-udaykhare77@gmail.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/remoteproc/qcom_common.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/remoteproc/qcom_common.c b/drivers/remoteproc/qcom_common.c
index 5bbbe36d09640..506678d1633e1 100644
--- a/drivers/remoteproc/qcom_common.c
+++ b/drivers/remoteproc/qcom_common.c
@@ -242,8 +242,10 @@ void qcom_add_glink_subdev(struct rproc *rproc, struct qcom_rproc_glink *glink,
return;
glink->ssr_name = kstrdup_const(ssr_name, GFP_KERNEL);
- if (!glink->ssr_name)
+ if (!glink->ssr_name) {
+ of_node_put(glink->node);
return;
+ }
glink->dev = dev;
glink->subdev.start = glink_subdev_start;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0558/1376] drm/bridge: tc358767: clamp the reported AUX read size to the request
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (556 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0557/1376] remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0559/1376] arm64: dts: qcom: msm8996-xiaomi-gemini: Fix up ti,drv2604 enable GPIO Greg Kroah-Hartman
` (440 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kaixuan Li, Maoyi Xie,
Douglas Anderson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <maoyixie.tju@gmail.com>
[ Upstream commit ec6444a00c49e6c2b5e9a507272a28126677f9ee ]
tc_aux_transfer() clamps an AUX read to the payload limit:
size_t size = min_t(size_t, DP_AUX_MAX_PAYLOAD_BYTES - 1, msg->size);
After the transfer it replaces size with the byte count the controller
reports in AUX_BYTES:
if (size)
size = FIELD_GET(AUX_BYTES, auxstatus);
AUX_BYTES is GENMASK(15, 8), so it can be up to 255. Nothing clamps it
back to the request. tc_aux_read_data() reads that many bytes into the
16-byte auxrdata stack buffer, then copies them into the caller buffer. A
reported count of 255 makes the read run to 256 bytes and overruns both.
The controller should never report more than it was asked to transfer, so
this is defense in depth rather than a live hole. The reported count is
only lightly trusted, and the check is cheap. Clamp it back to the request,
the same way ti-sn65dsi86 does in commit aca58eac52b8 ("drm/bridge:
ti-sn65dsi86: Never store more than msg->size bytes in AUX xfer").
Fixes: 12dfe7c4d9c5 ("drm/bridge: tc358767: Use reported AUX transfer size")
Co-developed-by: Kaixuan Li <kaixuan.li@ntu.edu.sg>
Signed-off-by: Kaixuan Li <kaixuan.li@ntu.edu.sg>
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://patch.msgid.link/20260701064440.1541418-1-maoyixie.tju@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/tc358767.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c
index 47189587643a1..47c9b2d4369ea 100644
--- a/drivers/gpu/drm/bridge/tc358767.c
+++ b/drivers/gpu/drm/bridge/tc358767.c
@@ -519,7 +519,7 @@ static ssize_t tc_aux_transfer(struct drm_dp_aux *aux,
* address-only transfer
*/
if (size)
- size = FIELD_GET(AUX_BYTES, auxstatus);
+ size = min_t(size_t, size, FIELD_GET(AUX_BYTES, auxstatus));
msg->reply = FIELD_GET(AUX_STATUS, auxstatus);
switch (request) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0559/1376] arm64: dts: qcom: msm8996-xiaomi-gemini: Fix up ti,drv2604 enable GPIO
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (557 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0558/1376] drm/bridge: tc358767: clamp the reported AUX read size to the request Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0560/1376] arm64: dts: qcom: sc8280xp-x13s: Fix the drive-strength of mclk pin Greg Kroah-Hartman
` (439 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Krzysztof Kozlowski,
Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
[ Upstream commit 569413a98a1761782a0770aa85d20a2c78893279 ]
Update the 'enable-gpio' property name to 'enable-gpios' to conform to
the bindings for the TI DRV2604 haptics module. While at it, use the
GPIO_ACTIVE_HIGH define instead of the raw literal.
Fixes: 4ac46b3682c5 ("arm64: dts: qcom: msm8996: xiaomi-gemini: Add support for Xiaomi Mi 5")
Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260625-topic-ti_drv2604_dtwarn-v1-1-76e91fcafbe8@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/msm8996-xiaomi-gemini.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/msm8996-xiaomi-gemini.dts b/arch/arm64/boot/dts/qcom/msm8996-xiaomi-gemini.dts
index dbad8f57f2fa3..f145e8ee5f80b 100644
--- a/arch/arm64/boot/dts/qcom/msm8996-xiaomi-gemini.dts
+++ b/arch/arm64/boot/dts/qcom/msm8996-xiaomi-gemini.dts
@@ -39,7 +39,7 @@ &blsp2_i2c3 {
haptics: drv2604@5a {
compatible = "ti,drv2604";
reg = <0x5a>;
- enable-gpio = <&tlmm 93 0x00>;
+ enable-gpios = <&tlmm 93 GPIO_ACTIVE_HIGH>;
mode = <DRV260X_LRA_MODE>;
library-sel = <DRV260X_LIB_LRA>;
pinctrl-names = "default","sleep";
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0560/1376] arm64: dts: qcom: sc8280xp-x13s: Fix the drive-strength of mclk pin
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (558 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0559/1376] arm64: dts: qcom: msm8996-xiaomi-gemini: Fix up ti,drv2604 enable GPIO Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0561/1376] arm64: dts: qcom: sm8250: sort out Iris power domains Greg Kroah-Hartman
` (438 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pengyu Luo, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengyu Luo <mitltlatltl@gmail.com>
[ Upstream commit 09531bb8e0de5081fdbe215877dd7f2ec8b2f0e1 ]
The value can be retrieve via windbg on Windows.
lkd> !dd f111000 L8
ctl_reg => 0x284
in drivers/pinctrl/qcom/pinctrl-msm.c
function msm_gpio_dbg_show_one()
...
drive = (ctl_reg >> g->drv_bit) & 7; // (0x284 >> 6) & 7 == 2
...
seq_printf(s, " %dmA", msm_regval_to_drive(drive)); // (drive + 1) * 2 == 6;
...
So the value is 6, not 16, it matches Windows now.
Fixes: 21927e94caa5 ("arm64: dts: qcom: sc8280xp-x13s: Enable RGB sensor")
Signed-off-by: Pengyu Luo <mitltlatltl@gmail.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260629065905.15651-2-mitltlatltl@gmail.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts b/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts
index 8e5951da5920d..4dfe29caa52d2 100644
--- a/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts
+++ b/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts
@@ -1488,7 +1488,7 @@ cam_rgb_default: cam-rgb-default-state {
mclk-pins {
pins = "gpio17";
function = "cam_mclk";
- drive-strength = <16>;
+ drive-strength = <6>;
bias-disable;
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0561/1376] arm64: dts: qcom: sm8250: sort out Iris power domains
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (559 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0560/1376] arm64: dts: qcom: sc8280xp-x13s: Fix the drive-strength of mclk pin Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0562/1376] arm64: dts: qcom: sm8250: correct frequencies in the Iris OPP table Greg Kroah-Hartman
` (437 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Dmitry Baryshkov,
Dikshita Agarwal, Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
[ Upstream commit d5c8efda722eb1f67cfe299b71f13dab93746934 ]
On SM8250 Iris core requires two power rails to function, MX (for PLLs)
and MMCX (for everything else). The commit fa245b3f06cd ("arm64: dts:
qcom: sm8250: Add venus DT node") added only MX power rail, but omitted
MMCX voltage levels.
Add MMCX domain to the Iris device node.
Fixes: fa245b3f06cd ("arm64: dts: qcom: sm8250: Add venus DT node")
Reported-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260604-iris-venus-fix-sm8250-v7-1-7bd2f0e5bae8@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sm8250.dtsi | 20 ++++++++++++++------
1 file changed, 14 insertions(+), 6 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi
index 4cb91f31340db..12c1d60ec3e76 100644
--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi
@@ -4310,8 +4310,12 @@ venus: video-codec@aa00000 {
interrupts = <GIC_SPI 174 IRQ_TYPE_LEVEL_HIGH>;
power-domains = <&videocc MVS0C_GDSC>,
<&videocc MVS0_GDSC>,
- <&rpmhpd RPMHPD_MX>;
- power-domain-names = "venus", "vcodec0", "mx";
+ <&rpmhpd RPMHPD_MX>,
+ <&rpmhpd RPMHPD_MMCX>;
+ power-domain-names = "venus",
+ "vcodec0",
+ "mx",
+ "mmcx";
operating-points-v2 = <&venus_opp_table>;
clocks = <&gcc GCC_VIDEO_AXI0_CLK>,
@@ -4345,22 +4349,26 @@ venus_opp_table: opp-table {
opp-720000000 {
opp-hz = /bits/ 64 <720000000>;
- required-opps = <&rpmhpd_opp_low_svs>;
+ required-opps = <&rpmhpd_opp_svs>,
+ <&rpmhpd_opp_low_svs>;
};
opp-1014000000 {
opp-hz = /bits/ 64 <1014000000>;
- required-opps = <&rpmhpd_opp_svs>;
+ required-opps = <&rpmhpd_opp_svs>,
+ <&rpmhpd_opp_svs>;
};
opp-1098000000 {
opp-hz = /bits/ 64 <1098000000>;
- required-opps = <&rpmhpd_opp_svs_l1>;
+ required-opps = <&rpmhpd_opp_svs_l1>,
+ <&rpmhpd_opp_svs_l1>;
};
opp-1332000000 {
opp-hz = /bits/ 64 <1332000000>;
- required-opps = <&rpmhpd_opp_nom>;
+ required-opps = <&rpmhpd_opp_svs_l1>,
+ <&rpmhpd_opp_nom>;
};
};
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0562/1376] arm64: dts: qcom: sm8250: correct frequencies in the Iris OPP table
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (560 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0561/1376] arm64: dts: qcom: sm8250: sort out Iris power domains Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0563/1376] perf jevents: Add more components to the metric sorting order Greg Kroah-Hartman
` (436 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Dikshita Agarwal,
Dmitry Baryshkov, Vishnu Reddy, Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
[ Upstream commit 68ea007df9293fcb29d38219d73094bbf4b59673 ]
The OPP table for the Iris core is wrong, it copies the VDD table from
the downstream kernel, but that table is written for the
video_cc_mvs0_clk_src, while the upstream uses video_cc_mvs0_clk for OPP
rate setting (which is clk_src divided by 3). Specify correct
frequencies in the OPP table.
Fixes: fa245b3f06cd ("arm64: dts: qcom: sm8250: Add venus DT node")
Reported-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260604-iris-venus-fix-sm8250-v7-2-7bd2f0e5bae8@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sm8250.dtsi | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi
index 12c1d60ec3e76..d6607c38eb35c 100644
--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi
@@ -4347,26 +4347,26 @@ video-encoder {
venus_opp_table: opp-table {
compatible = "operating-points-v2";
- opp-720000000 {
- opp-hz = /bits/ 64 <720000000>;
+ opp-240000000 {
+ opp-hz = /bits/ 64 <240000000>;
required-opps = <&rpmhpd_opp_svs>,
<&rpmhpd_opp_low_svs>;
};
- opp-1014000000 {
- opp-hz = /bits/ 64 <1014000000>;
+ opp-338000000 {
+ opp-hz = /bits/ 64 <338000000>;
required-opps = <&rpmhpd_opp_svs>,
<&rpmhpd_opp_svs>;
};
- opp-1098000000 {
- opp-hz = /bits/ 64 <1098000000>;
+ opp-366000000 {
+ opp-hz = /bits/ 64 <366000000>;
required-opps = <&rpmhpd_opp_svs_l1>,
<&rpmhpd_opp_svs_l1>;
};
- opp-1332000000 {
- opp-hz = /bits/ 64 <1332000000>;
+ opp-444000000 {
+ opp-hz = /bits/ 64 <444000000>;
required-opps = <&rpmhpd_opp_svs_l1>,
<&rpmhpd_opp_nom>;
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0563/1376] perf jevents: Add more components to the metric sorting order
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (561 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0562/1376] arm64: dts: qcom: sm8250: correct frequencies in the Iris OPP table Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0564/1376] wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs Greg Kroah-Hartman
` (435 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nazar Kazakov, Ian Rogers,
Namhyung Kim, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <irogers@google.com>
[ Upstream commit 557f8b3ca8c8e58d5bc3084734bc7a470b043922 ]
Nazar Kazakov reported non-deterministic builds due to the metrics
being reordered in the jevents.py output. The metrics were largely
only being sorted by name, add in the expressions and descriptions.
Reported-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Closes: https://lore.kernel.org/linux-perf-users/20260706175624.692736-1-nazar.kazakov@codethink.co.uk/
Fixes: 40769665b63d ("perf jevents: Parse metrics during conversion")
Tested-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/pmu-events/jevents.py | 5 +++--
tools/perf/pmu-events/metric.py | 6 +++++-
2 files changed, 8 insertions(+), 3 deletions(-)
diff --git a/tools/perf/pmu-events/jevents.py b/tools/perf/pmu-events/jevents.py
index 4145e02777531..87cbbafb41e08 100755
--- a/tools/perf/pmu-events/jevents.py
+++ b/tools/perf/pmu-events/jevents.py
@@ -540,13 +540,14 @@ const struct pmu_table_entry {_pending_events_tblname}[] = {{
def print_pending_metrics() -> None:
"""Optionally close metrics table."""
- def metric_cmp_key(j: JsonEvent) -> Tuple[bool, str, str]:
+ def metric_cmp_key(j: JsonEvent) -> Tuple[str, str, str, str]:
def fix_none(s: Optional[str]) -> str:
if s is None:
return ''
return s
- return (j.desc is not None, fix_none(j.pmu), fix_none(j.metric_name))
+ return (fix_none(j.pmu), fix_none(j.metric_name), j.metric_expr.ToPerfJson(),
+ fix_none(j.desc))
global _pending_metrics
if not _pending_metrics:
diff --git a/tools/perf/pmu-events/metric.py b/tools/perf/pmu-events/metric.py
index 92acd89ed97aa..ac322891c4f1b 100644
--- a/tools/perf/pmu-events/metric.py
+++ b/tools/perf/pmu-events/metric.py
@@ -445,7 +445,11 @@ class Metric:
def __lt__(self, other):
"""Sort order."""
- return self.name < other.name
+ if self.name != other.name:
+ return self.name < other.name
+ if not self.expr.Equals(other.expr):
+ return self.expr.ToPerfJson() < other.expr.ToPerfJson()
+ return self.description < other.description
def AddToMetricGroup(self, group):
"""Callback used when being added to a MetricGroup."""
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0564/1376] wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (562 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0563/1376] perf jevents: Add more components to the metric sorting order Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0565/1376] wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser Greg Kroah-Hartman
` (434 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Emmanuel Grumbach, Miri Korenblit,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
[ Upstream commit 71e67b4b59337b2f9f4fef976a27de2dad7aabf2 ]
The loop counter 'count' was declared as u8 while num_pc is u32.
If firmware advertises more than 255 PC entries the counter wraps
back to zero and the loop never terminates potentially causing an
infinite loop or reading past the allocated pc_data array.
Change the declaration to u32 to match num_pc.
Fixes: 2b69d242e29b ("wifi: iwlwifi: fw: print PC register value instead of address")
Assisted-by: GitHubCopilot:gpt-5.3-codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260715220243.a61c65f34e87.Ie5f1a7ca43e0cc5a0ddc8305b0448ddffc09cd18@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/fw/dump.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dump.c b/drivers/net/wireless/intel/iwlwifi/fw/dump.c
index 8f107ceec4076..0aa53212a9933 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/dump.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/dump.c
@@ -488,7 +488,7 @@ static void iwl_fwrt_dump_fseq_regs(struct iwl_fw_runtime *fwrt)
void iwl_fwrt_dump_error_logs(struct iwl_fw_runtime *fwrt)
{
struct iwl_pc_data *pc_data;
- u8 count;
+ u32 count;
if (!test_bit(STATUS_DEVICE_ENABLED, &fwrt->trans->status)) {
IWL_ERR(fwrt,
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0565/1376] wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (563 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0564/1376] wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0566/1376] wifi: iwlwifi: mei: check SAP message length before reading it Greg Kroah-Hartman
` (433 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Emmanuel Grumbach, Miri Korenblit,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
[ Upstream commit f6a6c01cbc046f68e6916a7e047a1bc881c8c9ab ]
iwl_mvm_frob_txf_key_iter() tracks the last matched byte position
in loop variable 'i'. When a full key match is found (match ==
keylen), 'i' points at the last byte of the matched key. The
memset start offset should therefore be i + 1 - keylen, not
i - keylen; the current code zeroes one byte before the match
and leaves the final key byte un-sanitised.
Fixes: 12d60c1efc29 ("iwlwifi: mvm: scrub key material in firmware dumps")
Assisted-by: GitHubCopilot:gpt-5.3-codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260715220243.355998ec4fbe.I40f3427657b897e911bdf4ebf8e494745508d126@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index a7dbc0a5ea84e..96de7edf17929 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -1010,7 +1010,7 @@ static void iwl_mvm_frob_txf_key_iter(struct ieee80211_hw *hw,
}
match++;
if (match == keylen) {
- memset(txf->buf + i - keylen, 0xAA, keylen);
+ memset(txf->buf + i + 1 - keylen, 0xAA, keylen);
match = 0;
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0566/1376] wifi: iwlwifi: mei: check SAP message length before reading it
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (564 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0565/1376] wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0567/1376] wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments Greg Kroah-Hartman
` (432 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Avraham Stern, Miri Korenblit,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Avraham Stern <avraham.stern@intel.com>
[ Upstream commit 7d8cc301bcba233f31b589a45f4c1c97f2bb90d6 ]
Verify the SAP message size is not larger than the local buffer before
reading the message to avoid buffer overflow.
Fixes: bcd68b3dbe78 ("wifi: iwlwifi: mei: fix tx DHCP packet for devices with new Tx API")
Signed-off-by: Avraham Stern <avraham.stern@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260715220243.f0026ce26218.I00a856d3aacae1caac605c708f7362689b734234@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/mei/main.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/mei/main.c b/drivers/net/wireless/intel/iwlwifi/mei/main.c
index dce0b7cf7b265..c083af5240593 100644
--- a/drivers/net/wireless/intel/iwlwifi/mei/main.c
+++ b/drivers/net/wireless/intel/iwlwifi/mei/main.c
@@ -1,6 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (C) 2021-2024 Intel Corporation
+ * Copyright (C) 2026 Intel Corporation
*/
#include <linux/etherdevice.h>
@@ -1147,6 +1148,11 @@ static void iwl_mei_handle_sap_rx_cmd(struct mei_cl_device *cldev,
iwl_mei_read_from_q(q_head, q_sz, &rd, wr, hdr, sizeof(*hdr));
valid_rx_sz -= sizeof(*hdr);
len = le16_to_cpu(hdr->len);
+ if (len + sizeof(*hdr) > PAGE_SIZE) {
+ dev_err(&cldev->dev,
+ "SAP message is too big: %u\n", len);
+ break;
+ }
if (valid_rx_sz < len)
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0567/1376] wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (565 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0566/1376] wifi: iwlwifi: mei: check SAP message length before reading it Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0568/1376] wifi: iwlwifi: mei: pass correct argument to function Greg Kroah-Hartman
` (431 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Emmanuel Grumbach, Miri Korenblit,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
[ Upstream commit 9318bc0c41b24705690cf80d1596cf6b711e7027 ]
Make sure we don't end-up with a num_frags = 0 situation.
For that, check that the required size is not 0 and put a checker on
num_frags as well.
Fixes: 14124b25780d ("iwlwifi: dbg_ini: implement monitor allocation flow")
Assisted-by: GitHubCopilot:gpt-5.3-codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260715220243.60121deecf2c.Iebc891c95a7bd1b2a093b0bb88532db446a758ee@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
index ce787326aa69d..47d5488c95043 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
/*
- * Copyright (C) 2018-2025 Intel Corporation
+ * Copyright (C) 2018-2026 Intel Corporation
*/
#include <linux/firmware.h>
#include "iwl-drv.h"
@@ -602,6 +602,9 @@ static int iwl_dbg_tlv_alloc_fragments(struct iwl_fw_runtime *fwrt,
cpu_to_le32(IWL_FW_INI_LOCATION_DRAM_PATH))
return 0;
+ if (!fw_mon_cfg->req_size)
+ return -EIO;
+
num_frags = le32_to_cpu(fw_mon_cfg->max_frags_num);
if (fwrt->trans->trans_cfg->device_family < IWL_DEVICE_FAMILY_AX210) {
if (alloc_id != IWL_FW_INI_ALLOCATION_ID_DBGC1)
@@ -612,6 +615,9 @@ static int iwl_dbg_tlv_alloc_fragments(struct iwl_fw_runtime *fwrt,
return -EIO;
}
+ if (!num_frags)
+ return -EIO;
+
remain_pages = DIV_ROUND_UP(le32_to_cpu(fw_mon_cfg->req_size),
PAGE_SIZE);
num_frags = min_t(u32, num_frags, BUF_ALLOC_MAX_NUM_FRAGS);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0568/1376] wifi: iwlwifi: mei: pass correct argument to function
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (566 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0567/1376] wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0569/1376] gpu: host1x: Fix offset calculation in trace_write_gather Greg Kroah-Hartman
` (430 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Avraham Stern, Miri Korenblit,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Avraham Stern <avraham.stern@intel.com>
[ Upstream commit 905f57aefde4f4092a411c8a55856182fb1c7598 ]
The first argument to iwl_mei_write_cyclic_buf() should be the cldev
but the q_head pointer is passed instead. Fix it.
Fixes: 652291601459 ("iwlwifi: mei: don't rely on the size from the shared area")
Signed-off-by: Avraham Stern <avraham.stern@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260715220243.24cea60c6428.I42301010c31487b1458faa967b22c8320b0cfd23@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/mei/main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mei/main.c b/drivers/net/wireless/intel/iwlwifi/mei/main.c
index c083af5240593..1486702d37e75 100644
--- a/drivers/net/wireless/intel/iwlwifi/mei/main.c
+++ b/drivers/net/wireless/intel/iwlwifi/mei/main.c
@@ -458,7 +458,7 @@ static int iwl_mei_send_sap_msg_payload(struct mei_cl_device *cldev,
notif_q = &dir->q_ctrl_blk[SAP_QUEUE_IDX_NOTIF];
q_head = mei->shared_mem.q_head[SAP_DIRECTION_HOST_TO_ME][SAP_QUEUE_IDX_NOTIF];
q_sz = mei->shared_mem.q_size[SAP_DIRECTION_HOST_TO_ME][SAP_QUEUE_IDX_NOTIF];
- ret = iwl_mei_write_cyclic_buf(q_head, notif_q, q_head, hdr, q_sz);
+ ret = iwl_mei_write_cyclic_buf(cldev, notif_q, q_head, hdr, q_sz);
if (ret < 0)
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0569/1376] gpu: host1x: Fix offset calculation in trace_write_gather
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (567 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0568/1376] wifi: iwlwifi: mei: pass correct argument to function Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0570/1376] gpu: host1x: Avoid stack over-read in debug output helpers Greg Kroah-Hartman
` (429 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mikko Perttunen, Thierry Reding,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikko Perttunen <mperttunen@nvidia.com>
[ Upstream commit eb896850964d3dfce291b4fdff9c2d42d85e564b ]
When a gather longer than 2*TRACE_MAX_LENGTH (256) words is traced
through host1x_cdma_push_gather, the reported BO offset drifts from
the third iteration onward.
Fix the calculation by properly calculating the value on each loop
rather than accumulating.
In reality, gathers tend to be pretty short so this is unlikely to
ever have been observed.
Fixes: b40d02bf96e0 ("gpu: host1x: Use struct host1x_bo pointers in traces")
Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://patch.msgid.link/20260609-b4-host1x-small-fixes-a-v1-3-7c1131c0b3ad@nvidia.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/host1x/hw/channel_hw.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/host1x/hw/channel_hw.c b/drivers/gpu/host1x/hw/channel_hw.c
index d44b8de890be0..46b6494768b4d 100644
--- a/drivers/gpu/host1x/hw/channel_hw.c
+++ b/drivers/gpu/host1x/hw/channel_hw.c
@@ -36,10 +36,9 @@ static void trace_write_gather(struct host1x_cdma *cdma, struct host1x_bo *bo,
for (i = 0; i < words; i += TRACE_MAX_LENGTH) {
u32 num_words = min(words - i, TRACE_MAX_LENGTH);
- offset += i * sizeof(u32);
-
trace_host1x_cdma_push_gather(dev_name(dev), bo,
- num_words, offset,
+ num_words,
+ offset + i * sizeof(u32),
mem);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0570/1376] gpu: host1x: Avoid stack over-read in debug output helpers
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (568 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0569/1376] gpu: host1x: Fix offset calculation in trace_write_gather Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0571/1376] drm/msm/a6xx: Fix stale rpmh votes after suspend Greg Kroah-Hartman
` (428 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mikko Perttunen, Thierry Reding,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikko Perttunen <mperttunen@nvidia.com>
[ Upstream commit bc17ac285fb708f22a8fa2c0ed32eceb1d37e6d6 ]
host1x_debug_output() and host1x_debug_cont() used vsnprintf(), which
returns the length the formatted string would have reached with an
unbounded buffer. That return value was passed straight to o->fn as
the number of bytes to emit.
This could cause a read past end of the output buffer if a call to
host1x_debug_* produced a string longer than 256 bytes. This only
affected the debugfs files as the printk debug sink ignores the
number of bytes. In practice, this is very unlikely to occur.
Fix by switching to vscnprintf(), which returns the number of bytes
actually written.
Fixes: 6236451d83a7 ("gpu: host1x: Add debug support")
Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://patch.msgid.link/20260609-b4-host1x-small-fixes-a-v1-4-7c1131c0b3ad@nvidia.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/host1x/debug.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/host1x/debug.c b/drivers/gpu/host1x/debug.c
index a18cc8d8caf57..ec819164e84f4 100644
--- a/drivers/gpu/host1x/debug.c
+++ b/drivers/gpu/host1x/debug.c
@@ -31,7 +31,7 @@ void host1x_debug_output(struct output *o, const char *fmt, ...)
int len;
va_start(args, fmt);
- len = vsnprintf(o->buf, sizeof(o->buf), fmt, args);
+ len = vscnprintf(o->buf, sizeof(o->buf), fmt, args);
va_end(args);
o->fn(o->ctx, o->buf, len, false);
@@ -43,7 +43,7 @@ void host1x_debug_cont(struct output *o, const char *fmt, ...)
int len;
va_start(args, fmt);
- len = vsnprintf(o->buf, sizeof(o->buf), fmt, args);
+ len = vscnprintf(o->buf, sizeof(o->buf), fmt, args);
va_end(args);
o->fn(o->ctx, o->buf, len, true);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0571/1376] drm/msm/a6xx: Fix stale rpmh votes after suspend
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (569 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0570/1376] gpu: host1x: Avoid stack over-read in debug output helpers Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0572/1376] bpf: Sync tail_call_reachable with callee state on entry Greg Kroah-Hartman
` (427 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shivam Rawat, Akhil P Oommen,
Dmitry Baryshkov, Konrad Dybcio, Rob Clark, Sasha Levin,
Neil Armstrong
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shivam Rawat <shivrawa@qti.qualcomm.com>
[ Upstream commit d9108bfdb746edacdb05bd27959a4ae63c6c7f3f ]
There are stale RPMH votes (BCM votes) observed after GMU suspend. This
is because the rpmh stop sequences are skipped during gmu suspend. Fix
this and also move GMU to reset state to avoid any further activity.
Fixes: f248d5d5159a ("drm/msm/a6xx: Fix PDC sleep sequence")
Signed-off-by: Shivam Rawat <shivrawa@qti.qualcomm.com>
Signed-off-by: Akhil P Oommen <akhilpo@oss.qualcomm.com>
Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-HDK
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/730652/
Message-ID: <20260605-assorted-fixes-june-v1-1-2caa04f7287c@oss.qualcomm.com>
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
index 3e36cec3801ed..99c3abd90c190 100644
--- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
+++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
@@ -514,7 +514,7 @@ static void a6xx_rpmh_stop(struct a6xx_gmu *gmu)
int ret;
u32 val;
- if (test_and_clear_bit(GMU_STATUS_FW_START, &gmu->status))
+ if (!test_and_clear_bit(GMU_STATUS_FW_START, &gmu->status))
return;
gmu_write(gmu, REG_A6XX_GMU_RSCC_CONTROL_REQ, 1);
@@ -1186,6 +1186,9 @@ static void a6xx_gmu_shutdown(struct a6xx_gmu *gmu)
/* Stop the interrupts and mask the hardware */
a6xx_gmu_irq_disable(gmu);
+ /* Halt the gmu cm3 core */
+ gmu_write(gmu, REG_A6XX_GMU_CM3_SYSRESET, 1);
+
/* Tell RPMh to power off the GPU */
a6xx_rpmh_stop(gmu);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0572/1376] bpf: Sync tail_call_reachable with callee state on entry
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (570 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0571/1376] drm/msm/a6xx: Fix stale rpmh votes after suspend Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0573/1376] crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping Greg Kroah-Hartman
` (426 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Pu Lehui, Eduard Zingerman,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pu Lehui <pulehui@huawei.com>
[ Upstream commit 3513ea9dab6c1a3d2dc8e6160c41f690206948b6 ]
Currently in check_max_stack_depth_subprog, when the verifier enters a
new callee branch, the local tail_call_reachable is not properly
synchronized with the callee's state.
Consider a main prog branching into multiple subprogs:
subprog0 -> tailcall
main <
subprog1 -> subprog2
When the verifier finishes checking subprog0 and backtracks to main
prog, the local tail_call_reachable state is left as true. As it
proceeds to subprog1, this uncleared state leaks into the new branch,
falsely marking subprog1 and subprog2 as tailcall reachable.
Fix this by explicitly syncing tail_call_reachable with the callee's
has_tail_call state on entry. The caller's state is safely preserved and
restored via the existing backtracking logic.
Fixes: ebf7d1f508a7 ("bpf, x64: rework pro/epilogue and tailcall handling in JIT")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Pu Lehui <pulehui@huawei.com>
Link: https://patch.msgid.link/20260716120157.835937-2-pulehui@huaweicloud.com
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/verifier.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index f9f2095eab4a0..2318c4cf0231e 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -6294,8 +6294,8 @@ static int check_max_stack_depth_subprog(struct bpf_verifier_env *env, int idx,
if (!priv_stack_supported)
subprog[idx].priv_stack_mode = NO_PRIV_STACK;
- if (subprog[idx].has_tail_call)
- tail_call_reachable = true;
+ /* sync tail_call_reachable with callee state on entry */
+ tail_call_reachable = subprog[idx].has_tail_call;
frame++;
if (frame >= MAX_CALL_FRAMES) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0573/1376] crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (571 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0572/1376] bpf: Sync tail_call_reachable with callee state on entry Greg Kroah-Hartman
@ 2026-09-12 6:49 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0574/1376] ACPI: processor: idle: Expand _LPI package sanity checks Greg Kroah-Hartman
` (425 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Linus Walleij,
Herbert Xu, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@linux.dev>
[ Upstream commit 3ae59a2eba64b3648f069aa52eeaaeefdfe4bb2f ]
sg_dma_len() is only valid after mapping the scatterlist with
dma_map_sg(). However, sl3516_ce_need_fallback() checks it before the
source and destination scatterlists are mapped. Thus, a stale DMA length
that is not a multiple of 16 could incorrectly force a software fallback
when CONFIG_NEED_SG_DMA_LENGTH=y.
Remove the invalid checks; the existing scatterlist length checks are
sufficient.
Fixes: 46c5338db7bd ("crypto: sl3516 - Add sl3516 crypto engine")
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Acked-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/gemini/sl3516-ce-cipher.c | 8 --------
1 file changed, 8 deletions(-)
diff --git a/drivers/crypto/gemini/sl3516-ce-cipher.c b/drivers/crypto/gemini/sl3516-ce-cipher.c
index 583010b2d0071..02ec4282333b6 100644
--- a/drivers/crypto/gemini/sl3516-ce-cipher.c
+++ b/drivers/crypto/gemini/sl3516-ce-cipher.c
@@ -56,10 +56,6 @@ static bool sl3516_ce_need_fallback(struct skcipher_request *areq)
ce->fallback_mod16++;
return true;
}
- if ((sg_dma_len(sg) % 16) != 0) {
- ce->fallback_mod16++;
- return true;
- }
if (!IS_ALIGNED(sg->offset, 16)) {
ce->fallback_align16++;
return true;
@@ -72,10 +68,6 @@ static bool sl3516_ce_need_fallback(struct skcipher_request *areq)
ce->fallback_mod16++;
return true;
}
- if ((sg_dma_len(sg) % 16) != 0) {
- ce->fallback_mod16++;
- return true;
- }
if (!IS_ALIGNED(sg->offset, 16)) {
ce->fallback_align16++;
return true;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0574/1376] ACPI: processor: idle: Expand _LPI package sanity checks
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (572 preceding siblings ...)
2026-09-12 6:49 ` [PATCH 6.12 0573/1376] crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0575/1376] usb: gadget: f_uac1_legacy: remove broken string configfs attributes Greg Kroah-Hartman
` (424 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rafael J. Wysocki, Sudeep Holla,
Huisong Li, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
[ Upstream commit d5c13047a132162d2649be876906ead691d12948 ]
The _LPI package sanity checks in acpi_processor_evaluate_lpi() miss
a couple of things, so expand them by adding a buffer size check
before retrieving a struct acpi_power_register from it (and skip the
given state if the buffer is not large enough to hold a register
structure) and making the function avoid copying the state description
from the ACPI table if there are too few elements in the package
supposed to hold it.
While at it, relocate and rephrase a comment about skipping _LPI state
package elements [7-8].
Fixes: a36a7fecfe60 ("ACPI / processor_idle: Add support for Low Power Idle(LPI) states")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org>
Acked-by: Huisong Li <lihuisong@huawei.com>
Link: https://patch.msgid.link/5084143.GXAFRqVoOG@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/processor_idle.c | 28 +++++++++++++++++++++-------
1 file changed, 21 insertions(+), 7 deletions(-)
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index b8a8cbf8fafd6..6ecf784cf6b5c 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -950,6 +950,13 @@ static int acpi_processor_evaluate_lpi(acpi_handle handle,
if (obj->type == ACPI_TYPE_BUFFER) {
struct acpi_power_register *reg;
+ if (obj->buffer.length < sizeof(*reg)) {
+ acpi_handle_debug(handle,
+ "Invalid register data for _LPI state %d\n",
+ state_idx);
+ continue;
+ }
+
reg = (struct acpi_power_register *)obj->buffer.pointer;
if (reg->space_id != ACPI_ADR_SPACE_SYSTEM_IO &&
reg->space_id != ACPI_ADR_SPACE_FIXED_HARDWARE)
@@ -966,13 +973,6 @@ static int acpi_processor_evaluate_lpi(acpi_handle handle,
continue;
}
- /* elements[7,8] skipped for now i.e. Residency/Usage counter*/
-
- obj = pkg_elem + 9;
- if (obj->type == ACPI_TYPE_STRING)
- strscpy(lpi_state->desc, obj->string.pointer,
- ACPI_CX_DESC_LEN);
-
lpi_state->index = state_idx;
if (obj_get_integer(pkg_elem + 0, &lpi_state->min_residency)) {
pr_debug("No min. residency found, assuming 10 us\n");
@@ -995,6 +995,20 @@ static int acpi_processor_evaluate_lpi(acpi_handle handle,
if (obj_get_integer(pkg_elem + 5, &lpi_state->enable_parent_state))
lpi_state->enable_parent_state = 0;
+
+ /* Skip elements [7-8] i.e. Residency/Usage counters. */
+
+ /*
+ * Avoid out-of-bounds access if the size of the package is less
+ * than expected.
+ */
+ if (element->package.count < 10)
+ continue;
+
+ obj = pkg_elem + 9;
+ if (obj->type == ACPI_TYPE_STRING)
+ strscpy(lpi_state->desc, obj->string.pointer,
+ ACPI_CX_DESC_LEN);
}
acpi_handle_debug(handle, "Found %d power states\n", state_idx);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0575/1376] usb: gadget: f_uac1_legacy: remove broken string configfs attributes
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (573 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0574/1376] ACPI: processor: idle: Expand _LPI package sanity checks Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0576/1376] tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 Greg Kroah-Hartman
` (423 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xu Yang, Frank Li, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <xu.yang_2@nxp.com>
[ Upstream commit 590d74ec8f488e06b9f1c0f8f0941f45531f3a55 ]
The UAC1_STR_ATTRIBUTE macro defines configfs show/store handlers for
the fn_play, fn_cap, and fn_cntl string options. The store function
contains an inverted null check on the kstrndup() return value.
This means every write attempt returns -ENOMEM on success and
dereferences a NULL pointer on allocation failure. The attributes
have been broken and unused for many years.
Remove the UAC1_STR_ATTRIBUTE macro and the three attributes it
generated. The internal defaults (FILE_PCM_PLAYBACK, FILE_PCM_CAPTURE,
FILE_CONTROL) set in f_audio_alloc_inst() are unaffected.
Fixes: 0854611a19ae ("usb: gadget: f_uac1: add configfs support")
Link: https://lore.kernel.org/linux-usb/20260625113154.1954813-1-xu.yang_2@oss.nxp.com/
Suggested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Assisted-by: Claude:claude-sonnet-4.6
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260713060845.3759673-1-xu.yang_2@oss.nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../testing/configfs-usb-gadget-uac1_legacy | 3 -
Documentation/usb/gadget-testing.rst | 3 -
drivers/usb/gadget/function/f_uac1_legacy.c | 56 -------------------
drivers/usb/gadget/function/u_uac1_legacy.h | 3 -
4 files changed, 65 deletions(-)
diff --git a/Documentation/ABI/testing/configfs-usb-gadget-uac1_legacy b/Documentation/ABI/testing/configfs-usb-gadget-uac1_legacy
index b2eaefd9bc498..6a681d219f439 100644
--- a/Documentation/ABI/testing/configfs-usb-gadget-uac1_legacy
+++ b/Documentation/ABI/testing/configfs-usb-gadget-uac1_legacy
@@ -5,8 +5,5 @@ Description:
The attributes:
audio_buf_size - audio buffer size
- fn_cap - capture pcm device file name
- fn_cntl - control device file name
- fn_play - playback pcm device file name
req_buf_size - ISO OUT endpoint request buffer size
req_count - ISO OUT endpoint request count
diff --git a/Documentation/usb/gadget-testing.rst b/Documentation/usb/gadget-testing.rst
index bf555c2270f5c..3ef109ad12d5b 100644
--- a/Documentation/usb/gadget-testing.rst
+++ b/Documentation/usb/gadget-testing.rst
@@ -712,9 +712,6 @@ The uac1 function provides these attributes in its function directory:
=============== ====================================
audio_buf_size audio buffer size
- fn_cap capture pcm device file name
- fn_cntl control device file name
- fn_play playback pcm device file name
req_buf_size ISO OUT endpoint request buffer size
req_count ISO OUT endpoint request count
=============== ====================================
diff --git a/drivers/usb/gadget/function/f_uac1_legacy.c b/drivers/usb/gadget/function/f_uac1_legacy.c
index 4981af8337ab8..c234f9fea27cf 100644
--- a/drivers/usb/gadget/function/f_uac1_legacy.c
+++ b/drivers/usb/gadget/function/f_uac1_legacy.c
@@ -888,60 +888,10 @@ UAC1_INT_ATTRIBUTE(req_buf_size);
UAC1_INT_ATTRIBUTE(req_count);
UAC1_INT_ATTRIBUTE(audio_buf_size);
-#define UAC1_STR_ATTRIBUTE(name) \
-static ssize_t f_uac1_opts_##name##_show(struct config_item *item, \
- char *page) \
-{ \
- struct f_uac1_legacy_opts *opts = to_f_uac1_opts(item); \
- int result; \
- \
- mutex_lock(&opts->lock); \
- result = sprintf(page, "%s\n", opts->name); \
- mutex_unlock(&opts->lock); \
- \
- return result; \
-} \
- \
-static ssize_t f_uac1_opts_##name##_store(struct config_item *item, \
- const char *page, size_t len) \
-{ \
- struct f_uac1_legacy_opts *opts = to_f_uac1_opts(item); \
- int ret = -EBUSY; \
- char *tmp; \
- \
- mutex_lock(&opts->lock); \
- if (opts->refcnt) \
- goto end; \
- \
- tmp = kstrndup(page, len, GFP_KERNEL); \
- if (tmp) { \
- ret = -ENOMEM; \
- goto end; \
- } \
- if (opts->name##_alloc) \
- kfree(opts->name); \
- opts->name##_alloc = true; \
- opts->name = tmp; \
- ret = len; \
- \
-end: \
- mutex_unlock(&opts->lock); \
- return ret; \
-} \
- \
-CONFIGFS_ATTR(f_uac1_opts_, name)
-
-UAC1_STR_ATTRIBUTE(fn_play);
-UAC1_STR_ATTRIBUTE(fn_cap);
-UAC1_STR_ATTRIBUTE(fn_cntl);
-
static struct configfs_attribute *f_uac1_attrs[] = {
&f_uac1_opts_attr_req_buf_size,
&f_uac1_opts_attr_req_count,
&f_uac1_opts_attr_audio_buf_size,
- &f_uac1_opts_attr_fn_play,
- &f_uac1_opts_attr_fn_cap,
- &f_uac1_opts_attr_fn_cntl,
NULL,
};
@@ -956,12 +906,6 @@ static void f_audio_free_inst(struct usb_function_instance *f)
struct f_uac1_legacy_opts *opts;
opts = container_of(f, struct f_uac1_legacy_opts, func_inst);
- if (opts->fn_play_alloc)
- kfree(opts->fn_play);
- if (opts->fn_cap_alloc)
- kfree(opts->fn_cap);
- if (opts->fn_cntl_alloc)
- kfree(opts->fn_cntl);
kfree(opts);
}
diff --git a/drivers/usb/gadget/function/u_uac1_legacy.h b/drivers/usb/gadget/function/u_uac1_legacy.h
index b5df9bcbbeba7..b9ddae550ff3c 100644
--- a/drivers/usb/gadget/function/u_uac1_legacy.h
+++ b/drivers/usb/gadget/function/u_uac1_legacy.h
@@ -62,9 +62,6 @@ struct f_uac1_legacy_opts {
char *fn_cap;
char *fn_cntl;
unsigned bound:1;
- unsigned fn_play_alloc:1;
- unsigned fn_cap_alloc:1;
- unsigned fn_cntl_alloc:1;
struct mutex lock;
int refcnt;
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0576/1376] tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (574 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0575/1376] usb: gadget: f_uac1_legacy: remove broken string configfs attributes Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0577/1376] UDF symlink pathComponent header OOB read Greg Kroah-Hartman
` (422 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Arnd Bergmann,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 782f4dbd1794b4f30dc116a7ca42c5962c409be8 ]
hvc_dcc drives the JTAG DCC via the ARMv6/v7 CP14 debug registers
(mrc/mcr p14, 0, rX, c0, c1/c5, 0 in asm/dcc.h). That encoding is
undefined on older ARM cores, and also on ARMv7-M, but HVC_DCC only
depends on ARM, so it can be enabled on e.g. ARM926 (ARCH_MULTI_V5),
where hvc_dcc_console_init() runs __dcc_putchar() at boot and takes an
undefined-instruction trap before the console is up:
Internal error: Oops - undefined instruction: 0 [#1] ARM
PC is at hvc_dcc_check+0x50/0x8c
hvc_dcc_check from hvc_dcc_console_init+0x18/0x48
hvc_dcc_console_init from console_init+0x58/0x170
Kernel panic - not syncing: Fatal exception
Restrict HVC_DCC to the CPUs where that encoding is valid: the
CPU_V6 || CPU_V6K || CPU_V7 set that arch/arm/include/debug/icedcc.S
guards it with, plus ARM64.
Fixes: 16c63f8ea49c ("drivers: char: hvc: add arm JTAG DCC console support")
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Link: https://patch.msgid.link/20260717071616.91423-1-kmehltretter@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/hvc/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/tty/hvc/Kconfig b/drivers/tty/hvc/Kconfig
index c2a4e88b328f3..5866195de26a6 100644
--- a/drivers/tty/hvc/Kconfig
+++ b/drivers/tty/hvc/Kconfig
@@ -79,7 +79,7 @@ config HVC_UDBG
config HVC_DCC
bool "ARM JTAG DCC console"
- depends on ARM || ARM64
+ depends on (ARM && (CPU_V6 || CPU_V6K || CPU_V7)) || ARM64
select HVC_DRIVER
select SERIAL_CORE_CONSOLE
help
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0577/1376] UDF symlink pathComponent header OOB read
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (575 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0576/1376] tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0578/1376] uio: Fix stale info pointer in failed registration path Greg Kroah-Hartman
` (421 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, David Lee, Jan Kara, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lee <david.lee@trailofbits.com>
[ Upstream commit d23eb7380d1594cda31a5dc8487dd2a5c8def8c7 ]
udf_symlink_filler() can enter udf_pc_to_char() with a partial pathComponent header.
Validate that enough input remains for a complete pathComponent header
before accessing it. Reject malformed symlink data that would otherwise
make udf_pc_to_char() perform an out-of-bounds read.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: David Lee <david.lee@trailofbits.com>
Assisted-by: Codex:gpt-5.5
Link: https://patch.msgid.link/20260717104722.41446-1-david.lee@trailofbits.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/udf/symlink.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/udf/symlink.c b/fs/udf/symlink.c
index fe03745d09b18..a05d1888a2bab 100644
--- a/fs/udf/symlink.c
+++ b/fs/udf/symlink.c
@@ -36,6 +36,8 @@ static int udf_pc_to_char(struct super_block *sb, unsigned char *from,
/* Reserve one byte for terminating \0 */
tolen--;
while (elen < fromlen) {
+ if (fromlen - elen < sizeof(struct pathComponent))
+ return -EIO;
pc = (struct pathComponent *)(from + elen);
elen += sizeof(struct pathComponent);
switch (pc->componentType) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0578/1376] uio: Fix stale info pointer in failed registration path
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (576 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0577/1376] UDF symlink pathComponent header OOB read Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0579/1376] accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() Greg Kroah-Hartman
` (420 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yuho Choi, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <dbgh9129@gmail.com>
[ Upstream commit 67b6fc084b034a91c3ec7907a3fed89a2450f30b ]
After device_add(), the UIO device is visible to userspace and /dev/uioX
can be opened. If a later setup step fails, __uio_register_device()
unwinds the device but leaves idev->info pointing at the caller-owned
struct uio_info.
That is unsafe when an opener races with the failed registration path.
The open file keeps a reference to the uio_device, while the caller sees
registration failure and may free its struct uio_info. Later file
operations can then follow idev->info and dereference freed memory.
Handle post-device_add() failures like unregister: remove UIO attributes
while the info pointer is still valid, then clear idev->info under
info_lock and wake existing waiters/async users before removing the
device and minor. This makes already-open file descriptors observe the
same "device gone" state as normal uio_unregister_device().
Fixes: a93e7b331568 ("uio: Prevent device destruction while fds are open")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Link: https://patch.msgid.link/20260630192714.1867170-1-dbgh9129@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/uio/uio.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index 004a549c6c7d4..bce9635c7ca87 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -1051,6 +1051,11 @@ int __uio_register_device(struct module *owner,
err_request_irq:
uio_dev_del_attributes(idev);
err_uio_dev_add_attributes:
+ mutex_lock(&idev->info_lock);
+ idev->info = NULL;
+ mutex_unlock(&idev->info_lock);
+ wake_up_interruptible(&idev->wait);
+ kill_fasync(&idev->async_queue, SIGIO, POLL_HUP);
device_del(&idev->dev);
err_device_create:
uio_free_minor(idev->minor);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0579/1376] accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (577 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0578/1376] uio: Fix stale info pointer in failed registration path Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0580/1376] speakup: keyhelp: guard letter_offsets possible out-of-range indexing Greg Kroah-Hartman
` (419 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Samuel Thibault,
Dan Carpenter, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit bce0e640623372520d9d90c42f33ddbfb576ce69 ]
snprintf() returns the "number of characters which *would* be generated for
the given input", not the size *really* generated.
In order to avoid too large values for 'len' (and potential negative
values for "sizeof(buf) - (len - 1)") use scnprintf() instead of
snprintf().
Fixes: c6e3fd22cd53 ("Staging: add speakup to the staging directory")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://patch.msgid.link/20260531230804.254962-5-samuel.thibault@ens-lyon.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/accessibility/speakup/kobjects.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/accessibility/speakup/kobjects.c b/drivers/accessibility/speakup/kobjects.c
index 0dfdb6608e022..943ef71b1329b 100644
--- a/drivers/accessibility/speakup/kobjects.c
+++ b/drivers/accessibility/speakup/kobjects.c
@@ -92,9 +92,9 @@ static void report_char_chartab_status(int reset, int received, int used,
if (reset) {
pr_info("%s reset to defaults\n", object_type[do_characters]);
} else if (received) {
- len = snprintf(buf, sizeof(buf),
- " updated %d of %d %s\n",
- used, received, object_type[do_characters]);
+ len = scnprintf(buf, sizeof(buf),
+ " updated %d of %d %s\n",
+ used, received, object_type[do_characters]);
if (rejected)
snprintf(buf + (len - 1), sizeof(buf) - (len - 1),
" with %d reject%s\n",
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0580/1376] speakup: keyhelp: guard letter_offsets possible out-of-range indexing
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (578 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0579/1376] accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0581/1376] misc: bcm-vk: Use acquire/release for msgq_inited Greg Kroah-Hartman
` (418 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pavel Zhigulin, Samuel Thibault,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Zhigulin <Pavel.Zhigulin@kaspersky.com>
[ Upstream commit 6a19ad4d68c95185308cd9e5d169b10a2cf236c8 ]
help_init() builds letter_offsets[] by using the first byte of each
function name as an index via `(start & 31) - 1`. If function_names are
overridden from sysfs (root) with a name starting outside [a–z], the
index underflows or exceeds the array, leading to OOB write.
Function names can be overridden with the following commands as root:
modprobe speakup_soft
echo "0 _bad" > /sys/accessibility/speakup/i18n/function_names
# then press Insert+2 on /dev/tty
This fix checks the first letter in help_init(), and if it is not in the
[a–z] range the function returns an error to the caller. Eventually this
error is propagated to drivers/accessibility/speakup/main.c:2217, which
causes a bleep sound.
Fixes: c6e3fd22cd53 ("Staging: add speakup to the staging directory")
Signed-off-by: Pavel Zhigulin <Pavel.Zhigulin@kaspersky.com>
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Link: https://patch.msgid.link/20260531230804.254962-10-samuel.thibault@ens-lyon.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/accessibility/speakup/keyhelp.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/drivers/accessibility/speakup/keyhelp.c b/drivers/accessibility/speakup/keyhelp.c
index 822ceac830683..e632c53d6246e 100644
--- a/drivers/accessibility/speakup/keyhelp.c
+++ b/drivers/accessibility/speakup/keyhelp.c
@@ -8,6 +8,7 @@
*/
#include <linux/keyboard.h>
+#include <linux/ctype.h>
#include "spk_priv.h"
#include "speakup.h"
@@ -111,7 +112,7 @@ static void say_key(int key)
spk_msg_get(MSG_KEYNAMES_START + (key - 1)));
}
-static int help_init(void)
+static void help_init(void)
{
char start = SPACE;
int i;
@@ -120,13 +121,19 @@ static int help_init(void)
state_tbl = spk_our_keys[0] + SHIFT_TBL_SIZE + 2;
for (i = 0; i < num_funcs; i++) {
char *cur_funcname = spk_msg_get(MSG_FUNCNAMES_START + i);
+ char first_letter;
- if (start == *cur_funcname)
+ first_letter = tolower(*cur_funcname);
+
+ /* Accept only 'a'..'z' to index letter_offsets[] safely */
+ if (first_letter < 'a' || first_letter > 'z')
+ continue;
+
+ if (start == first_letter)
continue;
- start = *cur_funcname;
+ start = first_letter;
letter_offsets[(start & 31) - 1] = i;
}
- return 0;
}
int spk_handle_help(struct vc_data *vc, u_char type, u_char ch, u_short key)
@@ -144,7 +151,7 @@ int spk_handle_help(struct vc_data *vc, u_char type, u_char ch, u_short key)
synth_printf("%s\n", spk_msg_get(MSG_LEAVING_HELP));
return 1;
}
- ch |= 32; /* lower case */
+ ch = tolower(ch);
if (ch < 'a' || ch > 'z')
return -1;
if (letter_offsets[ch - 'a'] == -1) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0581/1376] misc: bcm-vk: Use acquire/release for msgq_inited
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (579 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0580/1376] speakup: keyhelp: guard letter_offsets possible out-of-range indexing Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0582/1376] misc: rtsx: add missing write register handling Greg Kroah-Hartman
` (417 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gui-Dong Han, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gui-Dong Han <hanguidong02@gmail.com>
[ Upstream commit 61b101c6a150057b6d512421ed108aed16e822ea ]
bcm_vk_sync_msgq() fills the message queue information and then sets
msgq_inited. Readers call bcm_vk_drv_access_ok() before accessing the
message queues and their cached queue information.
atomic_set()/atomic_read() do not order those accesses. A reader can see
msgq_inited set while still seeing stale queue information. Use release
when publishing the initialized queues and acquire when checking the gate.
Keep the clear in bcm_vk_blk_drv_access() as atomic_set(). It closes the
gate and does not publish queue state to readers.
Fixes: 111d746bb476 ("misc: bcm-vk: add VK messaging support")
Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
Link: https://patch.msgid.link/20260603021127.3285057-1-hanguidong02@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/misc/bcm-vk/bcm_vk_msg.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/misc/bcm-vk/bcm_vk_msg.c b/drivers/misc/bcm-vk/bcm_vk_msg.c
index 665a3888708ac..a36a6c7d384a9 100644
--- a/drivers/misc/bcm-vk/bcm_vk_msg.c
+++ b/drivers/misc/bcm-vk/bcm_vk_msg.c
@@ -108,7 +108,8 @@ u32 msgq_avail_space(const struct bcm_vk_msgq __iomem *msgq,
bool bcm_vk_drv_access_ok(struct bcm_vk *vk)
{
- return (!!atomic_read(&vk->msgq_inited));
+ /* Pair with the release store after message queue initialization. */
+ return !!atomic_read_acquire(&vk->msgq_inited);
}
void bcm_vk_set_host_alert(struct bcm_vk *vk, u32 bit_mask)
@@ -501,7 +502,8 @@ int bcm_vk_sync_msgq(struct bcm_vk *vk, bool force_sync)
msgq++;
}
}
- atomic_set(&vk->msgq_inited, 1);
+ /* Publish message queue info before allowing driver access. */
+ atomic_set_release(&vk->msgq_inited, 1);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0582/1376] misc: rtsx: add missing write register handling
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (580 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0581/1376] misc: bcm-vk: Use acquire/release for msgq_inited Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0583/1376] misc: ad525x_dpot: use driver core groups for sysfs files Greg Kroah-Hartman
` (416 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gleb Markov, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gleb Markov <markov.gi@npc-ksb.ru>
[ Upstream commit 655faba1ccf195e22a7a83146ef6015e3271233c ]
If an error occurs at the stage of working with registers in conjunction
with MCU_Block, it will not be processed.
The occurrence of errors at this stage may signal an impact on writes to
the device's PCI registers and is a more global problem than a
driver-level security problem, but adding a handler would be a good
practice.
Add a missing error handling.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: c0e5f4e73a71 ("misc: rtsx: Add support for RTS5261")
Signed-off-by: Gleb Markov <markov.gi@npc-ksb.ru>
Link: https://patch.msgid.link/20260629130920.1260-1-markov.gi@npc-ksb.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/misc/cardreader/rtsx_pcr.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/misc/cardreader/rtsx_pcr.c b/drivers/misc/cardreader/rtsx_pcr.c
index be3d4e0e50ccd..6a1cfa948bdb3 100644
--- a/drivers/misc/cardreader/rtsx_pcr.c
+++ b/drivers/misc/cardreader/rtsx_pcr.c
@@ -1242,6 +1242,8 @@ static int rtsx_pci_init_hw(struct rtsx_pcr *pcr)
/* Gating real mcu clock */
err = rtsx_pci_write_register(pcr, RTS5261_FW_CFG1,
RTS5261_MCU_CLOCK_GATING, 0);
+ if (err < 0)
+ return err;
err = rtsx_pci_write_register(pcr, RTS5261_REG_FPDCTL,
SSC_POWER_DOWN, 0);
} else {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0583/1376] misc: ad525x_dpot: use driver core groups for sysfs files
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (581 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0582/1376] misc: rtsx: add missing write register handling Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0584/1376] cacheinfo: dont propagate DT/ACPI error when arch supplies info (arm64) Greg Kroah-Hartman
` (415 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ Upstream commit e3a8557e88eb26278eda60bf64f2ef33ce7de8bf ]
ad_dpot_probe() creates per-RDAC sysfs files manually and then
optionally creates the command sysfs group. This leaves probe responsible
for rolling back partial sysfs state and makes remove responsible for
matching every file that probe created.
Move the device attributes into driver core dev_groups for the I2C and
SPI drivers and use an is_visible() callback to expose only the
attributes supported by the probed device. With this shape, the driver
core creates the sysfs files only after probe succeeds and removes them
before the remove callback frees the driver data.
Fixes: 4eb174bee6f8 ("ad525x_dpot: new driver for AD525x digital potentiometers")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260623015643.36508-1-pengpeng@iscas.ac.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/misc/ad525x_dpot-i2c.c | 1 +
drivers/misc/ad525x_dpot-spi.c | 1 +
drivers/misc/ad525x_dpot.c | 177 ++++++++++++++++++++-------------
drivers/misc/ad525x_dpot.h | 3 +
4 files changed, 112 insertions(+), 70 deletions(-)
diff --git a/drivers/misc/ad525x_dpot-i2c.c b/drivers/misc/ad525x_dpot-i2c.c
index 469478f7a1d33..896ad61bb9e17 100644
--- a/drivers/misc/ad525x_dpot-i2c.c
+++ b/drivers/misc/ad525x_dpot-i2c.c
@@ -105,6 +105,7 @@ MODULE_DEVICE_TABLE(i2c, ad_dpot_id);
static struct i2c_driver ad_dpot_i2c_driver = {
.driver = {
.name = "ad_dpot",
+ .dev_groups = ad_dpot_groups,
},
.probe = ad_dpot_i2c_probe,
.remove = ad_dpot_i2c_remove,
diff --git a/drivers/misc/ad525x_dpot-spi.c b/drivers/misc/ad525x_dpot-spi.c
index 263055bda48b7..1ebe629715a84 100644
--- a/drivers/misc/ad525x_dpot-spi.c
+++ b/drivers/misc/ad525x_dpot-spi.c
@@ -131,6 +131,7 @@ MODULE_DEVICE_TABLE(spi, ad_dpot_spi_id);
static struct spi_driver ad_dpot_spi_driver = {
.driver = {
.name = "ad_dpot",
+ .dev_groups = ad_dpot_groups,
},
.probe = ad_dpot_spi_probe,
.remove = ad_dpot_spi_remove,
diff --git a/drivers/misc/ad525x_dpot.c b/drivers/misc/ad525x_dpot.c
index 756ef6912b5aa..3ceb1f1caa383 100644
--- a/drivers/misc/ad525x_dpot.c
+++ b/drivers/misc/ad525x_dpot.c
@@ -631,66 +631,132 @@ static struct attribute *ad525x_attributes_commands[] = {
NULL
};
-static const struct attribute_group ad525x_group_commands = {
- .attrs = ad525x_attributes_commands,
+static struct attribute *ad525x_attributes[] = {
+ &dev_attr_rdac0.attr,
+ &dev_attr_rdac1.attr,
+ &dev_attr_rdac2.attr,
+ &dev_attr_rdac3.attr,
+ &dev_attr_rdac4.attr,
+ &dev_attr_rdac5.attr,
+ &dev_attr_eeprom0.attr,
+ &dev_attr_eeprom1.attr,
+ &dev_attr_eeprom2.attr,
+ &dev_attr_eeprom3.attr,
+ &dev_attr_eeprom4.attr,
+ &dev_attr_eeprom5.attr,
+ &dev_attr_tolerance0.attr,
+ &dev_attr_tolerance1.attr,
+ &dev_attr_tolerance2.attr,
+ &dev_attr_tolerance3.attr,
+ &dev_attr_tolerance4.attr,
+ &dev_attr_tolerance5.attr,
+ &dev_attr_otp0.attr,
+ &dev_attr_otp1.attr,
+ &dev_attr_otp2.attr,
+ &dev_attr_otp3.attr,
+ &dev_attr_otp4.attr,
+ &dev_attr_otp5.attr,
+ &dev_attr_otp0en.attr,
+ &dev_attr_otp1en.attr,
+ &dev_attr_otp2en.attr,
+ &dev_attr_otp3en.attr,
+ &dev_attr_otp4en.attr,
+ &dev_attr_otp5en.attr,
+ &dev_attr_inc_all.attr,
+ &dev_attr_dec_all.attr,
+ &dev_attr_inc_all_6db.attr,
+ &dev_attr_dec_all_6db.attr,
+ NULL
};
-static int ad_dpot_add_files(struct device *dev,
- unsigned int features, unsigned int rdac)
+static int ad525x_attr_index(struct attribute *attr,
+ const struct attribute * const *attrs)
{
- int err = sysfs_create_file(&dev->kobj,
- dpot_attrib_wipers[rdac]);
- if (features & F_CMD_EEP)
- err |= sysfs_create_file(&dev->kobj,
- dpot_attrib_eeprom[rdac]);
- if (features & F_CMD_TOL)
- err |= sysfs_create_file(&dev->kobj,
- dpot_attrib_tolerance[rdac]);
- if (features & F_CMD_OTP) {
- err |= sysfs_create_file(&dev->kobj,
- dpot_attrib_otp_en[rdac]);
- err |= sysfs_create_file(&dev->kobj,
- dpot_attrib_otp[rdac]);
- }
+ int i;
- if (err)
- dev_err(dev, "failed to register sysfs hooks for RDAC%d\n",
- rdac);
+ for (i = 0; attrs[i]; i++)
+ if (attr == attrs[i])
+ return i;
- return err;
+ return -ENOENT;
}
-static inline void ad_dpot_remove_files(struct device *dev,
- unsigned int features, unsigned int rdac)
+static bool ad525x_is_command_attr(struct attribute *attr)
{
- sysfs_remove_file(&dev->kobj,
- dpot_attrib_wipers[rdac]);
- if (features & F_CMD_EEP)
- sysfs_remove_file(&dev->kobj,
- dpot_attrib_eeprom[rdac]);
- if (features & F_CMD_TOL)
- sysfs_remove_file(&dev->kobj,
- dpot_attrib_tolerance[rdac]);
- if (features & F_CMD_OTP) {
- sysfs_remove_file(&dev->kobj,
- dpot_attrib_otp_en[rdac]);
- sysfs_remove_file(&dev->kobj,
- dpot_attrib_otp[rdac]);
+ int i;
+
+ for (i = 0; ad525x_attributes_commands[i]; i++) {
+ if (attr == ad525x_attributes_commands[i])
+ return true;
}
+
+ return false;
+}
+
+static umode_t ad525x_is_visible(struct kobject *kobj, struct attribute *attr,
+ int n)
+{
+ struct device *dev = kobj_to_dev(kobj);
+ struct dpot_data *data = dev_get_drvdata(dev);
+ int rdac;
+
+ if (!data)
+ return 0;
+
+ rdac = ad525x_attr_index(attr, dpot_attrib_wipers);
+ if (rdac >= 0)
+ return data->wipers & BIT(rdac) ? attr->mode : 0;
+
+ rdac = ad525x_attr_index(attr, dpot_attrib_eeprom);
+ if (rdac >= 0)
+ return (data->wipers & BIT(rdac)) && (data->feat & F_CMD_EEP) ?
+ attr->mode : 0;
+
+ rdac = ad525x_attr_index(attr, dpot_attrib_tolerance);
+ if (rdac >= 0)
+ return (data->wipers & BIT(rdac)) && (data->feat & F_CMD_TOL) ?
+ attr->mode : 0;
+
+ rdac = ad525x_attr_index(attr, dpot_attrib_otp);
+ if (rdac >= 0)
+ return (data->wipers & BIT(rdac)) && (data->feat & F_CMD_OTP) ?
+ attr->mode : 0;
+
+ rdac = ad525x_attr_index(attr, dpot_attrib_otp_en);
+ if (rdac >= 0)
+ return (data->wipers & BIT(rdac)) && (data->feat & F_CMD_OTP) ?
+ attr->mode : 0;
+
+ if (ad525x_is_command_attr(attr))
+ return data->feat & F_CMD_INC ? attr->mode : 0;
+
+ return attr->mode;
}
+static const struct attribute_group ad525x_group = {
+ .attrs = ad525x_attributes,
+ .is_visible = ad525x_is_visible,
+};
+
+const struct attribute_group *ad_dpot_groups[] = {
+ &ad525x_group,
+ NULL
+};
+EXPORT_SYMBOL(ad_dpot_groups);
+
int ad_dpot_probe(struct device *dev,
struct ad_dpot_bus_data *bdata, unsigned long devid,
const char *name)
{
struct dpot_data *data;
- int i, err = 0;
+ int i;
data = kzalloc(sizeof(struct dpot_data), GFP_KERNEL);
if (!data) {
- err = -ENOMEM;
- goto exit;
+ dev_err(dev, "failed to create client for %s ID 0x%lX\n",
+ name, devid);
+ return -ENOMEM;
}
dev_set_drvdata(dev, data);
@@ -706,51 +772,22 @@ int ad_dpot_probe(struct device *dev,
data->wipers = DPOT_WIPERS(devid);
for (i = DPOT_RDAC0; i < MAX_RDACS; i++)
- if (data->wipers & (1 << i)) {
- err = ad_dpot_add_files(dev, data->feat, i);
- if (err)
- goto exit_remove_files;
+ if (data->wipers & BIT(i)) {
/* power-up midscale */
if (data->feat & F_RDACS_WONLY)
data->rdac_cache[i] = data->max_pos / 2;
}
- if (data->feat & F_CMD_INC)
- err = sysfs_create_group(&dev->kobj, &ad525x_group_commands);
-
- if (err) {
- dev_err(dev, "failed to register sysfs hooks\n");
- goto exit_free;
- }
-
dev_info(dev, "%s %d-Position Digital Potentiometer registered\n",
name, data->max_pos);
return 0;
-
-exit_remove_files:
- for (i = DPOT_RDAC0; i < MAX_RDACS; i++)
- if (data->wipers & (1 << i))
- ad_dpot_remove_files(dev, data->feat, i);
-
-exit_free:
- kfree(data);
- dev_set_drvdata(dev, NULL);
-exit:
- dev_err(dev, "failed to create client for %s ID 0x%lX\n",
- name, devid);
- return err;
}
EXPORT_SYMBOL(ad_dpot_probe);
void ad_dpot_remove(struct device *dev)
{
struct dpot_data *data = dev_get_drvdata(dev);
- int i;
-
- for (i = DPOT_RDAC0; i < MAX_RDACS; i++)
- if (data->wipers & (1 << i))
- ad_dpot_remove_files(dev, data->feat, i);
kfree(data);
}
diff --git a/drivers/misc/ad525x_dpot.h b/drivers/misc/ad525x_dpot.h
index 72a9d6801937c..2e877c89523b5 100644
--- a/drivers/misc/ad525x_dpot.h
+++ b/drivers/misc/ad525x_dpot.h
@@ -10,6 +10,8 @@
#include <linux/types.h>
+struct attribute_group;
+
#define DPOT_CONF(features, wipers, max_pos, uid) \
(((features) << 18) | (((wipers) & 0xFF) << 10) | \
((max_pos & 0xF) << 6) | (uid & 0x3F))
@@ -210,5 +212,6 @@ struct ad_dpot_bus_data {
int ad_dpot_probe(struct device *dev, struct ad_dpot_bus_data *bdata,
unsigned long devid, const char *name);
void ad_dpot_remove(struct device *dev);
+extern const struct attribute_group *ad_dpot_groups[];
#endif
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0584/1376] cacheinfo: dont propagate DT/ACPI error when arch supplies info (arm64)
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (582 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0583/1376] misc: ad525x_dpot: use driver core groups for sysfs files Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0585/1376] ppdev: prevent overflow when setting port timeout Greg Kroah-Hartman
` (414 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pierre Gondois, Breno Leitao,
Sudeep Holla, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <leitao@debian.org>
[ Upstream commit 274259391c14166fcabae74f9fc0104223ff27a1 ]
cache_setup_properties() sets use_arch_info = true when DT/ACPI
provide no cache nodes and the arch can derive the topology from
CPU registers (e.g. arm64 reading CLIDR_EL1), but still returns the
original -ENOENT. cache_shared_cpu_map_setup() bails on that error
before the new flag can take effect, so the first CPU brought online
always trips a misleading warning:
cacheinfo: Unable to detect cache hierarchy for CPU 0
Subsequent CPUs skip cache_setup_properties() entirely because
use_arch_info is now true, which is why only CPU0 hits it. This is
reproducible on arm64 with the QEMU 'virt' machine, whose default DT
has no cache nodes.
Clear ret after setting use_arch_info so the caller proceeds and
populates the shared cpu map via the arch-supplied leaves.
Fixes: ef9f643a9f8b ("cacheinfo: Add use_arch[|_cache]_info field/function")
Reviewed-by: Pierre Gondois <pierre.gondois@arm.com>
Signed-off-by: Breno Leitao <leitao@debian.org>
Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org>
Link: https://patch.msgid.link/20260611-cacheinfo-v2-1-6069ef066cf3@debian.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/cacheinfo.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/base/cacheinfo.c b/drivers/base/cacheinfo.c
index 89410127089b9..2af13612a40ab 100644
--- a/drivers/base/cacheinfo.c
+++ b/drivers/base/cacheinfo.c
@@ -332,9 +332,14 @@ static int cache_setup_properties(unsigned int cpu)
else if (!acpi_disabled)
ret = cache_setup_acpi(cpu);
- // Assume there is no cache information available in DT/ACPI from now.
- if (ret && use_arch_cache_info())
+ /*
+ * No DT/ACPI cache nodes; fall back to arch-derived topology (e.g.
+ * arm64 CLIDR_EL1) and clear the error to avoid a spurious warning.
+ */
+ if (ret && use_arch_cache_info()) {
use_arch_info = true;
+ ret = 0;
+ }
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0585/1376] ppdev: prevent overflow when setting port timeout
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (583 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0584/1376] cacheinfo: dont propagate DT/ACPI error when arch supplies info (arm64) Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0586/1376] ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove Greg Kroah-Hartman
` (413 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Linmao Li, Arnd Bergmann,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linmao Li <lilinmao@kylinos.cn>
[ Upstream commit 3c0cf801ea2fa40daa5e7d1e6d32adca5ff75ad9 ]
PPSETTIME64 supplies the timeval fields as s64 values, but
pp_set_timeout() narrows tv_usec to int and calculates tv_sec * HZ in a
signed long. Large positive values can therefore be truncated or overflow
and install an unintended timeout.
Keep both fields as s64, reject a non-canonical microsecond value, and
use timespec64_to_jiffies() to cap excessively large timeouts at
MAX_JIFFY_OFFSET. This is a behavior change because both PPSETTIME
ioctls could previously accept values with tv_usec >= USEC_PER_SEC.
The validation follows the precedent set by sock_set_timeout().
Fixes: 3b9ab374a1e6 ("ppdev: convert to y2038 safe")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Link: https://patch.msgid.link/20260716013923.19494-1-lilinmao@kylinos.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/ppdev.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/char/ppdev.c b/drivers/char/ppdev.c
index d1dfbd8d4d426..3dec6516a5eb1 100644
--- a/drivers/char/ppdev.c
+++ b/drivers/char/ppdev.c
@@ -340,15 +340,17 @@ static enum ieee1284_phase init_phase(int mode)
return IEEE1284_PH_FWD_IDLE;
}
-static int pp_set_timeout(struct pardevice *pdev, long tv_sec, int tv_usec)
+static int pp_set_timeout(struct pardevice *pdev, s64 tv_sec, s64 tv_usec)
{
+ struct timespec64 ts;
long to_jiffies;
- if ((tv_sec < 0) || (tv_usec < 0))
+ if (tv_sec < 0 || tv_usec < 0 || tv_usec >= USEC_PER_SEC)
return -EINVAL;
- to_jiffies = usecs_to_jiffies(tv_usec);
- to_jiffies += tv_sec * HZ;
+ ts.tv_sec = tv_sec;
+ ts.tv_nsec = tv_usec * NSEC_PER_USEC;
+ to_jiffies = timespec64_to_jiffies(&ts);
if (to_jiffies <= 0)
return -EINVAL;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0586/1376] ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (584 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0585/1376] ppdev: prevent overflow when setting port timeout Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0587/1376] char: xilinx_hwicap: unregister class on init errors Greg Kroah-Hartman
` (412 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Shuangpeng Bai, Pei Xiao,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pei Xiao <xiaopei01@kylinos.cn>
[ Upstream commit b6b5d64cb161a28347d64dc3168a636c4abb68d5 ]
Three issues arise when the device is removed while a tty session is
still active:
1. UAF of struct ipoctal: the remove callback frees ipoctal via
kfree() while tty ops may still access it. Fix by introducing
kref-based lifetime management — kref is taken in install() when
a tty is opened and released in cleanup() when the tty is finally
destroyed; remove() uses kref_put() instead of kfree().
2. NULL dereference in ipoctal_write_tty(): __ipoctal_remove()
frees xmit_buf via tty_port_free_xmit_buf() while a userspace
process may still hold the tty fd and call write(). Fix by
checking for NULL xmit_buf in ipoctal_write_tty().
3. UAF in ipoctal_cleanup(): ipack_put_carrier(ipoctal->dev)
dereferences ipoctal->dev after the ipack_device has been freed
by ipack_device_del(). Fix by caching ipoctal->carrier_owner
during probe() and calling module_put() on the cached pointer
directly in cleanup(), avoiding any access to ipoctal->dev.
Also introduce a "removed" flag in struct ipoctal, set at the start
of __ipoctal_remove(), and checked in every tty op that accesses
hardware resources (port_activate, write_tty, set_termios, hangup,
shutdown). This prevents page faults when devm_ioremap() regions
are unmapped after remove() returns.
Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Closes: https://lore.kernel.org/lkml/178144969601.60470.1257088106279546587@gmail.com/
Fixes: 05e5027efc9c ("Staging: ipack: move out of staging")
Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
Link: https://patch.msgid.link/e3b0a90b07f079c5bcd5ca90d1dd3b79bb29adb5.1782870760.git.xiaopei01@kylinos.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ipack/devices/ipoctal.c | 56 ++++++++++++++++++++++++++++++---
1 file changed, 52 insertions(+), 4 deletions(-)
diff --git a/drivers/ipack/devices/ipoctal.c b/drivers/ipack/devices/ipoctal.c
index ba2e9e52d72bf..474b58858dca6 100644
--- a/drivers/ipack/devices/ipoctal.c
+++ b/drivers/ipack/devices/ipoctal.c
@@ -10,6 +10,7 @@
#include <linux/device.h>
#include <linux/module.h>
#include <linux/interrupt.h>
+#include <linux/kref.h>
#include <linux/sched.h>
#include <linux/tty.h>
#include <linux/serial.h>
@@ -25,6 +26,8 @@
static const struct tty_operations ipoctal_fops;
+static void ipoctal_release(struct kref *kref);
+
struct ipoctal_channel {
struct ipoctal_stats stats;
unsigned int nb_bytes;
@@ -49,6 +52,9 @@ struct ipoctal {
struct tty_driver *tty_drv;
u8 __iomem *mem8_space;
u8 __iomem *int_space;
+ struct kref kref;
+ struct module *carrier_owner;
+ bool removed;
};
static inline struct ipoctal *chan_to_ipoctal(struct ipoctal_channel *chan,
@@ -70,8 +76,14 @@ static void ipoctal_reset_channel(struct ipoctal_channel *channel)
static int ipoctal_port_activate(struct tty_port *port, struct tty_struct *tty)
{
struct ipoctal_channel *channel;
+ struct ipoctal *ipoctal;
channel = dev_get_drvdata(tty->dev);
+ ipoctal = chan_to_ipoctal(channel, tty->index);
+
+
+ if (ipoctal->removed)
+ return -ENODEV;
/*
* Enable RX. TX will be enabled when
@@ -95,6 +107,7 @@ static int ipoctal_install(struct tty_driver *driver, struct tty_struct *tty)
if (res)
goto err_put_carrier;
+ kref_get(&ipoctal->kref);
tty->driver_data = channel;
return 0;
@@ -460,8 +473,13 @@ static ssize_t ipoctal_write_tty(struct tty_struct *tty, const u8 *buf,
size_t count)
{
struct ipoctal_channel *channel = tty->driver_data;
+ struct ipoctal *ipoctal = chan_to_ipoctal(channel, tty->index);
size_t char_copied;
+
+ if (ipoctal->removed || !channel->tty_port.xmit_buf)
+ return 0;
+
char_copied = ipoctal_copy_write_buffer(channel, buf, count);
/* As the IP-OCTAL 485 only supports half duplex, do it manually */
@@ -501,8 +519,13 @@ static void ipoctal_set_termios(struct tty_struct *tty,
unsigned char mr2 = 0;
unsigned char csr = 0;
struct ipoctal_channel *channel = tty->driver_data;
+ struct ipoctal *ipoctal = chan_to_ipoctal(channel, tty->index);
speed_t baud;
+
+ if (ipoctal->removed)
+ return;
+
cflag = tty->termios.c_cflag;
/* Disable and reset everything before change the setup */
@@ -631,10 +654,16 @@ static void ipoctal_hangup(struct tty_struct *tty)
{
unsigned long flags;
struct ipoctal_channel *channel = tty->driver_data;
+ struct ipoctal *ipoctal;
if (channel == NULL)
return;
+ ipoctal = chan_to_ipoctal(channel, tty->index);
+
+ if (ipoctal->removed)
+ return;
+
spin_lock_irqsave(&channel->lock, flags);
channel->nb_bytes = 0;
channel->pointer_read = 0;
@@ -651,10 +680,16 @@ static void ipoctal_hangup(struct tty_struct *tty)
static void ipoctal_shutdown(struct tty_struct *tty)
{
struct ipoctal_channel *channel = tty->driver_data;
+ struct ipoctal *ipoctal;
if (channel == NULL)
return;
+ ipoctal = chan_to_ipoctal(channel, tty->index);
+
+ if (ipoctal->removed)
+ return;
+
ipoctal_reset_channel(channel);
tty_port_set_initialized(&channel->tty_port, false);
}
@@ -664,8 +699,9 @@ static void ipoctal_cleanup(struct tty_struct *tty)
struct ipoctal_channel *channel = tty->driver_data;
struct ipoctal *ipoctal = chan_to_ipoctal(channel, tty->index);
- /* release the carrier driver */
- ipack_put_carrier(ipoctal->dev);
+ /* release the carrier driver via cached owner */
+ module_put(ipoctal->carrier_owner);
+ kref_put(&ipoctal->kref, ipoctal_release);
}
static const struct tty_operations ipoctal_fops = {
@@ -683,6 +719,13 @@ static const struct tty_operations ipoctal_fops = {
.cleanup = ipoctal_cleanup,
};
+static void ipoctal_release(struct kref *kref)
+{
+ struct ipoctal *ipoctal = container_of(kref, struct ipoctal, kref);
+
+ kfree(ipoctal);
+}
+
static int ipoctal_probe(struct ipack_device *dev)
{
int res;
@@ -692,7 +735,10 @@ static int ipoctal_probe(struct ipack_device *dev)
if (ipoctal == NULL)
return -ENOMEM;
+ kref_init(&ipoctal->kref);
+
ipoctal->dev = dev;
+ ipoctal->carrier_owner = dev->bus->owner;
res = ipoctal_inst_slot(ipoctal, dev->bus->bus_nr, dev->slot);
if (res)
goto out_uninst;
@@ -701,7 +747,7 @@ static int ipoctal_probe(struct ipack_device *dev)
return 0;
out_uninst:
- kfree(ipoctal);
+ kref_put(&ipoctal->kref, ipoctal_release);
return res;
}
@@ -709,6 +755,8 @@ static void __ipoctal_remove(struct ipoctal *ipoctal)
{
int i;
+ ipoctal->removed = true;
+
ipoctal->dev->bus->ops->free_irq(ipoctal->dev);
for (i = 0; i < NR_CHANNELS; i++) {
@@ -725,7 +773,7 @@ static void __ipoctal_remove(struct ipoctal *ipoctal)
tty_unregister_driver(ipoctal->tty_drv);
kfree(ipoctal->tty_drv->name);
tty_driver_kref_put(ipoctal->tty_drv);
- kfree(ipoctal);
+ kref_put(&ipoctal->kref, ipoctal_release);
}
static void ipoctal_remove(struct ipack_device *idev)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0587/1376] char: xilinx_hwicap: unregister class on init errors
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (585 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0586/1376] ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0588/1376] vfio/pci: clear vdev->msi_perm after freeing it on init failure Greg Kroah-Hartman
` (411 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Radhey Shyam Pandey, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit e7e12b4cc0f0c3a2782aea084d4215e23f5512b3 ]
hwicap_module_init() registers icap_class before reserving the
character-device region and registering the platform driver. If either
of those later steps fails, the init path must undo the successful class
registration before returning an error.
Route the chrdev registration failure through a class unwind label, and
let the platform-driver registration failure fall through the existing
chrdev unwind before unregistering the class. The normal module exit path
is unchanged.
This issue was identified during our ongoing static-analysis research while
reviewing kernel code.
Fixes: ef141a0bb0dc ("[POWERPC] Xilinx: hwicap driver")
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
Link: https://patch.msgid.link/20260623085604.89284-1-mhun512@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/xilinx_hwicap/xilinx_hwicap.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/char/xilinx_hwicap/xilinx_hwicap.c b/drivers/char/xilinx_hwicap/xilinx_hwicap.c
index 4f6c3cb8aa413..259900a9ee211 100644
--- a/drivers/char/xilinx_hwicap/xilinx_hwicap.c
+++ b/drivers/char/xilinx_hwicap/xilinx_hwicap.c
@@ -760,7 +760,7 @@ static int __init hwicap_module_init(void)
HWICAP_DEVICES,
DRIVER_NAME);
if (retval < 0)
- return retval;
+ goto failed_class;
retval = platform_driver_register(&hwicap_platform_driver);
if (retval)
@@ -771,6 +771,9 @@ static int __init hwicap_module_init(void)
failed:
unregister_chrdev_region(devt, HWICAP_DEVICES);
+ failed_class:
+ class_unregister(&icap_class);
+
return retval;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0588/1376] vfio/pci: clear vdev->msi_perm after freeing it on init failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (586 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0587/1376] char: xilinx_hwicap: unregister class on init errors Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0589/1376] soc: ti: knav_qmss_queue: Implement resource cleanup in remove() Greg Kroah-Hartman
` (410 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei,
Alex Williamson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
[ Upstream commit dc77acfeb979dded39b247b60fef0399536bfa77 ]
vfio_msi_cap_len() lazily allocates the per-device MSI permission table:
vdev->msi_perm = kmalloc_obj(struct perm_bits, GFP_KERNEL_ACCOUNT);
if (!vdev->msi_perm)
return -ENOMEM;
ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags);
if (ret) {
kfree(vdev->msi_perm);
return ret; /* vdev->msi_perm left dangling */
}
When init_pci_cap_msi_perm() -> alloc_perm_bits() fails with -ENOMEM, the
error path frees vdev->msi_perm but leaves the freed pointer stored in
it. vdev->msi_perm is not re-zeroed later because struct
vfio_pci_core_device is per-device and persists across open/close cycles,
and the vfio_config_init() error path returns without calling
vfio_config_free(). So the dangling pointer outlives the failed open.
That leads to two use-after-frees on the same device:
1. Reuse. The next vfio_config_init() sees the stale pointer at
"if (vdev->msi_perm) return len;" and reuses the freed object. MSI
config accesses in vfio_pci_config_rw_single() then dereference and
call the freed perm->readfn / perm->writefn function pointers.
2. Double free. A later vfio_config_free() runs free_perm_bits() and
kfree() on the already-freed object.
Fix it by NULLing vdev->msi_perm after the kfree(), matching the
NULL-after-free discipline already used in free_perm_bits() and
vfio_config_free().
BUG: KASAN: slab-use-after-free in vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961)
Read of size 8 at addr ffff88800fcc88d0 by task exploit/143
Call Trace:
...
kasan_report (mm/kasan/report.c:595)
vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961)
vfio_pci_config_rw (drivers/vfio/pci/vfio_pci_config.c:1986)
vfio_pci_rw (drivers/vfio/pci/vfio_pci_core.c:1599)
vfs_read (fs/read_write.c:572)
__x64_sys_pread64 (fs/read_write.c:764)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
...
Followed on device close by a double free of the same object:
Oops: general protection fault, probably for non-canonical address
0x1f63e0e8000008: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:kfree (mm/slub.c:6711)
Call Trace:
vfio_config_free (drivers/vfio/pci/vfio_pci_config.c:1861)
vfio_pci_core_disable (drivers/vfio/pci/vfio_pci_core.c:685)
vfio_pci_core_close_device (drivers/vfio/pci/vfio_pci_core.c:777)
vfio_df_close (drivers/vfio/vfio_main.c:602)
vfio_device_fops_release (drivers/vfio/vfio_main.c:648)
__fput (fs/file_table.c:512)
__x64_sys_close (fs/open.c:1496)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
...
Kernel panic - not syncing: Fatal exception
Fixes: 30ea32ab1951 ("vfio/pci: Fix potential memory leak in vfio_msi_cap_len")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Link: https://lore.kernel.org/r/20260705014010.1297885-1-xmei5@asu.edu
Signed-off-by: Alex Williamson <alex@shazbot.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vfio/pci/vfio_pci_config.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c
index 8ea38e7421df4..e1828547603c6 100644
--- a/drivers/vfio/pci/vfio_pci_config.c
+++ b/drivers/vfio/pci/vfio_pci_config.c
@@ -1257,6 +1257,7 @@ static int vfio_msi_cap_len(struct vfio_pci_core_device *vdev, u8 pos)
ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags);
if (ret) {
kfree(vdev->msi_perm);
+ vdev->msi_perm = NULL;
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0589/1376] soc: ti: knav_qmss_queue: Implement resource cleanup in remove()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (587 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0588/1376] vfio/pci: clear vdev->msi_perm after freeing it on init failure Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0590/1376] soc: ti: knav_qmss: Remove debugfs file on teardown Greg Kroah-Hartman
` (409 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nishanth Menon, Md Shofiqul Islam,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Md Shofiqul Islam <shofiqtest@gmail.com>
[ Upstream commit 10a1969353b20caa50c320717e054601631c0d3e ]
Implement the TODO in knav_queue_remove() by stopping PDSPs and
freeing queue regions and queue ranges before disabling runtime PM,
mirroring the cleanup performed in the probe error path.
Set device_ready to false before cleanup to prevent any further
use of the device during teardown.
This ensures resources are released on driver unbind and avoids
leaking queue/region state.
Suggested-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Md Shofiqul Islam <shofiqtest@gmail.com>
Link: https://lore.kernel.org/linux-arm-kernel/20260506154114.2288-1-shofiqtest@gmail.com/
Signed-off-by: Nishanth Menon <nm@ti.com>
Stable-dep-of: 3c8178627599 ("soc: ti: knav_qmss: Remove debugfs file on teardown")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/ti/knav_qmss_queue.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c
index c2ad1863048fe..df66fb15e4f95 100644
--- a/drivers/soc/ti/knav_qmss_queue.c
+++ b/drivers/soc/ti/knav_qmss_queue.c
@@ -1887,7 +1887,12 @@ static int knav_queue_probe(struct platform_device *pdev)
static void knav_queue_remove(struct platform_device *pdev)
{
- /* TODO: Free resources */
+ struct knav_device *kdev = platform_get_drvdata(pdev);
+
+ device_ready = false;
+ knav_queue_stop_pdsps(kdev);
+ knav_queue_free_regions(kdev);
+ knav_free_queue_ranges(kdev);
pm_runtime_put_sync(&pdev->dev);
pm_runtime_disable(&pdev->dev);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0590/1376] soc: ti: knav_qmss: Remove debugfs file on teardown
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (588 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0589/1376] soc: ti: knav_qmss_queue: Implement resource cleanup in remove() Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0591/1376] mtd: mtdswap: Avoid freeing registered blktrans device twice Greg Kroah-Hartman
` (408 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Nishanth Menon,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ Upstream commit 3c817862759913097f11467ed4ed2bbf974dabaf ]
knav_queue_probe() creates the global qmss debugfs file whose show
callback reads the global knav_qdev state. knav_queue_remove() tears
down the queue manager resources but leaves the debugfs file published.
Save the debugfs dentry in struct knav_device and remove it during
teardown before the resources used by the show callback are released.
While touching the debugfs_create_file() call, spell the unchanged read-
only file mode as 0444.
Fixes: 41f93af900a2 ("soc: ti: add Keystone Navigator QMSS driver")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260706144706.96313-1-pengpeng@iscas.ac.cn
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/ti/knav_qmss.h | 1 +
drivers/soc/ti/knav_qmss_queue.c | 7 +++++--
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/soc/ti/knav_qmss.h b/drivers/soc/ti/knav_qmss.h
index 9325e8ce2e25c..bd3426a30d958 100644
--- a/drivers/soc/ti/knav_qmss.h
+++ b/drivers/soc/ti/knav_qmss.h
@@ -304,6 +304,7 @@ struct knav_device {
struct list_head pools;
struct list_head pdsps;
struct list_head qmgrs;
+ struct dentry *debugfs_file;
enum qmss_version version;
};
diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c
index df66fb15e4f95..7b2ab95593ff6 100644
--- a/drivers/soc/ti/knav_qmss_queue.c
+++ b/drivers/soc/ti/knav_qmss_queue.c
@@ -1871,8 +1871,9 @@ static int knav_queue_probe(struct platform_device *pdev)
goto err;
}
- debugfs_create_file("qmss", S_IFREG | S_IRUGO, NULL, NULL,
- &knav_queue_debug_fops);
+ knav_qdev->debugfs_file =
+ debugfs_create_file("qmss", 0444, NULL, NULL,
+ &knav_queue_debug_fops);
device_ready = true;
return 0;
@@ -1890,6 +1891,8 @@ static void knav_queue_remove(struct platform_device *pdev)
struct knav_device *kdev = platform_get_drvdata(pdev);
device_ready = false;
+ debugfs_remove(kdev->debugfs_file);
+ kdev->debugfs_file = NULL;
knav_queue_stop_pdsps(kdev);
knav_queue_free_regions(kdev);
knav_free_queue_ranges(kdev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0591/1376] mtd: mtdswap: Avoid freeing registered blktrans device twice
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (589 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0590/1376] soc: ti: knav_qmss: Remove debugfs file on teardown Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0592/1376] mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() Greg Kroah-Hartman
` (407 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ruoyu Wang, Miquel Raynal,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <ruoyuw560@gmail.com>
[ Upstream commit 779aa4c66a96bf43d2d62982ea1a9096a9128d87 ]
In mtdswap_add_mtd(), debugfs setup failure after successful blktrans
registration can free mbd_dev twice.
add_mtd_blktrans_dev() initializes the blktrans device reference and
publishes the disk. Once that succeeds, del_mtd_blktrans_dev() tears the
disk down and drops the blktrans reference; when that reference reaches
zero, blktrans_dev_release() frees the mtd_blktrans_dev.
The debugfs failure path called del_mtd_blktrans_dev(mbd_dev), then fell
through the common cleanup label and called kfree(mbd_dev) again. Clear
the local pointer after deregistration so the common cleanup can still
release the mtdswap state without freeing the blktrans object twice.
This issue was found by a static analysis checker and confirmed by
manual source review.
Fixes: e8e3edb95ce6 ("mtd: create per-device and module-scope debugfs entries")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/mtdswap.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/mtd/mtdswap.c b/drivers/mtd/mtdswap.c
index 4d695875ea1b2..b7d5fe7eef4b6 100644
--- a/drivers/mtd/mtdswap.c
+++ b/drivers/mtd/mtdswap.c
@@ -1452,6 +1452,7 @@ static void mtdswap_add_mtd(struct mtd_blktrans_ops *tr, struct mtd_info *mtd)
debugfs_failed:
del_mtd_blktrans_dev(mbd_dev);
+ mbd_dev = NULL;
cleanup:
mtdswap_cleanup(d);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0592/1376] mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (590 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0591/1376] mtd: mtdswap: Avoid freeing registered blktrans device twice Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0593/1376] perf ui hists: Fix uninitialized stack memory free on pstack allocation failure Greg Kroah-Hartman
` (406 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, zhouminqiang, Zhihao Cheng,
Miquel Raynal, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: zhouminqiang <zhouminqiang2@huawei.com>
[ Upstream commit b759d5bb6265419344ee9729fd0dc07ad85719d8 ]
mtd_add_partition() does not reject the special offset value
MTDPART_OFS_RETAIN (-3), which leads to a WARN_ON in
add_mtd_device() when called through the BLKPG ioctl on NAND
devices. The RETAIN value depends on cur_offset being the end of
the previous partition, but in the dynamic partition path
cur_offset equals the offset argument itself, causing undefined
behavior.
Commit 5daa7b21496a ("mtd: prepare partition add and del functions
for ioctl requests") introduced mtd_add_partition() and correctly
rejected MTDPART_OFS_APPEND (-1) and MTDPART_OFS_NXTBLK (-2),
since those special offsets rely on cur_offset tracking the
previous partition's end. However, commit 1a31368bf92e ("mtd: add a flags
for partitions which should just leave smth. after them")
later added MTDPART_OFS_RETAIN (-3) for the static
partition table path without updating mtd_add_partition() to
also reject this value.
With offset=-3 passed via BLKPG, the RETAIN size calculation in
allocate_partition() underflows (parent_size - 0xFFFFFFFFFFFFFFFD
= parent_size + 3). If the underflow result does not appear to
leave enough space, allocate_partition() jumps to out_register via
goto, skipping erasesize initialization. This results in
erasesize=0, which triggers:
WARN_ON((!mtd->erasesize || !master->_erase) &&
!(mtd->flags & MTD_NO_ERASE))
in add_mtd_device(). If the underflow result appears to leave
enough space, a bogus partition size is calculated, but the
"out of reach" sanity check catches the invalid offset and
creates a disabled empty partition (offset=0, size=0) instead
of returning an error.
Fix this by adding MTDPART_OFS_RETAIN to the rejection list in
mtd_add_partition(), consistent with the existing handling of
APPEND and NXTBLK.
Fixes: 1a31368bf92e ("mtd: add a flags for partitions which should just leave smth. after them")
Signed-off-by: zhouminqiang <zhouminqiang2@huawei.com>
Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/mtdpart.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
index 208532d86cc93..c3ba57215c860 100644
--- a/drivers/mtd/mtdpart.c
+++ b/drivers/mtd/mtdpart.c
@@ -254,7 +254,8 @@ int mtd_add_partition(struct mtd_info *parent, const char *name,
/* the direct offset is expected */
if (offset == MTDPART_OFS_APPEND ||
- offset == MTDPART_OFS_NXTBLK)
+ offset == MTDPART_OFS_NXTBLK ||
+ offset == MTDPART_OFS_RETAIN)
return -EINVAL;
if (length == MTDPART_SIZ_FULL)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0593/1376] perf ui hists: Fix uninitialized stack memory free on pstack allocation failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (591 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0592/1376] mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0594/1376] software node: Fix software_node_get_reference_args() with index -1 Greg Kroah-Hartman
` (405 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Ian Rogers,
Namhyung Kim, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <irogers@google.com>
[ Upstream commit d5fdde1c426922efabe86a515f0782b3eba40577 ]
Fixes heap corruption by initializing the options and actions arrays before
the pstack allocation check, preventing an uninitialized stack pointer from
being passed to free_popup_options() if the allocation fails.
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/linux-perf-users/20260709035230.6DBEE1F000E9@smtp.kernel.org/
Fixes: f2b487db45f2 ("perf hists browser: Fix possible memory leak")
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Ian Rogers <irogers@google.com>
Link: https://lore.kernel.org/linux-perf-users/20260709035230.6DBEE1F000E9@smtp.kernel.org/
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/ui/browsers/hists.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
index 3283b6313bab8..00d1ca3295b4f 100644
--- a/tools/perf/ui/browsers/hists.c
+++ b/tools/perf/ui/browsers/hists.c
@@ -3033,15 +3033,15 @@ static int evsel__hists_browse(struct evsel *evsel, int nr_events, const char *h
browser->min_pcnt = min_pcnt;
hist_browser__update_nr_entries(browser);
+ memset(options, 0, sizeof(options));
+ memset(actions, 0, sizeof(actions));
+
browser->pstack = pstack__new(3);
if (browser->pstack == NULL)
goto out;
ui_helpline__push(helpline);
- memset(options, 0, sizeof(options));
- memset(actions, 0, sizeof(actions));
-
if (symbol_conf.col_width_list_str)
perf_hpp__set_user_width(symbol_conf.col_width_list_str);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0594/1376] software node: Fix software_node_get_reference_args() with index -1
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (592 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0593/1376] perf ui hists: Fix uninitialized stack memory free on pstack allocation failure Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0595/1376] driver core: soc: Unregister bus on early device registration failure Greg Kroah-Hartman
` (404 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Alban Bedel, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alban Bedel <alban.bedel@lht.dlh.de>
[ Upstream commit ba3dedcf3bd47017307595a7e54924198f018246 ]
The bounds check for the index passed to
software_node_get_reference_args() was failing when passed UINT_MAX,
this in turn would lead to an out of bound access in the property
array. Fix the bound check to also cover the UINT_MAX case.
Fixes: 31e4e12e0e960 ("software node: Correct a OOB check in software_node_get_reference_args()")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/linux-devicetree/20260611103904.7CB131F00893@smtp.kernel.org/
Signed-off-by: Alban Bedel <alban.bedel@lht.dlh.de>
Link: https://patch.msgid.link/20260611164005.2930205-1-alban.bedel@lht.dlh.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/swnode.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c
index 53b3f0061ad12..49295a1a3ea92 100644
--- a/drivers/base/swnode.c
+++ b/drivers/base/swnode.c
@@ -529,7 +529,7 @@ software_node_get_reference_args(const struct fwnode_handle *fwnode,
if (prop->is_inline)
return -EINVAL;
- if ((index + 1) * sizeof(*ref) > prop->length)
+ if (index >= prop->length / sizeof(*ref))
return -ENOENT;
ref_array = prop->pointer;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0595/1376] driver core: soc: Unregister bus on early device registration failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (593 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0594/1376] software node: Fix software_node_get_reference_args() with index -1 Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0596/1376] drm/msm/a6xx: Fix RBBM_CLOCK_CNTL3_TP0 value in a730_hwcg Greg Kroah-Hartman
` (403 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yuho Choi, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <dbgh9129@gmail.com>
[ Upstream commit 45dfa004893dfeae182ec27eddbd153c6d4ddbf9 ]
soc_bus_register() registers the SoC bus before registering a deferred
early SoC device. If soc_device_register() fails in that path, the
function returns the error directly and leaves the bus registered.
Store the returned SoC device pointer explicitly so the success and
error cases are handled separately. On failure, clear soc_bus_registered
and unregister the bus before returning the error.
Fixes: 6e12db376b60 ("base: soc: Allow early registration of a single SoC device")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Link: https://patch.msgid.link/20260615180746.713540-1-dbgh9129@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/soc.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
diff --git a/drivers/base/soc.c b/drivers/base/soc.c
index 282c38aece0de..c43940940aa34 100644
--- a/drivers/base/soc.c
+++ b/drivers/base/soc.c
@@ -194,6 +194,7 @@ EXPORT_SYMBOL_GPL(soc_device_unregister);
static int __init soc_bus_register(void)
{
+ struct soc_device *soc_dev;
int ret;
ret = bus_register(&soc_bus_type);
@@ -201,10 +202,20 @@ static int __init soc_bus_register(void)
return ret;
soc_bus_registered = true;
- if (early_soc_dev_attr)
- return PTR_ERR(soc_device_register(early_soc_dev_attr));
+ if (early_soc_dev_attr) {
+ soc_dev = soc_device_register(early_soc_dev_attr);
+ if (IS_ERR(soc_dev)) {
+ ret = PTR_ERR(soc_dev);
+ goto err_unregister_bus;
+ }
+ }
return 0;
+
+err_unregister_bus:
+ soc_bus_registered = false;
+ bus_unregister(&soc_bus_type);
+ return ret;
}
core_initcall(soc_bus_register);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0596/1376] drm/msm/a6xx: Fix RBBM_CLOCK_CNTL3_TP0 value in a730_hwcg
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (594 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0595/1376] driver core: soc: Unregister bus on early device registration failure Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0597/1376] bpf: Reject arena frees below the arena base Greg Kroah-Hartman
` (402 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Puranam V G Tejaswi, Konrad Dybcio,
Akhil P Oommen, Rob Clark, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Puranam V G Tejaswi <puranam.tejaswi@oss.qualcomm.com>
[ Upstream commit 01bcc0398f43099acb407a6067481e635c3e1b84 ]
The RBBM_CLOCK_CNTL3_TP0 entry in a730_hwcg has bits[19:16] set to 2
(clock gating enabled for that TP0 stage). As per the latest
recommendation, clear this nibble to disable clock gating for this
particular stage.
Fixes: 9588d2f860a4 ("drm/msm/a6xx: Add A730 support")
Signed-off-by: Puranam V G Tejaswi <puranam.tejaswi@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Akhil P Oommen <akhilpo@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/740955/
Message-ID: <20260718-eliza-gpu-v2-1-64379dbebd7a@oss.qualcomm.com>
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/adreno/a6xx_catalog.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/adreno/a6xx_catalog.c b/drivers/gpu/drm/msm/adreno/a6xx_catalog.c
index a763fe5d6e2d6..8bb23012994c6 100644
--- a/drivers/gpu/drm/msm/adreno/a6xx_catalog.c
+++ b/drivers/gpu/drm/msm/adreno/a6xx_catalog.c
@@ -1117,7 +1117,7 @@ static const struct adreno_reglist a730_hwcg[] = {
{ REG_A6XX_RBBM_CLOCK_DELAY_SP0, 0x00000080 },
{ REG_A6XX_RBBM_CLOCK_CNTL_TP0, 0x22222220 },
{ REG_A6XX_RBBM_CLOCK_CNTL2_TP0, 0x22222222 },
- { REG_A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22222222 },
+ { REG_A6XX_RBBM_CLOCK_CNTL3_TP0, 0x22220222 },
{ REG_A6XX_RBBM_CLOCK_CNTL4_TP0, 0x00222222 },
{ REG_A6XX_RBBM_CLOCK_HYST_TP0, 0x77777777 },
{ REG_A6XX_RBBM_CLOCK_HYST2_TP0, 0x77777777 },
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0597/1376] bpf: Reject arena frees below the arena base
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (595 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0596/1376] drm/msm/a6xx: Fix RBBM_CLOCK_CNTL3_TP0 value in a730_hwcg Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0598/1376] dmaengine: dw-edma: Terminate all descriptors without callbacks Greg Kroah-Hartman
` (401 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yiyang Chen, Emil Tsalapatis,
Kumar Kartikeya Dwivedi, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>
[ Upstream commit b5a71cb2db6d84ac0042549dcec266b18429d41e ]
bpf_arena_free_pages() accepts scalar arena addresses. The runtime
masks the address to the low 32 bits and reconstructs a full user
address from the arena base before returning the range to the arena
free tree.
When the scalar value is below the low 32 bits of the arena base,
full_uaddr falls below user_vm_start. The existing upper-end clipping
then turns this into an out-of-range free-tree offset. A later
allocation can reuse that offset and return an address below the arena
mapping.
Reject such frees before computing the clipped range.
Fixes: 317460317a02a ("bpf: Introduce bpf_arena.")
Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Link: https://lore.kernel.org/bpf/20260717-c10-031-public-bpf-next-v2-b4-v2-1-54b555443a7c@mails.tsinghua.edu.cn
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/arena.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/kernel/bpf/arena.c b/kernel/bpf/arena.c
index 187e4871b74b3..c62c6f261ca07 100644
--- a/kernel/bpf/arena.c
+++ b/kernel/bpf/arena.c
@@ -523,6 +523,8 @@ static void arena_free_pages(struct bpf_arena *arena, long uaddr, long page_cnt)
uaddr = (u32)uaddr;
uaddr &= PAGE_MASK;
full_uaddr = clear_lo32(arena->user_vm_start) + uaddr;
+ if (full_uaddr < arena->user_vm_start)
+ return;
uaddr_end = min(arena->user_vm_end, full_uaddr + (page_cnt << PAGE_SHIFT));
if (full_uaddr >= uaddr_end)
return;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0598/1376] dmaengine: dw-edma: Terminate all descriptors without callbacks
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (596 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0597/1376] bpf: Reject arena frees below the arena base Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0599/1376] dmaengine: dw-edma: Serialize abort state updates Greg Kroah-Hartman
` (400 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Frank Li, Koichiro Den, Vinod Koul,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <den@valinux.co.jp>
[ Upstream commit 99109a51efd28c9a661fbfb9469b023c517b31d1 ]
The DMA Engine client documentation says in the "Terminate APIs" section
of Documentation/driver-api/dmaengine/client.rst:
"No callback functions will be called for any incomplete transfers."
dw-edma instead calls vchan_cookie_complete() when a deferred STOP reaches
the interrupt handler. This schedules a callback for the active descriptor
and leaves other issued or submitted descriptors queued. A late callback
after dmaengine_terminate_sync() can dereference client state that has
already been freed, while leftover descriptors may later restart into
reused buffers or leak.
Move all issued and submitted descriptors to the terminated list whenever
termination completes. For a pending STOP, do this from both the DONE and
ABORT paths. Complete their cookies in order without scheduling callbacks.
A STOP can remain pending until the running transfer raises an
interrupt. Make device_synchronize() wait for such a pending STOP to
complete before releasing terminated descriptors. Reuse it from
free_chan_resources(), then release the remaining virt-dma resources.
Sleep instead of busy-polling while waiting, and warn if the existing
timeout expires.
Fixes: e63d79d1ffcd ("dmaengine: Add Synopsys eDMA IP core driver")
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Link: https://patch.msgid.link/20260717180639.2643243-3-den@valinux.co.jp
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/dw-edma/dw-edma-core.c | 90 +++++++++++++++++++++++++-----
1 file changed, 76 insertions(+), 14 deletions(-)
diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c
index fa0691c3b330d..e8ac14e7691e2 100644
--- a/drivers/dma/dw-edma/dw-edma-core.c
+++ b/drivers/dma/dw-edma/dw-edma-core.c
@@ -7,6 +7,7 @@
*/
#include <linux/module.h>
+#include <linux/delay.h>
#include <linux/device.h>
#include <linux/kernel.h>
#include <linux/dmaengine.h>
@@ -212,6 +213,35 @@ static int dw_edma_start_transfer(struct dw_edma_chan *chan)
return 1;
}
+static void dw_edma_terminate_vdesc(struct virt_dma_desc *vd)
+{
+ list_del(&vd->node);
+ dma_cookie_complete(&vd->tx);
+ vchan_terminate_vdesc(vd);
+}
+
+static void dw_edma_terminate_vdesc_list(struct list_head *head)
+{
+ struct virt_dma_desc *vd, *_vd;
+
+ list_for_each_entry_safe(vd, _vd, head, node)
+ dw_edma_terminate_vdesc(vd);
+}
+
+/* Must be called with vc.lock held. */
+static void dw_edma_terminate_all_descs(struct dw_edma_chan *chan)
+{
+ /*
+ * This order must not be reversed. Cookies are assigned when
+ * descriptors are submitted, so desc_issued contains older cookies
+ * than desc_submitted. Completing desc_submitted first could move
+ * chan->vc.chan.completed_cookie backwards when desc_issued is
+ * terminated afterwards.
+ */
+ dw_edma_terminate_vdesc_list(&chan->vc.desc_issued);
+ dw_edma_terminate_vdesc_list(&chan->vc.desc_submitted);
+}
+
static void dw_edma_device_caps(struct dma_chan *dchan,
struct dma_slave_caps *caps)
{
@@ -283,20 +313,22 @@ static int dw_edma_device_terminate_all(struct dma_chan *dchan)
struct dw_edma_chan *chan = dchan2dw_edma_chan(dchan);
int err = 0;
+ guard(spinlock_irqsave)(&chan->vc.lock);
+
if (!chan->configured) {
- /* Do nothing */
+ dw_edma_terminate_all_descs(chan);
} else if (chan->status == EDMA_ST_PAUSE) {
+ dw_edma_terminate_all_descs(chan);
chan->status = EDMA_ST_IDLE;
- chan->configured = false;
} else if (chan->status == EDMA_ST_IDLE) {
- chan->configured = false;
+ dw_edma_terminate_all_descs(chan);
} else if (dw_edma_core_ch_status(chan) == DMA_COMPLETE) {
/*
* The channel is in a false BUSY state, probably didn't
* receive or lost an interrupt
*/
+ dw_edma_terminate_all_descs(chan);
chan->status = EDMA_ST_IDLE;
- chan->configured = false;
} else if (chan->request > EDMA_REQ_PAUSE) {
err = -EPERM;
} else {
@@ -652,8 +684,7 @@ static void dw_edma_done_interrupt(struct dw_edma_chan *chan)
break;
case EDMA_REQ_STOP:
- list_del(&vd->node);
- vchan_cookie_complete(vd);
+ dw_edma_terminate_all_descs(chan);
chan->request = EDMA_REQ_NONE;
chan->status = EDMA_ST_IDLE;
break;
@@ -672,7 +703,9 @@ static void dw_edma_abort_interrupt(struct dw_edma_chan *chan)
spin_lock_irqsave(&chan->vc.lock, flags);
vd = vchan_next_desc(&chan->vc);
- if (vd) {
+ if (vd && chan->request == EDMA_REQ_STOP) {
+ dw_edma_terminate_all_descs(chan);
+ } else if (vd) {
dw_hdma_set_callback_result(vd, DMA_TRANS_ABORTED);
list_del(&vd->node);
vchan_cookie_complete(vd);
@@ -720,21 +753,49 @@ static int dw_edma_alloc_chan_resources(struct dma_chan *dchan)
return 0;
}
-static void dw_edma_free_chan_resources(struct dma_chan *dchan)
+static void dw_edma_wait_termination(struct dma_chan *dchan)
{
+ struct dw_edma_chan *chan = dchan2dw_edma_chan(dchan);
unsigned long timeout = jiffies + msecs_to_jiffies(5000);
- int ret;
+ bool stopping;
+ /*
+ * A STOP may be deferred to a later interrupt while the channel is still
+ * running. Wait until that handler completes the termination.
+ */
while (time_before(jiffies, timeout)) {
- ret = dw_edma_device_terminate_all(dchan);
- if (!ret)
- break;
+ scoped_guard(spinlock_irqsave, &chan->vc.lock)
+ stopping = chan->request == EDMA_REQ_STOP;
- if (time_after_eq(jiffies, timeout))
+ if (!stopping)
return;
- cpu_relax();
+ fsleep(1000);
}
+
+ dev_warn(chan->dw->chip->dev,
+ "timeout waiting for channel termination\n");
+}
+
+static void dw_edma_device_synchronize(struct dma_chan *dchan)
+{
+ struct dw_edma_chan *chan = dchan2dw_edma_chan(dchan);
+
+ dw_edma_wait_termination(dchan);
+ vchan_synchronize(&chan->vc);
+}
+
+static void dw_edma_free_chan_resources(struct dma_chan *dchan)
+{
+ struct dw_edma_chan *chan = dchan2dw_edma_chan(dchan);
+
+ dw_edma_device_terminate_all(dchan);
+ dw_edma_device_synchronize(dchan);
+
+ scoped_guard(spinlock_irqsave, &chan->vc.lock)
+ chan->configured = false;
+
+ vchan_free_chan_resources(&chan->vc);
}
static int dw_edma_channel_setup(struct dw_edma *dw, u32 wr_alloc, u32 rd_alloc)
@@ -830,6 +891,7 @@ static int dw_edma_channel_setup(struct dw_edma *dw, u32 wr_alloc, u32 rd_alloc)
dma->device_pause = dw_edma_device_pause;
dma->device_resume = dw_edma_device_resume;
dma->device_terminate_all = dw_edma_device_terminate_all;
+ dma->device_synchronize = dw_edma_device_synchronize;
dma->device_issue_pending = dw_edma_device_issue_pending;
dma->device_tx_status = dw_edma_device_tx_status;
dma->device_prep_slave_sg = dw_edma_device_prep_slave_sg;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0599/1376] dmaengine: dw-edma: Serialize abort state updates
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (597 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0598/1376] dmaengine: dw-edma: Terminate all descriptors without callbacks Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0600/1376] dmaengine: dw-edma: Serialize channel state checks Greg Kroah-Hartman
` (399 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Frank Li, Koichiro Den, Vinod Koul,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <den@valinux.co.jp>
[ Upstream commit dd80e259f65d932634e26d366570d71669ef6654 ]
dw_edma_abort_interrupt() drops vc.lock before changing request and
status. issue_pending() can acquire the lock in that small window,
observe the old busy state, and skip starting queued descriptors. Then
the abort handler overwrites the channel status as idle, leaving the new
descriptors stranded for good.
Keep descriptor completion and the state transition in the same critical
section.
Fixes: e63d79d1ffcd ("dmaengine: Add Synopsys eDMA IP core driver")
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Link: https://patch.msgid.link/20260717180639.2643243-4-den@valinux.co.jp
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/dw-edma/dw-edma-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c
index e8ac14e7691e2..7e1b270738ce0 100644
--- a/drivers/dma/dw-edma/dw-edma-core.c
+++ b/drivers/dma/dw-edma/dw-edma-core.c
@@ -710,9 +710,9 @@ static void dw_edma_abort_interrupt(struct dw_edma_chan *chan)
list_del(&vd->node);
vchan_cookie_complete(vd);
}
- spin_unlock_irqrestore(&chan->vc.lock, flags);
chan->request = EDMA_REQ_NONE;
chan->status = EDMA_ST_IDLE;
+ spin_unlock_irqrestore(&chan->vc.lock, flags);
}
static inline irqreturn_t dw_edma_interrupt_write(int irq, void *data)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0600/1376] dmaengine: dw-edma: Serialize channel state checks
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (598 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0599/1376] dmaengine: dw-edma: Serialize abort state updates Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0601/1376] dmaengine: dw-edma: Clear stale requests on termination Greg Kroah-Hartman
` (398 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Frank Li, Koichiro Den, Vinod Koul,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <den@valinux.co.jp>
[ Upstream commit f7d1619f3e10c619b62c6cd6d95371b5c526c85a ]
pause() and resume() read and update channel state without holding vc.lock,
while the interrupt handlers update the same state under it. Take the same
lock around those state checks so that request, status, and configured stay
consistent.
For example, pause() can observe EDMA_ST_BUSY right before the interrupt
handler completes the final descriptor and moves the channel to
EDMA_ST_IDLE, and then record EDMA_REQ_PAUSE on an already idle channel. No
further interrupt will acknowledge the request, and since issue_pending()
requires EDMA_REQ_NONE, the channel is wedged for good: terminate_all()
leaves the stale request behind, so even reconfiguring the channel does not
recover it.
issue_pending() already runs under vc.lock, but it tests configured before
taking it. Move that test under the lock as well, so configured, request,
and status are evaluated as one channel-state snapshot.
Fixes: e63d79d1ffcd ("dmaengine: Add Synopsys eDMA IP core driver")
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Link: https://patch.msgid.link/20260717180639.2643243-6-den@valinux.co.jp
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/dw-edma/dw-edma-core.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c
index 7e1b270738ce0..2526dad096332 100644
--- a/drivers/dma/dw-edma/dw-edma-core.c
+++ b/drivers/dma/dw-edma/dw-edma-core.c
@@ -276,6 +276,8 @@ static int dw_edma_device_pause(struct dma_chan *dchan)
struct dw_edma_chan *chan = dchan2dw_edma_chan(dchan);
int err = 0;
+ guard(spinlock_irqsave)(&chan->vc.lock);
+
if (!chan->configured)
err = -EPERM;
else if (chan->status != EDMA_ST_BUSY)
@@ -293,6 +295,8 @@ static int dw_edma_device_resume(struct dma_chan *dchan)
struct dw_edma_chan *chan = dchan2dw_edma_chan(dchan);
int err = 0;
+ guard(spinlock_irqsave)(&chan->vc.lock);
+
if (!chan->configured) {
err = -EPERM;
} else if (chan->status != EDMA_ST_PAUSE) {
@@ -343,11 +347,9 @@ static void dw_edma_device_issue_pending(struct dma_chan *dchan)
struct dw_edma_chan *chan = dchan2dw_edma_chan(dchan);
unsigned long flags;
- if (!chan->configured)
- return;
-
spin_lock_irqsave(&chan->vc.lock, flags);
- if (vchan_issue_pending(&chan->vc) && chan->request == EDMA_REQ_NONE &&
+ if (chan->configured && vchan_issue_pending(&chan->vc) &&
+ chan->request == EDMA_REQ_NONE &&
chan->status == EDMA_ST_IDLE) {
chan->status = EDMA_ST_BUSY;
dw_edma_start_transfer(chan);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0601/1376] dmaengine: dw-edma: Clear stale requests on termination
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (599 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0600/1376] dmaengine: dw-edma: Serialize channel state checks Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0602/1376] ASoC: meson: Keep link pointers valid on realloc failure Greg Kroah-Hartman
` (397 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Frank Li, Koichiro Den, Vinod Koul,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <den@valinux.co.jp>
[ Upstream commit c0d9c6275adcca7c0ca5f4270bf88026f9864bd1 ]
terminate_all() can finish immediately when the channel is unconfigured,
paused, idle, or already stopped in hardware. A pending PAUSE request can
survive these paths and block issue_pending() even after termination.
Clear the request whenever termination leaves the channel idle. A running
channel keeps its STOP request until the interrupt handler consumes it.
Fixes: e63d79d1ffcd ("dmaengine: Add Synopsys eDMA IP core driver")
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Link: https://patch.msgid.link/20260717180639.2643243-7-den@valinux.co.jp
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/dw-edma/dw-edma-core.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c
index 2526dad096332..1fd2dbc5d7178 100644
--- a/drivers/dma/dw-edma/dw-edma-core.c
+++ b/drivers/dma/dw-edma/dw-edma-core.c
@@ -338,6 +338,8 @@ static int dw_edma_device_terminate_all(struct dma_chan *dchan)
} else {
chan->request = EDMA_REQ_STOP;
}
+ if (chan->status == EDMA_ST_IDLE)
+ chan->request = EDMA_REQ_NONE;
return err;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0602/1376] ASoC: meson: Keep link pointers valid on realloc failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (600 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0601/1376] dmaengine: dw-edma: Clear stale requests on termination Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0603/1376] phy: starfive: Fix runtime PM cleanup in JH7110 DPHY TX probe Greg Kroah-Hartman
` (396 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linmao Li, Jerome Brunet, Mark Brown,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linmao Li <lilinmao@kylinos.cn>
[ Upstream commit 2aaa41cf974f83a6fb105422bac4e2f107150774 ]
meson_card_reallocate_links() grows the DAI link and private data
arrays with two consecutive krealloc() calls and updates the owner
pointers only after both calls have succeeded.
A successful krealloc() may move the data: it frees the old block and
returns a new one. When that happens for the link array and the second
krealloc() then fails, card->dai_link still points to the block that
krealloc() already freed, and the error path frees the new block too.
The probe error path then calls meson_card_clean_references(), which
dereferences card->dai_link and kfree()s it again, resulting in a
use-after-free and a double free.
Commit card->dai_link and card->num_links right after the first
krealloc() succeeds, so the pointer always refers to a valid allocation
that meson_card_clean_references() can walk and free. krealloc() with
__GFP_ZERO zero-initializes the added entries, so walking them on the
error path is safe. With both failure paths reduced to a plain return,
drop the goto labels and the error message.
Fixes: 7864a79f37b5 ("ASoC: meson: add axg sound card support")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Reviewed-by: Jerome Brunet <jbrunet@baylibre.com>
Link: https://patch.msgid.link/20260717012433.1432285-1-lilinmao@kylinos.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/meson/meson-card-utils.c | 17 ++++++-----------
1 file changed, 6 insertions(+), 11 deletions(-)
diff --git a/sound/soc/meson/meson-card-utils.c b/sound/soc/meson/meson-card-utils.c
index ad38c74166a46..c2a2531b30f98 100644
--- a/sound/soc/meson/meson-card-utils.c
+++ b/sound/soc/meson/meson-card-utils.c
@@ -50,25 +50,20 @@ int meson_card_reallocate_links(struct snd_soc_card *card,
num_links * sizeof(*priv->card.dai_link),
GFP_KERNEL | __GFP_ZERO);
if (!links)
- goto err_links;
+ return -ENOMEM;
+
+ priv->card.dai_link = links;
+ priv->card.num_links = num_links;
ldata = krealloc(priv->link_data,
num_links * sizeof(*priv->link_data),
GFP_KERNEL | __GFP_ZERO);
+ /* meson_card_clean_references() will free the links on this error path */
if (!ldata)
- goto err_ldata;
+ return -ENOMEM;
- priv->card.dai_link = links;
priv->link_data = ldata;
- priv->card.num_links = num_links;
return 0;
-
-err_ldata:
- kfree(links);
-err_links:
- dev_err(priv->card.dev, "failed to allocate links\n");
- return -ENOMEM;
-
}
EXPORT_SYMBOL_GPL(meson_card_reallocate_links);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0603/1376] phy: starfive: Fix runtime PM cleanup in JH7110 DPHY TX probe
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (601 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0602/1376] ASoC: meson: Keep link pointers valid on realloc failure Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0604/1376] phy: starfive: Fix runtime PM cleanup in JH7110 DPHY RX probe Greg Kroah-Hartman
` (395 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Can Peng, Changhuang Liang,
Vinod Koul, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Can Peng <pengcan@kylinos.cn>
[ Upstream commit f40b0241f3a382e99c14de2f28f14a44973407c1 ]
stf_dphy_probe() enables runtime PM before getting the clock and
reset controls, creating the PHY and registering the PHY provider. If
any of those steps fails, probe returns with runtime PM still enabled.
The driver also has no remove callback, so runtime PM is left enabled
on driver unbind after a successful probe.
Use devm_pm_runtime_enable() so runtime PM is disabled automatically
on later probe failures and on driver unbind.
Fixes: d3ab79553308 ("phy: starfive: Add mipi dphy tx support")
Signed-off-by: Can Peng <pengcan@kylinos.cn>
Reviewed-by: Changhuang Liang <changhuang.liang@starfivetech.com>
Link: https://patch.msgid.link/20260718090054.444513-2-pengcan@kylinos.cn
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/starfive/phy-jh7110-dphy-tx.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/phy/starfive/phy-jh7110-dphy-tx.c b/drivers/phy/starfive/phy-jh7110-dphy-tx.c
index c64d1c91b1307..181491a938079 100644
--- a/drivers/phy/starfive/phy-jh7110-dphy-tx.c
+++ b/drivers/phy/starfive/phy-jh7110-dphy-tx.c
@@ -392,6 +392,7 @@ static int stf_dphy_probe(struct platform_device *pdev)
{
struct phy_provider *phy_provider;
struct stf_dphy *dphy;
+ int ret;
dphy = devm_kzalloc(&pdev->dev, sizeof(*dphy), GFP_KERNEL);
if (!dphy)
@@ -406,7 +407,9 @@ static int stf_dphy_probe(struct platform_device *pdev)
if (IS_ERR(dphy->topsys))
return PTR_ERR(dphy->topsys);
- pm_runtime_enable(&pdev->dev);
+ ret = devm_pm_runtime_enable(&pdev->dev);
+ if (ret)
+ return ret;
dphy->txesc_clk = devm_clk_get(&pdev->dev, "txesc");
if (IS_ERR(dphy->txesc_clk))
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0604/1376] phy: starfive: Fix runtime PM cleanup in JH7110 DPHY RX probe
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (602 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0603/1376] phy: starfive: Fix runtime PM cleanup in JH7110 DPHY TX probe Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0605/1376] arm64: dts: amlogic: meson-axg: Add missing nand_rb0 pin to nand_all_pins Greg Kroah-Hartman
` (394 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Can Peng, Changhuang Liang,
Vinod Koul, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Can Peng <pengcan@kylinos.cn>
[ Upstream commit 97bed336f6a25c9d1115ca95e3aa00e05c3bc271 ]
stf_dphy_probe() enables runtime PM before registering the PHY provider.
If devm_of_phy_provider_register() fails, probe returns with runtime PM
still enabled.
The driver also has no remove callback, so runtime PM is left enabled
on driver unbind after a successful probe.
Use devm_pm_runtime_enable() so runtime PM is disabled automatically
on later probe failures and on driver unbind.
Fixes: f8aa660841bc ("phy: starfive: Add mipi dphy rx support")
Signed-off-by: Can Peng <pengcan@kylinos.cn>
Reviewed-by: Changhuang Liang <changhuang.liang@starfivetech.com>
Link: https://patch.msgid.link/20260718090054.444513-3-pengcan@kylinos.cn
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/starfive/phy-jh7110-dphy-rx.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/phy/starfive/phy-jh7110-dphy-rx.c b/drivers/phy/starfive/phy-jh7110-dphy-rx.c
index 0b039e1f71c55..d06f21ad63325 100644
--- a/drivers/phy/starfive/phy-jh7110-dphy-rx.c
+++ b/drivers/phy/starfive/phy-jh7110-dphy-rx.c
@@ -150,6 +150,7 @@ static int stf_dphy_probe(struct platform_device *pdev)
{
struct phy_provider *phy_provider;
struct stf_dphy *dphy;
+ int ret;
dphy = devm_kzalloc(&pdev->dev, sizeof(*dphy), GFP_KERNEL);
if (!dphy)
@@ -190,7 +191,9 @@ static int stf_dphy_probe(struct platform_device *pdev)
return PTR_ERR(dphy->phy);
}
- pm_runtime_enable(&pdev->dev);
+ ret = devm_pm_runtime_enable(&pdev->dev);
+ if (ret)
+ return ret;
phy_set_drvdata(dphy->phy, dphy);
phy_provider = devm_of_phy_provider_register(&pdev->dev,
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0605/1376] arm64: dts: amlogic: meson-axg: Add missing nand_rb0 pin to nand_all_pins
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (603 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0604/1376] phy: starfive: Fix runtime PM cleanup in JH7110 DPHY RX probe Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0606/1376] arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe Greg Kroah-Hartman
` (393 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jun Yan, Martin Blumenstingl,
Neil Armstrong, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jun Yan <jerrysteve1101@gmail.com>
[ Upstream commit 45eb76f9ab6854f79690d56d04df227429a536b8 ]
The nand_all_pins pinctrl node was missing the nand_rb0 (ready/busy)
pin description, which is required for NAND controller operation.
Add it to the pinmux list.
Fixes: be18d53c32b2 ("arm64: dts: amlogic: meson-axg: pinctrl node for NAND")
Signed-off-by: Jun Yan <jerrysteve1101@gmail.com>
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Link: https://patch.msgid.link/20260624135650.727077-3-jerrysteve1101@gmail.com
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/amlogic/meson-axg.dtsi | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
index 4717c9666f2a5..ff05b997f6fe8 100644
--- a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
@@ -454,7 +454,8 @@ mux {
"nand_ale",
"nand_cle",
"nand_wen_clk",
- "nand_ren_wr";
+ "nand_ren_wr",
+ "nand_rb0";
function = "nand";
input-enable;
bias-pull-up;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0606/1376] arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (604 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0605/1376] arm64: dts: amlogic: meson-axg: Add missing nand_rb0 pin to nand_all_pins Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0607/1376] RDMA/hfi1: Propagate sdma_txinit_ahg() errors Greg Kroah-Hartman
` (392 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jun Yan, Martin Blumenstingl,
Neil Armstrong, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jun Yan <jerrysteve1101@gmail.com>
[ Upstream commit 7f1d0cc86cb70fa550163b6f70fd1d484c03218e ]
The PCIe PHY node references mipi_pcie_analog_dphy via its phys property.
Enable this analog PHY node to make PCIe functionally viable.
Fixes: 9715b01da6cf ("arm64: dts: meson-axg-s400: enable PCIe M.2 Key E slots")
Signed-off-by: Jun Yan <jerrysteve1101@gmail.com>
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Link: https://patch.msgid.link/20260624135650.727077-5-jerrysteve1101@gmail.com
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/amlogic/meson-axg-s400.dts | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/arch/arm64/boot/dts/amlogic/meson-axg-s400.dts b/arch/arm64/boot/dts/amlogic/meson-axg-s400.dts
index 9611775b81eee..7c8a8529dbc5f 100644
--- a/arch/arm64/boot/dts/amlogic/meson-axg-s400.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-axg-s400.dts
@@ -432,6 +432,10 @@ gpio_speaker: gpio-controller@1f {
};
};
+&mipi_pcie_analog_dphy {
+ status = "okay";
+};
+
&pdm {
pinctrl-0 = <&pdm_dclk_a14_pins>, <&pdm_din0_pins>,
<&pdm_din1_pins>, <&pdm_din2_pins>, <&pdm_din3_pins>;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0607/1376] RDMA/hfi1: Propagate sdma_txinit_ahg() errors
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (605 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0606/1376] arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0608/1376] RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[] Greg Kroah-Hartman
` (391 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Danila Chernetsov, Leon Romanovsky,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danila Chernetsov <listdansp@mail.ru>
[ Upstream commit 091c6162c022cbdfb64219708a71728cfd1d4600 ]
set_txreq_header_ahg() ignores the return value of sdma_txinit_ahg().
If sdma_txinit_ahg() fails, it returns before initializing tx->txreq.
However, set_txreq_header_ahg() ignores the error and returns the AHG
change count, causing the caller to continue processing the request as
though initialization had succeeded.
Propagate sdma_txinit_ahg() failures to the caller and abort request
processing when initialization fails.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: e3304b7cc4f1 ("IB/hfi1: Optimize cachelines for user SDMA request structure")
Signed-off-by: Danila Chernetsov <listdansp@mail.ru>
Link: https://patch.msgid.link/20260708162252.936634-1-listdansp@mail.ru
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/hfi1/user_sdma.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c
index b72625283fcf8..d2cbece4eb0f9 100644
--- a/drivers/infiniband/hw/hfi1/user_sdma.c
+++ b/drivers/infiniband/hw/hfi1/user_sdma.c
@@ -1028,6 +1028,7 @@ static int set_txreq_header_ahg(struct user_sdma_request *req,
struct user_sdma_txreq *tx, u32 datalen)
{
u32 ahg[AHG_KDETH_ARRAY_SIZE];
+ int ret;
int idx = 0;
u8 omfactor; /* KDETH.OM */
struct hfi1_user_sdma_pkt_q *pq = req->pq;
@@ -1132,11 +1133,13 @@ static int set_txreq_header_ahg(struct user_sdma_request *req,
trace_hfi1_sdma_user_header_ahg(pq->dd, pq->ctxt, pq->subctxt,
req->info.comp_idx, req->sde->this_idx,
req->ahg_idx, ahg, idx, tidval);
- sdma_txinit_ahg(&tx->txreq,
- SDMA_TXREQ_F_USE_AHG,
- datalen, req->ahg_idx, idx,
- ahg, sizeof(req->hdr),
- user_sdma_txreq_cb);
+ ret = sdma_txinit_ahg(&tx->txreq,
+ SDMA_TXREQ_F_USE_AHG,
+ datalen, req->ahg_idx, idx,
+ ahg, sizeof(req->hdr),
+ user_sdma_txreq_cb);
+ if (ret)
+ return ret;
return idx;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0608/1376] RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[]
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (606 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0607/1376] RDMA/hfi1: Propagate sdma_txinit_ahg() errors Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0609/1376] RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters Greg Kroah-Hartman
` (390 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhu Yanjun, Ibrahim Hashimov,
Leon Romanovsky, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ibrahim Hashimov <security@auditcode.ai>
[ Upstream commit 126c757e4cd46f866ddc283143b58eb4d9bf52cd ]
For a user QP, qp->sq.queue is a ring the application writes directly,
so rxe_post_send() takes the is_user branch and only schedules send_task
without validating the WQE. rxe_requester() consumes it in place via
req_next_wqe() and calls copy_data(), which indexes
&wqe->dma.sge[cur_sge] with the attacker-controlled num_sge/cur_sge.
Only the kernel path bounds num_sge (validate_send_wr()); the user WQE
is never checked, so a local unprivileged user can post a WQE with an
out-of-range cur_sge or oversized num_sge and force an out-of-bounds
read of the per-WQE sge array in copy_data() (vmalloc OOB read, local
DoS).
Bound num_sge to qp->sq.max_sge in rxe_requester() before use, the way
get_srq_wqe() already guards SRQ entries, and bound cur_sge only when
the WQE carries payload (dma.resid): copy_data() returns early on a
zero-length copy before touching dma->sge[], so a zero-payload WQE --
the only kind a max_sge == 0 QP can post -- stays valid.
Reproduced under KASAN; the vmalloc-out-of-bounds in copy_data() is gone.
Fixes: 8700e3e7c485 ("Soft RoCE driver")
Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Signed-off-by: Ibrahim Hashimov <security@auditcode.ai>
Link: https://patch.msgid.link/20260712122149.78142-1-security@auditcode.ai
Assisted-by: AuditCode-AI:2026.07
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/sw/rxe/rxe_req.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
index d08ebb048cb0f..3a4fa0ca36a77 100644
--- a/drivers/infiniband/sw/rxe/rxe_req.c
+++ b/drivers/infiniband/sw/rxe/rxe_req.c
@@ -702,6 +702,21 @@ int rxe_requester(struct rxe_qp *qp)
if (unlikely(!wqe))
goto exit;
+ /*
+ * Don't trust user space data: a user QP's WQE comes from an mmap'd
+ * ring, so num_sge/cur_sge are attacker-controlled. Bound num_sge like
+ * get_srq_wqe(); bound cur_sge only when payload exists (dma.resid),
+ * since copy_data() skips dma->sge[] on a zero-length copy (all a
+ * max_sge == 0 QP can post).
+ */
+ if (unlikely(wqe->dma.num_sge > qp->sq.max_sge ||
+ (wqe->dma.resid &&
+ wqe->dma.cur_sge >= qp->sq.max_sge))) {
+ rxe_dbg_qp(qp, "invalid num_sge/cur_sge in send wqe\n");
+ wqe->status = IB_WC_LOC_QP_OP_ERR;
+ goto err;
+ }
+
if (rxe_wqe_is_fenced(qp, wqe)) {
qp->req.wait_fence = 1;
goto exit;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0609/1376] RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (607 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0608/1376] RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[] Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0610/1376] kcsan: avoid unintended access checking in NMIs Greg Kroah-Hartman
` (389 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, TanZheng, Leon Romanovsky,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: TanZheng <tanzheng@kylinos.cn>
[ Upstream commit b38f98e176050850f41bb6415f3a71400056623e ]
When srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect
descriptor, the unwind path destroys RDMA contexts but leaves stale
n_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later
sq_wr_avail accounting in srpt_queue_response() or srpt_write_pending()
can then subtract the wrong number of send queue credits.
Reset the counters and clear rw_ctxs after freeing the heap
allocation before returning an error.
Fixes: b99f8e4d7bcd ("IB/srpt: convert to the generic RDMA READ/WRITE API")
Signed-off-by: TanZheng <tanzheng@kylinos.cn>
Link: https://patch.msgid.link/20260715101550.45345-1-kensanya@163.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/ulp/srpt/ib_srpt.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
index 128e4e836470c..f3e35dfdb30b0 100644
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -959,6 +959,7 @@ static int srpt_alloc_rw_ctxs(struct srpt_send_ioctx *ioctx,
struct srpt_rdma_ch *ch = ioctx->ch;
struct scatterlist *prev = NULL;
unsigned prev_nents;
+ u8 n_rdma, n_rw_ctx;
int ret, i;
if (nbufs == 1) {
@@ -970,6 +971,9 @@ static int srpt_alloc_rw_ctxs(struct srpt_send_ioctx *ioctx,
return -ENOMEM;
}
+ n_rw_ctx = ioctx->n_rw_ctx;
+ n_rdma = ioctx->n_rdma;
+
for (i = ioctx->n_rw_ctx; i < nbufs; i++, db++) {
struct srpt_rw_ctx *ctx = &ioctx->rw_ctxs[i];
u64 remote_addr = be64_to_cpu(db->va);
@@ -1016,6 +1020,9 @@ static int srpt_alloc_rw_ctxs(struct srpt_send_ioctx *ioctx,
}
if (ioctx->rw_ctxs != &ioctx->s_rw_ctx)
kfree(ioctx->rw_ctxs);
+ ioctx->rw_ctxs = NULL;
+ ioctx->n_rw_ctx = n_rw_ctx;
+ ioctx->n_rdma = n_rdma;
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0610/1376] kcsan: avoid unintended access checking in NMIs
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (608 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0609/1376] RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0611/1376] arm64: dts: imx8-ss-audio: Fix LPCG clock indices for ASRC0 Greg Kroah-Hartman
` (388 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marco Elver, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Elver <elver@google.com>
[ Upstream commit a8488ecbd7ba44d65b912dfe88a73f438eba2447 ]
If a watcher deliberately disables interrupts (either by user choice, or
because we're dealing with a scoped reordered access) to avoid detecting
any data races in interrupts, NMIs are still able to fire.
When we set up a watchpoint on a scoped reordered access, we disabled
interrupts because the same CPU cannot observe reordering of its own
accesses. To ensure we observe no false positives from NMIs, disable
access checking for interrupt contexts as well.
Fixes: 69562e4983d9 ("kcsan: Add core support for a subset of weak memory modeling")
Signed-off-by: Marco Elver <elver@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/kcsan/core.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/kernel/kcsan/core.c b/kernel/kcsan/core.c
index 8a7baf4e332e3..2db82661cd60a 100644
--- a/kernel/kcsan/core.c
+++ b/kernel/kcsan/core.c
@@ -585,8 +585,14 @@ kcsan_setup_watchpoint(const volatile void *ptr, size_t size, int type, unsigned
* information is lost if dirtied by KCSAN.
*/
kcsan_save_irqtrace(current);
- if (!interrupt_watcher)
+ if (!interrupt_watcher) {
local_irq_save(irq_flags);
+ /*
+ * NMIs can still fire, disable checking for all interrupt
+ * contexts.
+ */
+ raw_cpu_ptr(&kcsan_cpu_ctx)->disable_count++;
+ }
watchpoint = insert_watchpoint((unsigned long)ptr, size, is_write);
if (watchpoint == NULL) {
@@ -699,8 +705,10 @@ kcsan_setup_watchpoint(const volatile void *ptr, size_t size, int type, unsigned
atomic_long_dec(&kcsan_counters[KCSAN_COUNTER_USED_WATCHPOINTS]);
out_unlock:
- if (!interrupt_watcher)
+ if (!interrupt_watcher) {
+ raw_cpu_ptr(&kcsan_cpu_ctx)->disable_count--;
local_irq_restore(irq_flags);
+ }
kcsan_restore_irqtrace(current);
ctx->disable_scoped--;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0611/1376] arm64: dts: imx8-ss-audio: Fix LPCG clock indices for ASRC0
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (609 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0610/1376] kcsan: avoid unintended access checking in NMIs Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0612/1376] selftests/bpf: Silence array bounds warning in global_map_resize Greg Kroah-Hartman
` (387 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Frank Li, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <Frank.Li@nxp.com>
[ Upstream commit 8563591f76ca02c1a6fd70ce986df1d0dde8d249 ]
The LPCG clock indices for ASRC0 and AUD_PLL_DIV0 are swapped. The ASRC0
LPCG provides only IMX_LPCG_CLK_4, so update the ASRC0 clock consumer to
use IMX_LPCG_CLK_4 instead of the non-existent IMX_LPCG_CLK_0.
Likewise, the AUD_PLL_DIV0 LPCG provides only IMX_LPCG_CLK_0, so update its
clock consumer to use IMX_LPCG_CLK_0 instead of the non-existent
IMX_LPCG_CLK_4.
Fixes: 5125617c7a4d3 ("arm64: dts: imx8qxp: add asrc[0,1], esai0, spdif0 and sai[4,5]")
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/freescale/imx8-ss-audio.dtsi | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/boot/dts/freescale/imx8-ss-audio.dtsi b/arch/arm64/boot/dts/freescale/imx8-ss-audio.dtsi
index ff5df0fed9e96..741a311614ddb 100644
--- a/arch/arm64/boot/dts/freescale/imx8-ss-audio.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8-ss-audio.dtsi
@@ -124,10 +124,10 @@ asrc0: asrc@59000000 {
compatible = "fsl,imx8qm-asrc";
reg = <0x59000000 0x10000>;
interrupts = <GIC_SPI 372 IRQ_TYPE_LEVEL_HIGH>;
- clocks = <&asrc0_lpcg IMX_LPCG_CLK_0>,
- <&asrc0_lpcg IMX_LPCG_CLK_0>,
- <&aud_pll_div0_lpcg IMX_LPCG_CLK_4>,
- <&aud_pll_div1_lpcg IMX_LPCG_CLK_4>,
+ clocks = <&asrc0_lpcg IMX_LPCG_CLK_4>,
+ <&asrc0_lpcg IMX_LPCG_CLK_4>,
+ <&aud_pll_div0_lpcg IMX_LPCG_CLK_0>,
+ <&aud_pll_div1_lpcg IMX_LPCG_CLK_0>,
<&acm IMX_ADMA_ACM_AUD_CLK0_SEL>,
<&acm IMX_ADMA_ACM_AUD_CLK1_SEL>,
<&clk_dummy>,
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0612/1376] selftests/bpf: Silence array bounds warning in global_map_resize
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (610 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0611/1376] arm64: dts: imx8-ss-audio: Fix LPCG clock indices for ASRC0 Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0613/1376] irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc() Greg Kroah-Hartman
` (386 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Viktor Malik,
Kumar Kartikeya Dwivedi, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viktor Malik <vmalik@redhat.com>
[ Upstream commit dcd164ec67f89e0db5ee025ee9e91280052eb737 ]
When compiling BPF selftests with -O2, GCC reports an array bounds
violation warning in global_map_resize test:
In function ‘global_map_resize_bss_subtest’,
inlined from ‘test_global_map_resize’ at /bpf-next/tools/testing/selftests/bpf/prog_tests/global_map_resize.c:228:3:
/bpf-next/tools/testing/selftests/bpf/prog_tests/global_map_resize.c:64:33: error: array subscript 1 is above array bounds of ‘int[1]’ [-Werror=array-bounds=]
64 | skel->bss->array[i] = 1;
| ~~~~~~~~~~~~~~~~^~~
In file included from /bpf-next/tools/testing/selftests/bpf/prog_tests/global_map_resize.c:6:
./test_global_map_resize.skel.h: In function ‘test_global_map_resize’:
./test_global_map_resize.skel.h:44:21: note: while referencing ‘array’
44 | int array[1];
| ^~~~~
This is a false positive because `array` (a BPF map) has been resized
from within the BPF program. GCC doesn't know that so let us silence the
warning by accessing the array via a plain pointer.
Fixes: 08b089567573 ("libbpf: Selftests for resizing datasec maps")
Signed-off-by: Viktor Malik <vmalik@redhat.com>
Link: https://lore.kernel.org/bpf/57765bc465a27923c3c093eba222cc24d08d8c40.1784112948.git.vmalik@redhat.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../testing/selftests/bpf/prog_tests/global_map_resize.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/bpf/prog_tests/global_map_resize.c b/tools/testing/selftests/bpf/prog_tests/global_map_resize.c
index 56b5baef35c8c..602ce30f1720c 100644
--- a/tools/testing/selftests/bpf/prog_tests/global_map_resize.c
+++ b/tools/testing/selftests/bpf/prog_tests/global_map_resize.c
@@ -23,6 +23,7 @@ static void global_map_resize_bss_subtest(void)
struct bpf_map *map;
const __u32 desired_sz = sizeof(skel->bss->sum) + sysconf(_SC_PAGE_SIZE) * 2;
size_t array_len, actual_sz, new_sz;
+ int *array;
skel = test_global_map_resize__open();
if (!ASSERT_OK_PTR(skel, "test_global_map_resize__open"))
@@ -58,10 +59,13 @@ static void global_map_resize_bss_subtest(void)
goto teardown;
/* fill the newly resized array with ones,
- * skipping the first element which was previously set
+ * skipping the first element which was previously set;
+ * access through a plain pointer to avoid -Warray-bounds
+ * since the array was resized beyond its declared length.
*/
+ array = skel->bss->array;
for (int i = 1; i < array_len; i++)
- skel->bss->array[i] = 1;
+ array[i] = 1;
/* set global const values before loading */
skel->rodata->pid = getpid();
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0613/1376] irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (611 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0612/1376] selftests/bpf: Silence array bounds warning in global_map_resize Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0614/1376] RDMA/nldev: validate dynamic counter attribute length Greg Kroah-Hartman
` (385 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kemeng Shi, Thomas Gleixner,
Marc Zyngier, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kemeng Shi <shikemeng@huaweicloud.com>
[ Upstream commit 325ff3e78c64cd619d52b99f7c8b09a3f31e1495 ]
When its_irq_gic_domain_alloc() fails, the following
its_vpe_irq_domain_free() fails to invoke its_vep_teardown() for the
corresponding interrupt, which leaks the resource.
Invoke its_vpe_teardown() in the error handling path to avoid the leak.
[ tglx: Massaged change log ]
Fixes: 7d75bbb4bc1ad ("irqchip/gic-v3-its: Add VPE irq domain allocation/teardown")
Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Acked-by: Marc Zyngier <maz@kernel.org>
Link: https://patch.msgid.link/20260721063241.52549-2-shikemeng@huaweicloud.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-gic-v3-its.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 7050bf88b87d3..b489594df3294 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -4503,6 +4503,13 @@ static int its_vpe_init(struct its_vpe *vpe)
static void its_vpe_teardown(struct its_vpe *vpe)
{
+ /*
+ * If vpt_page is NULL, then its_vpe_init() has failed, and
+ * there is nothing to do as no resource has been allocated.
+ */
+ if (vpe->vpt_page == NULL)
+ return;
+
its_vpe_db_proxy_unmap(vpe);
its_vpe_id_free(vpe->vpe_id);
its_free_pending_table(vpe->vpt_page);
@@ -4583,8 +4590,10 @@ static int its_vpe_irq_domain_alloc(struct irq_domain *domain, unsigned int virq
irqd_set_resend_when_in_progress(irq_get_irq_data(virq + i));
}
- if (err)
+ if (err) {
+ its_vpe_teardown(vm->vpes[i]);
its_vpe_irq_domain_free(domain, virq, i);
+ }
return err;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0614/1376] RDMA/nldev: validate dynamic counter attribute length
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (612 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0613/1376] irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc() Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0615/1376] ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer Greg Kroah-Hartman
` (384 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhu Yanjun, Pengpeng Hou,
Leon Romanovsky, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ Upstream commit 74f49255492a62658f36bf2578d7916f1c6ffad1 ]
RDMA_NLDEV_ATTR_STAT_HWCOUNTERS is a nested attribute whose children are
consumed directly with nla_get_u32(). The top-level policy validates only
the container, so it does not establish the fixed shape of each child.
Require every child payload to be exactly one u32 before reading it.
Fixes: 3c3c1f141639 ("RDMA/nldev: Allow optional-counter status configuration through RDMA netlink")
Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260720114918.70323-1-pengpeng@iscas.ac.cn
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/core/nldev.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c
index fef11a80647c4..aa24cc9f066e9 100644
--- a/drivers/infiniband/core/nldev.c
+++ b/drivers/infiniband/core/nldev.c
@@ -2093,6 +2093,11 @@ static int nldev_stat_set_counter_dynamic_doit(struct nlattr *tb[],
nla_for_each_nested(entry_attr, tb[RDMA_NLDEV_ATTR_STAT_HWCOUNTERS],
rem) {
+ if (nla_len(entry_attr) != sizeof(u32)) {
+ ret = -EINVAL;
+ goto out;
+ }
+
index = nla_get_u32(entry_attr);
if ((index >= stats->num_counters) ||
!(stats->descs[index].flags & IB_STAT_FLAG_OPTIONAL)) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0615/1376] ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (613 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0614/1376] RDMA/nldev: validate dynamic counter attribute length Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0616/1376] ACPI: processor: validate MADT IOAPIC entry bounds Greg Kroah-Hartman
` (383 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhu Ling, Rafael J. Wysocki,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhu Ling <zhuling2709@phytium.com.cn>
[ Upstream commit e71bdbce27dcaa7f467a3a198cbe723924f05569 ]
EC event delivery uses either a GPE or, on ACPI reduced hardware
platforms, a GpioInt resource. The GPE path does not have a provider
lookup that can defer, but acpi_dev_gpio_irq_get() can return
-EPROBE_DEFER for the GpioInt path.
ec_install_handlers() currently installs the EC address space handler and
executes _REG before looking up the GPIO IRQ. If the GPIO lookup then
defers, acpi_ec_setup() tears the handlers down again. Removing the EC
address space handler causes ACPICA to execute _REG for disconnect, so
firmware may observe an EC OpRegion connected -> disconnected transition
during one failed probe attempt.
This is observable when the namespace EC reuses a boot EC that has already
installed the EC address space handler. A deferred namespace EC probe can
disconnect the already usable boot EC OpRegion until a later reprobe
connects it again. AML that gates EC field accesses on _REG state can
then return fallback values to other drivers during that window.
Prepare the GPIOInt IRQ before publishing EC OpRegion availability to AML.
This leaves the GPE path unchanged, keeps non-deferred GPIO lookup errors
non-fatal as before, and still lets the existing acpi_ec_setup() error
path clean up real handler installation failures.
Fixes: f6484cadbcaf ("ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()")
Signed-off-by: Zhu Ling <zhuling2709@phytium.com.cn>
[ rjw: Added an empty code line after a conditional ]
Link: https://patch.msgid.link/20260715012556.12043-1-zhuling2709@phytium.com.cn
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/ec.c | 40 ++++++++++++++++++++++++++--------------
1 file changed, 26 insertions(+), 14 deletions(-)
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index 10bd2942c4beb..2e65d254f296b 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -1510,6 +1510,24 @@ static bool install_gpio_irq_event_handler(struct acpi_ec *ec)
IRQF_SHARED | IRQF_ONESHOT, "ACPI EC", ec) >= 0;
}
+static int ec_prepare_gpio_irq(struct acpi_ec *ec, struct acpi_device *device)
+{
+ int irq;
+
+ if (!device || ec->gpe >= 0 || ec->irq >= 0)
+ return 0;
+
+ /* ACPI reduced hardware platforms use a GpioInt from _CRS. */
+ irq = acpi_dev_gpio_irq_get(device, 0);
+ if (irq == -EPROBE_DEFER)
+ return irq;
+
+ if (irq >= 0)
+ ec->irq = irq;
+
+ return 0;
+}
+
/**
* ec_install_handlers - Install service callbacks and register query methods.
* @ec: Target EC.
@@ -1524,7 +1542,6 @@ static bool install_gpio_irq_event_handler(struct acpi_ec *ec)
* Return:
* -ENODEV if the address space handler cannot be installed, which means
* "unable to handle transactions",
- * -EPROBE_DEFER if GPIO IRQ acquisition needs to be deferred,
* or 0 (success) otherwise.
*/
static int ec_install_handlers(struct acpi_ec *ec, struct acpi_device *device,
@@ -1557,19 +1574,6 @@ static int ec_install_handlers(struct acpi_ec *ec, struct acpi_device *device,
if (!device)
return 0;
- if (ec->gpe < 0) {
- /* ACPI reduced hardware platforms use a GpioInt from _CRS. */
- int irq = acpi_dev_gpio_irq_get(device, 0);
- /*
- * Bail out right away for deferred probing or complete the
- * initialization regardless of any other errors.
- */
- if (irq == -EPROBE_DEFER)
- return -EPROBE_DEFER;
- else if (irq >= 0)
- ec->irq = irq;
- }
-
if (!test_bit(EC_FLAGS_QUERY_METHODS_INSTALLED, &ec->flags)) {
/* Find and register all query methods */
acpi_walk_namespace(ACPI_TYPE_METHOD, ec->handle, 1,
@@ -1647,6 +1651,14 @@ static int acpi_ec_setup(struct acpi_ec *ec, struct acpi_device *device, bool ca
{
int ret;
+ /*
+ * GPIO IRQ lookup can defer. Do it before publishing the EC
+ * OpRegion to AML to avoid a spurious _REG(disconnect).
+ */
+ ret = ec_prepare_gpio_irq(ec, device);
+ if (ret)
+ return ret;
+
/* First EC capable of handling transactions */
if (!first_ec)
first_ec = ec;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0616/1376] ACPI: processor: validate MADT IOAPIC entry bounds
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (614 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0615/1376] ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0617/1376] ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root Greg Kroah-Hartman
` (382 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Rafael J. Wysocki,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ Upstream commit 2c50ffdc73f3a70d745d249f509fc290754121e6 ]
The IOAPIC hotplug lookup parses both MADT and _MAT records directly.
The MADT walk previously used a subtable's declared length to advance
the cursor after only locating a generic header. The _MAT path likewise
passed a generic header to the IOAPIC helper.
Validate that a current record has a complete generic header, that its
declared length is contained in the available record range, and that a
typed IOAPIC record contains the full fixed IOAPIC body before reading
its fields. Use the same relation for both MADT and _MAT provider
paths.
Fixes: ecf5636dcd59 ("ACPI: Add interfaces to parse IOAPIC ID for IOAPIC hotplug")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260715083253.22831-1-pengpeng@iscas.ac.cn
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/processor_core.c | 31 +++++++++++++++++++++++++------
1 file changed, 25 insertions(+), 6 deletions(-)
diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
index a4498357bd165..3bf076c150fa1 100644
--- a/drivers/acpi/processor_core.c
+++ b/drivers/acpi/processor_core.c
@@ -336,11 +336,26 @@ int acpi_get_cpuid(acpi_handle handle, int type, u32 acpi_id)
EXPORT_SYMBOL_GPL(acpi_get_cpuid);
#ifdef CONFIG_ACPI_HOTPLUG_IOAPIC
-static int get_ioapic_id(struct acpi_subtable_header *entry, u32 gsi_base,
+static bool madt_entry_is_valid(struct acpi_subtable_header *entry,
+ unsigned long end)
+{
+ unsigned long start = (unsigned long)entry;
+
+ if (start >= end || end - start < sizeof(*entry))
+ return false;
+
+ return entry->length >= sizeof(*entry) && entry->length <= end - start;
+}
+
+static int get_ioapic_id(struct acpi_subtable_header *entry,
+ const unsigned long end, u32 gsi_base,
u64 *phys_addr, int *ioapic_id)
{
struct acpi_madt_io_apic *ioapic = (struct acpi_madt_io_apic *)entry;
+ if (!madt_entry_is_valid(entry, end) || BAD_MADT_ENTRY(ioapic, end))
+ return 0;
+
if (ioapic->global_irq_base != gsi_base)
return 0;
@@ -361,17 +376,19 @@ static int parse_madt_ioapic_entry(u32 gsi_base, u64 *phys_addr)
return apic_id;
entry = (unsigned long)madt;
+ if (madt->header.length < sizeof(*madt))
+ return apic_id;
madt_end = entry + madt->header.length;
/* Parse all entries looking for a match. */
entry += sizeof(struct acpi_table_madt);
- while (entry + sizeof(struct acpi_subtable_header) < madt_end) {
+ while (madt_entry_is_valid((struct acpi_subtable_header *)entry,
+ madt_end)) {
hdr = (struct acpi_subtable_header *)entry;
if (hdr->type == ACPI_MADT_TYPE_IO_APIC &&
- get_ioapic_id(hdr, gsi_base, phys_addr, &apic_id))
+ get_ioapic_id(hdr, madt_end, gsi_base, phys_addr, &apic_id))
break;
- else
- entry += hdr->length;
+ entry += hdr->length;
}
return apic_id;
@@ -398,7 +415,9 @@ static int parse_mat_ioapic_entry(acpi_handle handle, u32 gsi_base,
header = (struct acpi_subtable_header *)obj->buffer.pointer;
if (header->type == ACPI_MADT_TYPE_IO_APIC)
- get_ioapic_id(header, gsi_base, phys_addr, &apic_id);
+ get_ioapic_id(header,
+ (unsigned long)header + obj->buffer.length,
+ gsi_base, phys_addr, &apic_id);
exit:
kfree(buffer.pointer);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0617/1376] ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (615 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0616/1376] ACPI: processor: validate MADT IOAPIC entry bounds Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0618/1376] ext4: fix circular lock dependency in ext4_ext_migrate Greg Kroah-Hartman
` (381 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko AI review, Chen Pei,
Rafael J. Wysocki, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Pei <cp0613@linux.alibaba.com>
[ Upstream commit 8a742141f7ab84975aa758b775567ef4740ef0cf ]
acpi_pci_root_add() assigns the freshly allocated root to
device->driver_data before dmar_device_add() and pci_acpi_scan_root().
Both failure paths reach the end: label where root is kfree()'d, but
only the pci_acpi_scan_root() path clears driver_data first.
When dmar_device_add() fails during a hot-add, root is freed while
device->driver_data still points at it. The ACPI core does not clear
driver_data on attach failure, so a later acpi_pci_find_root() call may
dereference this dangling pointer.
acpi_pci_root_remove() has the same problem: it frees root without
clearing device->driver_data, leaving a dangling pointer behind after
the root bridge is removed.
Move the NULL assignment to the shared end: label so every error path in
acpi_pci_root_add() clears driver_data before freeing root, and clear it
in acpi_pci_root_remove() as well, so the object is never left reachable
through driver_data after being freed.
Fixes: db89b4f0dbab ("ACPI: catch calls of acpi_driver_data on pointer of wrong type")
Reported-by: Sashiko AI review <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/patchset/20260526025118.38935-1-cp0613@linux.alibaba.com
Link: https://sashiko.dev/#/patchset/20260707121258.11640-1-cp0613@linux.alibaba.com
Signed-off-by: Chen Pei <cp0613@linux.alibaba.com>
Link: https://patch.msgid.link/20260715135048.3278-1-cp0613@linux.alibaba.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/pci_root.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
index d0bfb37068019..eb36cb77dfa48 100644
--- a/drivers/acpi/pci_root.c
+++ b/drivers/acpi/pci_root.c
@@ -730,7 +730,6 @@ static int acpi_pci_root_add(struct acpi_device *device,
dev_err(&device->dev,
"Bus %04x:%02x not present in PCI namespace\n",
root->segment, (unsigned int)root->secondary.start);
- device->driver_data = NULL;
result = -ENODEV;
goto remove_dmar;
}
@@ -766,6 +765,7 @@ static int acpi_pci_root_add(struct acpi_device *device,
if (hotadd)
dmar_device_remove(handle);
end:
+ device->driver_data = NULL;
kfree(root);
return result;
}
@@ -789,6 +789,7 @@ static void acpi_pci_root_remove(struct acpi_device *device)
pci_unlock_rescan_remove();
+ device->driver_data = NULL;
kfree(root);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0618/1376] ext4: fix circular lock dependency in ext4_ext_migrate
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (616 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0617/1376] ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0619/1376] ext4: fix out-of-bounds read in ext4_read_inline_dir() Greg Kroah-Hartman
` (380 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+212e8f62790f8e0bc63b,
Yun Zhou, Jan Kara, Theodore Tso, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yun Zhou <yun.zhou@windriver.com>
[ Upstream commit a897682793eba5de51ee6f3152760374afa629cf ]
Move iput(tmp_inode) after ext4_writepages_up_write() to avoid a
circular lock dependency between s_writepages_rwsem and sb_internal
(freeze protection).
The deadlock scenario:
CPU0 (EXT4_IOC_MIGRATE) CPU1 (orphan cleanup during mount)
---- ----
ext4_ext_migrate()
ext4_writepages_down_write()
s_writepages_rwsem (write)
ext4_evict_inode()
sb_start_intwrite() [sb_internal]
...
ext4_writepages()
s_writepages_rwsem (read) [BLOCKED]
iput(tmp_inode)
ext4_evict_inode()
sb_start_intwrite() [BLOCKED]
The tmp_inode is a temporary inode with nlink=0 created solely for
building the extent tree. Its eviction does not require
s_writepages_rwsem protection, so deferring iput() until after
releasing the rwsem is safe.
Reported-by: syzbot+212e8f62790f8e0bc63b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=212e8f62790f8e0bc63b
Fixes: cb85f4d23f79 ("ext4: fix race between writepages and enabling EXT4_EXTENTS_FL")
Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20260612005330.1930804-1-yun.zhou@windriver.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/migrate.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c
index 1b0dfd963d3f0..84e3b703ab463 100644
--- a/fs/ext4/migrate.c
+++ b/fs/ext4/migrate.c
@@ -458,6 +458,7 @@ int ext4_ext_migrate(struct inode *inode)
if (IS_ERR(tmp_inode)) {
retval = PTR_ERR(tmp_inode);
ext4_journal_stop(handle);
+ tmp_inode = NULL;
goto out_unlock;
}
/*
@@ -585,9 +586,9 @@ int ext4_ext_migrate(struct inode *inode)
ext4_journal_stop(handle);
out_tmp_inode:
unlock_new_inode(tmp_inode);
- iput(tmp_inode);
out_unlock:
ext4_writepages_up_write(inode->i_sb, alloc_ctx);
+ iput(tmp_inode);
return retval;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0619/1376] ext4: fix out-of-bounds read in ext4_read_inline_dir()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (617 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0618/1376] ext4: fix circular lock dependency in ext4_ext_migrate Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0620/1376] ext4: skip extra isize expansion during mount to prevent deadlock Greg Kroah-Hartman
` (379 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei, Jan Kara,
Theodore Tso, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
[ Upstream commit 9333cc809f0a89e001b814155a6cb8903a6274df ]
ext4_read_inline_dir() can read a dirent header past the end of its inline
buffer, triggering a slab-out-of-bounds read during getdents64():
BUG: KASAN: slab-out-of-bounds in __ext4_check_dir_entry
Read of size 2 at addr ffff88800f3dd23c by task exploit/148
...
__ext4_check_dir_entry
ext4_read_inline_dir
iterate_dir
The dirent payload lives in a buffer of exactly inline_size bytes:
dir_buf = kmalloc(inline_size, GFP_NOFS);
but iteration runs in a position space extra_offset bytes larger
(extra_size = extra_offset + inline_size) so the synthetic "." and ".."
land at their block-dir offsets. A dirent is formed at "dir_buf + pos -
extra_offset", yet the ext4_check_dir_entry() length argument uses the
larger extra_size. A position whose dirent header would extend past
extra_size is therefore accepted, and the rescan loop's rec_len probe and
ext4_check_dir_entry() dereference de->rec_len before the entry is rejected.
Reject a position whose minimum-size dirent header would not fit within
extra_size before forming de, in both the rescan and main loops, and pass
inline_size rather than extra_size to ext4_check_dir_entry() so the length
check matches the physical buffer.
Fixes: c4d8b0235aa9 ("ext4: fix readdir error in case inline_data+^dir_index.")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20260615190519.946736-1-xmei5@asu.edu
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/inline.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index b55bf19c82f26..54eb10c376379 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -1554,6 +1554,8 @@ int ext4_read_inline_dir(struct file *file,
/* for other entry, the real offset in
* the buf has to be tuned accordingly.
*/
+ if (i + ext4_dir_rec_len(1, NULL) > extra_size)
+ break;
de = (struct ext4_dir_entry_2 *)
(dir_buf + i - extra_offset);
/* It's too expensive to do a full
@@ -1588,10 +1590,17 @@ int ext4_read_inline_dir(struct file *file,
continue;
}
+ /*
+ * de lives at dir_buf + ctx->pos - extra_offset, within the
+ * kmalloc(inline_size) buffer. Make sure its header fits before
+ * ext4_check_dir_entry() dereferences de->rec_len.
+ */
+ if (ctx->pos + ext4_dir_rec_len(1, NULL) > extra_size)
+ goto out;
de = (struct ext4_dir_entry_2 *)
(dir_buf + ctx->pos - extra_offset);
if (ext4_check_dir_entry(inode, file, de, iloc.bh, dir_buf,
- extra_size, ctx->pos))
+ inline_size, ctx->pos))
goto out;
if (le32_to_cpu(de->inode)) {
if (!dir_emit(ctx, de->name, de->name_len,
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0620/1376] ext4: skip extra isize expansion during mount to prevent deadlock
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (618 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0619/1376] ext4: fix out-of-bounds read in ext4_read_inline_dir() Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0621/1376] libbpf: Search /lib64 and /lib in resolve_full_path() Greg Kroah-Hartman
` (378 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+5d19358d7eb30ffb0cc5,
Yun Zhou, Jan Kara, Theodore Tso, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yun Zhou <yun.zhou@windriver.com>
[ Upstream commit 7461c60b9c6a839b13ad4c3490681a0cf5aa0637 ]
ext4_try_to_expand_extra_isize() is called from __ext4_mark_inode_dirty()
while holding an active jbd2 handle. During mount (!SB_ACTIVE), the
expand path may move xattrs to external blocks and release ea_inodes via
iput(). When !SB_ACTIVE, iput() calls write_inode_now() which acquires
s_writepages_rwsem, creating a circular lock dependency:
s_writepages_rwsem --> jbd2_handle --> xattr_sem --> s_writepages_rwsem
This can be triggered via:
ext4_process_orphan() -> ext4_truncate() -> ext4_mark_inode_dirty()
-> ext4_try_to_expand_extra_isize()
or:
ext4_evict_inode() -> ext4_mark_inode_dirty()
-> ext4_try_to_expand_extra_isize()
Skip expansion when !SB_ACTIVE. This is a minor loss of functionality
(extra isize won't grow for these inodes during mount), which e2fsck
can resolve later if needed.
Reported-by: syzbot+5d19358d7eb30ffb0cc5@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=5d19358d7eb30ffb0cc5
Fixes: c8585c6fcaf2 ("ext4: fix races between changing inode journal mode and ext4_writepages")
Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20260623061903.2148767-1-yun.zhou@windriver.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/inode.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index de8ad1f90af13..b299c0a5f2ec2 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5975,6 +5975,16 @@ static int ext4_try_to_expand_extra_isize(struct inode *inode,
if (ext4_test_inode_state(inode, EXT4_STATE_NO_EXPAND))
return -EOVERFLOW;
+ /*
+ * Skip expansion during mount (!SB_ACTIVE). Expanding extra isize
+ * may move xattrs to external blocks and release ea_inodes via iput.
+ * When !SB_ACTIVE, iput triggers write_inode_now() which acquires
+ * s_writepages_rwsem, causing a deadlock with the caller's active
+ * jbd2 handle (lock order: s_writepages_rwsem -> jbd2_handle).
+ */
+ if (unlikely(!(inode->i_sb->s_flags & SB_ACTIVE)))
+ return -EBUSY;
+
/*
* In nojournal mode, we can immediately attempt to expand
* the inode. When journaled, we first need to obtain extra
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0621/1376] libbpf: Search /lib64 and /lib in resolve_full_path()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (619 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0620/1376] ext4: skip extra isize expansion during mount to prevent deadlock Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0622/1376] riscv, bpf: Fix memory leak in bpf_jit_free Greg Kroah-Hartman
` (377 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ricardo B . Marlière,
Ihor Solodrai, Kumar Kartikeya Dwivedi, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo B. Marlière <rbm@suse.com>
[ Upstream commit 7b5ae0481efdac040cea72b4fabd1398109f975b ]
attach_probe/uprobe-lib and uprobe_autoattach selftests fail with "failed
to resolve full path for libc.so.6" on older non-usrmerged distros, where
libc.so.6 lives under a top-level /lib64 or /lib rather than /usr/lib64 or
/usr/lib. Add /lib64:/lib to the search paths, alongside the existing
/usr/lib64:/usr/lib and Debian multiarch entries.
Fixes: 1ce3a60e3c28 ("libbpf: auto-resolve programs/libraries when necessary for uprobes")
Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
Acked-by: Ihor Solodrai <ihor.solodrai@linux.dev>
Link: https://lore.kernel.org/bpf/20260720-selftests-bpf_fixes-v2-3-b450eda93dfe@suse.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/bpf/libbpf.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 9bbf7a3b87de7..ffb0d1f7e9a08 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -11946,13 +11946,14 @@ static const char *arch_specific_lib_paths(void)
/* Get full path to program/shared library. */
static int resolve_full_path(const char *file, char *result, size_t result_sz)
{
- const char *search_paths[3] = {};
+ const char *search_paths[4] = {};
int i, perm;
if (str_has_sfx(file, ".so") || strstr(file, ".so.")) {
search_paths[0] = getenv("LD_LIBRARY_PATH");
search_paths[1] = "/usr/lib64:/usr/lib";
search_paths[2] = arch_specific_lib_paths();
+ search_paths[3] = "/lib64:/lib";
perm = R_OK;
} else {
search_paths[0] = getenv("PATH");
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0622/1376] riscv, bpf: Fix memory leak in bpf_jit_free
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (620 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0621/1376] libbpf: Search /lib64 and /lib in resolve_full_path() Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0623/1376] ACPI: battery: Adjust charging status validation check Greg Kroah-Hartman
` (376 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Pu Lehui,
Björn Töpel, Kumar Kartikeya Dwivedi, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pu Lehui <pulehui@huawei.com>
[ Upstream commit 369e4635d04801f394d5bd42556f21029e95ff93 ]
When bpf_int_jit_compile() is called for subprograms, it returns early
during the first pass (!prog->is_func || extra_pass is false), keeping
ctx->offset alive for the subsequent extra pass.
If JIT compilation fails for a later subprogram, the BPF core aborts
and calls bpf_jit_free() to clean up the first subprogram. However,
bpf_jit_free() fails to free jit_data->ctx.offset, which causes a
memory leak of the JIT context offsets array.
Fix this by adding the missing kfree(jit_data->ctx.offset) in
bpf_jit_free().
Fixes: 48a8f78c50bd ("bpf, riscv: use prog pack allocator in the BPF JIT")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Pu Lehui <pulehui@huawei.com>
Reviewed-by: Björn Töpel <bjorn@kernel.org>
Acked-by: Björn Töpel <bjorn@kernel.org>
Link: https://lore.kernel.org/bpf/20260708064436.2971933-3-pulehui@huaweicloud.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/riscv/net/bpf_jit_core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c
index 2f2af89ab4dfe..43cba6b657b72 100644
--- a/arch/riscv/net/bpf_jit_core.c
+++ b/arch/riscv/net/bpf_jit_core.c
@@ -259,6 +259,7 @@ void bpf_jit_free(struct bpf_prog *prog)
*/
if (jit_data) {
bpf_jit_binary_pack_finalize(jit_data->ro_header, jit_data->header);
+ kfree(jit_data->ctx.offset);
kfree(jit_data);
}
hdr = bpf_jit_binary_pack_hdr(prog);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0623/1376] ACPI: battery: Adjust charging status validation check
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (621 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0622/1376] riscv, bpf: Fix memory leak in bpf_jit_free Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0624/1376] bpf: Preserve unique-field state across nested structs Greg Kroah-Hartman
` (375 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, golne tree, Rafael J. Wysocki,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
[ Upstream commit 77ce4be0d8d53c528d1663ab62a14d93d5853f11 ]
Commit bb1256e0ddc7 ("ACPI: battery: fix incorrect charging status when
current is zero") added a charge rate check to validate the "charging"
status of the battery, but that check is reported to cause some systems
to misbehave [1]. Namely, it causes the "not charging" status to be
reported on them while the battery is in fact charging (and they were
correctly reporting the "charging" status in that case previously).
To address that, check if the battery is full in addition to checking
the charge rate when the "charging" status is reported by the platform
firmware and only change it to "not charging" if the battery is full and
its charge rate is zero or it is unknown.
Fixes: bb1256e0ddc7 ("ACPI: battery: fix incorrect charging status when current is zero")
Reported-by: golne tree <lrepper@outlook.de>
Tested-by: golne tree <lrepper@outlook.de>
Closes: https://lore.kernel.org/linux-acpi/AM9P193MB158895CFE0DDFA62FCD1DA5ED0F22@AM9P193MB1588.EURP193.PROD.OUTLOOK.COM/ [1]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/6286911.lOV4Wx5bFT@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/battery.c | 36 +++++++++++++++++++-----------------
1 file changed, 19 insertions(+), 17 deletions(-)
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index a33d60e625f81..c69970ba1843f 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -151,27 +151,28 @@ static int acpi_battery_technology(struct acpi_battery *battery)
static int acpi_battery_get_state(struct acpi_battery *battery);
-static int acpi_battery_is_charged(struct acpi_battery *battery)
+static bool acpi_battery_is_full(struct acpi_battery *battery)
{
- /* charging, discharging, critical low or charge limited */
- if (battery->state != 0)
- return 0;
-
/* battery not reporting charge */
if (battery->capacity_now == ACPI_BATTERY_VALUE_UNKNOWN ||
battery->capacity_now == 0)
- return 0;
+ return false;
/* good batteries update full_charge as the batteries degrade */
if (battery->full_charge_capacity == battery->capacity_now)
- return 1;
+ return true;
/* fallback to using design values for broken batteries */
- if (battery->design_capacity <= battery->capacity_now)
- return 1;
+ return battery->design_capacity <= battery->capacity_now;
+}
- /* we don't do any sort of metric based on percentages */
- return 0;
+static int acpi_battery_is_charged(struct acpi_battery *battery)
+{
+ /* charging, discharging, critical low or charge limited */
+ if (battery->state != 0)
+ return 0;
+
+ return acpi_battery_is_full(battery);
}
static bool acpi_battery_is_degraded(struct acpi_battery *battery)
@@ -212,13 +213,14 @@ static int acpi_battery_get_property(struct power_supply *psy,
if (battery->state & ACPI_BATTERY_STATE_DISCHARGING)
val->intval = acpi_battery_handle_discharging(battery);
else if (battery->state & ACPI_BATTERY_STATE_CHARGING)
- /* Validate the status by checking the current. */
- if (battery->rate_now != ACPI_BATTERY_VALUE_UNKNOWN &&
- battery->rate_now == 0) {
- /* On charge but no current (0W/0mA). */
- val->intval = POWER_SUPPLY_STATUS_NOT_CHARGING;
- } else {
+ /* Check the rate and capacity to validate the status. */
+ if (!acpi_battery_is_full(battery) ||
+ (battery->rate_now != ACPI_BATTERY_VALUE_UNKNOWN &&
+ battery->rate_now > 0)) {
val->intval = POWER_SUPPLY_STATUS_CHARGING;
+ } else {
+ /* Full and zero rate. */
+ val->intval = POWER_SUPPLY_STATUS_NOT_CHARGING;
}
else if (battery->state & ACPI_BATTERY_STATE_CHARGE_LIMITING)
val->intval = POWER_SUPPLY_STATUS_NOT_CHARGING;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0624/1376] bpf: Preserve unique-field state across nested structs
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (622 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0623/1376] ACPI: battery: Adjust charging status validation check Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0625/1376] RDMA/srpt: Pass the mapped task attribute to target_init_cmd() Greg Kroah-Hartman
` (374 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kumar Kartikeya Dwivedi,
Eduard Zingerman, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
[ Upstream commit f08619f060468076e4acbdc10e0713af20d60e65 ]
btf_find_struct_field() initializes a fresh seen mask for every recursive
descent. Unique special fields in different levels of the same aggregate
therefore do not see one another. The duplicate fields can reach
btf_parse_fields(), where they trigger an invariant WARN_ON_ONCE(). A
crafted user BTF can consequently trigger the warning before map creation
checks capabilities.
Initialize the seen mask once in btf_find_field() and pass the same pointer
through struct, datasec, and nested-struct walks. This gives the entire field
traversal one shared uniqueness state.
Fixes: 64e8ee814819 ("bpf: look into the types of the fields of a struct type recursively.")
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://patch.msgid.link/20260719153634.2908692-3-memxor@gmail.com
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/btf.c | 26 ++++++++++++++------------
1 file changed, 14 insertions(+), 12 deletions(-)
diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 65006b4b84ca4..fbf3e1718bfc8 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -3565,7 +3565,7 @@ static int btf_repeat_fields(struct btf_field_info *info, int info_cnt,
static int btf_find_struct_field(const struct btf *btf,
const struct btf_type *t, u32 field_mask,
struct btf_field_info *info, int info_cnt,
- u32 level);
+ u32 level, u32 *seen_mask);
/* Find special fields in the struct type of a field.
*
@@ -3576,7 +3576,7 @@ static int btf_find_struct_field(const struct btf *btf,
static int btf_find_nested_struct(const struct btf *btf, const struct btf_type *t,
u32 off, u32 nelems,
u32 field_mask, struct btf_field_info *info,
- int info_cnt, u32 level)
+ int info_cnt, u32 level, u32 *seen_mask)
{
int ret, err, i;
@@ -3584,7 +3584,7 @@ static int btf_find_nested_struct(const struct btf *btf, const struct btf_type *
if (level >= MAX_RESOLVE_DEPTH)
return -E2BIG;
- ret = btf_find_struct_field(btf, t, field_mask, info, info_cnt, level);
+ ret = btf_find_struct_field(btf, t, field_mask, info, info_cnt, level, seen_mask);
if (ret <= 0)
return ret;
@@ -3641,7 +3641,7 @@ static int btf_find_field_one(const struct btf *btf,
if (expected_size && expected_size != sz * nelems)
return 0;
ret = btf_find_nested_struct(btf, var_type, off, nelems, field_mask,
- &info[0], info_cnt, level);
+ &info[0], info_cnt, level, seen_mask);
return ret;
}
@@ -3703,11 +3703,11 @@ static int btf_find_field_one(const struct btf *btf,
static int btf_find_struct_field(const struct btf *btf,
const struct btf_type *t, u32 field_mask,
struct btf_field_info *info, int info_cnt,
- u32 level)
+ u32 level, u32 *seen_mask)
{
int ret, idx = 0;
const struct btf_member *member;
- u32 i, off, seen_mask = 0;
+ u32 i, off;
for_each_member(i, t, member) {
const struct btf_type *member_type = btf_type_by_id(btf,
@@ -3721,7 +3721,7 @@ static int btf_find_struct_field(const struct btf *btf,
ret = btf_find_field_one(btf, t, member_type, i,
off, 0,
- field_mask, &seen_mask,
+ field_mask, seen_mask,
&info[idx], info_cnt - idx, level);
if (ret < 0)
return ret;
@@ -3732,11 +3732,11 @@ static int btf_find_struct_field(const struct btf *btf,
static int btf_find_datasec_var(const struct btf *btf, const struct btf_type *t,
u32 field_mask, struct btf_field_info *info,
- int info_cnt, u32 level)
+ int info_cnt, u32 level, u32 *seen_mask)
{
int ret, idx = 0;
const struct btf_var_secinfo *vsi;
- u32 i, off, seen_mask = 0;
+ u32 i, off;
for_each_vsi(i, t, vsi) {
const struct btf_type *var = btf_type_by_id(btf, vsi->type);
@@ -3744,7 +3744,7 @@ static int btf_find_datasec_var(const struct btf *btf, const struct btf_type *t,
off = vsi->offset;
ret = btf_find_field_one(btf, var, var_type, -1, off, vsi->size,
- field_mask, &seen_mask,
+ field_mask, seen_mask,
&info[idx], info_cnt - idx,
level);
if (ret < 0)
@@ -3758,10 +3758,12 @@ static int btf_find_field(const struct btf *btf, const struct btf_type *t,
u32 field_mask, struct btf_field_info *info,
int info_cnt)
{
+ u32 seen_mask = 0;
+
if (__btf_type_is_struct(t))
- return btf_find_struct_field(btf, t, field_mask, info, info_cnt, 0);
+ return btf_find_struct_field(btf, t, field_mask, info, info_cnt, 0, &seen_mask);
else if (btf_type_is_datasec(t))
- return btf_find_datasec_var(btf, t, field_mask, info, info_cnt, 0);
+ return btf_find_datasec_var(btf, t, field_mask, info, info_cnt, 0, &seen_mask);
return -EINVAL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0625/1376] RDMA/srpt: Pass the mapped task attribute to target_init_cmd()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (623 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0624/1376] bpf: Preserve unique-field state across nested structs Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0626/1376] PCI: j721e: Fix incorrect max_lanes for J7200 Greg Kroah-Hartman
` (373 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bart Van Assche, Leon Romanovsky,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <leonro@nvidia.com>
[ Upstream commit ef63cc441703412628a517dda354f3e51fe2dc92 ]
srpt_handle_cmd() maps the initiator-supplied srp_cmd->task_attr into
cmd->sam_task_attr, but then hands a hardcoded TCM_SIMPLE_TAG to
target_init_cmd().
Pass the already mapped cmd->sam_task_attr instead, so target core sees the
attribute the initiator requested.
Fixes: 9474b043132f ("ib_srpt: Convert I/O path to target_submit_cmd + drop legacy ioctx->kref")
Link: https://patch.msgid.link/20260721-b4-scsi-ordering-violation-due-to-hardc-v1-1-07205aab71bb@nvidia.com
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/ulp/srpt/ib_srpt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
index f3e35dfdb30b0..a289512560c5f 100644
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -1603,7 +1603,7 @@ static void srpt_handle_cmd(struct srpt_rdma_ch *ch,
rc = target_init_cmd(cmd, ch->sess, &send_ioctx->sense_data[0],
scsilun_to_int(&srp_cmd->lun), data_len,
- TCM_SIMPLE_TAG, dir, TARGET_SCF_ACK_KREF);
+ cmd->sam_task_attr, dir, TARGET_SCF_ACK_KREF);
if (rc != 0) {
pr_debug("target_submit_cmd() returned %d for tag %#llx\n", rc,
srp_cmd->tag);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0626/1376] PCI: j721e: Fix incorrect max_lanes for J7200
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (624 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0625/1376] RDMA/srpt: Pass the mapped task attribute to target_init_cmd() Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0627/1376] RDMA/erdma: Fix CEQ tasklet use-after-free on removal Greg Kroah-Hartman
` (372 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Takuma Fujiwara,
Manivannan Sadhasivam, Siddharth Vadapalli, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takuma Fujiwara <t-fujiwara1@ti.com>
[ Upstream commit 7147a7bfce47acd48c3738130bf0bd692bfd80de ]
The PCIe Controller in the J7200 SoC supports a 4-lane configuration.
However, j7200_pcie_rc_data and j7200_pcie_ep_data incorrectly set
.max_lanes = 2, limiting operation to fewer lanes than the hardware
supports.
Set .max_lanes = 4 for both j7200_pcie_rc_data and j7200_pcie_ep_data to
match the hardware capability.
See J7200 Technical Reference Manual (SPRUIU1D), section 12.2.3.1.1
for further details: https://www.ti.com/lit/pdf/spruiu1d
Fixes: 3ac7f14084f5 ("PCI: j721e: Add per platform maximum lane settings")
Signed-off-by: Takuma Fujiwara <t-fujiwara1@ti.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Reviewed-by: Siddharth Vadapalli <s-vadapalli@ti.com>
Link: https://patch.msgid.link/20260721155743.3347659-1-t-fujiwara1@ti.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/cadence/pci-j721e.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/pci/controller/cadence/pci-j721e.c b/drivers/pci/controller/cadence/pci-j721e.c
index c014220d2b24b..e2a522d0f6c14 100644
--- a/drivers/pci/controller/cadence/pci-j721e.c
+++ b/drivers/pci/controller/cadence/pci-j721e.c
@@ -374,7 +374,7 @@ static const struct j721e_pcie_data j7200_pcie_rc_data = {
.quirk_detect_quiet_flag = true,
.linkdown_irq_regfield = J7200_LINK_DOWN,
.byte_access_allowed = true,
- .max_lanes = 2,
+ .max_lanes = 4,
};
static const struct j721e_pcie_data j7200_pcie_ep_data = {
@@ -382,7 +382,7 @@ static const struct j721e_pcie_data j7200_pcie_ep_data = {
.quirk_detect_quiet_flag = true,
.linkdown_irq_regfield = J7200_LINK_DOWN,
.quirk_disable_flr = true,
- .max_lanes = 2,
+ .max_lanes = 4,
};
static const struct j721e_pcie_data am64_pcie_rc_data = {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0627/1376] RDMA/erdma: Fix CEQ tasklet use-after-free on removal
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (625 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0626/1376] PCI: j721e: Fix incorrect max_lanes for J7200 Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0628/1376] RDMA/restrack: Fix typos in the comments Greg Kroah-Hartman
` (371 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak, Cheng Xu,
Leon Romanovsky, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit 0ca79979384f031d710c4b3bae065dcb5d95aca3 ]
Each CEQ interrupt handler only schedules eqc->tasklet. The tasklet calls
erdma_ceq_completion_handler(), which reads the DMA-coherent EQ ring
through get_next_valid_eqe() and updates eq->dbrec through notify_eq().
erdma_ceqs_uninit() frees each CEQ IRQ and then destroys its EQ.
free_irq() prevents another hard IRQ and waits for an in-flight handler,
but it does not drain a tasklet that the handler already scheduled. The
tasklet can therefore access eq->qbuf or eq->dbrec after
erdma_eq_destroy() frees them.
Clearing ceq_cb->ready does not synchronize with a tasklet that already
passed the check at the start of erdma_ceq_completion_handler().
Kill the tasklet after free_irq(), when no handler can schedule it again,
and before erdma_ceq_uninit_one() releases the EQ buffers.
Fixes: f2a0a630b953 ("RDMA/erdma: Add event queue implementation")
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Link: https://patch.msgid.link/20260721082545.47395-1-mhun512@gmail.com
Acked-by: Cheng Xu <chengyou@linux.alibaba.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/erdma/erdma_eq.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/infiniband/hw/erdma/erdma_eq.c b/drivers/infiniband/hw/erdma/erdma_eq.c
index 9a72fec6d5ccf..a238626c40d12 100644
--- a/drivers/infiniband/hw/erdma/erdma_eq.c
+++ b/drivers/infiniband/hw/erdma/erdma_eq.c
@@ -219,6 +219,7 @@ static void erdma_free_ceq_irq(struct erdma_dev *dev, u16 ceqn)
irq_set_affinity_hint(eqc->irq.msix_vector, NULL);
free_irq(eqc->irq.msix_vector, eqc);
+ tasklet_kill(&eqc->tasklet);
}
static int create_eq_cmd(struct erdma_dev *dev, u32 eqn, struct erdma_eq *eq)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0628/1376] RDMA/restrack: Fix typos in the comments
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (626 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0627/1376] RDMA/erdma: Fix CEQ tasklet use-after-free on removal Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0629/1376] RDMA/nldev: Fix locking when accessing mr->pd Greg Kroah-Hartman
` (370 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kalesh AP, Leon Romanovsky,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
[ Upstream commit d43358cda7c4696e08880aaa58a7df82e471fa7c ]
Fix couple of occurrences of the misspelled word "reource"
in the comments with the correct spelling "resource".
Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Link: https://patch.msgid.link/20251113105457.879903-1-kalesh-anakkur.purayil@broadcom.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Stable-dep-of: 709ba0e5311b ("RDMA/core: Fix use after free in ib_query_qp()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/core/restrack.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/core/restrack.c b/drivers/infiniband/core/restrack.c
index 3313410014cd5..a587b6e92d081 100644
--- a/drivers/infiniband/core/restrack.c
+++ b/drivers/infiniband/core/restrack.c
@@ -173,7 +173,7 @@ void rdma_restrack_new(struct rdma_restrack_entry *res,
EXPORT_SYMBOL(rdma_restrack_new);
/**
- * rdma_restrack_add() - add object to the reource tracking database
+ * rdma_restrack_add() - add object to the resource tracking database
* @res: resource entry
*/
void rdma_restrack_add(struct rdma_restrack_entry *res)
@@ -275,7 +275,7 @@ int rdma_restrack_put(struct rdma_restrack_entry *res)
EXPORT_SYMBOL(rdma_restrack_put);
/**
- * rdma_restrack_del() - delete object from the reource tracking database
+ * rdma_restrack_del() - delete object from the resource tracking database
* @res: resource entry
*/
void rdma_restrack_del(struct rdma_restrack_entry *res)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0629/1376] RDMA/nldev: Fix locking when accessing mr->pd
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (627 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0628/1376] RDMA/restrack: Fix typos in the comments Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0630/1376] RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations Greg Kroah-Hartman
` (369 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jason Gunthorpe, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <jgg@nvidia.com>
[ Upstream commit 50d5c02ab8e62325548bd3a6e6b758a9dcd6e7c3 ]
Sashiko points out that, due to rereg_mr, the PD is actually variable and
all the touches in nldev are racy.
Use mr->device instead of mr->pd->device.
Getting the PD restrack ID is more tricky. To avoid disturbing all the
happy paths, add an rdma_restrack_sync() operation which is sort of like
flush_workqueue() or synchronize_irq(): after it returns, all the old
nldev touches to the mr are gone and everything sees the new PD. This
makes it safe to reach into the PD pointer.
Fixes: da5c85078215 ("RDMA/nldev: add driver-specific resource tracking")
Link: https://patch.msgid.link/r/4-v1-29ebd2c229b5+fd5-ib_mr_pd_jgg@nvidia.com
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Stable-dep-of: 709ba0e5311b ("RDMA/core: Fix use after free in ib_query_qp()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/core/nldev.c | 15 +++++----
drivers/infiniband/core/restrack.c | 49 ++++++++++++++++++++++++++++
drivers/infiniband/core/restrack.h | 1 +
drivers/infiniband/core/uverbs_cmd.c | 10 ++++--
include/rdma/ib_verbs.h | 5 +++
5 files changed, 72 insertions(+), 8 deletions(-)
diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c
index aa24cc9f066e9..98d33ad6a397a 100644
--- a/drivers/infiniband/core/nldev.c
+++ b/drivers/infiniband/core/nldev.c
@@ -678,7 +678,7 @@ static int fill_res_mr_entry(struct sk_buff *msg, bool has_cap_net_admin,
struct rdma_restrack_entry *res, uint32_t port)
{
struct ib_mr *mr = container_of(res, struct ib_mr, res);
- struct ib_device *dev = mr->pd->device;
+ struct ib_device *dev = mr->device;
if (has_cap_net_admin) {
if (nla_put_u32(msg, RDMA_NLDEV_ATTR_RES_RKEY, mr->rkey))
@@ -694,9 +694,12 @@ static int fill_res_mr_entry(struct sk_buff *msg, bool has_cap_net_admin,
if (nla_put_u32(msg, RDMA_NLDEV_ATTR_RES_MRN, res->id))
return -EMSGSIZE;
- if (!rdma_is_kernel_res(res) &&
- nla_put_u32(msg, RDMA_NLDEV_ATTR_RES_PDN, mr->pd->res.id))
- return -EMSGSIZE;
+ if (!rdma_is_kernel_res(res)) {
+ struct ib_pd *pd = READ_ONCE(mr->pd);
+
+ if (nla_put_u32(msg, RDMA_NLDEV_ATTR_RES_PDN, pd->res.id))
+ return -EMSGSIZE;
+ }
if (fill_res_name_pid(msg, res))
return -EMSGSIZE;
@@ -710,7 +713,7 @@ static int fill_res_mr_raw_entry(struct sk_buff *msg, bool has_cap_net_admin,
struct rdma_restrack_entry *res, uint32_t port)
{
struct ib_mr *mr = container_of(res, struct ib_mr, res);
- struct ib_device *dev = mr->pd->device;
+ struct ib_device *dev = mr->device;
if (!dev->ops.fill_res_mr_entry_raw)
return -EINVAL;
@@ -1000,7 +1003,7 @@ static int fill_stat_mr_entry(struct sk_buff *msg, bool has_cap_net_admin,
struct rdma_restrack_entry *res, uint32_t port)
{
struct ib_mr *mr = container_of(res, struct ib_mr, res);
- struct ib_device *dev = mr->pd->device;
+ struct ib_device *dev = mr->device;
if (nla_put_u32(msg, RDMA_NLDEV_ATTR_RES_MRN, res->id))
goto err;
diff --git a/drivers/infiniband/core/restrack.c b/drivers/infiniband/core/restrack.c
index a587b6e92d081..82d0865b32290 100644
--- a/drivers/infiniband/core/restrack.c
+++ b/drivers/infiniband/core/restrack.c
@@ -71,6 +71,8 @@ int rdma_restrack_count(struct ib_device *dev, enum rdma_restrack_type type,
xa_lock(&rt->xa);
xas_for_each(&xas, e, U32_MAX) {
+ if (xa_is_zero(e))
+ continue;
if (xa_get_mark(&rt->xa, e->id, RESTRACK_DD) && !show_details)
continue;
cnt++;
@@ -274,6 +276,53 @@ int rdma_restrack_put(struct rdma_restrack_entry *res)
}
EXPORT_SYMBOL(rdma_restrack_put);
+/**
+ * rdma_restrack_sync() - Fence concurrent netlink dumps on an entry
+ * @res: resource entry
+ *
+ * After this returns any concurrent netlink dump threads will see the current
+ * value of the object. This is useful if the object has to be changed and there
+ * is not locking to protect the nl side. Eg for mr->pd. This effectively
+ * destroys the object from a kref/xarray perspective and then immediately
+ * restores it. The kref is acting like a lock to barrier concurrent nl threads.
+ * Callers must ensure rdma_restrack_del() is not concurrently called.
+ */
+void rdma_restrack_sync(struct rdma_restrack_entry *res)
+{
+ struct rdma_restrack_entry *old;
+ struct rdma_restrack_root *rt;
+ struct task_struct *task;
+ struct ib_device *dev;
+
+ if (!res->valid || res->no_track)
+ return;
+
+ dev = res_to_dev(res);
+ if (WARN_ON(!dev))
+ return;
+
+ rt = &dev->res[res->type];
+ if (WARN_ON(xa_get_mark(&rt->xa, res->id, RESTRACK_DD)))
+ return;
+
+ old = xa_cmpxchg(&rt->xa, res->id, res, XA_ZERO_ENTRY, GFP_KERNEL);
+ if (WARN_ON(old != res))
+ return;
+
+ task = res->task;
+ if (task)
+ get_task_struct(task);
+ rdma_restrack_put(res);
+ wait_for_completion(&res->comp);
+ reinit_completion(&res->comp);
+ if (task)
+ res->task = task;
+ kref_init(&res->kref);
+
+ xa_cmpxchg(&rt->xa, res->id, XA_ZERO_ENTRY, res, GFP_KERNEL);
+}
+EXPORT_SYMBOL(rdma_restrack_sync);
+
/**
* rdma_restrack_del() - delete object from the resource tracking database
* @res: resource entry
diff --git a/drivers/infiniband/core/restrack.h b/drivers/infiniband/core/restrack.h
index 6a04fc41f7380..75b8d1005a984 100644
--- a/drivers/infiniband/core/restrack.h
+++ b/drivers/infiniband/core/restrack.h
@@ -27,6 +27,7 @@ int rdma_restrack_init(struct ib_device *dev);
void rdma_restrack_clean(struct ib_device *dev);
void rdma_restrack_add(struct rdma_restrack_entry *res);
void rdma_restrack_del(struct rdma_restrack_entry *res);
+void rdma_restrack_sync(struct rdma_restrack_entry *res);
void rdma_restrack_new(struct rdma_restrack_entry *res,
enum rdma_restrack_type type);
void rdma_restrack_set_name(struct rdma_restrack_entry *res,
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index ac81b7d1eec96..4c258f4c4fb2f 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -46,6 +46,7 @@
#include "uverbs.h"
#include "core_priv.h"
+#include "restrack.h"
/*
* Copy a response to userspace. If the provided 'resp' is larger than the
@@ -813,6 +814,10 @@ static int ib_uverbs_rereg_mr(struct uverbs_attr_bundle *attrs)
ret = PTR_ERR(new_pd);
goto put_uobjs;
}
+ if (new_pd == orig_pd) {
+ uobj_put_obj_read(new_pd);
+ cmd.flags &= ~IB_MR_REREG_PD;
+ }
} else {
new_pd = mr->pd;
}
@@ -858,9 +863,10 @@ static int ib_uverbs_rereg_mr(struct uverbs_attr_bundle *attrs)
mr = new_mr;
} else {
if (cmd.flags & IB_MR_REREG_PD) {
- atomic_dec(&orig_pd->usecnt);
- mr->pd = new_pd;
atomic_inc(&new_pd->usecnt);
+ WRITE_ONCE(mr->pd, new_pd);
+ rdma_restrack_sync(&mr->res);
+ atomic_dec(&orig_pd->usecnt);
}
if (cmd.flags & IB_MR_REREG_TRANS) {
mr->iova = cmd.hca_va;
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index a3d203ba238dd..3d44af15f1e67 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -1831,6 +1831,11 @@ struct ib_dm {
struct ib_mr {
struct ib_device *device;
+ /*
+ * Due to IB_MR_REREG_PD pd is not a fixed pointer and can change. For a
+ * user MR, this value should only be read from a system call that holds
+ * the uobject lock, or the driver should disable in-place REREG_PD.
+ */
struct ib_pd *pd;
u32 lkey;
u32 rkey;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0630/1376] RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (628 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0629/1376] RDMA/nldev: Fix locking when accessing mr->pd Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0631/1376] RDMA/core: Fix use after free in ib_query_qp() Greg Kroah-Hartman
` (368 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Patrisious Haddad, Michael Guralnik,
Edward Srouji, Leon Romanovsky, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrisious Haddad <phaddad@nvidia.com>
[ Upstream commit 8d186210677c0322db886973bcec9aa4d21b51cd ]
Add rdma_restrack_abort_del(), rdma_restrack_begin_del() and
rdma_restrack_commit_del() functions to allow deleting a resource from
the xarray to effectively prevent future access to it and wait for all
current users to finish while preserving its index in the xarray to
allow to re-insert it if needed with guaranteed success.
This is a preparatory change for subsequent patches in the series
which will use these functions to fix the cleanup flow.
Signed-off-by: Patrisious Haddad <phaddad@nvidia.com>
Reviewed-by: Michael Guralnik <michaelgur@nvidia.com>
Signed-off-by: Edward Srouji <edwards@nvidia.com>
Link: https://patch.msgid.link/20260713-restrack-uaf-fix-resub-v2-1-bbe8bb270d51@nvidia.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Stable-dep-of: 709ba0e5311b ("RDMA/core: Fix use after free in ib_query_qp()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/core/restrack.c | 165 +++++++++++++++++++++++------
drivers/infiniband/core/restrack.h | 3 +
2 files changed, 135 insertions(+), 33 deletions(-)
diff --git a/drivers/infiniband/core/restrack.c b/drivers/infiniband/core/restrack.c
index 82d0865b32290..c03042dc1ca5a 100644
--- a/drivers/infiniband/core/restrack.c
+++ b/drivers/infiniband/core/restrack.c
@@ -127,6 +127,46 @@ static void rdma_restrack_attach_task(struct rdma_restrack_entry *res,
res->user = true;
}
+static struct rdma_restrack_root *res_to_rt(struct rdma_restrack_entry *res)
+{
+ struct ib_device *dev = res_to_dev(res);
+
+ if (WARN_ON(!dev))
+ return NULL;
+
+ return &dev->res[res->type];
+}
+
+static void restrack_drain_res(struct rdma_restrack_root *rt,
+ struct rdma_restrack_entry *res)
+{
+ if (rt) {
+ struct rdma_restrack_entry *old;
+
+ old = xa_cmpxchg(&rt->xa, res->id, res, XA_ZERO_ENTRY,
+ GFP_KERNEL);
+ WARN_ON(old != res);
+ }
+
+ rdma_restrack_put(res);
+ wait_for_completion(&res->comp);
+}
+
+static void restrack_restore_res(struct rdma_restrack_root *rt,
+ struct rdma_restrack_entry *res)
+{
+ reinit_completion(&res->comp);
+ kref_init(&res->kref);
+
+ if (rt) {
+ struct rdma_restrack_entry *old;
+
+ old = xa_cmpxchg(&rt->xa, res->id, XA_ZERO_ENTRY, res,
+ GFP_KERNEL);
+ WARN_ON(old);
+ }
+}
+
/**
* rdma_restrack_set_name() - set the task for this resource
* @res: resource entry
@@ -175,22 +215,23 @@ void rdma_restrack_new(struct rdma_restrack_entry *res,
EXPORT_SYMBOL(rdma_restrack_new);
/**
- * rdma_restrack_add() - add object to the resource tracking database
+ * rdma_restrack_add() - add object to the resource tracking database.
+ * If this resource reuses an ID of a resource that was already destroyed
+ * after calling rdma_restrack_begin() but didn't yet call
+ * rdma_restrack_commit_del() it can result in an untracked QP.
* @res: resource entry
*/
void rdma_restrack_add(struct rdma_restrack_entry *res)
{
- struct ib_device *dev = res_to_dev(res);
struct rdma_restrack_root *rt;
int ret = 0;
- if (!dev)
- return;
-
if (res->no_track)
goto out;
- rt = &dev->res[res->type];
+ rt = res_to_rt(res);
+ if (!rt)
+ return;
if (res->type == RDMA_RESTRACK_QP) {
/* Special case to ensure that LQPN points to right QP */
@@ -227,6 +268,28 @@ void rdma_restrack_add(struct rdma_restrack_entry *res)
}
EXPORT_SYMBOL(rdma_restrack_add);
+/**
+ * rdma_restrack_abort_del() - re-add object to the resource tracking database
+ * it can only be used after rdma_restrack_begin_del().
+ * @res: resource entry
+ */
+void rdma_restrack_abort_del(struct rdma_restrack_entry *res)
+{
+ struct rdma_restrack_root *rt = NULL;
+
+ if (!res->valid)
+ return;
+
+ if (!res->no_track) {
+ rt = res_to_rt(res);
+ if (!rt)
+ return;
+ }
+
+ restrack_restore_res(rt, res);
+}
+EXPORT_SYMBOL(rdma_restrack_abort_del);
+
int __must_check rdma_restrack_get(struct rdma_restrack_entry *res)
{
return kref_get_unless_zero(&res->kref);
@@ -263,7 +326,7 @@ static void restrack_release(struct kref *kref)
struct rdma_restrack_entry *res;
res = container_of(kref, struct rdma_restrack_entry, kref);
- if (res->task) {
+ if (res->task && !res->valid) {
put_task_struct(res->task);
res->task = NULL;
}
@@ -289,37 +352,20 @@ EXPORT_SYMBOL(rdma_restrack_put);
*/
void rdma_restrack_sync(struct rdma_restrack_entry *res)
{
- struct rdma_restrack_entry *old;
struct rdma_restrack_root *rt;
- struct task_struct *task;
- struct ib_device *dev;
if (!res->valid || res->no_track)
return;
- dev = res_to_dev(res);
- if (WARN_ON(!dev))
+ rt = res_to_rt(res);
+ if (!rt)
return;
- rt = &dev->res[res->type];
if (WARN_ON(xa_get_mark(&rt->xa, res->id, RESTRACK_DD)))
return;
- old = xa_cmpxchg(&rt->xa, res->id, res, XA_ZERO_ENTRY, GFP_KERNEL);
- if (WARN_ON(old != res))
- return;
-
- task = res->task;
- if (task)
- get_task_struct(task);
- rdma_restrack_put(res);
- wait_for_completion(&res->comp);
- reinit_completion(&res->comp);
- if (task)
- res->task = task;
- kref_init(&res->kref);
-
- xa_cmpxchg(&rt->xa, res->id, XA_ZERO_ENTRY, res, GFP_KERNEL);
+ restrack_drain_res(rt, res);
+ restrack_restore_res(rt, res);
}
EXPORT_SYMBOL(rdma_restrack_sync);
@@ -331,7 +377,6 @@ void rdma_restrack_del(struct rdma_restrack_entry *res)
{
struct rdma_restrack_entry *old;
struct rdma_restrack_root *rt;
- struct ib_device *dev;
if (!res->valid) {
if (res->task) {
@@ -344,12 +389,10 @@ void rdma_restrack_del(struct rdma_restrack_entry *res)
if (res->no_track)
goto out;
- dev = res_to_dev(res);
- if (WARN_ON(!dev))
+ rt = res_to_rt(res);
+ if (!rt)
return;
- rt = &dev->res[res->type];
-
old = xa_erase(&rt->xa, res->id);
WARN_ON(old != res);
@@ -357,5 +400,61 @@ void rdma_restrack_del(struct rdma_restrack_entry *res)
res->valid = false;
rdma_restrack_put(res);
wait_for_completion(&res->comp);
+ if (res->task) {
+ put_task_struct(res->task);
+ res->task = NULL;
+ }
}
EXPORT_SYMBOL(rdma_restrack_del);
+
+/**
+ * rdma_restrack_begin_del() - invalidate the object from the resource tracking
+ * database but preserve its index in the array.
+ * Since this preserves the index in the array until rdma_restrack_commit_del()
+ * is called, if rdma_restrack_add() is called in between with an old QP ID it
+ * can result in an untracked QP.
+ * @res: resource entry
+ */
+void rdma_restrack_begin_del(struct rdma_restrack_entry *res)
+{
+ struct rdma_restrack_root *rt = NULL;
+
+ if (!res->valid)
+ return;
+
+ if (!res->no_track) {
+ rt = res_to_rt(res);
+ if (!rt)
+ return;
+ }
+
+ restrack_drain_res(rt, res);
+}
+EXPORT_SYMBOL(rdma_restrack_begin_del);
+
+/**
+ * rdma_restrack_commit_del() - delete object from the resource tracking
+ * database and free the task.
+ * @res: resource entry
+ */
+void rdma_restrack_commit_del(struct rdma_restrack_entry *res)
+{
+ struct rdma_restrack_root *rt;
+
+ if (!res->valid || res->no_track)
+ goto out;
+
+ rt = res_to_rt(res);
+ if (!rt)
+ return;
+
+ xa_erase(&rt->xa, res->id);
+
+out:
+ res->valid = false;
+ if (res->task) {
+ put_task_struct(res->task);
+ res->task = NULL;
+ }
+}
+EXPORT_SYMBOL(rdma_restrack_commit_del);
diff --git a/drivers/infiniband/core/restrack.h b/drivers/infiniband/core/restrack.h
index 75b8d1005a984..2df78e084e107 100644
--- a/drivers/infiniband/core/restrack.h
+++ b/drivers/infiniband/core/restrack.h
@@ -26,8 +26,11 @@ struct rdma_restrack_root {
int rdma_restrack_init(struct ib_device *dev);
void rdma_restrack_clean(struct ib_device *dev);
void rdma_restrack_add(struct rdma_restrack_entry *res);
+void rdma_restrack_abort_del(struct rdma_restrack_entry *res);
void rdma_restrack_del(struct rdma_restrack_entry *res);
void rdma_restrack_sync(struct rdma_restrack_entry *res);
+void rdma_restrack_begin_del(struct rdma_restrack_entry *res);
+void rdma_restrack_commit_del(struct rdma_restrack_entry *res);
void rdma_restrack_new(struct rdma_restrack_entry *res,
enum rdma_restrack_type type);
void rdma_restrack_set_name(struct rdma_restrack_entry *res,
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0631/1376] RDMA/core: Fix use after free in ib_query_qp()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (629 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0630/1376] RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0632/1376] RDMA/core: Fix potential use after free in ib_destroy_cq_user() Greg Kroah-Hartman
` (367 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Patrisious Haddad, Michael Guralnik,
Edward Srouji, Leon Romanovsky, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrisious Haddad <phaddad@nvidia.com>
[ Upstream commit 709ba0e5311bd034eb4d9c1c00cc4e1109d6dc3e ]
When querying a QP via the netlink flow the only synchronization
mechanism for the said QP is rdma_restrack_get(), meanwhile during the
QP destroy path rdma_restrack_del() is called at the end of the
ib_destroy_qp_user() function which is too late, since by then the
vendor specific resources for said QP would already be destroyed, and
till the rdma_restrack_del() is called this QP can still be accessed,
which could cause the use after free below.
Fix this by moving the rdma_restrack_begin_del() to the start of the
ib_destroy_qp_user(), which in turn waits for all usages of the QP to be
done then removes it from the database to prevent access to it while it
is being destroyed.
RIP: 0010:ib_query_qp+0x15/0x50 [ib_core]
Code: 48 83 05 5d 8e b9 ff 01 eb b5 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 c7 46 40 00 00 00 00 48 c7 46 78 00 00 00 00 <48> 8b 07 48 8b 80 88 01 00 00 48 85 c0 74 1a 48 83 05 54 91 b9 ff
RSP: 0018:ff11000108a8f2f0 EFLAGS: 00010202
RAX: 0000000000000000 RBX: ff11000108a8f370 RCX: ff11000108a8f370
RDX: 0000000000000000 RSI: ff11000108a8f3d8 RDI: 0000000000000000
RBP: ff1100010de5a000 R08: 0000000000000e80 R09: 0000000000000004
R10: ff110001057a604c R11: 0000000000000000 R12: ff11000108a8f370
R13: ff110001090e8000 R14: 0000000000000000 R15: ff110001057a602c
FS: 00007f2ffd8db6c0(0000) GS:ff110008dc90b000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000010b9a7004 CR4: 0000000000373eb0
Call Trace:
<TASK>
mlx5_ib_gsi_query_qp+0x21/0x50 [mlx5_ib]
mlx5_ib_query_qp+0x689/0x9d0 [mlx5_ib]
ib_query_qp+0x35/0x50 [ib_core]
fill_res_qp_entry_query.isra.0+0x47/0x280 [ib_core]
? __wake_up+0x40/0x50
? netlink_broadcast_filtered+0x15a/0x550
? kobject_uevent_env+0x562/0x710
? ep_poll_callback+0x242/0x270
? __nla_put+0xc/0x20
? nla_put+0x28/0x40
? nla_put_string+0x2e/0x40 [ib_core]
fill_res_qp_entry+0x138/0x190 [ib_core]
res_get_common_dumpit+0x4a5/0x800 [ib_core]
? fill_res_qp_entry_query.isra.0+0x280/0x280 [ib_core]
nldev_res_get_qp_dumpit+0x1e/0x30 [ib_core]
netlink_dump+0x16f/0x450
__netlink_dump_start+0x1ce/0x2e0
rdma_nl_rcv_msg+0x1d3/0x330 [ib_core]
? nldev_res_get_qp_raw_dumpit+0x30/0x30 [ib_core]
rdma_nl_rcv_skb.constprop.0.isra.0+0x108/0x180 [ib_core]
rdma_nl_rcv+0x12/0x20 [ib_core]
netlink_unicast+0x255/0x380
? __alloc_skb+0xfa/0x1e0
netlink_sendmsg+0x1f3/0x420
__sock_sendmsg+0x38/0x60
____sys_sendmsg+0x1e8/0x230
? copy_msghdr_from_user+0xea/0x170
___sys_sendmsg+0x7c/0xb0
? __futex_wait+0x95/0xf0
? __futex_wake_mark+0x40/0x40
? futex_wait+0x67/0x100
? futex_wake+0xac/0x1b0
__sys_sendmsg+0x5f/0xb0
do_syscall_64+0x55/0xb90
entry_SYSCALL_64_after_hwframe+0x4b/0x53
Fixes: 514aee660df4 ("RDMA: Globally allocate and release QP memory")
Signed-off-by: Patrisious Haddad <phaddad@nvidia.com>
Reviewed-by: Michael Guralnik <michaelgur@nvidia.com>
Signed-off-by: Edward Srouji <edwards@nvidia.com>
Link: https://patch.msgid.link/20260713-restrack-uaf-fix-resub-v2-2-bbe8bb270d51@nvidia.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/core/verbs.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index dff87b5980aac..52d412267d842 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -2098,6 +2098,8 @@ int ib_destroy_qp_user(struct ib_qp *qp, struct ib_udata *udata)
if (qp->real_qp != qp)
return __ib_destroy_shared_qp(qp);
+ rdma_restrack_begin_del(&qp->res);
+
sec = qp->qp_sec;
if (sec)
ib_destroy_qp_security_begin(sec);
@@ -2110,6 +2112,7 @@ int ib_destroy_qp_user(struct ib_qp *qp, struct ib_udata *udata)
if (ret) {
if (sec)
ib_destroy_qp_security_abort(sec);
+ rdma_restrack_abort_del(&qp->res);
return ret;
}
@@ -2122,7 +2125,7 @@ int ib_destroy_qp_user(struct ib_qp *qp, struct ib_udata *udata)
if (sec)
ib_destroy_qp_security_end(sec);
- rdma_restrack_del(&qp->res);
+ rdma_restrack_commit_del(&qp->res);
kfree(qp);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0632/1376] RDMA/core: Fix potential use after free in ib_destroy_cq_user()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (630 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0631/1376] RDMA/core: Fix use after free in ib_query_qp() Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0633/1376] RDMA/core: Fix potential use after free in ib_destroy_srq_user() Greg Kroah-Hartman
` (366 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Patrisious Haddad, Michael Guralnik,
Edward Srouji, Leon Romanovsky, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrisious Haddad <phaddad@nvidia.com>
[ Upstream commit 3481bec4dfc4aee24ffea5a547ee95b70b67d9d5 ]
When accessing a CQ via the netlink path the only synchronization
mechanism for the said CQ is rdma_restrack_get().
Currently, rdma_restrack_del() is invoked at the end of
ib_destroy_cq_user(), which is too late, since by that point
vendor-specific resources associated with the CQ might already be
freed. This can leave a short window where the CQ remains accessible
through restrack, leading to a potential use-after-free.
Fix this by moving the rdma_restrack_begin_del() call to the start of
ib_destroy_cq_user(), ensuring that the CQ is removed from restrack
before its internal resources are released. This guarantees that no new
users hold references to a CQ that is in the process of destruction.
In addition, this change preserves the intended inverted order
between create and destroy routines: resources are added to
restrack at the end of successful creation, and hence shall be removed
from the restrack first thing during the destruction flow, which keeps
the lifecycle management consistent and predictable.
Fixes: 08f294a1524b ("RDMA/core: Add resource tracking for create and destroy CQs")
Signed-off-by: Patrisious Haddad <phaddad@nvidia.com>
Reviewed-by: Michael Guralnik <michaelgur@nvidia.com>
Signed-off-by: Edward Srouji <edwards@nvidia.com>
Link: https://patch.msgid.link/20260713-restrack-uaf-fix-resub-v2-3-bbe8bb270d51@nvidia.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/core/verbs.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index 52d412267d842..67c04b14b1509 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -2190,11 +2190,15 @@ int ib_destroy_cq_user(struct ib_cq *cq, struct ib_udata *udata)
if (atomic_read(&cq->usecnt))
return -EBUSY;
+ rdma_restrack_begin_del(&cq->res);
+
ret = cq->device->ops.destroy_cq(cq, udata);
- if (ret)
+ if (ret) {
+ rdma_restrack_abort_del(&cq->res);
return ret;
+ }
- rdma_restrack_del(&cq->res);
+ rdma_restrack_commit_del(&cq->res);
kfree(cq);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0633/1376] RDMA/core: Fix potential use after free in ib_destroy_srq_user()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (631 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0632/1376] RDMA/core: Fix potential use after free in ib_destroy_cq_user() Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0634/1376] RDMA/core: Fix potential use after free in counter_release() Greg Kroah-Hartman
` (365 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Patrisious Haddad, Michael Guralnik,
Edward Srouji, Leon Romanovsky, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrisious Haddad <phaddad@nvidia.com>
[ Upstream commit 88244ecc71cc0b3ed200f5ef7ddea6686adfd730 ]
When accessing a SRQ via the netlink path the only synchronization
mechanism for the said SRQ is rdma_restrack_get().
Currently, rdma_restrack_del() is invoked at the end of
ib_destroy_srq_user(), which is too late, since by that point
vendor-specific resources associated with the SRQ might already be
freed. This can leave a short window where the SRQ remains accessible
through restrack, leading to a potential use-after-free.
Fix this by moving the rdma_restrack_begin_del() call to the start of
ib_destroy_srq_user(), ensuring that the SRQ is removed from restrack
before its internal resources are released. This guarantees that no new
users hold references to a SRQ that is in the process of destruction.
In addition, this change preserves the intended inverted order
between create and destroy routines: resources are added to
restrack at the end of successful creation, and hence shall be removed
from the restrack first thing during the destruction flow, which keeps
the lifecycle management consistent and predictable.
Fixes: 48f8a70e899f ("RDMA/restrack: Add support to get resource tracking for SRQ")
Signed-off-by: Patrisious Haddad <phaddad@nvidia.com>
Reviewed-by: Michael Guralnik <michaelgur@nvidia.com>
Signed-off-by: Edward Srouji <edwards@nvidia.com>
Link: https://patch.msgid.link/20260713-restrack-uaf-fix-resub-v2-4-bbe8bb270d51@nvidia.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/core/verbs.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index 67c04b14b1509..37393ce77a22e 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -1083,16 +1083,20 @@ int ib_destroy_srq_user(struct ib_srq *srq, struct ib_udata *udata)
if (atomic_read(&srq->usecnt))
return -EBUSY;
+ rdma_restrack_begin_del(&srq->res);
+
ret = srq->device->ops.destroy_srq(srq, udata);
- if (ret)
+ if (ret) {
+ rdma_restrack_abort_del(&srq->res);
return ret;
+ }
atomic_dec(&srq->pd->usecnt);
if (srq->srq_type == IB_SRQT_XRC && srq->ext.xrc.xrcd)
atomic_dec(&srq->ext.xrc.xrcd->usecnt);
if (ib_srq_has_cq(srq->srq_type))
atomic_dec(&srq->ext.cq->usecnt);
- rdma_restrack_del(&srq->res);
+ rdma_restrack_commit_del(&srq->res);
kfree(srq);
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0634/1376] RDMA/core: Fix potential use after free in counter_release()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (632 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 6.12 0633/1376] RDMA/core: Fix potential use after free in ib_destroy_srq_user() Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0635/1376] RDMA/core: Add driver APIs pre_destroy_cq() and post_destroy_cq() Greg Kroah-Hartman
` (364 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Patrisious Haddad, Michael Guralnik,
Edward Srouji, Leon Romanovsky, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrisious Haddad <phaddad@nvidia.com>
[ Upstream commit 235ef2d0e750885c29340b0fc40620a7a4f52e12 ]
When accessing a counter via the netlink path the only synchronization
mechanism for the said counter is rdma_restrack_get().
Currently, rdma_restrack_del() is invoked at the end of
counter_release(), which is too late, since by that point
vendor-specific resources associated with the counter might already be
freed. This can leave a short window where the counter remains
accessible through restrack, leading to a potential use-after-free.
Fix this by moving the rdma_restrack_del() call to be before the
freeing of the vendor-specific resources, ensuring that the counter is
removed from restrack before its internal resources are released.
This guarantees that no new users hold references to a counter that is
in the process of destruction.
Fixes: 99fa331dc862 ("RDMA/counter: Add "auto" configuration mode support")
Signed-off-by: Patrisious Haddad <phaddad@nvidia.com>
Reviewed-by: Michael Guralnik <michaelgur@nvidia.com>
Signed-off-by: Edward Srouji <edwards@nvidia.com>
Link: https://patch.msgid.link/20260713-restrack-uaf-fix-resub-v2-5-bbe8bb270d51@nvidia.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/core/counters.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/core/counters.c b/drivers/infiniband/core/counters.c
index d41af5ab6403a..8cbca897fc531 100644
--- a/drivers/infiniband/core/counters.c
+++ b/drivers/infiniband/core/counters.c
@@ -217,7 +217,6 @@ static void rdma_counter_free(struct rdma_counter *counter)
mutex_unlock(&port_counter->lock);
- rdma_restrack_del(&counter->res);
rdma_free_hw_stats_struct(counter->stats);
kfree(counter);
}
@@ -312,6 +311,7 @@ static void counter_release(struct kref *kref)
counter = container_of(kref, struct rdma_counter, kref);
counter_history_stat_update(counter);
+ rdma_restrack_del(&counter->res);
counter->device->ops.counter_dealloc(counter);
rdma_counter_free(counter);
}
@@ -472,7 +472,8 @@ static struct rdma_counter *rdma_get_counter_by_id(struct ib_device *dev,
return NULL;
counter = container_of(res, struct rdma_counter, res);
- kref_get(&counter->kref);
+ if (!kref_get_unless_zero(&counter->kref))
+ counter = NULL;
rdma_restrack_put(res);
return counter;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0635/1376] RDMA/core: Add driver APIs pre_destroy_cq() and post_destroy_cq()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (633 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0634/1376] RDMA/core: Fix potential use after free in counter_release() Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0636/1376] RDMA/core: Fix potential use after free in ib_free_cq() Greg Kroah-Hartman
` (363 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mark Zhang, Leon Romanovsky,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Zhang <markzhang@nvidia.com>
[ Upstream commit 5a2a5b65d5d67279be9e1f0e4b9baf39ee594cb1 ]
Currently in ib_free_cq, it disables IRQ or cancel the CQ work before
driver destroy_cq. This isn't good as a new IRQ or a CQ work can be
submitted immediately after disabling IRQ or canceling CQ work, which
may run concurrently with destroy_cq and cause crashes.
The right flow should be:
1. Driver disables CQ to make sure no new CQ event will be submitted;
2. Disables IRQ or Cancels CQ work in core layer, to make sure no CQ
polling work is running;
3. Free all resources to destroy the CQ.
This patch adds 2 driver APIs:
- pre_destroy_cq(): Disable a CQ to prevent it from generating any new
work completions, but not free any kernel resources;
- post_destroy_cq(): Free all kernel resources.
In ib_free_cq, the IRQ is disabled or CQ work is canceled after
pre_destroy_cq, and before post_destroy_cq.
Fixes: 14d3a3b2498e ("IB: add a proper completion queue abstraction")
Signed-off-by: Mark Zhang <markzhang@nvidia.com>
Link: https://patch.msgid.link/b5f7ae3d75f44a3e15ff3f4eb2bbdea13e06b97f.1750062328.git.leon@kernel.org
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Stable-dep-of: 29dc2f8e1c97 ("RDMA/core: Fix potential use after free in ib_free_cq()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/core/cq.c | 12 ++++++++++--
drivers/infiniband/core/device.c | 2 ++
include/rdma/ib_verbs.h | 9 +++++++++
3 files changed, 21 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/core/cq.c b/drivers/infiniband/core/cq.c
index a70876a0a2312..584537c71545c 100644
--- a/drivers/infiniband/core/cq.c
+++ b/drivers/infiniband/core/cq.c
@@ -317,13 +317,18 @@ EXPORT_SYMBOL(__ib_alloc_cq_any);
*/
void ib_free_cq(struct ib_cq *cq)
{
- int ret;
+ int ret = 0;
if (WARN_ON_ONCE(atomic_read(&cq->usecnt)))
return;
if (WARN_ON_ONCE(cq->cqe_used))
return;
+ if (cq->device->ops.pre_destroy_cq) {
+ ret = cq->device->ops.pre_destroy_cq(cq);
+ WARN_ONCE(ret, "Disable of kernel CQ shouldn't fail");
+ }
+
switch (cq->poll_ctx) {
case IB_POLL_DIRECT:
break;
@@ -340,7 +345,10 @@ void ib_free_cq(struct ib_cq *cq)
rdma_dim_destroy(cq);
trace_cq_free(cq);
- ret = cq->device->ops.destroy_cq(cq, NULL);
+ if (cq->device->ops.post_destroy_cq)
+ cq->device->ops.post_destroy_cq(cq);
+ else
+ ret = cq->device->ops.destroy_cq(cq, NULL);
WARN_ONCE(ret, "Destroy of kernel CQ shouldn't fail");
rdma_restrack_del(&cq->res);
kfree(cq->wc);
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index cd53e9c4f913b..d927270bab47c 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -2783,8 +2783,10 @@ void ib_set_device_ops(struct ib_device *dev, const struct ib_device_ops *ops)
SET_DEVICE_OP(dev_ops, modify_srq);
SET_DEVICE_OP(dev_ops, modify_wq);
SET_DEVICE_OP(dev_ops, peek_cq);
+ SET_DEVICE_OP(dev_ops, pre_destroy_cq);
SET_DEVICE_OP(dev_ops, poll_cq);
SET_DEVICE_OP(dev_ops, port_groups);
+ SET_DEVICE_OP(dev_ops, post_destroy_cq);
SET_DEVICE_OP(dev_ops, post_recv);
SET_DEVICE_OP(dev_ops, post_send);
SET_DEVICE_OP(dev_ops, post_srq_recv);
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 3d44af15f1e67..6c8f560e86370 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -2474,6 +2474,15 @@ struct ib_device_ops {
int (*modify_cq)(struct ib_cq *cq, u16 cq_count, u16 cq_period);
int (*destroy_cq)(struct ib_cq *cq, struct ib_udata *udata);
int (*resize_cq)(struct ib_cq *cq, int cqe, struct ib_udata *udata);
+ /**
+ * pre_destroy_cq - Prevent a cq from generating any new work
+ * completions, but not free any kernel resources
+ */
+ int (*pre_destroy_cq)(struct ib_cq *cq);
+ /**
+ * post_destroy_cq - Free all kernel resources
+ */
+ void (*post_destroy_cq)(struct ib_cq *cq);
struct ib_mr *(*get_dma_mr)(struct ib_pd *pd, int mr_access_flags);
struct ib_mr *(*reg_user_mr)(struct ib_pd *pd, u64 start, u64 length,
u64 virt_addr, int mr_access_flags,
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0636/1376] RDMA/core: Fix potential use after free in ib_free_cq()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (634 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0635/1376] RDMA/core: Add driver APIs pre_destroy_cq() and post_destroy_cq() Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0637/1376] RDMA/core: Fix potential use after free in ib_dealloc_pd_user() Greg Kroah-Hartman
` (362 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Patrisious Haddad, Michael Guralnik,
Edward Srouji, Leon Romanovsky, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrisious Haddad <phaddad@nvidia.com>
[ Upstream commit 29dc2f8e1c97372c2871a70088707933515fbd5b ]
When accessing a CQ via the netlink path the only synchronization
mechanism for the said CQ is rdma_restrack_get().
Currently, rdma_restrack_del() is invoked at the end of
ib_free_cq(), which is too late, since by that point
vendor-specific resources associated with the CQ might already be
freed. This can leave a short window where the CQ remains accessible
through restrack, leading to a potential use-after-free.
Fix this by moving the rdma_restrack_del() call to be before the freeing
of the vendor-specific resources ensuring that the CQ is removed from
restrack before its internal resources are released.
This guarantees that no new users hold references to a CQ that is in
the process of destruction.
Fixes: 43d781b9fa56 ("RDMA: Allow fail of destroy CQ")
Signed-off-by: Patrisious Haddad <phaddad@nvidia.com>
Reviewed-by: Michael Guralnik <michaelgur@nvidia.com>
Signed-off-by: Edward Srouji <edwards@nvidia.com>
Link: https://patch.msgid.link/20260713-restrack-uaf-fix-resub-v2-6-bbe8bb270d51@nvidia.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/core/cq.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/core/cq.c b/drivers/infiniband/core/cq.c
index 584537c71545c..4ea0dfcff95ea 100644
--- a/drivers/infiniband/core/cq.c
+++ b/drivers/infiniband/core/cq.c
@@ -324,6 +324,7 @@ void ib_free_cq(struct ib_cq *cq)
if (WARN_ON_ONCE(cq->cqe_used))
return;
+ rdma_restrack_del(&cq->res);
if (cq->device->ops.pre_destroy_cq) {
ret = cq->device->ops.pre_destroy_cq(cq);
WARN_ONCE(ret, "Disable of kernel CQ shouldn't fail");
@@ -350,7 +351,6 @@ void ib_free_cq(struct ib_cq *cq)
else
ret = cq->device->ops.destroy_cq(cq, NULL);
WARN_ONCE(ret, "Destroy of kernel CQ shouldn't fail");
- rdma_restrack_del(&cq->res);
kfree(cq->wc);
kfree(cq);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0637/1376] RDMA/core: Fix potential use after free in ib_dealloc_pd_user()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (635 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0636/1376] RDMA/core: Fix potential use after free in ib_free_cq() Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0638/1376] firmware: arm_scmi: Fix requested device removal race Greg Kroah-Hartman
` (361 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Patrisious Haddad, Michael Guralnik,
Edward Srouji, Leon Romanovsky, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrisious Haddad <phaddad@nvidia.com>
[ Upstream commit 8b90e701342275f414e36e7421c502237df241ad ]
When accessing a PD via the netlink path the only synchronization
mechanism for the said PD is rdma_restrack_get().
Currently, rdma_restrack_del() is invoked at the end of
ib_dealloc_pd_user(), which is too late, since by that point
vendor-specific resources associated with the PD might already be
freed. This can leave a short window where the PD remains accessible
through restrack, leading to a potential use-after-free.
Fix this by moving the rdma_restrack_begin_del() call to the start of
ib_dealloc_pd_user(), ensuring that the PD is removed from restrack
before its internal resources are released. This guarantees that no new
users hold references to a PD that is in the process of destruction.
In addition, this change preserves the intended inverted order
between create and destroy routines: resources are added to
restrack at the end of successful creation, and hence shall be removed
from the restrack first thing during the destruction flow, which keeps
the lifecycle management consistent and predictable.
Fixes: 91a7c58fce06 ("RDMA: Restore ability to fail on PD deallocate")
Signed-off-by: Patrisious Haddad <phaddad@nvidia.com>
Reviewed-by: Michael Guralnik <michaelgur@nvidia.com>
Signed-off-by: Edward Srouji <edwards@nvidia.com>
Link: https://patch.msgid.link/20260713-restrack-uaf-fix-resub-v2-8-bbe8bb270d51@nvidia.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/core/verbs.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index 37393ce77a22e..d0bd57ac7c6aa 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -335,6 +335,7 @@ int ib_dealloc_pd_user(struct ib_pd *pd, struct ib_udata *udata)
{
int ret;
+ rdma_restrack_begin_del(&pd->res);
if (pd->__internal_mr) {
ret = pd->device->ops.dereg_mr(pd->__internal_mr, NULL);
WARN_ON(ret);
@@ -342,10 +343,12 @@ int ib_dealloc_pd_user(struct ib_pd *pd, struct ib_udata *udata)
}
ret = pd->device->ops.dealloc_pd(pd, udata);
- if (ret)
+ if (ret) {
+ rdma_restrack_abort_del(&pd->res);
return ret;
+ }
- rdma_restrack_del(&pd->res);
+ rdma_restrack_commit_del(&pd->res);
kfree(pd);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0638/1376] firmware: arm_scmi: Fix requested device removal race
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (636 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0637/1376] RDMA/core: Fix potential use after free in ib_dealloc_pd_user() Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0639/1376] iommu/qcom: Remove sysfs device on probe failure path Greg Kroah-Hartman
` (360 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Sudeep Holla, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <sudeep.holla@kernel.org>
[ Upstream commit 2c4097e6c4aed276c5e9ec2ab331ab397ea780bf ]
scmi_protocol_device_unrequest() drops scmi_requested_devices_mtx while
notifying listeners but continues to retain the per-protocol list head.
When two SCMI drivers for the same protocol unregister concurrently, one
thread can remove the final request and free the list head while the other
is running its notifier. The latter then dereferences the freed list head
after reacquiring the mutex and can free it a second time.
Complete the list and IDR updates, including freeing an empty list head,
before dropping the mutex. Keep the blocking notifier outside the critical
section and retain only the detached request across the callback.
Fixes: d3cd7c525fd2 ("firmware: arm_scmi: Refactor protocol device creation")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260722095250.2011630-1-sudeep.holla@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/arm_scmi/bus.c | 26 +++++++++++++-------------
1 file changed, 13 insertions(+), 13 deletions(-)
diff --git a/drivers/firmware/arm_scmi/bus.c b/drivers/firmware/arm_scmi/bus.c
index 73a6ab4a224d7..2174d00feb253 100644
--- a/drivers/firmware/arm_scmi/bus.c
+++ b/drivers/firmware/arm_scmi/bus.c
@@ -157,6 +157,7 @@ static int scmi_protocol_table_register(const struct scmi_device_id *id_table)
*/
static void scmi_protocol_device_unrequest(const struct scmi_device_id *id_table)
{
+ struct scmi_requested_dev *rdev, *victim = NULL;
struct list_head *phead;
pr_debug("Unrequesting SCMI device (%s) for protocol %x\n",
@@ -165,29 +166,28 @@ static void scmi_protocol_device_unrequest(const struct scmi_device_id *id_table
mutex_lock(&scmi_requested_devices_mtx);
phead = idr_find(&scmi_requested_devices, id_table->protocol_id);
if (phead) {
- struct scmi_requested_dev *victim, *tmp;
-
- list_for_each_entry_safe(victim, tmp, phead, node) {
- if (!strcmp(victim->id_table->name, id_table->name)) {
- list_del(&victim->node);
-
- mutex_unlock(&scmi_requested_devices_mtx);
- blocking_notifier_call_chain(&scmi_requested_devices_nh,
- SCMI_BUS_NOTIFY_DEVICE_UNREQUEST,
- (void *)victim->id_table);
- kfree(victim);
- mutex_lock(&scmi_requested_devices_mtx);
+ list_for_each_entry(rdev, phead, node) {
+ if (!strcmp(rdev->id_table->name, id_table->name)) {
+ victim = rdev;
+ list_del(&rdev->node);
break;
}
}
- if (list_empty(phead)) {
+ if (victim && list_empty(phead)) {
idr_remove(&scmi_requested_devices,
id_table->protocol_id);
kfree(phead);
}
}
mutex_unlock(&scmi_requested_devices_mtx);
+
+ if (victim) {
+ blocking_notifier_call_chain(&scmi_requested_devices_nh,
+ SCMI_BUS_NOTIFY_DEVICE_UNREQUEST,
+ (void *)victim->id_table);
+ kfree(victim);
+ }
}
static void
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0639/1376] iommu/qcom: Remove sysfs device on probe failure path
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (637 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0638/1376] firmware: arm_scmi: Fix requested device removal race Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0640/1376] iommu/qcom: Fix inverted fault report check in qcom_iommu_fault() Greg Kroah-Hartman
` (359 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haoxiang Li, Konrad Dybcio,
Mukesh Ojha, Will Deacon, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <haoxiang_li2024@163.com>
[ Upstream commit c579f18e79599c16168925cb149e1db3f29eea5f ]
In qcom_iommu_device_probe(), if iommu_device_register()
fails, the sysfs device created by iommu_device_sysfs_add()
is not released. Add a goto label to do the cleanup.
Fixes: 0ae349a0f33f ("iommu/qcom: Add qcom_iommu")
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/arm/arm-smmu/qcom_iommu.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/iommu/arm/arm-smmu/qcom_iommu.c b/drivers/iommu/arm/arm-smmu/qcom_iommu.c
index 8a76b4f46a325..b3cca55c42184 100644
--- a/drivers/iommu/arm/arm-smmu/qcom_iommu.c
+++ b/drivers/iommu/arm/arm-smmu/qcom_iommu.c
@@ -860,7 +860,7 @@ static int qcom_iommu_device_probe(struct platform_device *pdev)
ret = iommu_device_register(&qcom_iommu->iommu, &qcom_iommu_ops, dev);
if (ret) {
dev_err(dev, "Failed to register iommu\n");
- goto err_pm_disable;
+ goto err_sysfs_remove;
}
if (qcom_iommu->local_base) {
@@ -871,6 +871,8 @@ static int qcom_iommu_device_probe(struct platform_device *pdev)
return 0;
+err_sysfs_remove:
+ iommu_device_sysfs_remove(&qcom_iommu->iommu);
err_pm_disable:
pm_runtime_disable(dev);
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0640/1376] iommu/qcom: Fix inverted fault report check in qcom_iommu_fault()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (638 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0639/1376] iommu/qcom: Remove sysfs device on probe failure path Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0641/1376] thermal: intel: int3400: clean up ODVP on probe failures Greg Kroah-Hartman
` (358 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Mukesh Ojha,
Will Deacon, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
[ Upstream commit 1f33b8208a1978b0c0d6ad60a47fe4bb7a235e58 ]
report_iommu_fault() returns 0 when a fault handler successfully handles
the fault, and -ENOSYS when no handler is installed. The condition
'!report_iommu_fault()' evaluates to true (printing "Unhandled context
fault") precisely when the fault *was* handled, and stays silent when no
handler is present — the opposite of what is intended.
Remove the '!' so the driver logs unhandled faults correctly.
Fixes: 049541e178d5 ("iommu: qcom: wire up fault handler")
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/arm/arm-smmu/qcom_iommu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iommu/arm/arm-smmu/qcom_iommu.c b/drivers/iommu/arm/arm-smmu/qcom_iommu.c
index b3cca55c42184..09d847666a68e 100644
--- a/drivers/iommu/arm/arm-smmu/qcom_iommu.c
+++ b/drivers/iommu/arm/arm-smmu/qcom_iommu.c
@@ -200,7 +200,7 @@ static irqreturn_t qcom_iommu_fault(int irq, void *dev)
fsynr = iommu_readl(ctx, ARM_SMMU_CB_FSYNR0);
iova = iommu_readq(ctx, ARM_SMMU_CB_FAR);
- if (!report_iommu_fault(ctx->domain, ctx->dev, iova, 0)) {
+ if (report_iommu_fault(ctx->domain, ctx->dev, iova, 0)) {
dev_err_ratelimited(ctx->dev,
"Unhandled context fault: fsr=0x%x, "
"iova=0x%016llx, fsynr=0x%x, cb=%d\n",
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0641/1376] thermal: intel: int3400: clean up ODVP on probe failures
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (639 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0640/1376] iommu/qcom: Fix inverted fault report check in qcom_iommu_fault() Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0642/1376] ext4: clear stale xarray tags on folios skipped during writeback Greg Kroah-Hartman
` (357 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Rafael J. Wysocki,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ Upstream commit d83dc9ce57a746a6dca28439bcc0575d26fa6986 ]
evaluate_odvp() creates per-ODVP sysfs files before the thermal zone
and later probe resources are registered. The current unwind path only
calls cleanup_odvp() from the late sysfs failure path, so failures after
evaluate_odvp() but before that label, including
thermal_tripless_zone_device_register() failures, leave the ODVP files
and storage behind.
Move the ODVP cleanup to the common ART/TRT unwind path so every failure
after evaluate_odvp() releases the ODVP state. Also clear the cached
ODVP pointers in cleanup_odvp(), because evaluate_odvp() can already call
it for partial setup failures while probe continues.
Fixes: 006f006f1e5c ("thermal/int340x_thermal: Export OEM vendor variables")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260623015140.19300-1-pengpeng@iscas.ac.cn
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/thermal/intel/int340x_thermal/int3400_thermal.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c
index f547d386ae805..0e18f4f6ccb88 100644
--- a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c
+++ b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c
@@ -363,8 +363,10 @@ static void cleanup_odvp(struct int3400_thermal_priv *priv)
kfree(priv->odvp_attrs[i].attr.attr.name);
}
kfree(priv->odvp_attrs);
+ priv->odvp_attrs = NULL;
}
kfree(priv->odvp);
+ priv->odvp = NULL;
priv->odvp_count = 0;
}
@@ -646,7 +648,6 @@ static int int3400_thermal_probe(struct platform_device *pdev)
acpi_remove_notify_handler(priv->adev->handle, ACPI_DEVICE_NOTIFY,
int3400_notify);
free_sysfs:
- cleanup_odvp(priv);
if (!ZERO_OR_NULL_PTR(priv->data_vault)) {
sysfs_remove_group(&pdev->dev.kobj, &data_attribute_group);
kfree(priv->data_vault);
@@ -660,6 +661,7 @@ static int int3400_thermal_probe(struct platform_device *pdev)
acpi_thermal_rel_misc_device_remove(priv->adev->handle);
thermal_zone_device_unregister(priv->thermal);
free_art_trt:
+ cleanup_odvp(priv);
kfree(priv->trts);
kfree(priv->arts);
free_priv:
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0642/1376] ext4: clear stale xarray tags on folios skipped during writeback
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (640 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0641/1376] thermal: intel: int3400: clean up ODVP on probe failures Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0643/1376] ext4: drain in-flight DIO before buffered write fallback Greg Kroah-Hartman
` (356 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gerald Yang, Jan Kara, Theodore Tso,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gerald Yang <gerald.yang@canonical.com>
[ Upstream commit ec524aae479b4b2078c47492b90ec21200bce434 ]
In data=journal mode, the writeback thread can hit the
WARN_ON_ONCE(sb_rdonly(sb)) in ext4_journal_check_start() while the
superblock is being remounted read-only during reboot:
Workqueue: writeback wb_workfn (flush-253:0)
RIP: 0010:ext4_journal_check_start+0x8b/0xd0
Call Trace:
__ext4_journal_start_sb+0x3c/0x1e0
mpage_prepare_extent_to_map+0x4af/0x580
ext4_do_writepages+0x3c0/0x1080
ext4_writepages+0xc8/0x1a0
do_writepages+0xc4/0x180
__writeback_single_inode+0x45/0x2f0
writeback_sb_inodes+0x26b/0x5d0
__writeback_inodes_wb+0x54/0x100
wb_writeback+0x1ac/0x320
wb_workfn+0x394/0x470
And followed by the warning:
EXT4-fs warning (device vda1): ext4_evict_inode:195: inode #6263:
comm (sd-umount): data will be lost
This issue is not reproduced every time, but frequently.
The reproduction step is to create a VM with 8 CPUs, 16G memory and
setup data=journal:
sudo tune2fs -o journal_data /dev/vda1
Run fio:
rm -f fiotest
fio --name=fiotest --rw=randwrite --bs=4k --runtime=6 --ioengine=libaio
--iodepth=256 --numjobs=8 --filename=fiotest --filesize=30G
--group_reporting
Reboot the VM, and check the console output from:
virsh console testvm
But there is no dirty inode, folio_clear_dirty_for_io clears PG_dirty
but leaves tags PAGECACHE_TAG_DIRTY and PAGECACHE_TAG_TOWRITE set which
are only cleared by __folio_start_writeback.
In data=journal mode, jbd2 checkpoints the journalled data to its final
location and clears its own dirty flag without touching folio PG_dirty
or xarray dirty flags.
The commit f4a2b42e7891 ("ext4: fix stale xarray tags after writeback")
fixes when PG_dirty is still set but there is no dirty page.
Another case is PG_dirty is cleared, but PAGECACHE_TAG_DIRTY and
PAGECACHE_TAG_TOWRITE is still set. In this case, writeback thread
checks clean folio and skips it in mpage_prepare_extent_to_map:
if (!folio_test_dirty(folio) ||
...
folio_unlcok(folio);
continue
And never reaches ext4_bio_write_folio where the commit f4a2b42e7891
clears the stale xarray tags. Print debug logs after the filesystem
is remounted read-only:
writepages RDONLY nrpages=2048 dirtytag=1 wbtag=0 towrite=1 sync=0
And all folios are actually clean:
folio idx=3 dirty=0 wb=0 checked=0 dirtybuf=0 jbddirty=0 mapped=1
...
We need to clear the xarray stale tags for such clean folios by
cycling them through writeback in the skip path, the same way
f4a2b42e7891 does in ext4_bio_write_folio.
Fixes: dff4ac75eeee ("ext4: move keep_towrite handling to ext4_bio_write_page()")
Signed-off-by: Gerald Yang <gerald.yang@canonical.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20260625160127.162272-1-gerald.yang@canonical.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/inode.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index b299c0a5f2ec2..fa303effb18a0 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -2489,13 +2489,25 @@ static int mpage_prepare_extent_to_map(struct mpage_da_data *mpd)
* page is already under writeback and we are not doing
* a data integrity writeback, skip the page
*/
- if (!folio_test_dirty(folio) ||
- (folio_test_writeback(folio) &&
- (mpd->wbc->sync_mode == WB_SYNC_NONE)) ||
+ if ((folio_test_writeback(folio) &&
+ mpd->wbc->sync_mode == WB_SYNC_NONE) ||
unlikely(folio->mapping != mapping)) {
folio_unlock(folio);
continue;
}
+ /*
+ * If the folio is clean, skip writing it back.
+ * Cycle the folio through the writeback state
+ * though, to clear stale xarray tags.
+ */
+ if (!folio_test_dirty(folio)) {
+ if (!folio_test_writeback(folio)) {
+ __folio_start_writeback(folio, false);
+ folio_end_writeback(folio);
+ }
+ folio_unlock(folio);
+ continue;
+ }
folio_wait_writeback(folio);
BUG_ON(folio_test_writeback(folio));
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0643/1376] ext4: drain in-flight DIO before buffered write fallback
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (641 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0642/1376] ext4: clear stale xarray tags on folios skipped during writeback Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0644/1376] wifi: ath6kl: avoid buffer overreads in WMI event handlers Greg Kroah-Hartman
` (355 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhang Yi, Jan Kara, Baokun Li,
Theodore Tso, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <libaokun@linux.alibaba.com>
[ Upstream commit 15cdefd0c0522f9d5e12d947fa04f4c11649b699 ]
generic/746 started failing intermittently on ext3 (no-extent inodes).
The test triggers 'Page cache invalidation failure on direct I/O'
warnings and subsequent fsync returns -EIO. Adding a 50ms delay
between ext4_buffered_write_iter() and filemap_write_and_wait_range()
in ext4_dio_write_iter() makes the race almost always reproducible.
On no-extent inodes, DIO writes to holes cannot use unwritten extents,
so ext4_iomap_alloc() leaves m_flags=0 and ext4_map_blocks() returns 0.
The iomap layer then returns -ENOTBLK, causing fallback to buffered I/O.
The fallback path in ext4_dio_write_iter() calls
ext4_buffered_write_iter() which dirties pages, then does flush and
invalidate. However, there's an unprotected window between
ext4_buffered_write_iter() returning (with inode lock released) and
the subsequent flush+invalidate.
Concurrent async DIO completions from other threads can run
kiocb_invalidate_post_direct_write() during this window. If pages have
been re-dirtied, post-invalidation finds dirty pages and triggers the
warning, setting -EIO in the error sequence.
Consider a file with two 4k extents: [hole][written]. Thread A does
DIO to the written extent, while thread B does DIO spanning both:
kworker A (4k DIO, allocated block) kworker B (8k DIO, fallback)
----------------------------------- ----------------------------
inode_lock_shared() inode_lock_shared()
iomap_dio_rw(): iomap_dio_rw():
kiocb_invalidate_pages -> clean iomap_begin -> -ENOTBLK
submit_bio (async) dio->size = 0
inode_unlock_shared() inode_unlock_shared()
[bio pending in block layer] /* fallback: lock released */
ext4_buffered_write_iter()
inode_lock(exclusive)
generic_perform_write()
-> dirty pages [0, 8k]
inode_unlock(exclusive)
/* pages dirty, no lock */
[bio completes] filemap_write_and_wait_range()
iomap_dio_complete() -> flush dirty pages
kiocb_invalidate_post_direct_write() invalidate_mapping_pages()
invalidate_inode_pages2_range()
-> finds dirty page!
-> dio_warn_stale_pagecache()
-> errseq_set(-EIO)
This issue can be triggered through normal I/O paths, not just
intentionally overlapping DIO writes from userspace. For example,
generic/746 uses a loop device where multiple kworkers issue concurrent
I/O to the backing file. Additionally, when block_size < folio_size,
non-overlapping DIO writes that share a large folio can also trigger
the race.
Add inode_dio_wait() in ext4_buffered_write_iter() before
ext4_write_checks() to drain all in-flight DIO. This ensures that
all DIO clears existing pages before submitting IO (via
kiocb_invalidate_pages()), all BIO waits for all DIO to complete
(via inode_dio_wait()), and ext4_write_checks() observes the inode
size after all completed DIO so that ext4_block_zero_eof() does not
race with in-flight DIO, thus eliminating the race.
Fixes: 378f32bab371 ("ext4: introduce direct I/O write using iomap infrastructure")
Suggested-by: Zhang Yi <yi.zhang@huawei.com>
Link: https://patch.msgid.link/d1adcf7c-c276-458d-9cac-68a4410f7626@gmail.com
Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Baokun Li <libaokun@linux.alibaba.com>
Link: https://patch.msgid.link/20260629113827.4074335-3-libaokun@linux.alibaba.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/file.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/fs/ext4/file.c b/fs/ext4/file.c
index 7d949ed0ab5fa..fe990ce16ddb5 100644
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -292,6 +292,13 @@ static ssize_t ext4_buffered_write_iter(struct kiocb *iocb,
return -EOPNOTSUPP;
inode_lock(inode);
+
+ /*
+ * Prevent concurrent direct I/O and buffered I/O to the same file
+ * range. Wait for in-flight DIO to finish before dirtying pages.
+ */
+ inode_dio_wait(inode);
+
ret = ext4_write_checks(iocb, from);
if (ret <= 0)
goto out;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0644/1376] wifi: ath6kl: avoid buffer overreads in WMI event handlers
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (642 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0643/1376] ext4: drain in-flight DIO before buffered write fallback Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0645/1376] wifi: ath12k: Correctly copy the hint BSSID in WMI scan request Greg Kroah-Hartman
` (354 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baochen Qiang, Jeff Johnson,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
[ Upstream commit f57314aade9d74d30f3360ec5ef85a83654748be ]
The following WMI event handlers currently read from the event buffer
without first verifying that the message was large enough to hold the
expected event:
ath6kl_wmi_scan_complete_rx()
ath6kl_wmi_addba_req_event_rx()
ath6kl_wmi_delba_req_event_rx()
Add length checks to prevent overread.
Fixes: bdcd81707973 ("Add ath6kl cleaned up driver")
Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260711-ath6kl_wmi_scan_complete_rx-v2-1-22dc0f7f45e7@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath6kl/wmi.c | 17 +++++++++++++++--
1 file changed, 15 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
index 447896b871c3e..eacaae752d8ae 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.c
+++ b/drivers/net/wireless/ath/ath6kl/wmi.c
@@ -1296,6 +1296,9 @@ static int ath6kl_wmi_scan_complete_rx(struct wmi *wmi, u8 *datap, int len,
{
struct wmi_scan_complete_event *ev;
+ if (len < sizeof(*ev))
+ return -EINVAL;
+
ev = (struct wmi_scan_complete_event *) datap;
ath6kl_scan_complete_evt(vif, a_sle32_to_cpu(ev->status));
@@ -3372,7 +3375,12 @@ static int ath6kl_wmi_get_pmkid_list_event_rx(struct wmi *wmi, u8 *datap,
static int ath6kl_wmi_addba_req_event_rx(struct wmi *wmi, u8 *datap, int len,
struct ath6kl_vif *vif)
{
- struct wmi_addba_req_event *cmd = (struct wmi_addba_req_event *) datap;
+ struct wmi_addba_req_event *cmd;
+
+ if (len < sizeof(*cmd))
+ return -EINVAL;
+
+ cmd = (struct wmi_addba_req_event *)datap;
aggr_recv_addba_req_evt(vif, cmd->tid,
le16_to_cpu(cmd->st_seq_no), cmd->win_sz);
@@ -3383,7 +3391,12 @@ static int ath6kl_wmi_addba_req_event_rx(struct wmi *wmi, u8 *datap, int len,
static int ath6kl_wmi_delba_req_event_rx(struct wmi *wmi, u8 *datap, int len,
struct ath6kl_vif *vif)
{
- struct wmi_delba_event *cmd = (struct wmi_delba_event *) datap;
+ struct wmi_delba_event *cmd;
+
+ if (len < sizeof(*cmd))
+ return -EINVAL;
+
+ cmd = (struct wmi_delba_event *)datap;
aggr_recv_delba_req_evt(vif, cmd->tid);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0645/1376] wifi: ath12k: Correctly copy the hint BSSID in WMI scan request
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (643 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0644/1376] wifi: ath6kl: avoid buffer overreads in WMI event handlers Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0646/1376] wifi: ath11k: " Greg Kroah-Hartman
` (353 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baochen Qiang, Rameshkumar Sundaram,
Jeff Johnson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
[ Upstream commit 7b0bd40e97a00991122122d5888ae455fb2bfc7a ]
Currently, in ath12k_wmi_send_scan_start_cmd(), the logic to populate
the hint_bssid copies the BSSID in the wrong direction, from the
firmware message to the argument buffer. Swap the parameters so that
the BSSID is correctly populated in the firmware message from the
argument buffer.
Compile tested only.
Reported-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Closes: https://lore.kernel.org/linux-wireless/afbff608-a005-43c4-af76-968a58bf0cc3@oss.qualcomm.com/
Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260713-ath12k_wmi_send_scan_start_cmd-bad-hint_bssid-v1-1-4ffc4a472992@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/wmi.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c
index 761c169c992f1..58cbacbb6f665 100644
--- a/drivers/net/wireless/ath/ath12k/wmi.c
+++ b/drivers/net/wireless/ath/ath12k/wmi.c
@@ -2479,8 +2479,8 @@ int ath12k_wmi_send_scan_start_cmd(struct ath12k *ar,
for (i = 0; i < arg->num_hint_bssid; ++i) {
hint_bssid->freq_flags =
arg->hint_bssid[i].freq_flags;
- ether_addr_copy(&arg->hint_bssid[i].bssid.addr[0],
- &hint_bssid->bssid.addr[0]);
+ ether_addr_copy(&hint_bssid->bssid.addr[0],
+ &arg->hint_bssid[i].bssid.addr[0]);
hint_bssid++;
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0646/1376] wifi: ath11k: Correctly copy the hint BSSID in WMI scan request
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (644 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0645/1376] wifi: ath12k: Correctly copy the hint BSSID in WMI scan request Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0647/1376] wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() Greg Kroah-Hartman
` (352 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baochen Qiang, Rameshkumar Sundaram,
Jeff Johnson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
[ Upstream commit 6fe2dddf59bbb2a96be0fcf23a205807b25ac173 ]
Currently, in ath11k_wmi_send_scan_start_cmd(), the logic to populate
the hint_bssid copies the BSSID in the wrong direction, from the
firmware message to the argument buffer. Swap the parameters so that
the BSSID is correctly populated in the firmware message from the
argument buffer.
This issue was reported on ath12k, but exists in ath11k as well.
Compile tested only.
Reported-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Closes: https://lore.kernel.org/linux-wireless/afbff608-a005-43c4-af76-968a58bf0cc3@oss.qualcomm.com/
Fixes: 74601ecfef6e ("ath11k: Add support for 6g scan hint")
Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260713-ath12k_wmi_send_scan_start_cmd-bad-hint_bssid-v1-2-4ffc4a472992@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath11k/wmi.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c
index 5f15f7acd5132..2f70541461d8e 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.c
+++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -2411,8 +2411,8 @@ int ath11k_wmi_send_scan_start_cmd(struct ath11k *ar,
for (i = 0; i < params->num_hint_bssid; ++i) {
hint_bssid->freq_flags =
params->hint_bssid[i].freq_flags;
- ether_addr_copy(¶ms->hint_bssid[i].bssid.addr[0],
- &hint_bssid->bssid.addr[0]);
+ ether_addr_copy(&hint_bssid->bssid.addr[0],
+ ¶ms->hint_bssid[i].bssid.addr[0]);
hint_bssid++;
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0647/1376] wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (645 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0646/1376] wifi: ath11k: " Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0648/1376] wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() Greg Kroah-Hartman
` (351 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rameshkumar Sundaram, Baochen Qiang,
Jeff Johnson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
[ Upstream commit 7698656a2f7b045af5a6859766238cefea1b1945 ]
Currently, in ath12k_wmi_op_rx(), the firmware buffer is read without
first verifying that the buffer has enough data to hold a header. This
could result in a buffer overread.
Update the logic to verify the buffer contains at least enough data to
hold a wmi_cmd_hdr before reading from the buffer.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3
Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260716-ath12k_wmi_op_rx-overread-v1-1-327a4b1c2372@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/wmi.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c
index 58cbacbb6f665..111b0c91d4dee 100644
--- a/drivers/net/wireless/ath/ath12k/wmi.c
+++ b/drivers/net/wireless/ath/ath12k/wmi.c
@@ -7196,12 +7196,12 @@ static void ath12k_wmi_op_rx(struct ath12k_base *ab, struct sk_buff *skb)
struct wmi_cmd_hdr *cmd_hdr;
enum wmi_tlv_event_id id;
- cmd_hdr = (struct wmi_cmd_hdr *)skb->data;
- id = le32_get_bits(cmd_hdr->cmd_id, WMI_CMD_HDR_CMD_ID);
-
- if (!skb_pull(skb, sizeof(struct wmi_cmd_hdr)))
+ cmd_hdr = skb_pull_data(skb, sizeof(*cmd_hdr));
+ if (!cmd_hdr)
goto out;
+ id = le32_get_bits(cmd_hdr->cmd_id, WMI_CMD_HDR_CMD_ID);
+
switch (id) {
/* Process all the WMI events here */
case WMI_SERVICE_READY_EVENTID:
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0648/1376] wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (646 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0647/1376] wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0649/1376] RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap Greg Kroah-Hartman
` (350 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rameshkumar Sundaram, Baochen Qiang,
Jeff Johnson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
[ Upstream commit 9ef9dd30058cc9223c72f711dca1a28a5947d0c5 ]
Currently, in ath11k_wmi_tlv_op_rx(), the firmware buffer is read
without first verifying that the buffer has enough data to hold a
header. This could result in a buffer overread.
Add an upfront length check before dereferencing skb->data as a
wmi_cmd_hdr. The check is placed before the trace_ath11k_wmi_event()
call to preserve the existing trace semantics (tracing the full raw
WMI event including the header), unlike the analogous ath12k fix which
could use skb_pull_data() directly.
Compile tested only.
Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260716-ath11k_wmi_tlv_op_rx-overread-v1-1-0b972b3f1368@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath11k/wmi.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c
index 2f70541461d8e..570c5e051b8c9 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.c
+++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -8757,13 +8757,15 @@ static void ath11k_wmi_tlv_op_rx(struct ath11k_base *ab, struct sk_buff *skb)
struct wmi_cmd_hdr *cmd_hdr;
enum wmi_tlv_event_id id;
+ if (skb->len < sizeof(*cmd_hdr))
+ goto out;
+
cmd_hdr = (struct wmi_cmd_hdr *)skb->data;
id = FIELD_GET(WMI_CMD_HDR_CMD_ID, (cmd_hdr->cmd_id));
trace_ath11k_wmi_event(ab, id, skb->data, skb->len);
- if (skb_pull(skb, sizeof(struct wmi_cmd_hdr)) == NULL)
- goto out;
+ skb_pull(skb, sizeof(*cmd_hdr));
switch (id) {
/* Process all the WMI events here */
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0649/1376] RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (647 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0648/1376] wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0650/1376] ext4: fix buffer_head leak in ext4_init_orphan_info Greg Kroah-Hartman
` (349 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yousef Alhouseen, Selvin Xavier,
Leon Romanovsky, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Selvin Xavier <selvin.xavier@broadcom.com>
[ Upstream commit 9b66c9af7172ffcf727214fa0ebe9a5e1ed6eb16 ]
bnxt_re_mmap() rejects VM_WRITE for the DBR_PAGE and TOGGLE_PAGE mmap
flags, but a read-only mapping can still retain VM_MAYWRITE. nd later
be upgraded with mprotect(PROT_WRITE). This can bypass the write check
that only runs at mmap time.
Clear VM_MAYWRITE before vm_insert_page() in the shared DBR/toggle-page
branch, matching the existing policy that userspace writes are not
expected for these pages.
Fixes: ea222485788208 ("RDMA/bnxt_re: Update alloc_page uapi for pacing")
Suggested-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
Link: https://patch.msgid.link/20260721115440.24021-5-selvin.xavier@broadcom.com
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/bnxt_re/ib_verbs.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index 7ad5d88358b03..467bdfea6c92c 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -4389,11 +4389,13 @@ int bnxt_re_mmap(struct ib_ucontext *ib_uctx, struct vm_area_struct *vma)
case BNXT_RE_MMAP_DBR_PAGE:
case BNXT_RE_MMAP_TOGGLE_PAGE:
/* Driver doesn't expect write access for user space */
- if (vma->vm_flags & VM_WRITE)
+ if (vma->vm_flags & VM_WRITE) {
ret = -EFAULT;
- else
+ } else {
+ vm_flags_clear(vma, VM_MAYWRITE);
ret = vm_insert_page(vma, vma->vm_start,
virt_to_page((void *)bnxt_entry->mem_offset));
+ }
break;
default:
ret = -EINVAL;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0650/1376] ext4: fix buffer_head leak in ext4_init_orphan_info
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (648 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0649/1376] RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0651/1376] ext4: check dir entry fits before reading the hash trailer in ext4_search_dir() Greg Kroah-Hartman
` (348 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guanghui Yang, Jan Kara,
Theodore Tso, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guanghui Yang <3497809730@qq.com>
[ Upstream commit 05704335803b69c1bfa8637b7ada942bf2ee8a41 ]
ext4_init_orphan_info() reads orphan file blocks with ext4_bread()
and stores the returned buffer_head in oi->of_binfo[i].ob_bh.
If ext4_bread() succeeds but the orphan block magic or checksum
validation fails, the function jumps to out_free. However, the old
out_free loop starts releasing buffers from i - 1, so the current
buffer_head at index i is skipped.
This leaks the buffer_head reference obtained by ext4_bread() on the
bad magic and bad checksum error paths.
Fix this by tracking the number of successfully read buffer_heads and
releasing exactly those buffer_heads on the error path.
Fixes: 02f310fcf47f ("ext4: Speedup ext4 orphan inode handling")
Signed-off-by: Guanghui Yang <3497809730@qq.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/tencent_B38798612A159E21450ECF959016371B0807@qq.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/orphan.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/fs/ext4/orphan.c b/fs/ext4/orphan.c
index d06e6aef4683d..7a5893dc18114 100644
--- a/fs/ext4/orphan.c
+++ b/fs/ext4/orphan.c
@@ -573,6 +573,7 @@ int ext4_init_orphan_info(struct super_block *sb)
int i, j;
int ret;
int free;
+ int loaded = 0;
__le32 *bdata;
int inodes_per_ob = ext4_inodes_per_orphan_block(sb);
struct ext4_orphan_block_tail *ot;
@@ -616,6 +617,7 @@ int ext4_init_orphan_info(struct super_block *sb)
ret = -EIO;
goto out_free;
}
+ loaded++;
ot = ext4_orphan_block_tail(sb, oi->of_binfo[i].ob_bh);
if (le32_to_cpu(ot->ob_magic) != EXT4_ORPHAN_BLOCK_MAGIC) {
ext4_error(sb, "orphan file block %d: bad magic", i);
@@ -638,8 +640,10 @@ int ext4_init_orphan_info(struct super_block *sb)
iput(inode);
return 0;
out_free:
- for (i--; i >= 0; i--)
- brelse(oi->of_binfo[i].ob_bh);
+ while (loaded > 0) {
+ loaded--;
+ brelse(oi->of_binfo[loaded].ob_bh);
+ }
kvfree(oi->of_binfo);
out_put:
iput(inode);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0651/1376] ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (649 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0650/1376] ext4: fix buffer_head leak in ext4_init_orphan_info Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0652/1376] ARM: dts: allwinner: a10: Fix PMU interrupt Greg Kroah-Hartman
` (347 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei,
Andreas Dilger, Jan Kara, Theodore Tso, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
[ Upstream commit c7e6b863d298f56522d0d08554bbea7f142e6588 ]
For casefolded encrypted directories ext4 stores an 8-byte hash trailer
after the name (EXT4_DIRENT_HASHES()), at an offset derived from
de->name_len. On the sb_no_casefold_compat_fallback() path ext4_match()
reads that trailer, but ext4_search_dir()'s by-hand pre-check only tests
de->name + de->name_len <= dlimit, which proves the name fits, not the
rounded trailer. A crafted entry whose name ends at the block boundary
passes the check while EXT4_DIRENT_HASHES(de) lands past the block end,
so ext4_match() reads out of bounds on an ordinary lookup. KASAN reports
it as a use-after-free when the page after the directory block holds a
freed object:
BUG: KASAN: use-after-free in ext4_match (fs/ext4/namei.c:1435)
Read of size 4 at addr ffff888010458000 by task exploit
Call Trace:
ext4_match (fs/ext4/namei.c:1435)
ext4_search_dir (fs/ext4/namei.c:1470)
__ext4_find_entry (fs/ext4/namei.c:1268 fs/ext4/namei.c:1632)
ext4_lookup (fs/ext4/namei.c:1703 fs/ext4/namei.c:1769)
...
filename_lookup (fs/namei.c:2842)
vfs_statx (fs/stat.c:353)
__do_sys_newfstatat (fs/stat.c:538)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Require, for hash-in-dirent directories, that the whole entry including
the rounded trailer fits before calling ext4_match(). This is the same
bound ext4_check_dir_entry() already enforces via ext4_dir_rec_len(), so
no well-formed entry is rejected. The other caller, ext4_find_dest_de(),
runs ext4_check_dir_entry() first and is unaffected.
Fixes: 471fbbea7ff7 ("ext4: handle casefolding with encryption")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20260709184101.441348-1-xmei5@asu.edu
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/namei.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index e50c066b6cc45..f115ac0a10d59 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -1499,6 +1499,8 @@ int ext4_search_dir(struct buffer_head *bh, char *search_buf, int buf_size,
/* this code is executed quadratically often */
/* do minimal checking `by hand' */
if (de->name + de->name_len <= dlimit &&
+ (!ext4_hash_in_dirent(dir) ||
+ (char *)de + ext4_dir_rec_len(de->name_len, dir) <= dlimit) &&
ext4_match(dir, fname, de)) {
/* found a match - just to be sure, do
* a full check */
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0652/1376] ARM: dts: allwinner: a10: Fix PMU interrupt
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (650 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0651/1376] ext4: check dir entry fits before reading the hash trailer in ext4_search_dir() Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0653/1376] cpufreq/amd-pstate: Store the boost numerator as highest perf again Greg Kroah-Hartman
` (346 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andre Przywara, Chen-Yu Tsai,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andre Przywara <andre.przywara@arm.com>
[ Upstream commit eb7051f756460d7b951e94d9656e31ebb631ba28 ]
The Performance Monitoring Unit of the Cortex-A8 cores in the Allwinner
A10 SoC is connected to interrupt line 66, not 3. This is shown in the
manual (where interrupt 3 is assigned to UART2, also in our .dtsi), but
has also been confirmed by triggering an PMU overflow interrupt and
inspecting the IRQ controller status registers (from U-Boot).
Please note that "perf stat" does not use interrupts, this might explain
why this evaded the initial testing.
Fixes: 7e345d25c796 ("ARM: dts: sun4i-a10: Add PMU node")
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Link: https://patch.msgid.link/20260720215128.5761-1-andre.przywara@arm.com
Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/allwinner/sun4i-a10.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/allwinner/sun4i-a10.dtsi b/arch/arm/boot/dts/allwinner/sun4i-a10.dtsi
index 51a6464aab9a3..cabf619c2e217 100644
--- a/arch/arm/boot/dts/allwinner/sun4i-a10.dtsi
+++ b/arch/arm/boot/dts/allwinner/sun4i-a10.dtsi
@@ -185,7 +185,7 @@ de: display-engine {
pmu {
compatible = "arm,cortex-a8-pmu";
- interrupts = <3>;
+ interrupts = <66>;
};
reserved-memory {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0653/1376] cpufreq/amd-pstate: Store the boost numerator as highest perf again
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (651 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0652/1376] ARM: dts: allwinner: a10: Fix PMU interrupt Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0654/1376] ACPI: CPPC: Add IS_OPTIONAL_CPC_REG macro to judge if a cpc_reg is optional Greg Kroah-Hartman
` (345 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dhananjay Ugwekar, Gautham R. Shenoy,
Mario Limonciello, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <mario.limonciello@amd.com>
[ Upstream commit 50a062a7620051c09adacd6d140ebd56881a333b ]
commit ad4caad58d91d ("cpufreq: amd-pstate: Merge
amd_pstate_highest_perf_set() into amd_get_boost_ratio_numerator()")
changed the semantics for highest perf and commit 18d9b52271213
("cpufreq/amd-pstate: Use nominal perf for limits when boost is disabled")
worked around those semantic changes.
This however is a confusing result and furthermore makes it awkward to
change frequency limits and boost due to the scaling differences. Restore
the boost numerator to highest perf again.
Suggested-by: Dhananjay Ugwekar <Dhananjay.Ugwekar@amd.com>
Reviewed-by: Gautham R. Shenoy <gautham.shenoy@amd.com>
Fixes: ad4caad58d91 ("cpufreq: amd-pstate: Merge amd_pstate_highest_perf_set() into amd_get_boost_ratio_numerator()")
Link: https://lore.kernel.org/r/20241209185248.16301-2-mario.limonciello@amd.com
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Stable-dep-of: 9dfd13f80c85 ("cpufreq/amd-pstate: Toggle auto_sel in active mode on shared memory systems")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/admin-guide/pm/amd-pstate.rst | 4 +---
drivers/cpufreq/amd-pstate.c | 25 ++++++++++++---------
2 files changed, 16 insertions(+), 13 deletions(-)
diff --git a/Documentation/admin-guide/pm/amd-pstate.rst b/Documentation/admin-guide/pm/amd-pstate.rst
index 210a808b74ec2..412423c54f258 100644
--- a/Documentation/admin-guide/pm/amd-pstate.rst
+++ b/Documentation/admin-guide/pm/amd-pstate.rst
@@ -251,9 +251,7 @@ performance supported in `AMD CPPC Performance Capability <perf_cap_>`_).
In some ASICs, the highest CPPC performance is not the one in the ``_CPC``
table, so we need to expose it to sysfs. If boost is not active, but
still supported, this maximum frequency will be larger than the one in
-``cpuinfo``. On systems that support preferred core, the driver will have
-different values for some cores than others and this will reflect the values
-advertised by the platform at bootup.
+``cpuinfo``.
This attribute is read-only.
``amd_pstate_lowest_nonlinear_freq``
diff --git a/drivers/cpufreq/amd-pstate.c b/drivers/cpufreq/amd-pstate.c
index c0e073b0425ec..de687d073b7b2 100644
--- a/drivers/cpufreq/amd-pstate.c
+++ b/drivers/cpufreq/amd-pstate.c
@@ -368,15 +368,19 @@ static inline int amd_pstate_enable(bool enable)
static int pstate_init_perf(struct amd_cpudata *cpudata)
{
- u64 cap1;
+ u64 cap1, numerator;
int ret = rdmsrl_safe_on_cpu(cpudata->cpu, MSR_AMD_CPPC_CAP1,
&cap1);
if (ret)
return ret;
- WRITE_ONCE(cpudata->highest_perf, AMD_CPPC_HIGHEST_PERF(cap1));
- WRITE_ONCE(cpudata->max_limit_perf, AMD_CPPC_HIGHEST_PERF(cap1));
+ ret = amd_get_boost_ratio_numerator(cpudata->cpu, &numerator);
+ if (ret)
+ return ret;
+
+ WRITE_ONCE(cpudata->highest_perf, numerator);
+ WRITE_ONCE(cpudata->max_limit_perf, numerator);
WRITE_ONCE(cpudata->nominal_perf, AMD_CPPC_NOMINAL_PERF(cap1));
WRITE_ONCE(cpudata->lowest_nonlinear_perf, AMD_CPPC_LOWNONLIN_PERF(cap1));
WRITE_ONCE(cpudata->lowest_perf, AMD_CPPC_LOWEST_PERF(cap1));
@@ -388,13 +392,18 @@ static int pstate_init_perf(struct amd_cpudata *cpudata)
static int cppc_init_perf(struct amd_cpudata *cpudata)
{
struct cppc_perf_caps cppc_perf;
+ u64 numerator;
int ret = cppc_get_perf_caps(cpudata->cpu, &cppc_perf);
if (ret)
return ret;
- WRITE_ONCE(cpudata->highest_perf, cppc_perf.highest_perf);
- WRITE_ONCE(cpudata->max_limit_perf, cppc_perf.highest_perf);
+ ret = amd_get_boost_ratio_numerator(cpudata->cpu, &numerator);
+ if (ret)
+ return ret;
+
+ WRITE_ONCE(cpudata->highest_perf, numerator);
+ WRITE_ONCE(cpudata->max_limit_perf, numerator);
WRITE_ONCE(cpudata->nominal_perf, cppc_perf.nominal_perf);
WRITE_ONCE(cpudata->lowest_nonlinear_perf,
cppc_perf.lowest_nonlinear_perf);
@@ -867,7 +876,6 @@ static int amd_pstate_init_freq(struct amd_cpudata *cpudata)
{
int ret;
u32 min_freq, max_freq;
- u64 numerator;
u32 nominal_perf, nominal_freq;
u32 lowest_nonlinear_perf, lowest_nonlinear_freq;
u32 boost_ratio, lowest_nonlinear_ratio;
@@ -889,10 +897,7 @@ static int amd_pstate_init_freq(struct amd_cpudata *cpudata)
nominal_perf = READ_ONCE(cpudata->nominal_perf);
- ret = amd_get_boost_ratio_numerator(cpudata->cpu, &numerator);
- if (ret)
- return ret;
- boost_ratio = div_u64(numerator << SCHED_CAPACITY_SHIFT, nominal_perf);
+ boost_ratio = div_u64(cpudata->highest_perf << SCHED_CAPACITY_SHIFT, nominal_perf);
max_freq = (nominal_freq * boost_ratio >> SCHED_CAPACITY_SHIFT) * 1000;
lowest_nonlinear_perf = READ_ONCE(cpudata->lowest_nonlinear_perf);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0654/1376] ACPI: CPPC: Add IS_OPTIONAL_CPC_REG macro to judge if a cpc_reg is optional
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (652 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0653/1376] cpufreq/amd-pstate: Store the boost numerator as highest perf again Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0655/1376] ACPI: CPPC: Optimize cppc_get_perf() Greg Kroah-Hartman
` (344 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pierre Gondois, Lifeng Zheng,
Mario Limonciello, Rafael J. Wysocki, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lifeng Zheng <zhenglifeng1@huawei.com>
[ Upstream commit e3d7935a6c6138da51626d2b956a079dd0e6671b ]
In ACPI 6.5, s8.4.6.1 _CPC (Continuous Performance Control), whether
each of the per-cpu cpc_regs[] is mandatory or optional is defined.
Since the CPC_SUPPORTED() check is only for optional _CPC fields,
another macro to check if the field is optional is needed.
Reviewed-by: Pierre Gondois <pierre.gondois@arm.com>
Signed-off-by: Lifeng Zheng <zhenglifeng1@huawei.com>
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://patch.msgid.link/20250411093855.982491-2-zhenglifeng1@huawei.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: 9dfd13f80c85 ("cpufreq/amd-pstate: Toggle auto_sel in active mode on shared memory systems")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/cppc_acpi.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c
index fd6a83e3d4301..9f158353b3603 100644
--- a/drivers/acpi/cppc_acpi.c
+++ b/drivers/acpi/cppc_acpi.c
@@ -129,6 +129,20 @@ static DEFINE_PER_CPU(struct cpc_desc *, cpc_desc_ptr);
#define CPC_SUPPORTED(cpc) ((cpc)->type == ACPI_TYPE_INTEGER ? \
!!(cpc)->cpc_entry.int_value : \
!IS_NULL_REG(&(cpc)->cpc_entry.reg))
+
+/*
+ * Each bit indicates the optionality of the register in per-cpu
+ * cpc_regs[] with the corresponding index. 0 means mandatory and 1
+ * means optional.
+ */
+#define REG_OPTIONAL (0x1FC7D0)
+
+/*
+ * Use the index of the register in per-cpu cpc_regs[] to check if
+ * it's an optional one.
+ */
+#define IS_OPTIONAL_CPC_REG(reg_idx) (REG_OPTIONAL & (1U << (reg_idx)))
+
/*
* Arbitrary Retries in case the remote processor is slow to respond
* to PCC commands. Keeping it high enough to cover emulators where
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0655/1376] ACPI: CPPC: Optimize cppc_get_perf()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (653 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0654/1376] ACPI: CPPC: Add IS_OPTIONAL_CPC_REG macro to judge if a cpc_reg is optional Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0656/1376] ACPI: CPPC: Rename cppc_get_perf() to cppc_get_reg_val() Greg Kroah-Hartman
` (343 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pierre Gondois, Lifeng Zheng,
Mario Limonciello, Rafael J. Wysocki, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lifeng Zheng <zhenglifeng1@huawei.com>
[ Upstream commit 45f3763a2122553e548fa0430b77605dc23f00cc ]
Optimize cppc_get_perf() with three changes:
1. Change the error kind to "no such device" when pcc_ss_id < 0, as
other register value getting functions.
2. Add a check to ensure the pointer 'perf' is no null.
3. Add a check to verify if the register is supported to be read before
using it. The logic is:
(1) If the register is of the integer type, check whether the
register is optional and its value is 0. If yes, the register
is not supported.
(2) If the register is of other types, a null one is not supported.
4. Return the result of cpc_read() instead of 0.
Reviewed-by: Pierre Gondois <pierre.gondois@arm.com>
Signed-off-by: Lifeng Zheng <zhenglifeng1@huawei.com>
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://patch.msgid.link/20250411093855.982491-3-zhenglifeng1@huawei.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: 9dfd13f80c85 ("cpufreq/amd-pstate: Toggle auto_sel in active mode on shared memory systems")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/cppc_acpi.c | 24 +++++++++++++++++-------
1 file changed, 17 insertions(+), 7 deletions(-)
diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c
index 9f158353b3603..1d857af8e7176 100644
--- a/drivers/acpi/cppc_acpi.c
+++ b/drivers/acpi/cppc_acpi.c
@@ -1195,6 +1195,9 @@ static int cppc_get_perf(int cpunum, enum cppc_regs reg_idx, u64 *perf)
struct cpc_desc *cpc_desc = per_cpu(cpc_desc_ptr, cpunum);
struct cpc_register_resource *reg;
+ if (perf == NULL)
+ return -EINVAL;
+
if (!cpc_desc) {
pr_debug("No CPC descriptor for CPU:%d\n", cpunum);
return -ENODEV;
@@ -1202,20 +1205,29 @@ static int cppc_get_perf(int cpunum, enum cppc_regs reg_idx, u64 *perf)
reg = &cpc_desc->cpc_regs[reg_idx];
+ if ((reg->type == ACPI_TYPE_INTEGER && IS_OPTIONAL_CPC_REG(reg_idx) &&
+ !reg->cpc_entry.int_value) || (reg->type != ACPI_TYPE_INTEGER &&
+ IS_NULL_REG(®->cpc_entry.reg))) {
+ pr_debug("CPC register is not supported\n");
+ return -EOPNOTSUPP;
+ }
+
if (CPC_IN_PCC(reg)) {
int pcc_ss_id = per_cpu(cpu_pcc_subspace_idx, cpunum);
struct cppc_pcc_data *pcc_ss_data = NULL;
- int ret = 0;
+ int ret;
- if (pcc_ss_id < 0)
- return -EIO;
+ if (pcc_ss_id < 0) {
+ pr_debug("Invalid pcc_ss_id\n");
+ return -ENODEV;
+ }
pcc_ss_data = pcc_data[pcc_ss_id];
down_write(&pcc_ss_data->pcc_lock);
if (send_pcc_cmd(pcc_ss_id, CMD_READ) >= 0)
- cpc_read(cpunum, reg, perf);
+ ret = cpc_read(cpunum, reg, perf);
else
ret = -EIO;
@@ -1224,9 +1236,7 @@ static int cppc_get_perf(int cpunum, enum cppc_regs reg_idx, u64 *perf)
return ret;
}
- cpc_read(cpunum, reg, perf);
-
- return 0;
+ return cpc_read(cpunum, reg, perf);
}
/**
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0656/1376] ACPI: CPPC: Rename cppc_get_perf() to cppc_get_reg_val()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (654 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0655/1376] ACPI: CPPC: Optimize cppc_get_perf() Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0657/1376] ACPI: CPPC: Add cppc_set_reg_val() Greg Kroah-Hartman
` (342 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pierre Gondois, Lifeng Zheng,
Mario Limonciello, Rafael J. Wysocki, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lifeng Zheng <zhenglifeng1@huawei.com>
[ Upstream commit 714d103ce868cd0718d0e5262cbc76384a2eb03a ]
Rename cppc_get_perf() to cppc_get_reg_val() as a generic function to
read CPPC registers.
Reviewed-by: Pierre Gondois <pierre.gondois@arm.com>
Signed-off-by: Lifeng Zheng <zhenglifeng1@huawei.com>
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://patch.msgid.link/20250411093855.982491-4-zhenglifeng1@huawei.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: 9dfd13f80c85 ("cpufreq/amd-pstate: Toggle auto_sel in active mode on shared memory systems")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/cppc_acpi.c | 22 +++++++++++-----------
1 file changed, 11 insertions(+), 11 deletions(-)
diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c
index 1d857af8e7176..28c8ec2b38aac 100644
--- a/drivers/acpi/cppc_acpi.c
+++ b/drivers/acpi/cppc_acpi.c
@@ -1190,16 +1190,16 @@ static int cpc_write(int cpu, struct cpc_register_resource *reg_res, u64 val)
return ret_val;
}
-static int cppc_get_perf(int cpunum, enum cppc_regs reg_idx, u64 *perf)
+static int cppc_get_reg_val(int cpu, enum cppc_regs reg_idx, u64 *val)
{
- struct cpc_desc *cpc_desc = per_cpu(cpc_desc_ptr, cpunum);
+ struct cpc_desc *cpc_desc = per_cpu(cpc_desc_ptr, cpu);
struct cpc_register_resource *reg;
- if (perf == NULL)
+ if (val == NULL)
return -EINVAL;
if (!cpc_desc) {
- pr_debug("No CPC descriptor for CPU:%d\n", cpunum);
+ pr_debug("No CPC descriptor for CPU:%d\n", cpu);
return -ENODEV;
}
@@ -1213,7 +1213,7 @@ static int cppc_get_perf(int cpunum, enum cppc_regs reg_idx, u64 *perf)
}
if (CPC_IN_PCC(reg)) {
- int pcc_ss_id = per_cpu(cpu_pcc_subspace_idx, cpunum);
+ int pcc_ss_id = per_cpu(cpu_pcc_subspace_idx, cpu);
struct cppc_pcc_data *pcc_ss_data = NULL;
int ret;
@@ -1227,7 +1227,7 @@ static int cppc_get_perf(int cpunum, enum cppc_regs reg_idx, u64 *perf)
down_write(&pcc_ss_data->pcc_lock);
if (send_pcc_cmd(pcc_ss_id, CMD_READ) >= 0)
- ret = cpc_read(cpunum, reg, perf);
+ ret = cpc_read(cpu, reg, val);
else
ret = -EIO;
@@ -1236,7 +1236,7 @@ static int cppc_get_perf(int cpunum, enum cppc_regs reg_idx, u64 *perf)
return ret;
}
- return cpc_read(cpunum, reg, perf);
+ return cpc_read(cpu, reg, val);
}
/**
@@ -1248,7 +1248,7 @@ static int cppc_get_perf(int cpunum, enum cppc_regs reg_idx, u64 *perf)
*/
int cppc_get_desired_perf(int cpunum, u64 *desired_perf)
{
- return cppc_get_perf(cpunum, DESIRED_PERF, desired_perf);
+ return cppc_get_reg_val(cpunum, DESIRED_PERF, desired_perf);
}
EXPORT_SYMBOL_GPL(cppc_get_desired_perf);
@@ -1261,7 +1261,7 @@ EXPORT_SYMBOL_GPL(cppc_get_desired_perf);
*/
int cppc_get_nominal_perf(int cpunum, u64 *nominal_perf)
{
- return cppc_get_perf(cpunum, NOMINAL_PERF, nominal_perf);
+ return cppc_get_reg_val(cpunum, NOMINAL_PERF, nominal_perf);
}
/**
@@ -1273,7 +1273,7 @@ int cppc_get_nominal_perf(int cpunum, u64 *nominal_perf)
*/
int cppc_get_highest_perf(int cpunum, u64 *highest_perf)
{
- return cppc_get_perf(cpunum, HIGHEST_PERF, highest_perf);
+ return cppc_get_reg_val(cpunum, HIGHEST_PERF, highest_perf);
}
EXPORT_SYMBOL_GPL(cppc_get_highest_perf);
@@ -1286,7 +1286,7 @@ EXPORT_SYMBOL_GPL(cppc_get_highest_perf);
*/
int cppc_get_epp_perf(int cpunum, u64 *epp_perf)
{
- return cppc_get_perf(cpunum, ENERGY_PERF, epp_perf);
+ return cppc_get_reg_val(cpunum, ENERGY_PERF, epp_perf);
}
EXPORT_SYMBOL_GPL(cppc_get_epp_perf);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0657/1376] ACPI: CPPC: Add cppc_set_reg_val()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (655 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0656/1376] ACPI: CPPC: Rename cppc_get_perf() to cppc_get_reg_val() Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0658/1376] ACPI: CPPC: Refactor register value get and set ABIs Greg Kroah-Hartman
` (341 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pierre Gondois, Lifeng Zheng,
Mario Limonciello, Rafael J. Wysocki, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lifeng Zheng <zhenglifeng1@huawei.com>
[ Upstream commit e05c75072c2eaa6e0b152a558b3be5cbcf79a587 ]
Add cppc_set_reg_val() as a generic function for setting CPPC register
values, with this features:
1. Check register. If a register is writeable, it must be a buffer and
can not be null.
2. Extract the operations if register is in PCC out as
cppc_set_reg_val_in_pcc().
This function can be used to reduce some existing code duplication.
Reviewed-by: Pierre Gondois <pierre.gondois@arm.com>
Signed-off-by: Lifeng Zheng <zhenglifeng1@huawei.com>
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://patch.msgid.link/20250411093855.982491-6-zhenglifeng1@huawei.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: 9dfd13f80c85 ("cpufreq/amd-pstate: Toggle auto_sel in active mode on shared memory systems")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/cppc_acpi.c | 49 ++++++++++++++++++++++++++++++++++++++++
1 file changed, 49 insertions(+)
diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c
index 28c8ec2b38aac..52306eec1cca8 100644
--- a/drivers/acpi/cppc_acpi.c
+++ b/drivers/acpi/cppc_acpi.c
@@ -1239,6 +1239,55 @@ static int cppc_get_reg_val(int cpu, enum cppc_regs reg_idx, u64 *val)
return cpc_read(cpu, reg, val);
}
+static int cppc_set_reg_val_in_pcc(int cpu, struct cpc_register_resource *reg, u64 val)
+{
+ int pcc_ss_id = per_cpu(cpu_pcc_subspace_idx, cpu);
+ struct cppc_pcc_data *pcc_ss_data = NULL;
+ int ret;
+
+ if (pcc_ss_id < 0) {
+ pr_debug("Invalid pcc_ss_id\n");
+ return -ENODEV;
+ }
+
+ ret = cpc_write(cpu, reg, val);
+ if (ret)
+ return ret;
+
+ pcc_ss_data = pcc_data[pcc_ss_id];
+
+ down_write(&pcc_ss_data->pcc_lock);
+ /* after writing CPC, transfer the ownership of PCC to platform */
+ ret = send_pcc_cmd(pcc_ss_id, CMD_WRITE);
+ up_write(&pcc_ss_data->pcc_lock);
+
+ return ret;
+}
+
+static int cppc_set_reg_val(int cpu, enum cppc_regs reg_idx, u64 val)
+{
+ struct cpc_desc *cpc_desc = per_cpu(cpc_desc_ptr, cpu);
+ struct cpc_register_resource *reg;
+
+ if (!cpc_desc) {
+ pr_debug("No CPC descriptor for CPU:%d\n", cpu);
+ return -ENODEV;
+ }
+
+ reg = &cpc_desc->cpc_regs[reg_idx];
+
+ /* if a register is writeable, it must be a buffer and not null */
+ if ((reg->type != ACPI_TYPE_BUFFER) || IS_NULL_REG(®->cpc_entry.reg)) {
+ pr_debug("CPC register is not supported\n");
+ return -EOPNOTSUPP;
+ }
+
+ if (CPC_IN_PCC(reg))
+ return cppc_set_reg_val_in_pcc(cpu, reg, val);
+
+ return cpc_write(cpu, reg, val);
+}
+
/**
* cppc_get_desired_perf - Get the desired performance register value.
* @cpunum: CPU from which to get desired performance.
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0658/1376] ACPI: CPPC: Refactor register value get and set ABIs
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (656 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0657/1376] ACPI: CPPC: Add cppc_set_reg_val() Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0659/1376] ACPI: CPPC: Modify cppc_get_auto_sel_caps() to cppc_get_auto_sel() Greg Kroah-Hartman
` (340 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pierre Gondois, Lifeng Zheng,
Mario Limonciello, Rafael J. Wysocki, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lifeng Zheng <zhenglifeng1@huawei.com>
[ Upstream commit ab482f1bac6b128b8fe910b6663a4f74a3a9796c ]
Refactor register value get and set ABIs by using cppc_get_reg_val(),
cppc_set_reg_val() and CPPC_REG_VAL_READ().
Reviewed-by: Pierre Gondois <pierre.gondois@arm.com>
Signed-off-by: Lifeng Zheng <zhenglifeng1@huawei.com>
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://patch.msgid.link/20250411093855.982491-7-zhenglifeng1@huawei.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: 9dfd13f80c85 ("cpufreq/amd-pstate: Toggle auto_sel in active mode on shared memory systems")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/cppc_acpi.c | 111 +++------------------------------------
1 file changed, 7 insertions(+), 104 deletions(-)
diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c
index 52306eec1cca8..e33ad70827429 100644
--- a/drivers/acpi/cppc_acpi.c
+++ b/drivers/acpi/cppc_acpi.c
@@ -1616,44 +1616,14 @@ EXPORT_SYMBOL_GPL(cppc_set_epp_perf);
*/
int cppc_get_auto_sel_caps(int cpunum, struct cppc_perf_caps *perf_caps)
{
- struct cpc_desc *cpc_desc = per_cpu(cpc_desc_ptr, cpunum);
- struct cpc_register_resource *auto_sel_reg;
- u64 auto_sel;
-
- if (!cpc_desc) {
- pr_debug("No CPC descriptor for CPU:%d\n", cpunum);
- return -ENODEV;
- }
-
- auto_sel_reg = &cpc_desc->cpc_regs[AUTO_SEL_ENABLE];
-
- if (!CPC_SUPPORTED(auto_sel_reg))
- pr_warn_once("Autonomous mode is not unsupported!\n");
-
- if (CPC_IN_PCC(auto_sel_reg)) {
- int pcc_ss_id = per_cpu(cpu_pcc_subspace_idx, cpunum);
- struct cppc_pcc_data *pcc_ss_data = NULL;
- int ret = 0;
-
- if (pcc_ss_id < 0)
- return -ENODEV;
-
- pcc_ss_data = pcc_data[pcc_ss_id];
-
- down_write(&pcc_ss_data->pcc_lock);
-
- if (send_pcc_cmd(pcc_ss_id, CMD_READ) >= 0) {
- cpc_read(cpunum, auto_sel_reg, &auto_sel);
- perf_caps->auto_sel = (bool)auto_sel;
- } else {
- ret = -EIO;
- }
-
- up_write(&pcc_ss_data->pcc_lock);
+ u64 auto_sel;
+ int ret;
+ ret = cppc_get_reg_val(cpunum, AUTO_SEL_ENABLE, &auto_sel);
+ if (ret)
return ret;
- }
+ perf_caps->auto_sel = (bool)auto_sel;
return 0;
}
EXPORT_SYMBOL_GPL(cppc_get_auto_sel_caps);
@@ -1665,43 +1635,7 @@ EXPORT_SYMBOL_GPL(cppc_get_auto_sel_caps);
*/
int cppc_set_auto_sel(int cpu, bool enable)
{
- int pcc_ss_id = per_cpu(cpu_pcc_subspace_idx, cpu);
- struct cpc_register_resource *auto_sel_reg;
- struct cpc_desc *cpc_desc = per_cpu(cpc_desc_ptr, cpu);
- struct cppc_pcc_data *pcc_ss_data = NULL;
- int ret = -EINVAL;
-
- if (!cpc_desc) {
- pr_debug("No CPC descriptor for CPU:%d\n", cpu);
- return -ENODEV;
- }
-
- auto_sel_reg = &cpc_desc->cpc_regs[AUTO_SEL_ENABLE];
-
- if (CPC_IN_PCC(auto_sel_reg)) {
- if (pcc_ss_id < 0) {
- pr_debug("Invalid pcc_ss_id\n");
- return -ENODEV;
- }
-
- if (CPC_SUPPORTED(auto_sel_reg)) {
- ret = cpc_write(cpu, auto_sel_reg, enable);
- if (ret)
- return ret;
- }
-
- pcc_ss_data = pcc_data[pcc_ss_id];
-
- down_write(&pcc_ss_data->pcc_lock);
- /* after writing CPC, transfer the ownership of PCC to platform */
- ret = send_pcc_cmd(pcc_ss_id, CMD_WRITE);
- up_write(&pcc_ss_data->pcc_lock);
- } else {
- ret = -ENOTSUPP;
- pr_debug("_CPC in PCC is not supported\n");
- }
-
- return ret;
+ return cppc_set_reg_val(cpu, AUTO_SEL_ENABLE, enable);
}
EXPORT_SYMBOL_GPL(cppc_set_auto_sel);
@@ -1715,38 +1649,7 @@ EXPORT_SYMBOL_GPL(cppc_set_auto_sel);
*/
int cppc_set_enable(int cpu, bool enable)
{
- int pcc_ss_id = per_cpu(cpu_pcc_subspace_idx, cpu);
- struct cpc_register_resource *enable_reg;
- struct cpc_desc *cpc_desc = per_cpu(cpc_desc_ptr, cpu);
- struct cppc_pcc_data *pcc_ss_data = NULL;
- int ret = -EINVAL;
-
- if (!cpc_desc) {
- pr_debug("No CPC descriptor for CPU:%d\n", cpu);
- return -EINVAL;
- }
-
- enable_reg = &cpc_desc->cpc_regs[ENABLE];
-
- if (CPC_IN_PCC(enable_reg)) {
-
- if (pcc_ss_id < 0)
- return -EIO;
-
- ret = cpc_write(cpu, enable_reg, enable);
- if (ret)
- return ret;
-
- pcc_ss_data = pcc_data[pcc_ss_id];
-
- down_write(&pcc_ss_data->pcc_lock);
- /* after writing CPC, transfer the ownership of PCC to platfrom */
- ret = send_pcc_cmd(pcc_ss_id, CMD_WRITE);
- up_write(&pcc_ss_data->pcc_lock);
- return ret;
- }
-
- return cpc_write(cpu, enable_reg, enable);
+ return cppc_set_reg_val(cpu, ENABLE, enable);
}
EXPORT_SYMBOL_GPL(cppc_set_enable);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0659/1376] ACPI: CPPC: Modify cppc_get_auto_sel_caps() to cppc_get_auto_sel()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (657 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0658/1376] ACPI: CPPC: Refactor register value get and set ABIs Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0660/1376] cpufreq/amd-pstate: Toggle auto_sel in active mode on shared memory systems Greg Kroah-Hartman
` (339 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pierre Gondois, Lifeng Zheng,
Mario Limonciello, Rafael J. Wysocki, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lifeng Zheng <zhenglifeng1@huawei.com>
[ Upstream commit 2605e4ab6615ef43361b18fc6d08dd884896aad8 ]
Modify cppc_get_auto_sel_caps() to cppc_get_auto_sel(). Using a
cppc_perf_caps to carry the value is unnecessary.
Add a check to ensure the pointer 'enable' is not null.
Reviewed-by: Pierre Gondois <pierre.gondois@arm.com>
Signed-off-by: Lifeng Zheng <zhenglifeng1@huawei.com>
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://patch.msgid.link/20250411093855.982491-8-zhenglifeng1@huawei.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: 9dfd13f80c85 ("cpufreq/amd-pstate: Toggle auto_sel in active mode on shared memory systems")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/cppc_acpi.c | 18 +++++++++++-------
drivers/cpufreq/amd-pstate.c | 3 ++-
include/acpi/cppc_acpi.h | 6 +++---
3 files changed, 16 insertions(+), 11 deletions(-)
diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c
index e33ad70827429..8ad6d12b77727 100644
--- a/drivers/acpi/cppc_acpi.c
+++ b/drivers/acpi/cppc_acpi.c
@@ -1610,23 +1610,27 @@ int cppc_set_epp_perf(int cpu, struct cppc_perf_ctrls *perf_ctrls, bool enable)
EXPORT_SYMBOL_GPL(cppc_set_epp_perf);
/**
- * cppc_get_auto_sel_caps - Read autonomous selection register.
- * @cpunum : CPU from which to read register.
- * @perf_caps : struct where autonomous selection register value is updated.
+ * cppc_get_auto_sel() - Read autonomous selection register.
+ * @cpu: CPU from which to read register.
+ * @enable: Return address.
*/
-int cppc_get_auto_sel_caps(int cpunum, struct cppc_perf_caps *perf_caps)
+int cppc_get_auto_sel(int cpu, bool *enable)
{
u64 auto_sel;
int ret;
- ret = cppc_get_reg_val(cpunum, AUTO_SEL_ENABLE, &auto_sel);
+ if (enable == NULL)
+ return -EINVAL;
+
+ ret = cppc_get_reg_val(cpu, AUTO_SEL_ENABLE, &auto_sel);
if (ret)
return ret;
- perf_caps->auto_sel = (bool)auto_sel;
+ *enable = (bool)auto_sel;
+
return 0;
}
-EXPORT_SYMBOL_GPL(cppc_get_auto_sel_caps);
+EXPORT_SYMBOL_GPL(cppc_get_auto_sel);
/**
* cppc_set_auto_sel - Write autonomous selection register.
diff --git a/drivers/cpufreq/amd-pstate.c b/drivers/cpufreq/amd-pstate.c
index de687d073b7b2..5806bcc18517a 100644
--- a/drivers/cpufreq/amd-pstate.c
+++ b/drivers/cpufreq/amd-pstate.c
@@ -393,6 +393,7 @@ static int cppc_init_perf(struct amd_cpudata *cpudata)
{
struct cppc_perf_caps cppc_perf;
u64 numerator;
+ bool auto_sel;
int ret = cppc_get_perf_caps(cpudata->cpu, &cppc_perf);
if (ret)
@@ -414,7 +415,7 @@ static int cppc_init_perf(struct amd_cpudata *cpudata)
if (cppc_state == AMD_PSTATE_ACTIVE)
return 0;
- ret = cppc_get_auto_sel_caps(cpudata->cpu, &cppc_perf);
+ ret = cppc_get_auto_sel(cpudata->cpu, &auto_sel);
if (ret) {
pr_warn("failed to get auto_sel, ret: %d\n", ret);
return 0;
diff --git a/include/acpi/cppc_acpi.h b/include/acpi/cppc_acpi.h
index 62d368bcd9eca..31767c65be20c 100644
--- a/include/acpi/cppc_acpi.h
+++ b/include/acpi/cppc_acpi.h
@@ -159,7 +159,7 @@ extern int cpc_read_ffh(int cpunum, struct cpc_reg *reg, u64 *val);
extern int cpc_write_ffh(int cpunum, struct cpc_reg *reg, u64 val);
extern int cppc_get_epp_perf(int cpunum, u64 *epp_perf);
extern int cppc_set_epp_perf(int cpu, struct cppc_perf_ctrls *perf_ctrls, bool enable);
-extern int cppc_get_auto_sel_caps(int cpunum, struct cppc_perf_caps *perf_caps);
+extern int cppc_get_auto_sel(int cpu, bool *enable);
extern int cppc_set_auto_sel(int cpu, bool enable);
extern int amd_get_highest_perf(unsigned int cpu, u32 *highest_perf);
extern int amd_get_boost_ratio_numerator(unsigned int cpu, u64 *numerator);
@@ -229,11 +229,11 @@ static inline int cppc_get_epp_perf(int cpunum, u64 *epp_perf)
{
return -EOPNOTSUPP;
}
-static inline int cppc_set_auto_sel(int cpu, bool enable)
+static inline int cppc_get_auto_sel(int cpu, bool *enable)
{
return -EOPNOTSUPP;
}
-static inline int cppc_get_auto_sel_caps(int cpunum, struct cppc_perf_caps *perf_caps)
+static inline int cppc_set_auto_sel(int cpu, bool enable)
{
return -EOPNOTSUPP;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0660/1376] cpufreq/amd-pstate: Toggle auto_sel in active mode on shared memory systems
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (658 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0659/1376] ACPI: CPPC: Modify cppc_get_auto_sel_caps() to cppc_get_auto_sel() Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0661/1376] firmware: arm_scmi: Roll back partial protocol table registration Greg Kroah-Hartman
` (338 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, K Prateek Nayak, Marco Scardovi,
K Prateek Nayak, Mario Limonciello, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Scardovi <scardracs@disroot.org>
[ Upstream commit 9dfd13f80c856eab79130403a13fa3b83199346b ]
On shared memory systems, the EPP configuration path (handled via
cppc_set_epp_perf()) is responsible for toggling on the CPPC autonomous
selection register (auto_sel).
Currently, shmem_init_perf() returns early without doing any of the auto_sel
configuration steps if cppc_state is AMD_PSTATE_ACTIVE. This skips enabling
auto_sel, leaving the CPU in non-autonomous mode.
Remove the early return check in shmem_init_perf() when cppc_state is
AMD_PSTATE_ACTIVE. Toggling auto_sel is necessary for the active mode on
shared memory systems to function based on the ACPI spec for CPPC v2 and
below.
Fixes: 2dd6d0ebf740 ("cpufreq: amd-pstate: Add guided autonomous mode")
Assisted-by: Antigravity:gemini-3.5-flash
Reviewed-by: K Prateek Nayak <kprateek.nayak@amd.com>
Tested-by: K Prateek Nayak <kprateek.nayak@amd.com>
Signed-off-by: Marco Scardovi <scardracs@disroot.org>
Reviewed-by: K Prateek Nayak <kprateek.anayk@amd.com>
Link: https://lore.kernel.org/r/20260609073042.81275-3-scardracs@disroot.org
Signed-off-by: Mario Limonciello <superm1@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/amd-pstate.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/cpufreq/amd-pstate.c b/drivers/cpufreq/amd-pstate.c
index 5806bcc18517a..cee6cc7b071ba 100644
--- a/drivers/cpufreq/amd-pstate.c
+++ b/drivers/cpufreq/amd-pstate.c
@@ -412,9 +412,6 @@ static int cppc_init_perf(struct amd_cpudata *cpudata)
WRITE_ONCE(cpudata->prefcore_ranking, cppc_perf.highest_perf);
WRITE_ONCE(cpudata->min_limit_perf, cppc_perf.lowest_perf);
- if (cppc_state == AMD_PSTATE_ACTIVE)
- return 0;
-
ret = cppc_get_auto_sel(cpudata->cpu, &auto_sel);
if (ret) {
pr_warn("failed to get auto_sel, ret: %d\n", ret);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0661/1376] firmware: arm_scmi: Roll back partial protocol table registration
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (659 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0660/1376] cpufreq/amd-pstate: Toggle auto_sel in active mode on shared memory systems Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0662/1376] firmware: arm_scmi: Unrequest devices if driver registration fails Greg Kroah-Hartman
` (337 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Sudeep Holla, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <sudeep.holla@kernel.org>
[ Upstream commit 2224b622260ba590ab56ea1585d6bf7610be25b2 ]
scmi_protocol_table_register() can leave earlier requests registered when
a later entry in the same ID table fails. Each request retains a pointer
to the driver's ID table, so a failed module load can leave a dangling
pointer after the module storage is released.
Unrequest only the successfully registered prefix, in reverse order,
before returning the failure. Leave the failed entry and the remaining
entries untouched because matching requests can be owned by another
driver.
Fixes: 2858f6e5f064 ("firmware: arm_scmi: Add multiple protocols registration support")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260722173521.2184378-1-sudeep.holla@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/arm_scmi/bus.c | 31 ++++++++++++++++++++-----------
1 file changed, 20 insertions(+), 11 deletions(-)
diff --git a/drivers/firmware/arm_scmi/bus.c b/drivers/firmware/arm_scmi/bus.c
index 2174d00feb253..f39d46b587fd5 100644
--- a/drivers/firmware/arm_scmi/bus.c
+++ b/drivers/firmware/arm_scmi/bus.c
@@ -134,17 +134,6 @@ static int scmi_protocol_device_request(const struct scmi_device_id *id_table)
return ret;
}
-static int scmi_protocol_table_register(const struct scmi_device_id *id_table)
-{
- int ret = 0;
- const struct scmi_device_id *entry;
-
- for (entry = id_table; entry->name && ret == 0; entry++)
- ret = scmi_protocol_device_request(entry);
-
- return ret;
-}
-
/**
* scmi_protocol_device_unrequest - Helper to unrequest a device
*
@@ -190,6 +179,26 @@ static void scmi_protocol_device_unrequest(const struct scmi_device_id *id_table
}
}
+static int scmi_protocol_table_register(const struct scmi_device_id *id_table)
+{
+ const struct scmi_device_id *entry;
+ int ret;
+
+ for (entry = id_table; entry->name; entry++) {
+ ret = scmi_protocol_device_request(entry);
+ if (ret)
+ goto err_unrequest;
+ }
+
+ return 0;
+
+err_unrequest:
+ while (entry != id_table)
+ scmi_protocol_device_unrequest(--entry);
+
+ return ret;
+}
+
static void
scmi_protocol_table_unregister(const struct scmi_device_id *id_table)
{
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0662/1376] firmware: arm_scmi: Unrequest devices if driver registration fails
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (660 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0661/1376] firmware: arm_scmi: Roll back partial protocol table registration Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0663/1376] perf cs-etm: Flush thread stacks after decoder reset Greg Kroah-Hartman
` (336 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Sudeep Holla, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <sudeep.holla@kernel.org>
[ Upstream commit 9f7cd6a62aa754ed6b48cbd5d50de40add1bcc86 ]
scmi_driver_register() requests protocol devices before registering the
driver. If driver_register() fails, those requests remain in the global
IDR and retain pointers to the module's ID table. Once the failed module
load releases that storage, later request matching or SCMI device creation
can dereference the stale pointers.
Unrequest the complete protocol table before returning the registration
failure. At this point table registration succeeded, so every entry is
owned by the current registration attempt.
Fixes: d3cd7c525fd2 ("firmware: arm_scmi: Refactor protocol device creation")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260722173521.2184378-2-sudeep.holla@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/arm_scmi/bus.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/firmware/arm_scmi/bus.c b/drivers/firmware/arm_scmi/bus.c
index f39d46b587fd5..771b6da2d83b6 100644
--- a/drivers/firmware/arm_scmi/bus.c
+++ b/drivers/firmware/arm_scmi/bus.c
@@ -314,10 +314,14 @@ int scmi_driver_register(struct scmi_driver *driver, struct module *owner,
driver->driver.mod_name = mod_name;
retval = driver_register(&driver->driver);
- if (!retval)
- pr_debug("Registered new scmi driver %s\n", driver->name);
+ if (retval) {
+ scmi_protocol_table_unregister(driver->id_table);
+ return retval;
+ }
- return retval;
+ pr_debug("Registered new scmi driver %s\n", driver->name);
+
+ return 0;
}
EXPORT_SYMBOL_GPL(scmi_driver_register);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0663/1376] perf cs-etm: Flush thread stacks after decoder reset
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (661 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0662/1376] firmware: arm_scmi: Unrequest devices if driver registration fails Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0664/1376] perf cs-etm: Avoid truncating AUX buffer sizes to int Greg Kroah-Hartman
` (335 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, James Clark, Leo Yan, Namhyung Kim,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <leo.yan@arm.com>
[ Upstream commit ea5075e3776846d4941dddf1549426ebd3feb81f ]
Perf resets the CoreSight decoder when moving to a new AUX trace buffer,
this causes trace discontinunity globally.
For callchain synthesis, keeping thread-stack state after decoder reset
can leave stale call/return history attached to threads that are decoded
later, producing incorrect synthesized callchains.
Flush all host thread stacks after a decoder reset. When virtualization
is present, flush the guest thread stacks as well.
Reviewed-by: James Clark <james.clark@linaro.org>
Signed-off-by: Leo Yan <leo.yan@arm.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Stable-dep-of: ec99be8a31db ("perf cs-etm: Avoid truncating AUX buffer sizes to int")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/cs-etm.c | 45 ++++++++++++++++++++++++++++++++++++++++
1 file changed, 45 insertions(+)
diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c
index 29f0211324970..5b0dc7ef3a964 100644
--- a/tools/perf/util/cs-etm.c
+++ b/tools/perf/util/cs-etm.c
@@ -2039,6 +2039,45 @@ static int cs_etm__end_block(struct cs_etm_queue *etmq,
return 0;
}
+
+static int cs_etm__flush_stack_cb(struct thread *thread,
+ void *data __maybe_unused)
+{
+ thread_stack__flush(thread);
+ return 0;
+}
+
+static void cs_etm__flush_machine_stack(struct cs_etm_queue *etmq, pid_t pid)
+{
+ struct machine *machine;
+
+ machine = machines__find(&etmq->etm->session->machines, pid);
+ if (machine)
+ machine__for_each_thread(machine, cs_etm__flush_stack_cb, NULL);
+}
+
+static void cs_etm__flush_all_stack(struct cs_etm_queue *etmq)
+{
+ enum cs_etm_pid_fmt pid_fmt = cs_etm__get_pid_fmt(etmq);
+
+ if (!etmq->etm->synth_opts.last_branch)
+ return;
+
+ switch (pid_fmt) {
+ case CS_ETM_PIDFMT_CTXTID2:
+ /* Clear the guest stack if virtualization is supported */
+ cs_etm__flush_machine_stack(etmq, DEFAULT_GUEST_KERNEL_ID);
+ fallthrough;
+ case CS_ETM_PIDFMT_CTXTID:
+ cs_etm__flush_machine_stack(etmq, HOST_KERNEL_ID);
+ break;
+ case CS_ETM_PIDFMT_NONE:
+ default:
+ break;
+
+ }
+}
+
/*
* cs_etm__get_data_block: Fetch a block from the auxtrace_buffer queue
* if need be.
@@ -2061,6 +2100,12 @@ static int cs_etm__get_data_block(struct cs_etm_queue *etmq)
ret = cs_etm_decoder__reset(etmq->decoder);
if (ret)
return ret;
+
+ /*
+ * Since the decoder is reset, this causes a global trace
+ * discontinuity. Flush all thread stacks.
+ */
+ cs_etm__flush_all_stack(etmq);
}
return etmq->buf_len;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0664/1376] perf cs-etm: Avoid truncating AUX buffer sizes to int
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (662 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0663/1376] perf cs-etm: Flush thread stacks after decoder reset Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0665/1376] xfrm: Fix skb double-free in xfrm_dev_direct_output() Greg Kroah-Hartman
` (334 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Suyash Mahar, Leo Yan, James Clark,
Namhyung Kim, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <leo.yan@arm.com>
[ Upstream commit ec99be8a31db999a4f866be74ea7db61dbb19f24 ]
cs_etm__get_trace() returns an int, but it used to return etmq->buf_len
on success. That value comes from auxtrace_buffer::size, which is a
size_t. For a large AUX trace block, returning the byte count through an
int can overflow and make a valid buffer look like a negative error.
The callers do not need the actual byte count from cs_etm__get_trace().
The buffer length is already stored in the etmq->buf_len. The callers
only need to distinguish three states:
< 0: error
= 0: no more AUX buffers
> 0: data is available
Make cs_etm__get_trace() return 0 for all non-error cases and use
etmq->buf_len to indicate whether a new buffer was found. Then make
cs_etm__get_data_block() return 1 whenever data is available, instead of
returning the buffer length.
Also refactor cs_etm__get_data_block() to make its return value
semantics clearer.
Reported-by: Suyash Mahar <smahar@meta.com>
Fixes: 8224531cf5a1 ("perf cs-etm: Modularize auxtrace_buffer fetch function")
Signed-off-by: Leo Yan <leo.yan@arm.com>
Reviewed-by: James Clark <james.clark@linaro.org>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/cs-etm.c | 46 +++++++++++++++++++++++-----------------
1 file changed, 26 insertions(+), 20 deletions(-)
diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c
index 5b0dc7ef3a964..a6344ff19f746 100644
--- a/tools/perf/util/cs-etm.c
+++ b/tools/perf/util/cs-etm.c
@@ -1484,8 +1484,7 @@ cs_etm__get_trace(struct cs_etm_queue *etmq)
etmq->buf_used = 0;
etmq->buf_len = aux_buffer->size;
etmq->buf = aux_buffer->data;
-
- return etmq->buf_len;
+ return 0;
}
/*
@@ -2089,26 +2088,33 @@ static int cs_etm__get_data_block(struct cs_etm_queue *etmq)
{
int ret;
- if (!etmq->buf_len) {
- ret = cs_etm__get_trace(etmq);
- if (ret <= 0)
- return ret;
- /*
- * We cannot assume consecutive blocks in the data file
- * are contiguous, reset the decoder to force re-sync.
- */
- ret = cs_etm_decoder__reset(etmq->decoder);
- if (ret)
- return ret;
+ /* The current block is not finished */
+ if (etmq->buf_len)
+ return 1;
- /*
- * Since the decoder is reset, this causes a global trace
- * discontinuity. Flush all thread stacks.
- */
- cs_etm__flush_all_stack(etmq);
- }
+ ret = cs_etm__get_trace(etmq);
+ if (ret < 0)
+ return ret;
+
+ /* No more buffer to read */
+ if (!etmq->buf_len)
+ return 0;
+
+ /*
+ * We cannot assume consecutive blocks in the data file
+ * are contiguous, reset the decoder to force re-sync.
+ */
+ ret = cs_etm_decoder__reset(etmq->decoder);
+ if (ret)
+ return ret;
+
+ /*
+ * Since the decoder is reset, this causes a global trace
+ * discontinuity. Flush all thread stacks.
+ */
+ cs_etm__flush_all_stack(etmq);
- return etmq->buf_len;
+ return 1;
}
static bool cs_etm__is_svc_instr(struct cs_etm_queue *etmq,
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0665/1376] xfrm: Fix skb double-free in xfrm_dev_direct_output()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (663 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0664/1376] perf cs-etm: Avoid truncating AUX buffer sizes to int Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0666/1376] RDMA/erdma: Probe the erdma RoCEv2 device Greg Kroah-Hartman
` (333 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sanghyun Park, Steffen Klassert,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanghyun Park <sanghyun.park.cnu@gmail.com>
[ Upstream commit 2aed51fc58d9ce450e2c116efb956160fd06fa02 ]
A return value other than 1 from local_out() means that the skb has been
consumed or its ownership was transferred. xfrm_dev_direct_output()
nevertheless frees the skb on this path, causing a double-free when
netfilter drops the packet and invalidating any other owner.
Return the local_out() result directly, matching the ownership handling
in xfrm_output_resume().
Fixes: 5eddd76ec2fd ("xfrm: fix tunnel mode TX datapath in packet offload mode")
Signed-off-by: Sanghyun Park <sanghyun.park.cnu@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/xfrm/xfrm_output.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index a5b5d82bd7550..53654c5fa9e98 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -627,10 +627,8 @@ static int xfrm_dev_direct_output(struct sock *sk, struct xfrm_state *x,
nf_reset_ct(skb);
err = skb_dst(skb)->ops->local_out(net, sk, skb);
- if (unlikely(err != 1)) {
- kfree_skb(skb);
+ if (unlikely(err != 1))
return err;
- }
/* In transport mode, network destination is
* directly reachable, while in tunnel mode,
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0666/1376] RDMA/erdma: Probe the erdma RoCEv2 device
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (664 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0665/1376] xfrm: Fix skb double-free in xfrm_dev_direct_output() Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0667/1376] RDMA/erdma: Add GID table management interfaces Greg Kroah-Hartman
` (332 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Boshi Yu, Cheng Xu, Leon Romanovsky,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boshi Yu <boshiyu@linux.alibaba.com>
[ Upstream commit a883e71345a0101ff33be23a8d13f112ec4defb5 ]
Currently, the erdma driver supports both the iWARP and RoCEv2 protocols.
The erdma driver reads the ERDMA_REGS_DEV_PROTO_REG register to identify
the protocol used by the erdma device. Since each protocol requires
different ib_device_ops, we introduce the erdma_device_ops_iwarp and
erdma_device_ops_rocev2 for iWARP and RoCEv2 protocols, respectively.
Signed-off-by: Boshi Yu <boshiyu@linux.alibaba.com>
Link: https://patch.msgid.link/20241211020930.68833-2-boshiyu@linux.alibaba.com
Reviewed-by: Cheng Xu <chengyou@linux.alibaba.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Stable-dep-of: 652befcba956 ("RDMA/erdma: complete object teardown when the destroy command fails")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/erdma/Kconfig | 2 +-
drivers/infiniband/hw/erdma/erdma.h | 3 +-
drivers/infiniband/hw/erdma/erdma_hw.h | 7 +++++
drivers/infiniband/hw/erdma/erdma_main.c | 34 +++++++++++++++++------
drivers/infiniband/hw/erdma/erdma_verbs.c | 16 ++++++++++-
drivers/infiniband/hw/erdma/erdma_verbs.h | 12 ++++++++
6 files changed, 62 insertions(+), 12 deletions(-)
diff --git a/drivers/infiniband/hw/erdma/Kconfig b/drivers/infiniband/hw/erdma/Kconfig
index 169038e3ceb12..267fc1f3c42af 100644
--- a/drivers/infiniband/hw/erdma/Kconfig
+++ b/drivers/infiniband/hw/erdma/Kconfig
@@ -5,7 +5,7 @@ config INFINIBAND_ERDMA
depends on INFINIBAND_ADDR_TRANS
depends on INFINIBAND_USER_ACCESS
help
- This is a RDMA/iWarp driver for Alibaba Elastic RDMA Adapter(ERDMA),
+ This is a RDMA driver for Alibaba Elastic RDMA Adapter(ERDMA),
which supports RDMA features in Alibaba cloud environment.
To compile this driver as module, choose M here. The module will be
diff --git a/drivers/infiniband/hw/erdma/erdma.h b/drivers/infiniband/hw/erdma/erdma.h
index 3c166359448d0..ad4dc1a4bdc72 100644
--- a/drivers/infiniband/hw/erdma/erdma.h
+++ b/drivers/infiniband/hw/erdma/erdma.h
@@ -16,7 +16,7 @@
#include "erdma_hw.h"
#define DRV_MODULE_NAME "erdma"
-#define ERDMA_NODE_DESC "Elastic RDMA(iWARP) stack"
+#define ERDMA_NODE_DESC "Elastic RDMA Adapter stack"
struct erdma_eq {
void *qbuf;
@@ -215,6 +215,7 @@ struct erdma_dev {
struct dma_pool *db_pool;
struct dma_pool *resp_pool;
+ enum erdma_proto_type proto;
};
static inline void *get_queue_entry(void *qbuf, u32 idx, u32 depth, u32 shift)
diff --git a/drivers/infiniband/hw/erdma/erdma_hw.h b/drivers/infiniband/hw/erdma/erdma_hw.h
index 05978f3b14759..970b392d4fb4e 100644
--- a/drivers/infiniband/hw/erdma/erdma_hw.h
+++ b/drivers/infiniband/hw/erdma/erdma_hw.h
@@ -21,8 +21,15 @@
#define ERDMA_NUM_MSIX_VEC 32U
#define ERDMA_MSIX_VECTOR_CMDQ 0
+/* erdma device protocol type */
+enum erdma_proto_type {
+ ERDMA_PROTO_IWARP = 0,
+ ERDMA_PROTO_ROCEV2 = 1,
+};
+
/* PCIe Bar0 Registers. */
#define ERDMA_REGS_VERSION_REG 0x0
+#define ERDMA_REGS_DEV_PROTO_REG 0xC
#define ERDMA_REGS_DEV_CTRL_REG 0x10
#define ERDMA_REGS_DEV_ST_REG 0x14
#define ERDMA_REGS_NETDEV_MAC_L_REG 0x18
diff --git a/drivers/infiniband/hw/erdma/erdma_main.c b/drivers/infiniband/hw/erdma/erdma_main.c
index 62f497a710041..cf97bb79e5951 100644
--- a/drivers/infiniband/hw/erdma/erdma_main.c
+++ b/drivers/infiniband/hw/erdma/erdma_main.c
@@ -172,6 +172,8 @@ static int erdma_device_init(struct erdma_dev *dev, struct pci_dev *pdev)
{
int ret;
+ dev->proto = erdma_reg_read32(dev, ERDMA_REGS_DEV_PROTO_REG);
+
dev->resp_pool = dma_pool_create("erdma_resp_pool", &pdev->dev,
ERDMA_HW_RESP_SIZE, ERDMA_HW_RESP_SIZE,
0);
@@ -474,6 +476,21 @@ static void erdma_res_cb_free(struct erdma_dev *dev)
bitmap_free(dev->res_cb[i].bitmap);
}
+static const struct ib_device_ops erdma_device_ops_rocev2 = {
+ .get_link_layer = erdma_get_link_layer,
+};
+
+static const struct ib_device_ops erdma_device_ops_iwarp = {
+ .iw_accept = erdma_accept,
+ .iw_add_ref = erdma_qp_get_ref,
+ .iw_connect = erdma_connect,
+ .iw_create_listen = erdma_create_listen,
+ .iw_destroy_listen = erdma_destroy_listen,
+ .iw_get_qp = erdma_get_ibqp,
+ .iw_reject = erdma_reject,
+ .iw_rem_ref = erdma_qp_put_ref,
+};
+
static const struct ib_device_ops erdma_device_ops = {
.owner = THIS_MODULE,
.driver_id = RDMA_DRIVER_ERDMA,
@@ -494,14 +511,6 @@ static const struct ib_device_ops erdma_device_ops = {
.get_dma_mr = erdma_get_dma_mr,
.get_hw_stats = erdma_get_hw_stats,
.get_port_immutable = erdma_get_port_immutable,
- .iw_accept = erdma_accept,
- .iw_add_ref = erdma_qp_get_ref,
- .iw_connect = erdma_connect,
- .iw_create_listen = erdma_create_listen,
- .iw_destroy_listen = erdma_destroy_listen,
- .iw_get_qp = erdma_get_ibqp,
- .iw_reject = erdma_reject,
- .iw_rem_ref = erdma_qp_put_ref,
.map_mr_sg = erdma_map_mr_sg,
.mmap = erdma_mmap,
.mmap_free = erdma_mmap_free,
@@ -537,7 +546,14 @@ static int erdma_ib_device_add(struct pci_dev *pdev)
if (ret)
return ret;
- ibdev->node_type = RDMA_NODE_RNIC;
+ if (erdma_device_iwarp(dev)) {
+ ibdev->node_type = RDMA_NODE_RNIC;
+ ib_set_device_ops(ibdev, &erdma_device_ops_iwarp);
+ } else {
+ ibdev->node_type = RDMA_NODE_IB_CA;
+ ib_set_device_ops(ibdev, &erdma_device_ops_rocev2);
+ }
+
memcpy(ibdev->node_desc, ERDMA_NODE_DESC, sizeof(ERDMA_NODE_DESC));
/*
diff --git a/drivers/infiniband/hw/erdma/erdma_verbs.c b/drivers/infiniband/hw/erdma/erdma_verbs.c
index bf5627e3f237b..b330f33d32808 100644
--- a/drivers/infiniband/hw/erdma/erdma_verbs.c
+++ b/drivers/infiniband/hw/erdma/erdma_verbs.c
@@ -395,8 +395,17 @@ int erdma_query_port(struct ib_device *ibdev, u32 port,
int erdma_get_port_immutable(struct ib_device *ibdev, u32 port,
struct ib_port_immutable *port_immutable)
{
+ struct erdma_dev *dev = to_edev(ibdev);
+
+ if (erdma_device_iwarp(dev)) {
+ port_immutable->core_cap_flags = RDMA_CORE_PORT_IWARP;
+ } else {
+ port_immutable->core_cap_flags =
+ RDMA_CORE_PORT_IBA_ROCE_UDP_ENCAP;
+ port_immutable->max_mad_size = IB_MGMT_MAD_SIZE;
+ }
+
port_immutable->gid_tbl_len = 1;
- port_immutable->core_cap_flags = RDMA_CORE_PORT_IWARP;
return 0;
}
@@ -1842,3 +1851,8 @@ int erdma_get_hw_stats(struct ib_device *ibdev, struct rdma_hw_stats *stats,
return stats->num_counters;
}
+
+enum rdma_link_layer erdma_get_link_layer(struct ib_device *ibdev, u32 port_num)
+{
+ return IB_LINK_LAYER_ETHERNET;
+}
diff --git a/drivers/infiniband/hw/erdma/erdma_verbs.h b/drivers/infiniband/hw/erdma/erdma_verbs.h
index c998acd39a788..90e2b35a0973a 100644
--- a/drivers/infiniband/hw/erdma/erdma_verbs.h
+++ b/drivers/infiniband/hw/erdma/erdma_verbs.h
@@ -291,6 +291,16 @@ int erdma_modify_qp_internal(struct erdma_qp *qp, struct erdma_qp_attrs *attrs,
void erdma_qp_llp_close(struct erdma_qp *qp);
void erdma_qp_cm_drop(struct erdma_qp *qp);
+static inline bool erdma_device_iwarp(struct erdma_dev *dev)
+{
+ return dev->proto == ERDMA_PROTO_IWARP;
+}
+
+static inline bool erdma_device_rocev2(struct erdma_dev *dev)
+{
+ return dev->proto == ERDMA_PROTO_ROCEV2;
+}
+
static inline struct erdma_ucontext *to_ectx(struct ib_ucontext *ibctx)
{
return container_of(ibctx, struct erdma_ucontext, ibucontext);
@@ -370,5 +380,7 @@ struct rdma_hw_stats *erdma_alloc_hw_port_stats(struct ib_device *device,
u32 port_num);
int erdma_get_hw_stats(struct ib_device *ibdev, struct rdma_hw_stats *stats,
u32 port, int index);
+enum rdma_link_layer erdma_get_link_layer(struct ib_device *ibdev,
+ u32 port_num);
#endif
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0667/1376] RDMA/erdma: Add GID table management interfaces
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (665 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0666/1376] RDMA/erdma: Probe the erdma RoCEv2 device Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0668/1376] RDMA/erdma: Add the erdma_query_pkey() interface Greg Kroah-Hartman
` (331 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Boshi Yu, Cheng Xu, Leon Romanovsky,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boshi Yu <boshiyu@linux.alibaba.com>
[ Upstream commit 6edc15abc256f676ae44ac2ddc914567859bd1a7 ]
The erdma_add_gid() interface inserts a GID entry at the
specified index. The erdma_del_gid() interface deletes the
GID entry at the specified index. Additionally, programs
can invoke the erdma_query_port() and erdma_get_port_immutable()
interfaces to query the GID table length.
Signed-off-by: Boshi Yu <boshiyu@linux.alibaba.com>
Link: https://patch.msgid.link/20241211020930.68833-3-boshiyu@linux.alibaba.com
Reviewed-by: Cheng Xu <chengyou@linux.alibaba.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Stable-dep-of: 652befcba956 ("RDMA/erdma: complete object teardown when the destroy command fails")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/erdma/erdma.h | 1 +
drivers/infiniband/hw/erdma/erdma_hw.h | 28 +++++++++++-
drivers/infiniband/hw/erdma/erdma_main.c | 3 ++
drivers/infiniband/hw/erdma/erdma_verbs.c | 56 +++++++++++++++++++++--
drivers/infiniband/hw/erdma/erdma_verbs.h | 12 +++++
5 files changed, 96 insertions(+), 4 deletions(-)
diff --git a/drivers/infiniband/hw/erdma/erdma.h b/drivers/infiniband/hw/erdma/erdma.h
index ad4dc1a4bdc72..42dabf674f5d4 100644
--- a/drivers/infiniband/hw/erdma/erdma.h
+++ b/drivers/infiniband/hw/erdma/erdma.h
@@ -148,6 +148,7 @@ struct erdma_devattr {
u32 max_mr;
u32 max_pd;
u32 max_mw;
+ u32 max_gid;
u32 local_dma_key;
};
diff --git a/drivers/infiniband/hw/erdma/erdma_hw.h b/drivers/infiniband/hw/erdma/erdma_hw.h
index 970b392d4fb4e..7e03c5f97501a 100644
--- a/drivers/infiniband/hw/erdma/erdma_hw.h
+++ b/drivers/infiniband/hw/erdma/erdma_hw.h
@@ -21,6 +21,9 @@
#define ERDMA_NUM_MSIX_VEC 32U
#define ERDMA_MSIX_VECTOR_CMDQ 0
+/* RoCEv2 related */
+#define ERDMA_ROCEV2_GID_SIZE 16
+
/* erdma device protocol type */
enum erdma_proto_type {
ERDMA_PROTO_IWARP = 0,
@@ -143,7 +146,8 @@ enum CMDQ_RDMA_OPCODE {
CMDQ_OPCODE_DESTROY_CQ = 5,
CMDQ_OPCODE_REFLUSH = 6,
CMDQ_OPCODE_REG_MR = 8,
- CMDQ_OPCODE_DEREG_MR = 9
+ CMDQ_OPCODE_DEREG_MR = 9,
+ CMDQ_OPCODE_SET_GID = 14,
};
enum CMDQ_COMMON_OPCODE {
@@ -401,7 +405,29 @@ struct erdma_cmdq_query_stats_resp {
u64 rx_pps_meter_drop_packets_cnt;
};
+enum erdma_network_type {
+ ERDMA_NETWORK_TYPE_IPV4 = 0,
+ ERDMA_NETWORK_TYPE_IPV6 = 1,
+};
+
+enum erdma_set_gid_op {
+ ERDMA_SET_GID_OP_ADD = 0,
+ ERDMA_SET_GID_OP_DEL = 1,
+};
+
+/* set gid cfg */
+#define ERDMA_CMD_SET_GID_SGID_IDX_MASK GENMASK(15, 0)
+#define ERDMA_CMD_SET_GID_NTYPE_MASK BIT(16)
+#define ERDMA_CMD_SET_GID_OP_MASK BIT(31)
+
+struct erdma_cmdq_set_gid_req {
+ u64 hdr;
+ u32 cfg;
+ u8 gid[ERDMA_ROCEV2_GID_SIZE];
+};
+
/* cap qword 0 definition */
+#define ERDMA_CMD_DEV_CAP_MAX_GID_MASK GENMASK_ULL(51, 48)
#define ERDMA_CMD_DEV_CAP_MAX_CQE_MASK GENMASK_ULL(47, 40)
#define ERDMA_CMD_DEV_CAP_FLAGS_MASK GENMASK_ULL(31, 24)
#define ERDMA_CMD_DEV_CAP_MAX_RECV_WR_MASK GENMASK_ULL(23, 16)
diff --git a/drivers/infiniband/hw/erdma/erdma_main.c b/drivers/infiniband/hw/erdma/erdma_main.c
index cf97bb79e5951..77440324b7e73 100644
--- a/drivers/infiniband/hw/erdma/erdma_main.c
+++ b/drivers/infiniband/hw/erdma/erdma_main.c
@@ -400,6 +400,7 @@ static int erdma_dev_attrs_init(struct erdma_dev *dev)
dev->attrs.max_mr_size = 1ULL << ERDMA_GET_CAP(MAX_MR_SIZE, cap0);
dev->attrs.max_mw = 1 << ERDMA_GET_CAP(MAX_MW, cap1);
dev->attrs.max_recv_wr = 1 << ERDMA_GET_CAP(MAX_RECV_WR, cap0);
+ dev->attrs.max_gid = 1 << ERDMA_GET_CAP(MAX_GID, cap0);
dev->attrs.local_dma_key = ERDMA_GET_CAP(DMA_LOCAL_KEY, cap1);
dev->attrs.cc = ERDMA_GET_CAP(DEFAULT_CC, cap1);
dev->attrs.max_qp = ERDMA_NQP_PER_QBLOCK * ERDMA_GET_CAP(QBLOCK, cap1);
@@ -478,6 +479,8 @@ static void erdma_res_cb_free(struct erdma_dev *dev)
static const struct ib_device_ops erdma_device_ops_rocev2 = {
.get_link_layer = erdma_get_link_layer,
+ .add_gid = erdma_add_gid,
+ .del_gid = erdma_del_gid,
};
static const struct ib_device_ops erdma_device_ops_iwarp = {
diff --git a/drivers/infiniband/hw/erdma/erdma_verbs.c b/drivers/infiniband/hw/erdma/erdma_verbs.c
index b330f33d32808..2c22354071470 100644
--- a/drivers/infiniband/hw/erdma/erdma_verbs.c
+++ b/drivers/infiniband/hw/erdma/erdma_verbs.c
@@ -367,7 +367,13 @@ int erdma_query_port(struct ib_device *ibdev, u32 port,
memset(attr, 0, sizeof(*attr));
- attr->gid_tbl_len = 1;
+ if (erdma_device_iwarp(dev)) {
+ attr->gid_tbl_len = 1;
+ } else {
+ attr->gid_tbl_len = dev->attrs.max_gid;
+ attr->ip_gids = true;
+ }
+
attr->port_cap_flags = IB_PORT_CM_SUP | IB_PORT_DEVICE_MGMT_SUP;
attr->max_msg_sz = -1;
@@ -399,14 +405,14 @@ int erdma_get_port_immutable(struct ib_device *ibdev, u32 port,
if (erdma_device_iwarp(dev)) {
port_immutable->core_cap_flags = RDMA_CORE_PORT_IWARP;
+ port_immutable->gid_tbl_len = 1;
} else {
port_immutable->core_cap_flags =
RDMA_CORE_PORT_IBA_ROCE_UDP_ENCAP;
port_immutable->max_mad_size = IB_MGMT_MAD_SIZE;
+ port_immutable->gid_tbl_len = dev->attrs.max_gid;
}
- port_immutable->gid_tbl_len = 1;
-
return 0;
}
@@ -1856,3 +1862,47 @@ enum rdma_link_layer erdma_get_link_layer(struct ib_device *ibdev, u32 port_num)
{
return IB_LINK_LAYER_ETHERNET;
}
+
+static int erdma_set_gid(struct erdma_dev *dev, u8 op, u32 idx,
+ const union ib_gid *gid)
+{
+ struct erdma_cmdq_set_gid_req req;
+ u8 ntype;
+
+ req.cfg = FIELD_PREP(ERDMA_CMD_SET_GID_SGID_IDX_MASK, idx) |
+ FIELD_PREP(ERDMA_CMD_SET_GID_OP_MASK, op);
+
+ if (op == ERDMA_SET_GID_OP_ADD) {
+ if (ipv6_addr_v4mapped((struct in6_addr *)gid))
+ ntype = ERDMA_NETWORK_TYPE_IPV4;
+ else
+ ntype = ERDMA_NETWORK_TYPE_IPV6;
+
+ req.cfg |= FIELD_PREP(ERDMA_CMD_SET_GID_NTYPE_MASK, ntype);
+
+ memcpy(&req.gid, gid, ERDMA_ROCEV2_GID_SIZE);
+ }
+
+ erdma_cmdq_build_reqhdr(&req.hdr, CMDQ_SUBMOD_RDMA,
+ CMDQ_OPCODE_SET_GID);
+ return erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL);
+}
+
+int erdma_add_gid(const struct ib_gid_attr *attr, void **context)
+{
+ struct erdma_dev *dev = to_edev(attr->device);
+ int ret;
+
+ ret = erdma_check_gid_attr(attr);
+ if (ret)
+ return ret;
+
+ return erdma_set_gid(dev, ERDMA_SET_GID_OP_ADD, attr->index,
+ &attr->gid);
+}
+
+int erdma_del_gid(const struct ib_gid_attr *attr, void **context)
+{
+ return erdma_set_gid(to_edev(attr->device), ERDMA_SET_GID_OP_DEL,
+ attr->index, NULL);
+}
diff --git a/drivers/infiniband/hw/erdma/erdma_verbs.h b/drivers/infiniband/hw/erdma/erdma_verbs.h
index 90e2b35a0973a..23cfeaf79eaab 100644
--- a/drivers/infiniband/hw/erdma/erdma_verbs.h
+++ b/drivers/infiniband/hw/erdma/erdma_verbs.h
@@ -326,6 +326,16 @@ static inline struct erdma_cq *to_ecq(struct ib_cq *ibcq)
return container_of(ibcq, struct erdma_cq, ibcq);
}
+static inline int erdma_check_gid_attr(const struct ib_gid_attr *attr)
+{
+ u8 ntype = rdma_gid_attr_network_type(attr);
+
+ if (ntype != RDMA_NETWORK_IPV4 && ntype != RDMA_NETWORK_IPV6)
+ return -EINVAL;
+
+ return 0;
+}
+
static inline struct erdma_user_mmap_entry *
to_emmap(struct rdma_user_mmap_entry *ibmmap)
{
@@ -382,5 +392,7 @@ int erdma_get_hw_stats(struct ib_device *ibdev, struct rdma_hw_stats *stats,
u32 port, int index);
enum rdma_link_layer erdma_get_link_layer(struct ib_device *ibdev,
u32 port_num);
+int erdma_add_gid(const struct ib_gid_attr *attr, void **context);
+int erdma_del_gid(const struct ib_gid_attr *attr, void **context);
#endif
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0668/1376] RDMA/erdma: Add the erdma_query_pkey() interface
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (666 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0667/1376] RDMA/erdma: Add GID table management interfaces Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0669/1376] RDMA/erdma: Add address handle implementation Greg Kroah-Hartman
` (330 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Boshi Yu, Cheng Xu, Leon Romanovsky,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boshi Yu <boshiyu@linux.alibaba.com>
[ Upstream commit 14bcf7354a0ed2004da85b4b03afe44effd5e445 ]
The erdma_query_pkey() interface queries the PKey at the specified
index. Currently, erdma supports only one partition and returns the
default PKey for each query. Besides, the correct length of the PKey
table can be obtained by calling the erdma_query_port() and
erdma_get_port_immutable() interfaces.
Signed-off-by: Boshi Yu <boshiyu@linux.alibaba.com>
Link: https://patch.msgid.link/20241211020930.68833-4-boshiyu@linux.alibaba.com
Reviewed-by: Cheng Xu <chengyou@linux.alibaba.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Stable-dep-of: 652befcba956 ("RDMA/erdma: complete object teardown when the destroy command fails")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/erdma/erdma_hw.h | 2 ++
drivers/infiniband/hw/erdma/erdma_main.c | 1 +
drivers/infiniband/hw/erdma/erdma_verbs.c | 14 ++++++++++++++
drivers/infiniband/hw/erdma/erdma_verbs.h | 1 +
4 files changed, 18 insertions(+)
diff --git a/drivers/infiniband/hw/erdma/erdma_hw.h b/drivers/infiniband/hw/erdma/erdma_hw.h
index 7e03c5f97501a..f7f9dcac3ab01 100644
--- a/drivers/infiniband/hw/erdma/erdma_hw.h
+++ b/drivers/infiniband/hw/erdma/erdma_hw.h
@@ -23,6 +23,8 @@
/* RoCEv2 related */
#define ERDMA_ROCEV2_GID_SIZE 16
+#define ERDMA_MAX_PKEYS 1
+#define ERDMA_DEFAULT_PKEY 0xFFFF
/* erdma device protocol type */
enum erdma_proto_type {
diff --git a/drivers/infiniband/hw/erdma/erdma_main.c b/drivers/infiniband/hw/erdma/erdma_main.c
index 77440324b7e73..b9d0ad77436a7 100644
--- a/drivers/infiniband/hw/erdma/erdma_main.c
+++ b/drivers/infiniband/hw/erdma/erdma_main.c
@@ -481,6 +481,7 @@ static const struct ib_device_ops erdma_device_ops_rocev2 = {
.get_link_layer = erdma_get_link_layer,
.add_gid = erdma_add_gid,
.del_gid = erdma_del_gid,
+ .query_pkey = erdma_query_pkey,
};
static const struct ib_device_ops erdma_device_ops_iwarp = {
diff --git a/drivers/infiniband/hw/erdma/erdma_verbs.c b/drivers/infiniband/hw/erdma/erdma_verbs.c
index 2c22354071470..8de2d11317f7f 100644
--- a/drivers/infiniband/hw/erdma/erdma_verbs.c
+++ b/drivers/infiniband/hw/erdma/erdma_verbs.c
@@ -336,6 +336,9 @@ int erdma_query_device(struct ib_device *ibdev, struct ib_device_attr *attr,
attr->max_fast_reg_page_list_len = ERDMA_MAX_FRMR_PA;
attr->page_size_cap = ERDMA_PAGE_SIZE_SUPPORT;
+ if (erdma_device_rocev2(dev))
+ attr->max_pkeys = ERDMA_MAX_PKEYS;
+
if (dev->attrs.cap_flags & ERDMA_DEV_CAP_FLAGS_ATOMIC)
attr->atomic_cap = IB_ATOMIC_GLOB;
@@ -372,6 +375,7 @@ int erdma_query_port(struct ib_device *ibdev, u32 port,
} else {
attr->gid_tbl_len = dev->attrs.max_gid;
attr->ip_gids = true;
+ attr->pkey_tbl_len = ERDMA_MAX_PKEYS;
}
attr->port_cap_flags = IB_PORT_CM_SUP | IB_PORT_DEVICE_MGMT_SUP;
@@ -411,6 +415,7 @@ int erdma_get_port_immutable(struct ib_device *ibdev, u32 port,
RDMA_CORE_PORT_IBA_ROCE_UDP_ENCAP;
port_immutable->max_mad_size = IB_MGMT_MAD_SIZE;
port_immutable->gid_tbl_len = dev->attrs.max_gid;
+ port_immutable->pkey_tbl_len = ERDMA_MAX_PKEYS;
}
return 0;
@@ -1906,3 +1911,12 @@ int erdma_del_gid(const struct ib_gid_attr *attr, void **context)
return erdma_set_gid(to_edev(attr->device), ERDMA_SET_GID_OP_DEL,
attr->index, NULL);
}
+
+int erdma_query_pkey(struct ib_device *ibdev, u32 port, u16 index, u16 *pkey)
+{
+ if (index >= ERDMA_MAX_PKEYS)
+ return -EINVAL;
+
+ *pkey = ERDMA_DEFAULT_PKEY;
+ return 0;
+}
diff --git a/drivers/infiniband/hw/erdma/erdma_verbs.h b/drivers/infiniband/hw/erdma/erdma_verbs.h
index 23cfeaf79eaab..1ae6ba56f5972 100644
--- a/drivers/infiniband/hw/erdma/erdma_verbs.h
+++ b/drivers/infiniband/hw/erdma/erdma_verbs.h
@@ -394,5 +394,6 @@ enum rdma_link_layer erdma_get_link_layer(struct ib_device *ibdev,
u32 port_num);
int erdma_add_gid(const struct ib_gid_attr *attr, void **context);
int erdma_del_gid(const struct ib_gid_attr *attr, void **context);
+int erdma_query_pkey(struct ib_device *ibdev, u32 port, u16 index, u16 *pkey);
#endif
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0669/1376] RDMA/erdma: Add address handle implementation
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (667 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0668/1376] RDMA/erdma: Add the erdma_query_pkey() interface Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0670/1376] RDMA/erdma: Add erdma_modify_qp_rocev2() interface Greg Kroah-Hartman
` (329 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Boshi Yu, Cheng Xu, Leon Romanovsky,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boshi Yu <boshiyu@linux.alibaba.com>
[ Upstream commit 41dcaf48ff9e31d1441b6a74ed488360aad096d4 ]
The address handle contains the necessary information to transmit
messages to a remote peer in the RoCEv2 protocol. This commit
implements the erdma_create_ah(), erdma_destroy_ah(), and
erdma_query_ah() interfaces, which are used to create, destroy,
and query an address handle, respectively.
Signed-off-by: Boshi Yu <boshiyu@linux.alibaba.com>
Link: https://patch.msgid.link/20241211020930.68833-5-boshiyu@linux.alibaba.com
Reviewed-by: Cheng Xu <chengyou@linux.alibaba.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Stable-dep-of: 652befcba956 ("RDMA/erdma: complete object teardown when the destroy command fails")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/erdma/erdma.h | 4 +-
drivers/infiniband/hw/erdma/erdma_hw.h | 34 +++++++
drivers/infiniband/hw/erdma/erdma_main.c | 4 +
drivers/infiniband/hw/erdma/erdma_verbs.c | 114 +++++++++++++++++++++-
drivers/infiniband/hw/erdma/erdma_verbs.h | 28 ++++++
5 files changed, 182 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/hw/erdma/erdma.h b/drivers/infiniband/hw/erdma/erdma.h
index 42dabf674f5d4..4f840d8e3bebb 100644
--- a/drivers/infiniband/hw/erdma/erdma.h
+++ b/drivers/infiniband/hw/erdma/erdma.h
@@ -149,6 +149,7 @@ struct erdma_devattr {
u32 max_pd;
u32 max_mw;
u32 max_gid;
+ u32 max_ah;
u32 local_dma_key;
};
@@ -178,7 +179,8 @@ struct erdma_resource_cb {
enum {
ERDMA_RES_TYPE_PD = 0,
ERDMA_RES_TYPE_STAG_IDX = 1,
- ERDMA_RES_CNT = 2,
+ ERDMA_RES_TYPE_AH = 2,
+ ERDMA_RES_CNT = 3,
};
struct erdma_dev {
diff --git a/drivers/infiniband/hw/erdma/erdma_hw.h b/drivers/infiniband/hw/erdma/erdma_hw.h
index f7f9dcac3ab01..64d856494359e 100644
--- a/drivers/infiniband/hw/erdma/erdma_hw.h
+++ b/drivers/infiniband/hw/erdma/erdma_hw.h
@@ -9,6 +9,7 @@
#include <linux/kernel.h>
#include <linux/types.h>
+#include <linux/if_ether.h>
/* PCIe device related definition. */
#define ERDMA_PCI_WIDTH 64
@@ -150,6 +151,8 @@ enum CMDQ_RDMA_OPCODE {
CMDQ_OPCODE_REG_MR = 8,
CMDQ_OPCODE_DEREG_MR = 9,
CMDQ_OPCODE_SET_GID = 14,
+ CMDQ_OPCODE_CREATE_AH = 15,
+ CMDQ_OPCODE_DESTROY_AH = 16,
};
enum CMDQ_COMMON_OPCODE {
@@ -297,6 +300,36 @@ struct erdma_cmdq_dereg_mr_req {
u32 cfg;
};
+/* create_av cfg0 */
+#define ERDMA_CMD_CREATE_AV_FL_MASK GENMASK(19, 0)
+#define ERDMA_CMD_CREATE_AV_NTYPE_MASK BIT(20)
+
+struct erdma_av_cfg {
+ u32 cfg0;
+ u8 traffic_class;
+ u8 hop_limit;
+ u8 sl;
+ u8 rsvd;
+ u16 udp_sport;
+ u16 sgid_index;
+ u8 dmac[ETH_ALEN];
+ u8 padding[2];
+ u8 dgid[ERDMA_ROCEV2_GID_SIZE];
+};
+
+struct erdma_cmdq_create_ah_req {
+ u64 hdr;
+ u32 pdn;
+ u32 ahn;
+ struct erdma_av_cfg av_cfg;
+};
+
+struct erdma_cmdq_destroy_ah_req {
+ u64 hdr;
+ u32 pdn;
+ u32 ahn;
+};
+
/* modify qp cfg */
#define ERDMA_CMD_MODIFY_QP_STATE_MASK GENMASK(31, 24)
#define ERDMA_CMD_MODIFY_QP_CC_MASK GENMASK(23, 20)
@@ -433,6 +466,7 @@ struct erdma_cmdq_set_gid_req {
#define ERDMA_CMD_DEV_CAP_MAX_CQE_MASK GENMASK_ULL(47, 40)
#define ERDMA_CMD_DEV_CAP_FLAGS_MASK GENMASK_ULL(31, 24)
#define ERDMA_CMD_DEV_CAP_MAX_RECV_WR_MASK GENMASK_ULL(23, 16)
+#define ERDMA_CMD_DEV_CAP_MAX_AH_MASK GENMASK_ULL(15, 8)
#define ERDMA_CMD_DEV_CAP_MAX_MR_SIZE_MASK GENMASK_ULL(7, 0)
/* cap qword 1 definition */
diff --git a/drivers/infiniband/hw/erdma/erdma_main.c b/drivers/infiniband/hw/erdma/erdma_main.c
index b9d0ad77436a7..d632c09c9acd8 100644
--- a/drivers/infiniband/hw/erdma/erdma_main.c
+++ b/drivers/infiniband/hw/erdma/erdma_main.c
@@ -401,6 +401,7 @@ static int erdma_dev_attrs_init(struct erdma_dev *dev)
dev->attrs.max_mw = 1 << ERDMA_GET_CAP(MAX_MW, cap1);
dev->attrs.max_recv_wr = 1 << ERDMA_GET_CAP(MAX_RECV_WR, cap0);
dev->attrs.max_gid = 1 << ERDMA_GET_CAP(MAX_GID, cap0);
+ dev->attrs.max_ah = 1 << ERDMA_GET_CAP(MAX_AH, cap0);
dev->attrs.local_dma_key = ERDMA_GET_CAP(DMA_LOCAL_KEY, cap1);
dev->attrs.cc = ERDMA_GET_CAP(DEFAULT_CC, cap1);
dev->attrs.max_qp = ERDMA_NQP_PER_QBLOCK * ERDMA_GET_CAP(QBLOCK, cap1);
@@ -418,6 +419,7 @@ static int erdma_dev_attrs_init(struct erdma_dev *dev)
dev->res_cb[ERDMA_RES_TYPE_PD].max_cap = ERDMA_MAX_PD;
dev->res_cb[ERDMA_RES_TYPE_STAG_IDX].max_cap = dev->attrs.max_mr;
+ dev->res_cb[ERDMA_RES_TYPE_AH].max_cap = dev->attrs.max_ah;
erdma_cmdq_build_reqhdr(&req_hdr, CMDQ_SUBMOD_COMMON,
CMDQ_OPCODE_QUERY_FW_INFO);
@@ -482,6 +484,8 @@ static const struct ib_device_ops erdma_device_ops_rocev2 = {
.add_gid = erdma_add_gid,
.del_gid = erdma_del_gid,
.query_pkey = erdma_query_pkey,
+ .create_ah = erdma_create_ah,
+ .destroy_ah = erdma_destroy_ah,
};
static const struct ib_device_ops erdma_device_ops_iwarp = {
diff --git a/drivers/infiniband/hw/erdma/erdma_verbs.c b/drivers/infiniband/hw/erdma/erdma_verbs.c
index 8de2d11317f7f..8db030dc295a0 100644
--- a/drivers/infiniband/hw/erdma/erdma_verbs.c
+++ b/drivers/infiniband/hw/erdma/erdma_verbs.c
@@ -336,8 +336,10 @@ int erdma_query_device(struct ib_device *ibdev, struct ib_device_attr *attr,
attr->max_fast_reg_page_list_len = ERDMA_MAX_FRMR_PA;
attr->page_size_cap = ERDMA_PAGE_SIZE_SUPPORT;
- if (erdma_device_rocev2(dev))
+ if (erdma_device_rocev2(dev)) {
attr->max_pkeys = ERDMA_MAX_PKEYS;
+ attr->max_ah = dev->attrs.max_ah;
+ }
if (dev->attrs.cap_flags & ERDMA_DEV_CAP_FLAGS_ATOMIC)
attr->atomic_cap = IB_ATOMIC_GLOB;
@@ -1920,3 +1922,113 @@ int erdma_query_pkey(struct ib_device *ibdev, u32 port, u16 index, u16 *pkey)
*pkey = ERDMA_DEFAULT_PKEY;
return 0;
}
+
+int erdma_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr,
+ struct ib_udata *udata)
+{
+ const struct ib_global_route *grh =
+ rdma_ah_read_grh(init_attr->ah_attr);
+ struct erdma_dev *dev = to_edev(ibah->device);
+ struct erdma_pd *pd = to_epd(ibah->pd);
+ struct erdma_ah *ah = to_eah(ibah);
+ struct erdma_cmdq_create_ah_req req;
+ u32 udp_sport;
+ int ret;
+
+ ret = erdma_check_gid_attr(grh->sgid_attr);
+ if (ret)
+ return ret;
+
+ ret = erdma_alloc_idx(&dev->res_cb[ERDMA_RES_TYPE_AH]);
+ if (ret < 0)
+ return ret;
+
+ ah->ahn = ret;
+
+ if (grh->flow_label)
+ udp_sport = rdma_flow_label_to_udp_sport(grh->flow_label);
+ else
+ udp_sport =
+ IB_ROCE_UDP_ENCAP_VALID_PORT_MIN + (ah->ahn & 0x3FFF);
+
+ ah->av.port = rdma_ah_get_port_num(init_attr->ah_attr);
+ ah->av.sgid_index = grh->sgid_index;
+ ah->av.hop_limit = grh->hop_limit;
+ ah->av.traffic_class = grh->traffic_class;
+ ah->av.sl = rdma_ah_get_sl(init_attr->ah_attr);
+ ah->av.flow_label = grh->flow_label;
+ ah->av.udp_sport = udp_sport;
+
+ ether_addr_copy(ah->av.dmac, init_attr->ah_attr->roce.dmac);
+ memcpy(ah->av.dgid, grh->dgid.raw, ERDMA_ROCEV2_GID_SIZE);
+
+ if (ipv6_addr_v4mapped((struct in6_addr *)&grh->dgid))
+ ah->av.ntype = ERDMA_NETWORK_TYPE_IPV4;
+ else
+ ah->av.ntype = ERDMA_NETWORK_TYPE_IPV6;
+
+ erdma_cmdq_build_reqhdr(&req.hdr, CMDQ_SUBMOD_RDMA,
+ CMDQ_OPCODE_CREATE_AH);
+
+ req.pdn = pd->pdn;
+ req.ahn = ah->ahn;
+
+ req.av_cfg.cfg0 =
+ FIELD_PREP(ERDMA_CMD_CREATE_AV_FL_MASK, ah->av.flow_label) |
+ FIELD_PREP(ERDMA_CMD_CREATE_AV_NTYPE_MASK, ah->av.ntype);
+ req.av_cfg.traffic_class = ah->av.traffic_class;
+ req.av_cfg.hop_limit = ah->av.hop_limit;
+ req.av_cfg.sl = ah->av.sl;
+ req.av_cfg.udp_sport = ah->av.udp_sport;
+ req.av_cfg.sgid_index = ah->av.sgid_index;
+ ether_addr_copy(req.av_cfg.dmac, ah->av.dmac);
+ memcpy(req.av_cfg.dgid, ah->av.dgid, ERDMA_ROCEV2_GID_SIZE);
+
+ ret = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL);
+ if (ret) {
+ erdma_free_idx(&dev->res_cb[ERDMA_RES_TYPE_AH], ah->ahn);
+ return ret;
+ }
+
+ return 0;
+}
+
+int erdma_destroy_ah(struct ib_ah *ibah, u32 flags)
+{
+ struct erdma_dev *dev = to_edev(ibah->device);
+ struct erdma_pd *pd = to_epd(ibah->pd);
+ struct erdma_ah *ah = to_eah(ibah);
+ struct erdma_cmdq_destroy_ah_req req;
+ int ret;
+
+ erdma_cmdq_build_reqhdr(&req.hdr, CMDQ_SUBMOD_RDMA,
+ CMDQ_OPCODE_DESTROY_AH);
+
+ req.pdn = pd->pdn;
+ req.ahn = ah->ahn;
+
+ ret = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL);
+ if (ret)
+ return ret;
+
+ erdma_free_idx(&dev->res_cb[ERDMA_RES_TYPE_AH], ah->ahn);
+
+ return 0;
+}
+
+int erdma_query_ah(struct ib_ah *ibah, struct rdma_ah_attr *ah_attr)
+{
+ struct erdma_ah *ah = to_eah(ibah);
+
+ memset(ah_attr, 0, sizeof(*ah_attr));
+
+ ah_attr->type = RDMA_AH_ATTR_TYPE_ROCE;
+ rdma_ah_set_sl(ah_attr, ah->av.sl);
+ rdma_ah_set_port_num(ah_attr, ah->av.port);
+ rdma_ah_set_ah_flags(ah_attr, IB_AH_GRH);
+ rdma_ah_set_grh(ah_attr, NULL, ah->av.flow_label, ah->av.sgid_index,
+ ah->av.hop_limit, ah->av.traffic_class);
+ rdma_ah_set_dgid_raw(ah_attr, ah->av.dgid);
+
+ return 0;
+}
diff --git a/drivers/infiniband/hw/erdma/erdma_verbs.h b/drivers/infiniband/hw/erdma/erdma_verbs.h
index 1ae6ba56f5972..78a6c35cf1a5a 100644
--- a/drivers/infiniband/hw/erdma/erdma_verbs.h
+++ b/drivers/infiniband/hw/erdma/erdma_verbs.h
@@ -136,6 +136,25 @@ struct erdma_user_dbrecords_page {
int refcnt;
};
+struct erdma_av {
+ u8 port;
+ u8 hop_limit;
+ u8 traffic_class;
+ u8 sl;
+ u8 sgid_index;
+ u16 udp_sport;
+ u32 flow_label;
+ u8 dmac[ETH_ALEN];
+ u8 dgid[ERDMA_ROCEV2_GID_SIZE];
+ enum erdma_network_type ntype;
+};
+
+struct erdma_ah {
+ struct ib_ah ibah;
+ struct erdma_av av;
+ u32 ahn;
+};
+
struct erdma_uqp {
struct erdma_mem sq_mem;
struct erdma_mem rq_mem;
@@ -326,6 +345,11 @@ static inline struct erdma_cq *to_ecq(struct ib_cq *ibcq)
return container_of(ibcq, struct erdma_cq, ibcq);
}
+static inline struct erdma_ah *to_eah(struct ib_ah *ibah)
+{
+ return container_of(ibah, struct erdma_ah, ibah);
+}
+
static inline int erdma_check_gid_attr(const struct ib_gid_attr *attr)
{
u8 ntype = rdma_gid_attr_network_type(attr);
@@ -395,5 +419,9 @@ enum rdma_link_layer erdma_get_link_layer(struct ib_device *ibdev,
int erdma_add_gid(const struct ib_gid_attr *attr, void **context);
int erdma_del_gid(const struct ib_gid_attr *attr, void **context);
int erdma_query_pkey(struct ib_device *ibdev, u32 port, u16 index, u16 *pkey);
+int erdma_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr,
+ struct ib_udata *udata);
+int erdma_destroy_ah(struct ib_ah *ibah, u32 flags);
+int erdma_query_ah(struct ib_ah *ibah, struct rdma_ah_attr *ah_attr);
#endif
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0670/1376] RDMA/erdma: Add erdma_modify_qp_rocev2() interface
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (668 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0669/1376] RDMA/erdma: Add address handle implementation Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0671/1376] RDMA/erdma: Refactor the code of the modify_qp interface Greg Kroah-Hartman
` (328 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Boshi Yu, Cheng Xu, Leon Romanovsky,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boshi Yu <boshiyu@linux.alibaba.com>
[ Upstream commit 9566cf6a7742f2e2bb8044b4624a7a1e66b6a549 ]
The QP state machines in the RoCEv2 and iWARP protocols are
different. To handle these differences for the erdma RoCEv2
device, we provide the erdma_modify_qp_rocev2() interface,
which transitions the QP state and modifies QP attributes
accordingly.
Signed-off-by: Boshi Yu <boshiyu@linux.alibaba.com>
Link: https://patch.msgid.link/20241211020930.68833-6-boshiyu@linux.alibaba.com
Reviewed-by: Cheng Xu <chengyou@linux.alibaba.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Stable-dep-of: 652befcba956 ("RDMA/erdma: complete object teardown when the destroy command fails")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/erdma/erdma_cq.c | 45 +++++
drivers/infiniband/hw/erdma/erdma_hw.h | 14 ++
drivers/infiniband/hw/erdma/erdma_main.c | 3 +-
drivers/infiniband/hw/erdma/erdma_qp.c | 92 +++++++++
drivers/infiniband/hw/erdma/erdma_verbs.c | 221 +++++++++++++++++++---
drivers/infiniband/hw/erdma/erdma_verbs.h | 44 +++++
6 files changed, 388 insertions(+), 31 deletions(-)
diff --git a/drivers/infiniband/hw/erdma/erdma_cq.c b/drivers/infiniband/hw/erdma/erdma_cq.c
index 70f89f0162aa7..eada882472a37 100644
--- a/drivers/infiniband/hw/erdma/erdma_cq.c
+++ b/drivers/infiniband/hw/erdma/erdma_cq.c
@@ -201,3 +201,48 @@ int erdma_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
return npolled;
}
+
+void erdma_remove_cqes_of_qp(struct ib_cq *ibcq, u32 qpn)
+{
+ struct erdma_cq *cq = to_ecq(ibcq);
+ struct erdma_cqe *cqe, *dst_cqe;
+ u32 prev_cq_ci, cur_cq_ci;
+ u32 ncqe = 0, nqp_cqe = 0;
+ unsigned long flags;
+ u8 owner;
+
+ spin_lock_irqsave(&cq->kern_cq.lock, flags);
+
+ prev_cq_ci = cq->kern_cq.ci;
+
+ while (ncqe < cq->depth && (cqe = get_next_valid_cqe(cq)) != NULL) {
+ ++cq->kern_cq.ci;
+ ++ncqe;
+ }
+
+ while (ncqe > 0) {
+ cur_cq_ci = prev_cq_ci + ncqe - 1;
+ cqe = get_queue_entry(cq->kern_cq.qbuf, cur_cq_ci, cq->depth,
+ CQE_SHIFT);
+
+ if (be32_to_cpu(cqe->qpn) == qpn) {
+ ++nqp_cqe;
+ } else if (nqp_cqe) {
+ dst_cqe = get_queue_entry(cq->kern_cq.qbuf,
+ cur_cq_ci + nqp_cqe,
+ cq->depth, CQE_SHIFT);
+ owner = FIELD_GET(ERDMA_CQE_HDR_OWNER_MASK,
+ be32_to_cpu(dst_cqe->hdr));
+ cqe->hdr = cpu_to_be32(
+ (be32_to_cpu(cqe->hdr) &
+ ~ERDMA_CQE_HDR_OWNER_MASK) |
+ FIELD_PREP(ERDMA_CQE_HDR_OWNER_MASK, owner));
+ memcpy(dst_cqe, cqe, sizeof(*cqe));
+ }
+
+ --ncqe;
+ }
+
+ cq->kern_cq.ci = prev_cq_ci + nqp_cqe;
+ spin_unlock_irqrestore(&cq->kern_cq.lock, flags);
+}
diff --git a/drivers/infiniband/hw/erdma/erdma_hw.h b/drivers/infiniband/hw/erdma/erdma_hw.h
index 64d856494359e..b5c1aca71144c 100644
--- a/drivers/infiniband/hw/erdma/erdma_hw.h
+++ b/drivers/infiniband/hw/erdma/erdma_hw.h
@@ -347,6 +347,20 @@ struct erdma_cmdq_modify_qp_req {
u32 recv_nxt;
};
+/* modify qp cfg1 for roce device */
+#define ERDMA_CMD_MODIFY_QP_DQPN_MASK GENMASK(19, 0)
+
+struct erdma_cmdq_mod_qp_req_rocev2 {
+ u64 hdr;
+ u32 cfg0;
+ u32 cfg1;
+ u32 attr_mask;
+ u32 qkey;
+ u32 rq_psn;
+ u32 sq_psn;
+ struct erdma_av_cfg av_cfg;
+};
+
/* create qp cfg0 */
#define ERDMA_CMD_CREATE_QP_SQ_DEPTH_MASK GENMASK(31, 20)
#define ERDMA_CMD_CREATE_QP_QPN_MASK GENMASK(19, 0)
diff --git a/drivers/infiniband/hw/erdma/erdma_main.c b/drivers/infiniband/hw/erdma/erdma_main.c
index d632c09c9acd8..2fca163b17442 100644
--- a/drivers/infiniband/hw/erdma/erdma_main.c
+++ b/drivers/infiniband/hw/erdma/erdma_main.c
@@ -486,6 +486,7 @@ static const struct ib_device_ops erdma_device_ops_rocev2 = {
.query_pkey = erdma_query_pkey,
.create_ah = erdma_create_ah,
.destroy_ah = erdma_destroy_ah,
+ .modify_qp = erdma_modify_qp_rocev2,
};
static const struct ib_device_ops erdma_device_ops_iwarp = {
@@ -497,6 +498,7 @@ static const struct ib_device_ops erdma_device_ops_iwarp = {
.iw_get_qp = erdma_get_ibqp,
.iw_reject = erdma_reject,
.iw_rem_ref = erdma_qp_put_ref,
+ .modify_qp = erdma_modify_qp,
};
static const struct ib_device_ops erdma_device_ops = {
@@ -522,7 +524,6 @@ static const struct ib_device_ops erdma_device_ops = {
.map_mr_sg = erdma_map_mr_sg,
.mmap = erdma_mmap,
.mmap_free = erdma_mmap_free,
- .modify_qp = erdma_modify_qp,
.post_recv = erdma_post_recv,
.post_send = erdma_post_send,
.poll_cq = erdma_poll_cq,
diff --git a/drivers/infiniband/hw/erdma/erdma_qp.c b/drivers/infiniband/hw/erdma/erdma_qp.c
index 4dfab0c49e519..5a425599cddea 100644
--- a/drivers/infiniband/hw/erdma/erdma_qp.c
+++ b/drivers/infiniband/hw/erdma/erdma_qp.c
@@ -186,6 +186,98 @@ int erdma_modify_qp_internal(struct erdma_qp *qp, struct erdma_qp_attrs *attrs,
return ret;
}
+static int modify_qp_cmd_rocev2(struct erdma_qp *qp,
+ struct erdma_mod_qp_params_rocev2 *params,
+ enum erdma_qpa_mask_rocev2 attr_mask)
+{
+ struct erdma_cmdq_mod_qp_req_rocev2 req;
+
+ memset(&req, 0, sizeof(req));
+
+ erdma_cmdq_build_reqhdr(&req.hdr, CMDQ_SUBMOD_RDMA,
+ CMDQ_OPCODE_MODIFY_QP);
+
+ req.cfg0 = FIELD_PREP(ERDMA_CMD_MODIFY_QP_QPN_MASK, QP_ID(qp));
+
+ if (attr_mask & ERDMA_QPA_ROCEV2_STATE)
+ req.cfg0 |= FIELD_PREP(ERDMA_CMD_MODIFY_QP_STATE_MASK,
+ params->state);
+
+ if (attr_mask & ERDMA_QPA_ROCEV2_DST_QPN)
+ req.cfg1 = FIELD_PREP(ERDMA_CMD_MODIFY_QP_DQPN_MASK,
+ params->dst_qpn);
+
+ if (attr_mask & ERDMA_QPA_ROCEV2_QKEY)
+ req.qkey = params->qkey;
+
+ if (attr_mask & ERDMA_QPA_ROCEV2_AV)
+ erdma_set_av_cfg(&req.av_cfg, ¶ms->av);
+
+ if (attr_mask & ERDMA_QPA_ROCEV2_SQ_PSN)
+ req.sq_psn = params->sq_psn;
+
+ if (attr_mask & ERDMA_QPA_ROCEV2_RQ_PSN)
+ req.rq_psn = params->rq_psn;
+
+ req.attr_mask = attr_mask;
+
+ return erdma_post_cmd_wait(&qp->dev->cmdq, &req, sizeof(req), NULL,
+ NULL);
+}
+
+static void erdma_reset_qp(struct erdma_qp *qp)
+{
+ qp->kern_qp.sq_pi = 0;
+ qp->kern_qp.sq_ci = 0;
+ qp->kern_qp.rq_pi = 0;
+ qp->kern_qp.rq_ci = 0;
+ memset(qp->kern_qp.swr_tbl, 0, qp->attrs.sq_size * sizeof(u64));
+ memset(qp->kern_qp.rwr_tbl, 0, qp->attrs.rq_size * sizeof(u64));
+ memset(qp->kern_qp.sq_buf, 0, qp->attrs.sq_size << SQEBB_SHIFT);
+ memset(qp->kern_qp.rq_buf, 0, qp->attrs.rq_size << RQE_SHIFT);
+ erdma_remove_cqes_of_qp(&qp->scq->ibcq, QP_ID(qp));
+ if (qp->rcq != qp->scq)
+ erdma_remove_cqes_of_qp(&qp->rcq->ibcq, QP_ID(qp));
+}
+
+int erdma_modify_qp_state_rocev2(struct erdma_qp *qp,
+ struct erdma_mod_qp_params_rocev2 *params,
+ int attr_mask)
+{
+ struct erdma_dev *dev = to_edev(qp->ibqp.device);
+ int ret;
+
+ ret = modify_qp_cmd_rocev2(qp, params, attr_mask);
+ if (ret)
+ return ret;
+
+ if (attr_mask & ERDMA_QPA_ROCEV2_STATE)
+ qp->attrs.rocev2.state = params->state;
+
+ if (attr_mask & ERDMA_QPA_ROCEV2_QKEY)
+ qp->attrs.rocev2.qkey = params->qkey;
+
+ if (attr_mask & ERDMA_QPA_ROCEV2_DST_QPN)
+ qp->attrs.rocev2.dst_qpn = params->dst_qpn;
+
+ if (attr_mask & ERDMA_QPA_ROCEV2_AV)
+ memcpy(&qp->attrs.rocev2.av, ¶ms->av,
+ sizeof(struct erdma_av));
+
+ if (rdma_is_kernel_res(&qp->ibqp.res) &&
+ params->state == ERDMA_QPS_ROCEV2_RESET)
+ erdma_reset_qp(qp);
+
+ if (rdma_is_kernel_res(&qp->ibqp.res) &&
+ params->state == ERDMA_QPS_ROCEV2_ERROR) {
+ qp->flags |= ERDMA_QP_IN_FLUSHING;
+ mod_delayed_work(dev->reflush_wq, &qp->reflush_dwork,
+ usecs_to_jiffies(100));
+ }
+
+ return 0;
+}
+
static void erdma_qp_safe_free(struct kref *ref)
{
struct erdma_qp *qp = container_of(ref, struct erdma_qp, ref);
diff --git a/drivers/infiniband/hw/erdma/erdma_verbs.c b/drivers/infiniband/hw/erdma/erdma_verbs.c
index 8db030dc295a0..860703a24c2c7 100644
--- a/drivers/infiniband/hw/erdma/erdma_verbs.c
+++ b/drivers/infiniband/hw/erdma/erdma_verbs.c
@@ -121,7 +121,7 @@ static int create_qp_cmd(struct erdma_ucontext *uctx, struct erdma_qp *qp)
err = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), &resp0,
&resp1);
- if (!err)
+ if (!err && erdma_device_iwarp(dev))
qp->attrs.cookie =
FIELD_GET(ERDMA_CMDQ_CREATE_QP_RESP_COOKIE_MASK, resp0);
@@ -1020,7 +1020,12 @@ int erdma_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs,
qp->attrs.max_send_sge = attrs->cap.max_send_sge;
qp->attrs.max_recv_sge = attrs->cap.max_recv_sge;
- qp->attrs.state = ERDMA_QP_STATE_IDLE;
+
+ if (erdma_device_iwarp(qp->dev))
+ qp->attrs.state = ERDMA_QP_STATE_IDLE;
+ else
+ qp->attrs.rocev2.state = ERDMA_QPS_ROCEV2_RESET;
+
INIT_DELAYED_WORK(&qp->reflush_dwork, erdma_flush_worker);
ret = create_qp_cmd(uctx, qp);
@@ -1294,13 +1299,20 @@ int erdma_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata)
struct erdma_dev *dev = to_edev(ibqp->device);
struct erdma_ucontext *ctx = rdma_udata_to_drv_context(
udata, struct erdma_ucontext, ibucontext);
+ struct erdma_mod_qp_params_rocev2 rocev2_params;
struct erdma_qp_attrs qp_attrs;
int err;
struct erdma_cmdq_destroy_qp_req req;
down_write(&qp->state_lock);
- qp_attrs.state = ERDMA_QP_STATE_ERROR;
- erdma_modify_qp_internal(qp, &qp_attrs, ERDMA_QP_ATTR_STATE);
+ if (erdma_device_iwarp(dev)) {
+ qp_attrs.state = ERDMA_QP_STATE_ERROR;
+ erdma_modify_qp_internal(qp, &qp_attrs, ERDMA_QP_ATTR_STATE);
+ } else {
+ rocev2_params.state = ERDMA_QPS_ROCEV2_ERROR;
+ erdma_modify_qp_state_rocev2(qp, &rocev2_params,
+ ERDMA_QPA_ROCEV2_STATE);
+ }
up_write(&qp->state_lock);
cancel_delayed_work_sync(&qp->reflush_dwork);
@@ -1531,6 +1543,29 @@ void erdma_dealloc_ucontext(struct ib_ucontext *ibctx)
atomic_dec(&dev->num_ctx);
}
+static void erdma_attr_to_av(const struct rdma_ah_attr *ah_attr,
+ struct erdma_av *av, u16 sport)
+{
+ const struct ib_global_route *grh = rdma_ah_read_grh(ah_attr);
+
+ av->port = rdma_ah_get_port_num(ah_attr);
+ av->sgid_index = grh->sgid_index;
+ av->hop_limit = grh->hop_limit;
+ av->traffic_class = grh->traffic_class;
+ av->sl = rdma_ah_get_sl(ah_attr);
+
+ av->flow_label = grh->flow_label;
+ av->udp_sport = sport;
+
+ ether_addr_copy(av->dmac, ah_attr->roce.dmac);
+ memcpy(av->dgid, grh->dgid.raw, ERDMA_ROCEV2_GID_SIZE);
+
+ if (ipv6_addr_v4mapped((struct in6_addr *)&grh->dgid))
+ av->ntype = ERDMA_NETWORK_TYPE_IPV4;
+ else
+ av->ntype = ERDMA_NETWORK_TYPE_IPV6;
+}
+
static int ib_qp_state_to_erdma_qp_state[IB_QPS_ERR + 1] = {
[IB_QPS_RESET] = ERDMA_QP_STATE_IDLE,
[IB_QPS_INIT] = ERDMA_QP_STATE_IDLE,
@@ -1541,6 +1576,140 @@ static int ib_qp_state_to_erdma_qp_state[IB_QPS_ERR + 1] = {
[IB_QPS_ERR] = ERDMA_QP_STATE_ERROR
};
+static int ib_qps_to_erdma_qps_rocev2[IB_QPS_ERR + 1] = {
+ [IB_QPS_RESET] = ERDMA_QPS_ROCEV2_RESET,
+ [IB_QPS_INIT] = ERDMA_QPS_ROCEV2_INIT,
+ [IB_QPS_RTR] = ERDMA_QPS_ROCEV2_RTR,
+ [IB_QPS_RTS] = ERDMA_QPS_ROCEV2_RTS,
+ [IB_QPS_SQD] = ERDMA_QPS_ROCEV2_SQD,
+ [IB_QPS_SQE] = ERDMA_QPS_ROCEV2_SQE,
+ [IB_QPS_ERR] = ERDMA_QPS_ROCEV2_ERROR,
+};
+
+static int erdma_qps_to_ib_qps_rocev2[ERDMA_QPS_ROCEV2_COUNT] = {
+ [ERDMA_QPS_ROCEV2_RESET] = IB_QPS_RESET,
+ [ERDMA_QPS_ROCEV2_INIT] = IB_QPS_INIT,
+ [ERDMA_QPS_ROCEV2_RTR] = IB_QPS_RTR,
+ [ERDMA_QPS_ROCEV2_RTS] = IB_QPS_RTS,
+ [ERDMA_QPS_ROCEV2_SQD] = IB_QPS_SQD,
+ [ERDMA_QPS_ROCEV2_SQE] = IB_QPS_SQE,
+ [ERDMA_QPS_ROCEV2_ERROR] = IB_QPS_ERR,
+};
+
+static int erdma_check_qp_attr_rocev2(struct erdma_qp *qp,
+ struct ib_qp_attr *attr, int attr_mask)
+{
+ enum ib_qp_state cur_state, nxt_state;
+ struct erdma_dev *dev = qp->dev;
+ int ret = -EINVAL;
+
+ if (attr_mask & ~IB_QP_ATTR_STANDARD_BITS) {
+ ret = -EOPNOTSUPP;
+ goto out;
+ }
+
+ if ((attr_mask & IB_QP_PKEY_INDEX) &&
+ attr->pkey_index >= ERDMA_MAX_PKEYS)
+ goto out;
+
+ if ((attr_mask & IB_QP_PORT) &&
+ !rdma_is_port_valid(&dev->ibdev, attr->port_num))
+ goto out;
+
+ cur_state = (attr_mask & IB_QP_CUR_STATE) ?
+ attr->cur_qp_state :
+ erdma_qps_to_ib_qps_rocev2[qp->attrs.rocev2.state];
+
+ nxt_state = (attr_mask & IB_QP_STATE) ? attr->qp_state : cur_state;
+
+ if (!ib_modify_qp_is_ok(cur_state, nxt_state, qp->ibqp.qp_type,
+ attr_mask))
+ goto out;
+
+ if ((attr_mask & IB_QP_AV) &&
+ erdma_check_gid_attr(rdma_ah_read_grh(&attr->ah_attr)->sgid_attr))
+ goto out;
+
+ return 0;
+
+out:
+ return ret;
+}
+
+static void erdma_init_mod_qp_params_rocev2(
+ struct erdma_qp *qp, struct erdma_mod_qp_params_rocev2 *params,
+ int *erdma_attr_mask, struct ib_qp_attr *attr, int ib_attr_mask)
+{
+ enum erdma_qpa_mask_rocev2 to_modify_attrs = 0;
+ enum erdma_qps_rocev2 cur_state, nxt_state;
+ u16 udp_sport;
+
+ if (ib_attr_mask & IB_QP_CUR_STATE)
+ cur_state = ib_qps_to_erdma_qps_rocev2[attr->cur_qp_state];
+ else
+ cur_state = qp->attrs.rocev2.state;
+
+ if (ib_attr_mask & IB_QP_STATE)
+ nxt_state = ib_qps_to_erdma_qps_rocev2[attr->qp_state];
+ else
+ nxt_state = cur_state;
+
+ to_modify_attrs |= ERDMA_QPA_ROCEV2_STATE;
+ params->state = nxt_state;
+
+ if (ib_attr_mask & IB_QP_QKEY) {
+ to_modify_attrs |= ERDMA_QPA_ROCEV2_QKEY;
+ params->qkey = attr->qkey;
+ }
+
+ if (ib_attr_mask & IB_QP_SQ_PSN) {
+ to_modify_attrs |= ERDMA_QPA_ROCEV2_SQ_PSN;
+ params->sq_psn = attr->sq_psn;
+ }
+
+ if (ib_attr_mask & IB_QP_RQ_PSN) {
+ to_modify_attrs |= ERDMA_QPA_ROCEV2_RQ_PSN;
+ params->rq_psn = attr->rq_psn;
+ }
+
+ if (ib_attr_mask & IB_QP_DEST_QPN) {
+ to_modify_attrs |= ERDMA_QPA_ROCEV2_DST_QPN;
+ params->dst_qpn = attr->dest_qp_num;
+ }
+
+ if (ib_attr_mask & IB_QP_AV) {
+ to_modify_attrs |= ERDMA_QPA_ROCEV2_AV;
+ udp_sport = rdma_get_udp_sport(attr->ah_attr.grh.flow_label,
+ QP_ID(qp), params->dst_qpn);
+ erdma_attr_to_av(&attr->ah_attr, ¶ms->av, udp_sport);
+ }
+
+ *erdma_attr_mask = to_modify_attrs;
+}
+
+int erdma_modify_qp_rocev2(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+ int attr_mask, struct ib_udata *udata)
+{
+ struct erdma_mod_qp_params_rocev2 params;
+ struct erdma_qp *qp = to_eqp(ibqp);
+ int ret = 0, erdma_attr_mask = 0;
+
+ down_write(&qp->state_lock);
+
+ ret = erdma_check_qp_attr_rocev2(qp, attr, attr_mask);
+ if (ret)
+ goto out;
+
+ erdma_init_mod_qp_params_rocev2(qp, ¶ms, &erdma_attr_mask, attr,
+ attr_mask);
+
+ ret = erdma_modify_qp_state_rocev2(qp, ¶ms, erdma_attr_mask);
+
+out:
+ up_write(&qp->state_lock);
+ return ret;
+}
+
int erdma_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask,
struct ib_udata *udata)
{
@@ -1923,6 +2092,22 @@ int erdma_query_pkey(struct ib_device *ibdev, u32 port, u16 index, u16 *pkey)
return 0;
}
+void erdma_set_av_cfg(struct erdma_av_cfg *av_cfg, struct erdma_av *av)
+{
+ av_cfg->cfg0 = FIELD_PREP(ERDMA_CMD_CREATE_AV_FL_MASK, av->flow_label) |
+ FIELD_PREP(ERDMA_CMD_CREATE_AV_NTYPE_MASK, av->ntype);
+
+ av_cfg->traffic_class = av->traffic_class;
+ av_cfg->hop_limit = av->hop_limit;
+ av_cfg->sl = av->sl;
+
+ av_cfg->udp_sport = av->udp_sport;
+ av_cfg->sgid_index = av->sgid_index;
+
+ ether_addr_copy(av_cfg->dmac, av->dmac);
+ memcpy(av_cfg->dgid, av->dgid, ERDMA_ROCEV2_GID_SIZE);
+}
+
int erdma_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr,
struct ib_udata *udata)
{
@@ -1951,38 +2136,14 @@ int erdma_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr,
udp_sport =
IB_ROCE_UDP_ENCAP_VALID_PORT_MIN + (ah->ahn & 0x3FFF);
- ah->av.port = rdma_ah_get_port_num(init_attr->ah_attr);
- ah->av.sgid_index = grh->sgid_index;
- ah->av.hop_limit = grh->hop_limit;
- ah->av.traffic_class = grh->traffic_class;
- ah->av.sl = rdma_ah_get_sl(init_attr->ah_attr);
- ah->av.flow_label = grh->flow_label;
- ah->av.udp_sport = udp_sport;
-
- ether_addr_copy(ah->av.dmac, init_attr->ah_attr->roce.dmac);
- memcpy(ah->av.dgid, grh->dgid.raw, ERDMA_ROCEV2_GID_SIZE);
-
- if (ipv6_addr_v4mapped((struct in6_addr *)&grh->dgid))
- ah->av.ntype = ERDMA_NETWORK_TYPE_IPV4;
- else
- ah->av.ntype = ERDMA_NETWORK_TYPE_IPV6;
+ erdma_attr_to_av(init_attr->ah_attr, &ah->av, udp_sport);
erdma_cmdq_build_reqhdr(&req.hdr, CMDQ_SUBMOD_RDMA,
CMDQ_OPCODE_CREATE_AH);
req.pdn = pd->pdn;
req.ahn = ah->ahn;
-
- req.av_cfg.cfg0 =
- FIELD_PREP(ERDMA_CMD_CREATE_AV_FL_MASK, ah->av.flow_label) |
- FIELD_PREP(ERDMA_CMD_CREATE_AV_NTYPE_MASK, ah->av.ntype);
- req.av_cfg.traffic_class = ah->av.traffic_class;
- req.av_cfg.hop_limit = ah->av.hop_limit;
- req.av_cfg.sl = ah->av.sl;
- req.av_cfg.udp_sport = ah->av.udp_sport;
- req.av_cfg.sgid_index = ah->av.sgid_index;
- ether_addr_copy(req.av_cfg.dmac, ah->av.dmac);
- memcpy(req.av_cfg.dgid, ah->av.dgid, ERDMA_ROCEV2_GID_SIZE);
+ erdma_set_av_cfg(&req.av_cfg, &ah->av);
ret = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL);
if (ret) {
diff --git a/drivers/infiniband/hw/erdma/erdma_verbs.h b/drivers/infiniband/hw/erdma/erdma_verbs.h
index 78a6c35cf1a5a..fad3e475d8f1d 100644
--- a/drivers/infiniband/hw/erdma/erdma_verbs.h
+++ b/drivers/infiniband/hw/erdma/erdma_verbs.h
@@ -216,10 +216,46 @@ enum erdma_qp_attr_mask {
ERDMA_QP_ATTR_MPA = (1 << 7)
};
+enum erdma_qps_rocev2 {
+ ERDMA_QPS_ROCEV2_RESET = 0,
+ ERDMA_QPS_ROCEV2_INIT = 1,
+ ERDMA_QPS_ROCEV2_RTR = 2,
+ ERDMA_QPS_ROCEV2_RTS = 3,
+ ERDMA_QPS_ROCEV2_SQD = 4,
+ ERDMA_QPS_ROCEV2_SQE = 5,
+ ERDMA_QPS_ROCEV2_ERROR = 6,
+ ERDMA_QPS_ROCEV2_COUNT = 7,
+};
+
+enum erdma_qpa_mask_rocev2 {
+ ERDMA_QPA_ROCEV2_STATE = (1 << 0),
+ ERDMA_QPA_ROCEV2_QKEY = (1 << 1),
+ ERDMA_QPA_ROCEV2_AV = (1 << 2),
+ ERDMA_QPA_ROCEV2_SQ_PSN = (1 << 3),
+ ERDMA_QPA_ROCEV2_RQ_PSN = (1 << 4),
+ ERDMA_QPA_ROCEV2_DST_QPN = (1 << 5),
+};
+
enum erdma_qp_flags {
ERDMA_QP_IN_FLUSHING = (1 << 0),
};
+struct erdma_mod_qp_params_rocev2 {
+ enum erdma_qps_rocev2 state;
+ u32 qkey;
+ u32 sq_psn;
+ u32 rq_psn;
+ u32 dst_qpn;
+ struct erdma_av av;
+};
+
+struct erdma_qp_attrs_rocev2 {
+ enum erdma_qps_rocev2 state;
+ u32 qkey;
+ u32 dst_qpn;
+ struct erdma_av av;
+};
+
struct erdma_qp_attrs {
enum erdma_qp_state state;
enum erdma_cc_alg cc; /* Congestion control algorithm */
@@ -234,6 +270,7 @@ struct erdma_qp_attrs {
#define ERDMA_QP_PASSIVE 1
u8 qp_type;
u8 pd_len;
+ struct erdma_qp_attrs_rocev2 rocev2;
};
struct erdma_qp {
@@ -307,6 +344,9 @@ void erdma_qp_get(struct erdma_qp *qp);
void erdma_qp_put(struct erdma_qp *qp);
int erdma_modify_qp_internal(struct erdma_qp *qp, struct erdma_qp_attrs *attrs,
enum erdma_qp_attr_mask mask);
+int erdma_modify_qp_state_rocev2(struct erdma_qp *qp,
+ struct erdma_mod_qp_params_rocev2 *params,
+ int attr_mask);
void erdma_qp_llp_close(struct erdma_qp *qp);
void erdma_qp_cm_drop(struct erdma_qp *qp);
@@ -386,6 +426,8 @@ int erdma_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int mask,
struct ib_qp_init_attr *init_attr);
int erdma_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int mask,
struct ib_udata *data);
+int erdma_modify_qp_rocev2(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+ int mask, struct ib_udata *udata);
int erdma_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata);
int erdma_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata);
void erdma_disassociate_ucontext(struct ib_ucontext *ibcontext);
@@ -404,6 +446,7 @@ int erdma_post_send(struct ib_qp *ibqp, const struct ib_send_wr *send_wr,
int erdma_post_recv(struct ib_qp *ibqp, const struct ib_recv_wr *recv_wr,
const struct ib_recv_wr **bad_recv_wr);
int erdma_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc);
+void erdma_remove_cqes_of_qp(struct ib_cq *ibcq, u32 qpn);
struct ib_mr *erdma_ib_alloc_mr(struct ib_pd *ibpd, enum ib_mr_type mr_type,
u32 max_num_sg);
int erdma_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, int sg_nents,
@@ -419,6 +462,7 @@ enum rdma_link_layer erdma_get_link_layer(struct ib_device *ibdev,
int erdma_add_gid(const struct ib_gid_attr *attr, void **context);
int erdma_del_gid(const struct ib_gid_attr *attr, void **context);
int erdma_query_pkey(struct ib_device *ibdev, u32 port, u16 index, u16 *pkey);
+void erdma_set_av_cfg(struct erdma_av_cfg *av_cfg, struct erdma_av *av);
int erdma_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr,
struct ib_udata *udata);
int erdma_destroy_ah(struct ib_ah *ibah, u32 flags);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0671/1376] RDMA/erdma: Refactor the code of the modify_qp interface
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (669 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0670/1376] RDMA/erdma: Add erdma_modify_qp_rocev2() interface Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0672/1376] RDMA/erdma: Add the query_qp command to the cmdq Greg Kroah-Hartman
` (327 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Boshi Yu, Cheng Xu, Leon Romanovsky,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boshi Yu <boshiyu@linux.alibaba.com>
[ Upstream commit de5b8008aa4da7e1e750cc780c086d45242ba51e ]
The procedure for modifying QP is similar for both the iWARP and
RoCEv2 protocols. Therefore, we unify the code and provide the
erdma_modify_qp() interface for both protocols.
Signed-off-by: Boshi Yu <boshiyu@linux.alibaba.com>
Link: https://patch.msgid.link/20241211020930.68833-7-boshiyu@linux.alibaba.com
Reviewed-by: Cheng Xu <chengyou@linux.alibaba.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Stable-dep-of: 652befcba956 ("RDMA/erdma: complete object teardown when the destroy command fails")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/erdma/erdma_cm.c | 71 ++++----
drivers/infiniband/hw/erdma/erdma_hw.h | 1 +
drivers/infiniband/hw/erdma/erdma_main.c | 3 +-
drivers/infiniband/hw/erdma/erdma_qp.c | 136 ++++++++------
drivers/infiniband/hw/erdma/erdma_verbs.c | 210 +++++++++++-----------
drivers/infiniband/hw/erdma/erdma_verbs.h | 75 +++++---
6 files changed, 276 insertions(+), 220 deletions(-)
diff --git a/drivers/infiniband/hw/erdma/erdma_cm.c b/drivers/infiniband/hw/erdma/erdma_cm.c
index e349e8d2fb50a..e0acc185e7193 100644
--- a/drivers/infiniband/hw/erdma/erdma_cm.c
+++ b/drivers/infiniband/hw/erdma/erdma_cm.c
@@ -567,7 +567,8 @@ static int erdma_proc_mpareq(struct erdma_cep *cep)
static int erdma_proc_mpareply(struct erdma_cep *cep)
{
- struct erdma_qp_attrs qp_attrs;
+ enum erdma_qpa_mask_iwarp to_modify_attrs = 0;
+ struct erdma_mod_qp_params_iwarp params;
struct erdma_qp *qp = cep->qp;
struct mpa_rr *rep;
int ret;
@@ -597,26 +598,29 @@ static int erdma_proc_mpareply(struct erdma_cep *cep)
return -EINVAL;
}
- memset(&qp_attrs, 0, sizeof(qp_attrs));
- qp_attrs.irq_size = cep->ird;
- qp_attrs.orq_size = cep->ord;
- qp_attrs.state = ERDMA_QP_STATE_RTS;
+ memset(¶ms, 0, sizeof(params));
+ params.state = ERDMA_QPS_IWARP_RTS;
+ params.irq_size = cep->ird;
+ params.orq_size = cep->ord;
down_write(&qp->state_lock);
- if (qp->attrs.state > ERDMA_QP_STATE_RTR) {
+ if (qp->attrs.iwarp.state > ERDMA_QPS_IWARP_RTR) {
ret = -EINVAL;
up_write(&qp->state_lock);
goto out_err;
}
- qp->attrs.qp_type = ERDMA_QP_ACTIVE;
- if (__mpa_ext_cc(cep->mpa.ext_data.bits) != qp->attrs.cc)
- qp->attrs.cc = COMPROMISE_CC;
+ to_modify_attrs = ERDMA_QPA_IWARP_STATE | ERDMA_QPA_IWARP_LLP_HANDLE |
+ ERDMA_QPA_IWARP_MPA | ERDMA_QPA_IWARP_IRD |
+ ERDMA_QPA_IWARP_ORD;
- ret = erdma_modify_qp_internal(qp, &qp_attrs,
- ERDMA_QP_ATTR_STATE |
- ERDMA_QP_ATTR_LLP_HANDLE |
- ERDMA_QP_ATTR_MPA);
+ params.qp_type = ERDMA_QP_ACTIVE;
+ if (__mpa_ext_cc(cep->mpa.ext_data.bits) != qp->attrs.cc) {
+ to_modify_attrs |= ERDMA_QPA_IWARP_CC;
+ params.cc = COMPROMISE_CC;
+ }
+
+ ret = erdma_modify_qp_state_iwarp(qp, ¶ms, to_modify_attrs);
up_write(&qp->state_lock);
@@ -721,7 +725,7 @@ static int erdma_newconn_connected(struct erdma_cep *cep)
__mpa_rr_set_revision(&cep->mpa.hdr.params.bits, MPA_REVISION_EXT_1);
memcpy(cep->mpa.hdr.key, MPA_KEY_REQ, MPA_KEY_SIZE);
- cep->mpa.ext_data.cookie = cpu_to_be32(cep->qp->attrs.cookie);
+ cep->mpa.ext_data.cookie = cpu_to_be32(cep->qp->attrs.iwarp.cookie);
__mpa_ext_set_cc(&cep->mpa.ext_data.bits, cep->qp->attrs.cc);
ret = erdma_send_mpareqrep(cep, cep->private_data, cep->pd_len);
@@ -1125,10 +1129,11 @@ int erdma_connect(struct iw_cm_id *id, struct iw_cm_conn_param *params)
int erdma_accept(struct iw_cm_id *id, struct iw_cm_conn_param *params)
{
- struct erdma_dev *dev = to_edev(id->device);
struct erdma_cep *cep = (struct erdma_cep *)id->provider_data;
+ struct erdma_mod_qp_params_iwarp mod_qp_params;
+ enum erdma_qpa_mask_iwarp to_modify_attrs = 0;
+ struct erdma_dev *dev = to_edev(id->device);
struct erdma_qp *qp;
- struct erdma_qp_attrs qp_attrs;
int ret;
erdma_cep_set_inuse(cep);
@@ -1155,7 +1160,7 @@ int erdma_accept(struct iw_cm_id *id, struct iw_cm_conn_param *params)
erdma_qp_get(qp);
down_write(&qp->state_lock);
- if (qp->attrs.state > ERDMA_QP_STATE_RTR) {
+ if (qp->attrs.iwarp.state > ERDMA_QPS_IWARP_RTR) {
ret = -EINVAL;
up_write(&qp->state_lock);
goto error;
@@ -1180,11 +1185,11 @@ int erdma_accept(struct iw_cm_id *id, struct iw_cm_conn_param *params)
cep->cm_id = id;
id->add_ref(id);
- memset(&qp_attrs, 0, sizeof(qp_attrs));
- qp_attrs.orq_size = params->ord;
- qp_attrs.irq_size = params->ird;
+ memset(&mod_qp_params, 0, sizeof(mod_qp_params));
- qp_attrs.state = ERDMA_QP_STATE_RTS;
+ mod_qp_params.irq_size = params->ird;
+ mod_qp_params.orq_size = params->ord;
+ mod_qp_params.state = ERDMA_QPS_IWARP_RTS;
/* Associate QP with CEP */
erdma_cep_get(cep);
@@ -1193,19 +1198,21 @@ int erdma_accept(struct iw_cm_id *id, struct iw_cm_conn_param *params)
cep->state = ERDMA_EPSTATE_RDMA_MODE;
- qp->attrs.qp_type = ERDMA_QP_PASSIVE;
- qp->attrs.pd_len = params->private_data_len;
+ mod_qp_params.qp_type = ERDMA_QP_PASSIVE;
+ mod_qp_params.pd_len = params->private_data_len;
- if (qp->attrs.cc != __mpa_ext_cc(cep->mpa.ext_data.bits))
- qp->attrs.cc = COMPROMISE_CC;
+ to_modify_attrs = ERDMA_QPA_IWARP_STATE | ERDMA_QPA_IWARP_ORD |
+ ERDMA_QPA_IWARP_LLP_HANDLE | ERDMA_QPA_IWARP_IRD |
+ ERDMA_QPA_IWARP_MPA;
+
+ if (qp->attrs.cc != __mpa_ext_cc(cep->mpa.ext_data.bits)) {
+ to_modify_attrs |= ERDMA_QPA_IWARP_CC;
+ mod_qp_params.cc = COMPROMISE_CC;
+ }
/* move to rts */
- ret = erdma_modify_qp_internal(qp, &qp_attrs,
- ERDMA_QP_ATTR_STATE |
- ERDMA_QP_ATTR_ORD |
- ERDMA_QP_ATTR_LLP_HANDLE |
- ERDMA_QP_ATTR_IRD |
- ERDMA_QP_ATTR_MPA);
+ ret = erdma_modify_qp_state_iwarp(qp, &mod_qp_params, to_modify_attrs);
+
up_write(&qp->state_lock);
if (ret)
@@ -1213,7 +1220,7 @@ int erdma_accept(struct iw_cm_id *id, struct iw_cm_conn_param *params)
cep->mpa.ext_data.bits = 0;
__mpa_ext_set_cc(&cep->mpa.ext_data.bits, qp->attrs.cc);
- cep->mpa.ext_data.cookie = cpu_to_be32(cep->qp->attrs.cookie);
+ cep->mpa.ext_data.cookie = cpu_to_be32(cep->qp->attrs.iwarp.cookie);
ret = erdma_send_mpareqrep(cep, params->private_data,
params->private_data_len);
diff --git a/drivers/infiniband/hw/erdma/erdma_hw.h b/drivers/infiniband/hw/erdma/erdma_hw.h
index b5c1aca71144c..3b0f7fc4ff312 100644
--- a/drivers/infiniband/hw/erdma/erdma_hw.h
+++ b/drivers/infiniband/hw/erdma/erdma_hw.h
@@ -31,6 +31,7 @@
enum erdma_proto_type {
ERDMA_PROTO_IWARP = 0,
ERDMA_PROTO_ROCEV2 = 1,
+ ERDMA_PROTO_COUNT = 2,
};
/* PCIe Bar0 Registers. */
diff --git a/drivers/infiniband/hw/erdma/erdma_main.c b/drivers/infiniband/hw/erdma/erdma_main.c
index 2fca163b17442..51cc8b17b9e9a 100644
--- a/drivers/infiniband/hw/erdma/erdma_main.c
+++ b/drivers/infiniband/hw/erdma/erdma_main.c
@@ -486,7 +486,6 @@ static const struct ib_device_ops erdma_device_ops_rocev2 = {
.query_pkey = erdma_query_pkey,
.create_ah = erdma_create_ah,
.destroy_ah = erdma_destroy_ah,
- .modify_qp = erdma_modify_qp_rocev2,
};
static const struct ib_device_ops erdma_device_ops_iwarp = {
@@ -498,7 +497,6 @@ static const struct ib_device_ops erdma_device_ops_iwarp = {
.iw_get_qp = erdma_get_ibqp,
.iw_reject = erdma_reject,
.iw_rem_ref = erdma_qp_put_ref,
- .modify_qp = erdma_modify_qp,
};
static const struct ib_device_ops erdma_device_ops = {
@@ -533,6 +531,7 @@ static const struct ib_device_ops erdma_device_ops = {
.query_qp = erdma_query_qp,
.req_notify_cq = erdma_req_notify_cq,
.reg_user_mr = erdma_reg_user_mr,
+ .modify_qp = erdma_modify_qp,
INIT_RDMA_OBJ_SIZE(ib_cq, erdma_cq, ibcq),
INIT_RDMA_OBJ_SIZE(ib_pd, erdma_pd, ibpd),
diff --git a/drivers/infiniband/hw/erdma/erdma_qp.c b/drivers/infiniband/hw/erdma/erdma_qp.c
index 5a425599cddea..e6856e3ca9709 100644
--- a/drivers/infiniband/hw/erdma/erdma_qp.c
+++ b/drivers/infiniband/hw/erdma/erdma_qp.c
@@ -11,20 +11,20 @@
void erdma_qp_llp_close(struct erdma_qp *qp)
{
- struct erdma_qp_attrs qp_attrs;
+ struct erdma_mod_qp_params_iwarp params;
down_write(&qp->state_lock);
- switch (qp->attrs.state) {
- case ERDMA_QP_STATE_RTS:
- case ERDMA_QP_STATE_RTR:
- case ERDMA_QP_STATE_IDLE:
- case ERDMA_QP_STATE_TERMINATE:
- qp_attrs.state = ERDMA_QP_STATE_CLOSING;
- erdma_modify_qp_internal(qp, &qp_attrs, ERDMA_QP_ATTR_STATE);
+ switch (qp->attrs.iwarp.state) {
+ case ERDMA_QPS_IWARP_RTS:
+ case ERDMA_QPS_IWARP_RTR:
+ case ERDMA_QPS_IWARP_IDLE:
+ case ERDMA_QPS_IWARP_TERMINATE:
+ params.state = ERDMA_QPS_IWARP_CLOSING;
+ erdma_modify_qp_state_iwarp(qp, ¶ms, ERDMA_QPA_IWARP_STATE);
break;
- case ERDMA_QP_STATE_CLOSING:
- qp->attrs.state = ERDMA_QP_STATE_IDLE;
+ case ERDMA_QPS_IWARP_CLOSING:
+ qp->attrs.iwarp.state = ERDMA_QPS_IWARP_IDLE;
break;
default:
break;
@@ -48,9 +48,10 @@ struct ib_qp *erdma_get_ibqp(struct ib_device *ibdev, int id)
return NULL;
}
-static int erdma_modify_qp_state_to_rts(struct erdma_qp *qp,
- struct erdma_qp_attrs *attrs,
- enum erdma_qp_attr_mask mask)
+static int
+erdma_modify_qp_state_to_rts(struct erdma_qp *qp,
+ struct erdma_mod_qp_params_iwarp *params,
+ enum erdma_qpa_mask_iwarp mask)
{
int ret;
struct erdma_dev *dev = qp->dev;
@@ -59,12 +60,15 @@ static int erdma_modify_qp_state_to_rts(struct erdma_qp *qp,
struct erdma_cep *cep = qp->cep;
struct sockaddr_storage local_addr, remote_addr;
- if (!(mask & ERDMA_QP_ATTR_LLP_HANDLE))
+ if (!(mask & ERDMA_QPA_IWARP_LLP_HANDLE))
return -EINVAL;
- if (!(mask & ERDMA_QP_ATTR_MPA))
+ if (!(mask & ERDMA_QPA_IWARP_MPA))
return -EINVAL;
+ if (!(mask & ERDMA_QPA_IWARP_CC))
+ params->cc = qp->attrs.cc;
+
ret = getname_local(cep->sock, &local_addr);
if (ret < 0)
return ret;
@@ -73,18 +77,16 @@ static int erdma_modify_qp_state_to_rts(struct erdma_qp *qp,
if (ret < 0)
return ret;
- qp->attrs.state = ERDMA_QP_STATE_RTS;
-
tp = tcp_sk(qp->cep->sock->sk);
erdma_cmdq_build_reqhdr(&req.hdr, CMDQ_SUBMOD_RDMA,
CMDQ_OPCODE_MODIFY_QP);
- req.cfg = FIELD_PREP(ERDMA_CMD_MODIFY_QP_STATE_MASK, qp->attrs.state) |
- FIELD_PREP(ERDMA_CMD_MODIFY_QP_CC_MASK, qp->attrs.cc) |
+ req.cfg = FIELD_PREP(ERDMA_CMD_MODIFY_QP_STATE_MASK, params->state) |
+ FIELD_PREP(ERDMA_CMD_MODIFY_QP_CC_MASK, params->cc) |
FIELD_PREP(ERDMA_CMD_MODIFY_QP_QPN_MASK, QP_ID(qp));
- req.cookie = be32_to_cpu(qp->cep->mpa.ext_data.cookie);
+ req.cookie = be32_to_cpu(cep->mpa.ext_data.cookie);
req.dip = to_sockaddr_in(remote_addr).sin_addr.s_addr;
req.sip = to_sockaddr_in(local_addr).sin_addr.s_addr;
req.dport = to_sockaddr_in(remote_addr).sin_port;
@@ -92,33 +94,55 @@ static int erdma_modify_qp_state_to_rts(struct erdma_qp *qp,
req.send_nxt = tp->snd_nxt;
/* rsvd tcp seq for mpa-rsp in server. */
- if (qp->attrs.qp_type == ERDMA_QP_PASSIVE)
- req.send_nxt += MPA_DEFAULT_HDR_LEN + qp->attrs.pd_len;
+ if (params->qp_type == ERDMA_QP_PASSIVE)
+ req.send_nxt += MPA_DEFAULT_HDR_LEN + params->pd_len;
req.recv_nxt = tp->rcv_nxt;
- return erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL);
+ ret = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL);
+ if (ret)
+ return ret;
+
+ if (mask & ERDMA_QPA_IWARP_IRD)
+ qp->attrs.irq_size = params->irq_size;
+
+ if (mask & ERDMA_QPA_IWARP_ORD)
+ qp->attrs.orq_size = params->orq_size;
+
+ if (mask & ERDMA_QPA_IWARP_CC)
+ qp->attrs.cc = params->cc;
+
+ qp->attrs.iwarp.state = ERDMA_QPS_IWARP_RTS;
+
+ return 0;
}
-static int erdma_modify_qp_state_to_stop(struct erdma_qp *qp,
- struct erdma_qp_attrs *attrs,
- enum erdma_qp_attr_mask mask)
+static int
+erdma_modify_qp_state_to_stop(struct erdma_qp *qp,
+ struct erdma_mod_qp_params_iwarp *params,
+ enum erdma_qpa_mask_iwarp mask)
{
struct erdma_dev *dev = qp->dev;
struct erdma_cmdq_modify_qp_req req;
-
- qp->attrs.state = attrs->state;
+ int ret;
erdma_cmdq_build_reqhdr(&req.hdr, CMDQ_SUBMOD_RDMA,
CMDQ_OPCODE_MODIFY_QP);
- req.cfg = FIELD_PREP(ERDMA_CMD_MODIFY_QP_STATE_MASK, attrs->state) |
+ req.cfg = FIELD_PREP(ERDMA_CMD_MODIFY_QP_STATE_MASK, params->state) |
FIELD_PREP(ERDMA_CMD_MODIFY_QP_QPN_MASK, QP_ID(qp));
- return erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL);
+ ret = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL);
+ if (ret)
+ return ret;
+
+ qp->attrs.iwarp.state = params->state;
+
+ return 0;
}
-int erdma_modify_qp_internal(struct erdma_qp *qp, struct erdma_qp_attrs *attrs,
- enum erdma_qp_attr_mask mask)
+int erdma_modify_qp_state_iwarp(struct erdma_qp *qp,
+ struct erdma_mod_qp_params_iwarp *params,
+ int mask)
{
bool need_reflush = false;
int drop_conn, ret = 0;
@@ -126,31 +150,31 @@ int erdma_modify_qp_internal(struct erdma_qp *qp, struct erdma_qp_attrs *attrs,
if (!mask)
return 0;
- if (!(mask & ERDMA_QP_ATTR_STATE))
+ if (!(mask & ERDMA_QPA_IWARP_STATE))
return 0;
- switch (qp->attrs.state) {
- case ERDMA_QP_STATE_IDLE:
- case ERDMA_QP_STATE_RTR:
- if (attrs->state == ERDMA_QP_STATE_RTS) {
- ret = erdma_modify_qp_state_to_rts(qp, attrs, mask);
- } else if (attrs->state == ERDMA_QP_STATE_ERROR) {
- qp->attrs.state = ERDMA_QP_STATE_ERROR;
+ switch (qp->attrs.iwarp.state) {
+ case ERDMA_QPS_IWARP_IDLE:
+ case ERDMA_QPS_IWARP_RTR:
+ if (params->state == ERDMA_QPS_IWARP_RTS) {
+ ret = erdma_modify_qp_state_to_rts(qp, params, mask);
+ } else if (params->state == ERDMA_QPS_IWARP_ERROR) {
+ qp->attrs.iwarp.state = ERDMA_QPS_IWARP_ERROR;
need_reflush = true;
if (qp->cep) {
erdma_cep_put(qp->cep);
qp->cep = NULL;
}
- ret = erdma_modify_qp_state_to_stop(qp, attrs, mask);
+ ret = erdma_modify_qp_state_to_stop(qp, params, mask);
}
break;
- case ERDMA_QP_STATE_RTS:
+ case ERDMA_QPS_IWARP_RTS:
drop_conn = 0;
- if (attrs->state == ERDMA_QP_STATE_CLOSING ||
- attrs->state == ERDMA_QP_STATE_TERMINATE ||
- attrs->state == ERDMA_QP_STATE_ERROR) {
- ret = erdma_modify_qp_state_to_stop(qp, attrs, mask);
+ if (params->state == ERDMA_QPS_IWARP_CLOSING ||
+ params->state == ERDMA_QPS_IWARP_TERMINATE ||
+ params->state == ERDMA_QPS_IWARP_ERROR) {
+ ret = erdma_modify_qp_state_to_stop(qp, params, mask);
drop_conn = 1;
need_reflush = true;
}
@@ -159,17 +183,17 @@ int erdma_modify_qp_internal(struct erdma_qp *qp, struct erdma_qp_attrs *attrs,
erdma_qp_cm_drop(qp);
break;
- case ERDMA_QP_STATE_TERMINATE:
- if (attrs->state == ERDMA_QP_STATE_ERROR)
- qp->attrs.state = ERDMA_QP_STATE_ERROR;
+ case ERDMA_QPS_IWARP_TERMINATE:
+ if (params->state == ERDMA_QPS_IWARP_ERROR)
+ qp->attrs.iwarp.state = ERDMA_QPS_IWARP_ERROR;
break;
- case ERDMA_QP_STATE_CLOSING:
- if (attrs->state == ERDMA_QP_STATE_IDLE) {
- qp->attrs.state = ERDMA_QP_STATE_IDLE;
- } else if (attrs->state == ERDMA_QP_STATE_ERROR) {
- ret = erdma_modify_qp_state_to_stop(qp, attrs, mask);
- qp->attrs.state = ERDMA_QP_STATE_ERROR;
- } else if (attrs->state != ERDMA_QP_STATE_CLOSING) {
+ case ERDMA_QPS_IWARP_CLOSING:
+ if (params->state == ERDMA_QPS_IWARP_IDLE) {
+ qp->attrs.iwarp.state = ERDMA_QPS_IWARP_IDLE;
+ } else if (params->state == ERDMA_QPS_IWARP_ERROR) {
+ ret = erdma_modify_qp_state_to_stop(qp, params, mask);
+ qp->attrs.iwarp.state = ERDMA_QPS_IWARP_ERROR;
+ } else if (params->state != ERDMA_QPS_IWARP_CLOSING) {
return -ECONNABORTED;
}
break;
diff --git a/drivers/infiniband/hw/erdma/erdma_verbs.c b/drivers/infiniband/hw/erdma/erdma_verbs.c
index 860703a24c2c7..707ca315bdfcc 100644
--- a/drivers/infiniband/hw/erdma/erdma_verbs.c
+++ b/drivers/infiniband/hw/erdma/erdma_verbs.c
@@ -122,7 +122,7 @@ static int create_qp_cmd(struct erdma_ucontext *uctx, struct erdma_qp *qp)
err = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), &resp0,
&resp1);
if (!err && erdma_device_iwarp(dev))
- qp->attrs.cookie =
+ qp->attrs.iwarp.cookie =
FIELD_GET(ERDMA_CMDQ_CREATE_QP_RESP_COOKIE_MASK, resp0);
return err;
@@ -1022,7 +1022,7 @@ int erdma_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs,
qp->attrs.max_recv_sge = attrs->cap.max_recv_sge;
if (erdma_device_iwarp(qp->dev))
- qp->attrs.state = ERDMA_QP_STATE_IDLE;
+ qp->attrs.iwarp.state = ERDMA_QPS_IWARP_IDLE;
else
qp->attrs.rocev2.state = ERDMA_QPS_ROCEV2_RESET;
@@ -1299,18 +1299,18 @@ int erdma_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata)
struct erdma_dev *dev = to_edev(ibqp->device);
struct erdma_ucontext *ctx = rdma_udata_to_drv_context(
udata, struct erdma_ucontext, ibucontext);
- struct erdma_mod_qp_params_rocev2 rocev2_params;
- struct erdma_qp_attrs qp_attrs;
- int err;
struct erdma_cmdq_destroy_qp_req req;
+ union erdma_mod_qp_params params;
+ int err;
down_write(&qp->state_lock);
if (erdma_device_iwarp(dev)) {
- qp_attrs.state = ERDMA_QP_STATE_ERROR;
- erdma_modify_qp_internal(qp, &qp_attrs, ERDMA_QP_ATTR_STATE);
+ params.iwarp.state = ERDMA_QPS_IWARP_ERROR;
+ erdma_modify_qp_state_iwarp(qp, ¶ms.iwarp,
+ ERDMA_QPA_IWARP_STATE);
} else {
- rocev2_params.state = ERDMA_QPS_ROCEV2_ERROR;
- erdma_modify_qp_state_rocev2(qp, &rocev2_params,
+ params.rocev2.state = ERDMA_QPS_ROCEV2_ERROR;
+ erdma_modify_qp_state_rocev2(qp, ¶ms.rocev2,
ERDMA_QPA_ROCEV2_STATE);
}
up_write(&qp->state_lock);
@@ -1566,38 +1566,69 @@ static void erdma_attr_to_av(const struct rdma_ah_attr *ah_attr,
av->ntype = ERDMA_NETWORK_TYPE_IPV6;
}
-static int ib_qp_state_to_erdma_qp_state[IB_QPS_ERR + 1] = {
- [IB_QPS_RESET] = ERDMA_QP_STATE_IDLE,
- [IB_QPS_INIT] = ERDMA_QP_STATE_IDLE,
- [IB_QPS_RTR] = ERDMA_QP_STATE_RTR,
- [IB_QPS_RTS] = ERDMA_QP_STATE_RTS,
- [IB_QPS_SQD] = ERDMA_QP_STATE_CLOSING,
- [IB_QPS_SQE] = ERDMA_QP_STATE_TERMINATE,
- [IB_QPS_ERR] = ERDMA_QP_STATE_ERROR
+static int ib_qps_to_erdma_qps[ERDMA_PROTO_COUNT][IB_QPS_ERR + 1] = {
+ [ERDMA_PROTO_IWARP] = {
+ [IB_QPS_RESET] = ERDMA_QPS_IWARP_IDLE,
+ [IB_QPS_INIT] = ERDMA_QPS_IWARP_IDLE,
+ [IB_QPS_RTR] = ERDMA_QPS_IWARP_RTR,
+ [IB_QPS_RTS] = ERDMA_QPS_IWARP_RTS,
+ [IB_QPS_SQD] = ERDMA_QPS_IWARP_CLOSING,
+ [IB_QPS_SQE] = ERDMA_QPS_IWARP_TERMINATE,
+ [IB_QPS_ERR] = ERDMA_QPS_IWARP_ERROR,
+ },
+ [ERDMA_PROTO_ROCEV2] = {
+ [IB_QPS_RESET] = ERDMA_QPS_ROCEV2_RESET,
+ [IB_QPS_INIT] = ERDMA_QPS_ROCEV2_INIT,
+ [IB_QPS_RTR] = ERDMA_QPS_ROCEV2_RTR,
+ [IB_QPS_RTS] = ERDMA_QPS_ROCEV2_RTS,
+ [IB_QPS_SQD] = ERDMA_QPS_ROCEV2_SQD,
+ [IB_QPS_SQE] = ERDMA_QPS_ROCEV2_SQE,
+ [IB_QPS_ERR] = ERDMA_QPS_ROCEV2_ERROR,
+ },
};
-static int ib_qps_to_erdma_qps_rocev2[IB_QPS_ERR + 1] = {
- [IB_QPS_RESET] = ERDMA_QPS_ROCEV2_RESET,
- [IB_QPS_INIT] = ERDMA_QPS_ROCEV2_INIT,
- [IB_QPS_RTR] = ERDMA_QPS_ROCEV2_RTR,
- [IB_QPS_RTS] = ERDMA_QPS_ROCEV2_RTS,
- [IB_QPS_SQD] = ERDMA_QPS_ROCEV2_SQD,
- [IB_QPS_SQE] = ERDMA_QPS_ROCEV2_SQE,
- [IB_QPS_ERR] = ERDMA_QPS_ROCEV2_ERROR,
+static int erdma_qps_to_ib_qps[ERDMA_PROTO_COUNT][ERDMA_QPS_ROCEV2_COUNT] = {
+ [ERDMA_PROTO_IWARP] = {
+ [ERDMA_QPS_IWARP_IDLE] = IB_QPS_INIT,
+ [ERDMA_QPS_IWARP_RTR] = IB_QPS_RTR,
+ [ERDMA_QPS_IWARP_RTS] = IB_QPS_RTS,
+ [ERDMA_QPS_IWARP_CLOSING] = IB_QPS_ERR,
+ [ERDMA_QPS_IWARP_TERMINATE] = IB_QPS_ERR,
+ [ERDMA_QPS_IWARP_ERROR] = IB_QPS_ERR,
+ },
+ [ERDMA_PROTO_ROCEV2] = {
+ [ERDMA_QPS_ROCEV2_RESET] = IB_QPS_RESET,
+ [ERDMA_QPS_ROCEV2_INIT] = IB_QPS_INIT,
+ [ERDMA_QPS_ROCEV2_RTR] = IB_QPS_RTR,
+ [ERDMA_QPS_ROCEV2_RTS] = IB_QPS_RTS,
+ [ERDMA_QPS_ROCEV2_SQD] = IB_QPS_SQD,
+ [ERDMA_QPS_ROCEV2_SQE] = IB_QPS_SQE,
+ [ERDMA_QPS_ROCEV2_ERROR] = IB_QPS_ERR,
+ },
};
-static int erdma_qps_to_ib_qps_rocev2[ERDMA_QPS_ROCEV2_COUNT] = {
- [ERDMA_QPS_ROCEV2_RESET] = IB_QPS_RESET,
- [ERDMA_QPS_ROCEV2_INIT] = IB_QPS_INIT,
- [ERDMA_QPS_ROCEV2_RTR] = IB_QPS_RTR,
- [ERDMA_QPS_ROCEV2_RTS] = IB_QPS_RTS,
- [ERDMA_QPS_ROCEV2_SQD] = IB_QPS_SQD,
- [ERDMA_QPS_ROCEV2_SQE] = IB_QPS_SQE,
- [ERDMA_QPS_ROCEV2_ERROR] = IB_QPS_ERR,
-};
+static inline enum erdma_qps_iwarp ib_to_iwarp_qps(enum ib_qp_state state)
+{
+ return ib_qps_to_erdma_qps[ERDMA_PROTO_IWARP][state];
+}
-static int erdma_check_qp_attr_rocev2(struct erdma_qp *qp,
- struct ib_qp_attr *attr, int attr_mask)
+static inline enum erdma_qps_rocev2 ib_to_rocev2_qps(enum ib_qp_state state)
+{
+ return ib_qps_to_erdma_qps[ERDMA_PROTO_ROCEV2][state];
+}
+
+static inline enum ib_qp_state iwarp_to_ib_qps(enum erdma_qps_iwarp state)
+{
+ return erdma_qps_to_ib_qps[ERDMA_PROTO_IWARP][state];
+}
+
+static inline enum ib_qp_state rocev2_to_ib_qps(enum erdma_qps_rocev2 state)
+{
+ return erdma_qps_to_ib_qps[ERDMA_PROTO_ROCEV2][state];
+}
+
+static int erdma_check_qp_attrs(struct erdma_qp *qp, struct ib_qp_attr *attr,
+ int attr_mask)
{
enum ib_qp_state cur_state, nxt_state;
struct erdma_dev *dev = qp->dev;
@@ -1608,27 +1639,31 @@ static int erdma_check_qp_attr_rocev2(struct erdma_qp *qp,
goto out;
}
- if ((attr_mask & IB_QP_PKEY_INDEX) &&
- attr->pkey_index >= ERDMA_MAX_PKEYS)
- goto out;
-
if ((attr_mask & IB_QP_PORT) &&
!rdma_is_port_valid(&dev->ibdev, attr->port_num))
goto out;
- cur_state = (attr_mask & IB_QP_CUR_STATE) ?
- attr->cur_qp_state :
- erdma_qps_to_ib_qps_rocev2[qp->attrs.rocev2.state];
+ if (erdma_device_rocev2(dev)) {
+ cur_state = (attr_mask & IB_QP_CUR_STATE) ?
+ attr->cur_qp_state :
+ rocev2_to_ib_qps(qp->attrs.rocev2.state);
- nxt_state = (attr_mask & IB_QP_STATE) ? attr->qp_state : cur_state;
+ nxt_state = (attr_mask & IB_QP_STATE) ? attr->qp_state :
+ cur_state;
- if (!ib_modify_qp_is_ok(cur_state, nxt_state, qp->ibqp.qp_type,
- attr_mask))
- goto out;
+ if (!ib_modify_qp_is_ok(cur_state, nxt_state, qp->ibqp.qp_type,
+ attr_mask))
+ goto out;
- if ((attr_mask & IB_QP_AV) &&
- erdma_check_gid_attr(rdma_ah_read_grh(&attr->ah_attr)->sgid_attr))
- goto out;
+ if ((attr_mask & IB_QP_AV) &&
+ erdma_check_gid_attr(
+ rdma_ah_read_grh(&attr->ah_attr)->sgid_attr))
+ goto out;
+
+ if ((attr_mask & IB_QP_PKEY_INDEX) &&
+ attr->pkey_index >= ERDMA_MAX_PKEYS)
+ goto out;
+ }
return 0;
@@ -1645,12 +1680,12 @@ static void erdma_init_mod_qp_params_rocev2(
u16 udp_sport;
if (ib_attr_mask & IB_QP_CUR_STATE)
- cur_state = ib_qps_to_erdma_qps_rocev2[attr->cur_qp_state];
+ cur_state = ib_to_rocev2_qps(attr->cur_qp_state);
else
cur_state = qp->attrs.rocev2.state;
if (ib_attr_mask & IB_QP_STATE)
- nxt_state = ib_qps_to_erdma_qps_rocev2[attr->qp_state];
+ nxt_state = ib_to_rocev2_qps(attr->qp_state);
else
nxt_state = cur_state;
@@ -1687,75 +1722,46 @@ static void erdma_init_mod_qp_params_rocev2(
*erdma_attr_mask = to_modify_attrs;
}
-int erdma_modify_qp_rocev2(struct ib_qp *ibqp, struct ib_qp_attr *attr,
- int attr_mask, struct ib_udata *udata)
+int erdma_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask,
+ struct ib_udata *udata)
{
- struct erdma_mod_qp_params_rocev2 params;
struct erdma_qp *qp = to_eqp(ibqp);
+ union erdma_mod_qp_params params;
int ret = 0, erdma_attr_mask = 0;
down_write(&qp->state_lock);
- ret = erdma_check_qp_attr_rocev2(qp, attr, attr_mask);
+ ret = erdma_check_qp_attrs(qp, attr, attr_mask);
if (ret)
goto out;
- erdma_init_mod_qp_params_rocev2(qp, ¶ms, &erdma_attr_mask, attr,
- attr_mask);
-
- ret = erdma_modify_qp_state_rocev2(qp, ¶ms, erdma_attr_mask);
-
-out:
- up_write(&qp->state_lock);
- return ret;
-}
-
-int erdma_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask,
- struct ib_udata *udata)
-{
- struct erdma_qp_attrs new_attrs;
- enum erdma_qp_attr_mask erdma_attr_mask = 0;
- struct erdma_qp *qp = to_eqp(ibqp);
- int ret = 0;
-
- if (attr_mask & ~IB_QP_ATTR_STANDARD_BITS)
- return -EOPNOTSUPP;
-
- memset(&new_attrs, 0, sizeof(new_attrs));
+ if (erdma_device_iwarp(qp->dev)) {
+ if (attr_mask & IB_QP_STATE) {
+ erdma_attr_mask |= ERDMA_QPA_IWARP_STATE;
+ params.iwarp.state = ib_to_iwarp_qps(attr->qp_state);
+ }
- if (attr_mask & IB_QP_STATE) {
- new_attrs.state = ib_qp_state_to_erdma_qp_state[attr->qp_state];
+ ret = erdma_modify_qp_state_iwarp(qp, ¶ms.iwarp,
+ erdma_attr_mask);
+ } else {
+ erdma_init_mod_qp_params_rocev2(
+ qp, ¶ms.rocev2, &erdma_attr_mask, attr, attr_mask);
- erdma_attr_mask |= ERDMA_QP_ATTR_STATE;
+ ret = erdma_modify_qp_state_rocev2(qp, ¶ms.rocev2,
+ erdma_attr_mask);
}
- down_write(&qp->state_lock);
-
- ret = erdma_modify_qp_internal(qp, &new_attrs, erdma_attr_mask);
-
+out:
up_write(&qp->state_lock);
-
return ret;
}
static enum ib_qp_state query_qp_state(struct erdma_qp *qp)
{
- switch (qp->attrs.state) {
- case ERDMA_QP_STATE_IDLE:
- return IB_QPS_INIT;
- case ERDMA_QP_STATE_RTR:
- return IB_QPS_RTR;
- case ERDMA_QP_STATE_RTS:
- return IB_QPS_RTS;
- case ERDMA_QP_STATE_CLOSING:
- return IB_QPS_ERR;
- case ERDMA_QP_STATE_TERMINATE:
- return IB_QPS_ERR;
- case ERDMA_QP_STATE_ERROR:
- return IB_QPS_ERR;
- default:
- return IB_QPS_ERR;
- }
+ if (erdma_device_iwarp(qp->dev))
+ return iwarp_to_ib_qps(qp->attrs.iwarp.state);
+ else
+ return rocev2_to_ib_qps(qp->attrs.rocev2.state);
}
int erdma_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr,
diff --git a/drivers/infiniband/hw/erdma/erdma_verbs.h b/drivers/infiniband/hw/erdma/erdma_verbs.h
index fad3e475d8f1d..f9408ccc8bad0 100644
--- a/drivers/infiniband/hw/erdma/erdma_verbs.h
+++ b/drivers/infiniband/hw/erdma/erdma_verbs.h
@@ -195,25 +195,26 @@ struct erdma_kqp {
u8 sig_all;
};
-enum erdma_qp_state {
- ERDMA_QP_STATE_IDLE = 0,
- ERDMA_QP_STATE_RTR = 1,
- ERDMA_QP_STATE_RTS = 2,
- ERDMA_QP_STATE_CLOSING = 3,
- ERDMA_QP_STATE_TERMINATE = 4,
- ERDMA_QP_STATE_ERROR = 5,
- ERDMA_QP_STATE_UNDEF = 7,
- ERDMA_QP_STATE_COUNT = 8
+enum erdma_qps_iwarp {
+ ERDMA_QPS_IWARP_IDLE = 0,
+ ERDMA_QPS_IWARP_RTR = 1,
+ ERDMA_QPS_IWARP_RTS = 2,
+ ERDMA_QPS_IWARP_CLOSING = 3,
+ ERDMA_QPS_IWARP_TERMINATE = 4,
+ ERDMA_QPS_IWARP_ERROR = 5,
+ ERDMA_QPS_IWARP_UNDEF = 6,
+ ERDMA_QPS_IWARP_COUNT = 7,
};
-enum erdma_qp_attr_mask {
- ERDMA_QP_ATTR_STATE = (1 << 0),
- ERDMA_QP_ATTR_LLP_HANDLE = (1 << 2),
- ERDMA_QP_ATTR_ORD = (1 << 3),
- ERDMA_QP_ATTR_IRD = (1 << 4),
- ERDMA_QP_ATTR_SQ_SIZE = (1 << 5),
- ERDMA_QP_ATTR_RQ_SIZE = (1 << 6),
- ERDMA_QP_ATTR_MPA = (1 << 7)
+enum erdma_qpa_mask_iwarp {
+ ERDMA_QPA_IWARP_STATE = (1 << 0),
+ ERDMA_QPA_IWARP_LLP_HANDLE = (1 << 2),
+ ERDMA_QPA_IWARP_ORD = (1 << 3),
+ ERDMA_QPA_IWARP_IRD = (1 << 4),
+ ERDMA_QPA_IWARP_SQ_SIZE = (1 << 5),
+ ERDMA_QPA_IWARP_RQ_SIZE = (1 << 6),
+ ERDMA_QPA_IWARP_MPA = (1 << 7),
+ ERDMA_QPA_IWARP_CC = (1 << 8),
};
enum erdma_qps_rocev2 {
@@ -240,6 +241,23 @@ enum erdma_qp_flags {
ERDMA_QP_IN_FLUSHING = (1 << 0),
};
+#define ERDMA_QP_ACTIVE 0
+#define ERDMA_QP_PASSIVE 1
+
+struct erdma_mod_qp_params_iwarp {
+ enum erdma_qps_iwarp state;
+ enum erdma_cc_alg cc;
+ u8 qp_type;
+ u8 pd_len;
+ u32 irq_size;
+ u32 orq_size;
+};
+
+struct erdma_qp_attrs_iwarp {
+ enum erdma_qps_iwarp state;
+ u32 cookie;
+};
+
struct erdma_mod_qp_params_rocev2 {
enum erdma_qps_rocev2 state;
u32 qkey;
@@ -249,6 +267,11 @@ struct erdma_mod_qp_params_rocev2 {
struct erdma_av av;
};
+union erdma_mod_qp_params {
+ struct erdma_mod_qp_params_iwarp iwarp;
+ struct erdma_mod_qp_params_rocev2 rocev2;
+};
+
struct erdma_qp_attrs_rocev2 {
enum erdma_qps_rocev2 state;
u32 qkey;
@@ -257,7 +280,6 @@ struct erdma_qp_attrs_rocev2 {
};
struct erdma_qp_attrs {
- enum erdma_qp_state state;
enum erdma_cc_alg cc; /* Congestion control algorithm */
u32 sq_size;
u32 rq_size;
@@ -265,12 +287,10 @@ struct erdma_qp_attrs {
u32 irq_size;
u32 max_send_sge;
u32 max_recv_sge;
- u32 cookie;
-#define ERDMA_QP_ACTIVE 0
-#define ERDMA_QP_PASSIVE 1
- u8 qp_type;
- u8 pd_len;
- struct erdma_qp_attrs_rocev2 rocev2;
+ union {
+ struct erdma_qp_attrs_iwarp iwarp;
+ struct erdma_qp_attrs_rocev2 rocev2;
+ };
};
struct erdma_qp {
@@ -342,8 +362,9 @@ static inline struct erdma_cq *find_cq_by_cqn(struct erdma_dev *dev, int id)
void erdma_qp_get(struct erdma_qp *qp);
void erdma_qp_put(struct erdma_qp *qp);
-int erdma_modify_qp_internal(struct erdma_qp *qp, struct erdma_qp_attrs *attrs,
- enum erdma_qp_attr_mask mask);
+int erdma_modify_qp_state_iwarp(struct erdma_qp *qp,
+ struct erdma_mod_qp_params_iwarp *params,
+ int mask);
int erdma_modify_qp_state_rocev2(struct erdma_qp *qp,
struct erdma_mod_qp_params_rocev2 *params,
int attr_mask);
@@ -426,8 +447,6 @@ int erdma_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int mask,
struct ib_qp_init_attr *init_attr);
int erdma_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int mask,
struct ib_udata *data);
-int erdma_modify_qp_rocev2(struct ib_qp *ibqp, struct ib_qp_attr *attr,
- int mask, struct ib_udata *udata);
int erdma_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata);
int erdma_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata);
void erdma_disassociate_ucontext(struct ib_ucontext *ibcontext);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0672/1376] RDMA/erdma: Add the query_qp command to the cmdq
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (670 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0671/1376] RDMA/erdma: Refactor the code of the modify_qp interface Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0673/1376] RDMA/erdma: Fix incorrect response returned from query_qp Greg Kroah-Hartman
` (326 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Boshi Yu, Cheng Xu, Leon Romanovsky,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boshi Yu <boshiyu@linux.alibaba.com>
[ Upstream commit 1cccbd3eec3d6370ddf9a003c1a1baeb8c155b3b ]
Certian QP attributes, such as sq_draining, can only be obtained
by querying the hardware on the erdma RoCEv2 device. To address this,
we add the query_qp command to the cmdq and parse the response to
retrieve corresponding QP attributes.
Signed-off-by: Boshi Yu <boshiyu@linux.alibaba.com>
Link: https://patch.msgid.link/20241211020930.68833-8-boshiyu@linux.alibaba.com
Reviewed-by: Cheng Xu <chengyou@linux.alibaba.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Stable-dep-of: 652befcba956 ("RDMA/erdma: complete object teardown when the destroy command fails")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/erdma/erdma_hw.h | 12 +++++
drivers/infiniband/hw/erdma/erdma_verbs.c | 58 +++++++++++++++++++----
2 files changed, 60 insertions(+), 10 deletions(-)
diff --git a/drivers/infiniband/hw/erdma/erdma_hw.h b/drivers/infiniband/hw/erdma/erdma_hw.h
index 3b0f7fc4ff312..809e77dde271a 100644
--- a/drivers/infiniband/hw/erdma/erdma_hw.h
+++ b/drivers/infiniband/hw/erdma/erdma_hw.h
@@ -154,6 +154,7 @@ enum CMDQ_RDMA_OPCODE {
CMDQ_OPCODE_SET_GID = 14,
CMDQ_OPCODE_CREATE_AH = 15,
CMDQ_OPCODE_DESTROY_AH = 16,
+ CMDQ_OPCODE_QUERY_QP = 17,
};
enum CMDQ_COMMON_OPCODE {
@@ -362,6 +363,17 @@ struct erdma_cmdq_mod_qp_req_rocev2 {
struct erdma_av_cfg av_cfg;
};
+/* query qp response mask */
+#define ERDMA_CMD_QUERY_QP_RESP_SQ_PSN_MASK GENMASK_ULL(23, 0)
+#define ERDMA_CMD_QUERY_QP_RESP_RQ_PSN_MASK GENMASK_ULL(47, 24)
+#define ERDMA_CMD_QUERY_QP_RESP_QP_STATE_MASK GENMASK_ULL(55, 48)
+#define ERDMA_CMD_QUERY_QP_RESP_SQ_DRAINING_MASK GENMASK_ULL(56, 56)
+
+struct erdma_cmdq_query_qp_req_rocev2 {
+ u64 hdr;
+ u32 qpn;
+};
+
/* create qp cfg0 */
#define ERDMA_CMD_CREATE_QP_SQ_DEPTH_MASK GENMASK(31, 20)
#define ERDMA_CMD_CREATE_QP_QPN_MASK GENMASK(19, 0)
diff --git a/drivers/infiniband/hw/erdma/erdma_verbs.c b/drivers/infiniband/hw/erdma/erdma_verbs.c
index 707ca315bdfcc..3f2d2941e3103 100644
--- a/drivers/infiniband/hw/erdma/erdma_verbs.c
+++ b/drivers/infiniband/hw/erdma/erdma_verbs.c
@@ -1566,6 +1566,19 @@ static void erdma_attr_to_av(const struct rdma_ah_attr *ah_attr,
av->ntype = ERDMA_NETWORK_TYPE_IPV6;
}
+static void erdma_av_to_attr(struct erdma_av *av, struct rdma_ah_attr *ah_attr)
+{
+ ah_attr->type = RDMA_AH_ATTR_TYPE_ROCE;
+
+ rdma_ah_set_sl(ah_attr, av->sl);
+ rdma_ah_set_port_num(ah_attr, av->port);
+ rdma_ah_set_ah_flags(ah_attr, IB_AH_GRH);
+
+ rdma_ah_set_grh(ah_attr, NULL, av->flow_label, av->sgid_index,
+ av->hop_limit, av->traffic_class);
+ rdma_ah_set_dgid_raw(ah_attr, av->dgid);
+}
+
static int ib_qps_to_erdma_qps[ERDMA_PROTO_COUNT][IB_QPS_ERR + 1] = {
[ERDMA_PROTO_IWARP] = {
[IB_QPS_RESET] = ERDMA_QPS_IWARP_IDLE,
@@ -1767,8 +1780,11 @@ static enum ib_qp_state query_qp_state(struct erdma_qp *qp)
int erdma_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr,
int qp_attr_mask, struct ib_qp_init_attr *qp_init_attr)
{
+ struct erdma_cmdq_query_qp_req_rocev2 req;
struct erdma_dev *dev;
struct erdma_qp *qp;
+ u64 resp;
+ int ret;
if (ibqp && qp_attr && qp_init_attr) {
qp = to_eqp(ibqp);
@@ -1795,8 +1811,37 @@ int erdma_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr,
qp_init_attr->cap = qp_attr->cap;
- qp_attr->qp_state = query_qp_state(qp);
- qp_attr->cur_qp_state = query_qp_state(qp);
+ if (erdma_device_rocev2(dev)) {
+ /* Query hardware to get some attributes */
+ erdma_cmdq_build_reqhdr(&req.hdr, CMDQ_SUBMOD_RDMA,
+ CMDQ_OPCODE_QUERY_QP);
+ req.qpn = QP_ID(qp);
+
+ ret = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), &resp,
+ NULL);
+ if (ret)
+ return ret;
+
+ qp_attr->sq_psn =
+ FIELD_GET(ERDMA_CMD_QUERY_QP_RESP_SQ_PSN_MASK, resp);
+ qp_attr->rq_psn =
+ FIELD_GET(ERDMA_CMD_QUERY_QP_RESP_RQ_PSN_MASK, resp);
+ qp_attr->qp_state = rocev2_to_ib_qps(
+ FIELD_GET(ERDMA_CMD_QUERY_QP_RESP_QP_STATE_MASK, resp));
+ qp_attr->cur_qp_state = qp_attr->qp_state;
+ qp_attr->sq_draining = FIELD_GET(
+ ERDMA_CMD_QUERY_QP_RESP_SQ_DRAINING_MASK, resp);
+
+ qp_attr->pkey_index = 0;
+ qp_attr->dest_qp_num = qp->attrs.rocev2.dst_qpn;
+
+ if (qp->ibqp.qp_type == IB_QPT_RC)
+ erdma_av_to_attr(&qp->attrs.rocev2.av,
+ &qp_attr->ah_attr);
+ } else {
+ qp_attr->qp_state = query_qp_state(qp);
+ qp_attr->cur_qp_state = qp_attr->qp_state;
+ }
return 0;
}
@@ -2188,14 +2233,7 @@ int erdma_query_ah(struct ib_ah *ibah, struct rdma_ah_attr *ah_attr)
struct erdma_ah *ah = to_eah(ibah);
memset(ah_attr, 0, sizeof(*ah_attr));
-
- ah_attr->type = RDMA_AH_ATTR_TYPE_ROCE;
- rdma_ah_set_sl(ah_attr, ah->av.sl);
- rdma_ah_set_port_num(ah_attr, ah->av.port);
- rdma_ah_set_ah_flags(ah_attr, IB_AH_GRH);
- rdma_ah_set_grh(ah_attr, NULL, ah->av.flow_label, ah->av.sgid_index,
- ah->av.hop_limit, ah->av.traffic_class);
- rdma_ah_set_dgid_raw(ah_attr, ah->av.dgid);
+ erdma_av_to_attr(&ah->av, ah_attr);
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0673/1376] RDMA/erdma: Fix incorrect response returned from query_qp
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (671 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0672/1376] RDMA/erdma: Add the query_qp command to the cmdq Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0674/1376] RDMA/erdma: Support non-sleeping erdma_post_cmd_wait() Greg Kroah-Hartman
` (325 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cheng Xu, Boshi Yu, Leon Romanovsky,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boshi Yu <boshiyu@linux.alibaba.com>
[ Upstream commit 3761e0ad79c137d61baf5f1518e4795f35fe8159 ]
The erdma_post_cmd_wait() function returns the cmdq response
only when both resp0 and resp1 are not NULL.
Reviewed-by: Cheng Xu <chengyou@linux.alibaba.com>
Signed-off-by: Boshi Yu <boshiyu@linux.alibaba.com>
Link: https://patch.msgid.link/20241226084141.74823-3-boshiyu@linux.alibaba.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Stable-dep-of: 652befcba956 ("RDMA/erdma: complete object teardown when the destroy command fails")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/erdma/erdma_verbs.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/drivers/infiniband/hw/erdma/erdma_verbs.c b/drivers/infiniband/hw/erdma/erdma_verbs.c
index 3f2d2941e3103..2e5d6e721952b 100644
--- a/drivers/infiniband/hw/erdma/erdma_verbs.c
+++ b/drivers/infiniband/hw/erdma/erdma_verbs.c
@@ -1783,7 +1783,7 @@ int erdma_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr,
struct erdma_cmdq_query_qp_req_rocev2 req;
struct erdma_dev *dev;
struct erdma_qp *qp;
- u64 resp;
+ u64 resp0, resp1;
int ret;
if (ibqp && qp_attr && qp_init_attr) {
@@ -1817,20 +1817,20 @@ int erdma_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr,
CMDQ_OPCODE_QUERY_QP);
req.qpn = QP_ID(qp);
- ret = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), &resp,
- NULL);
+ ret = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), &resp0,
+ &resp1);
if (ret)
return ret;
qp_attr->sq_psn =
- FIELD_GET(ERDMA_CMD_QUERY_QP_RESP_SQ_PSN_MASK, resp);
+ FIELD_GET(ERDMA_CMD_QUERY_QP_RESP_SQ_PSN_MASK, resp0);
qp_attr->rq_psn =
- FIELD_GET(ERDMA_CMD_QUERY_QP_RESP_RQ_PSN_MASK, resp);
- qp_attr->qp_state = rocev2_to_ib_qps(
- FIELD_GET(ERDMA_CMD_QUERY_QP_RESP_QP_STATE_MASK, resp));
+ FIELD_GET(ERDMA_CMD_QUERY_QP_RESP_RQ_PSN_MASK, resp0);
+ qp_attr->qp_state = rocev2_to_ib_qps(FIELD_GET(
+ ERDMA_CMD_QUERY_QP_RESP_QP_STATE_MASK, resp0));
qp_attr->cur_qp_state = qp_attr->qp_state;
qp_attr->sq_draining = FIELD_GET(
- ERDMA_CMD_QUERY_QP_RESP_SQ_DRAINING_MASK, resp);
+ ERDMA_CMD_QUERY_QP_RESP_SQ_DRAINING_MASK, resp0);
qp_attr->pkey_index = 0;
qp_attr->dest_qp_num = qp->attrs.rocev2.dst_qpn;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0674/1376] RDMA/erdma: Support non-sleeping erdma_post_cmd_wait()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (672 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0673/1376] RDMA/erdma: Fix incorrect response returned from query_qp Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0675/1376] RDMA/erdma: complete object teardown when the destroy command fails Greg Kroah-Hartman
` (324 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cheng Xu, Boshi Yu, Leon Romanovsky,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boshi Yu <boshiyu@linux.alibaba.com>
[ Upstream commit 26981e688ca896e9310e1918d104a79cb140ce85 ]
Several scenarios require posting commands to the cmdq in a non-sleepable
context. For example, the cm_alloc_msg() might call erdma_create_ah()
while still holding a spinlock. So we add support for non-sleeping
erdma_post_cmd_wait().
Reviewed-by: Cheng Xu <chengyou@linux.alibaba.com>
Signed-off-by: Boshi Yu <boshiyu@linux.alibaba.com>
Link: https://patch.msgid.link/20241226084141.74823-4-boshiyu@linux.alibaba.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Stable-dep-of: 652befcba956 ("RDMA/erdma: complete object teardown when the destroy command fails")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/erdma/erdma.h | 4 +--
drivers/infiniband/hw/erdma/erdma_cmdq.c | 26 +++++++-------
drivers/infiniband/hw/erdma/erdma_eq.c | 6 ++--
drivers/infiniband/hw/erdma/erdma_main.c | 7 ++--
drivers/infiniband/hw/erdma/erdma_qp.c | 8 +++--
drivers/infiniband/hw/erdma/erdma_verbs.c | 44 ++++++++++++++---------
6 files changed, 54 insertions(+), 41 deletions(-)
diff --git a/drivers/infiniband/hw/erdma/erdma.h b/drivers/infiniband/hw/erdma/erdma.h
index 4f840d8e3bebb..f7ed1e4cff993 100644
--- a/drivers/infiniband/hw/erdma/erdma.h
+++ b/drivers/infiniband/hw/erdma/erdma.h
@@ -101,8 +101,6 @@ struct erdma_cmdq {
struct erdma_comp_wait *wait_pool;
spinlock_t lock;
- bool use_event;
-
struct erdma_cmdq_sq sq;
struct erdma_cmdq_cq cq;
struct erdma_eq eq;
@@ -269,7 +267,7 @@ void erdma_cmdq_destroy(struct erdma_dev *dev);
void erdma_cmdq_build_reqhdr(u64 *hdr, u32 mod, u32 op);
int erdma_post_cmd_wait(struct erdma_cmdq *cmdq, void *req, u32 req_size,
- u64 *resp0, u64 *resp1);
+ u64 *resp0, u64 *resp1, bool sleepable);
void erdma_cmdq_completion_handler(struct erdma_cmdq *cmdq);
int erdma_ceqs_init(struct erdma_dev *dev);
diff --git a/drivers/infiniband/hw/erdma/erdma_cmdq.c b/drivers/infiniband/hw/erdma/erdma_cmdq.c
index a3d8922d1ad10..b867aefe83b2f 100644
--- a/drivers/infiniband/hw/erdma/erdma_cmdq.c
+++ b/drivers/infiniband/hw/erdma/erdma_cmdq.c
@@ -182,7 +182,6 @@ int erdma_cmdq_init(struct erdma_dev *dev)
int err;
cmdq->max_outstandings = ERDMA_CMDQ_MAX_OUTSTANDING;
- cmdq->use_event = false;
sema_init(&cmdq->credits, cmdq->max_outstandings);
@@ -223,8 +222,6 @@ int erdma_cmdq_init(struct erdma_dev *dev)
void erdma_finish_cmdq_init(struct erdma_dev *dev)
{
- /* after device init successfully, change cmdq to event mode. */
- dev->cmdq.use_event = true;
arm_cmdq_cq(&dev->cmdq);
}
@@ -312,8 +309,7 @@ static int erdma_poll_single_cmd_completion(struct erdma_cmdq *cmdq)
/* Copy 16B comp data after cqe hdr to outer */
be32_to_cpu_array(comp_wait->comp_data, cqe + 2, 4);
- if (cmdq->use_event)
- complete(&comp_wait->wait_event);
+ complete(&comp_wait->wait_event);
return 0;
}
@@ -332,9 +328,6 @@ static void erdma_polling_cmd_completions(struct erdma_cmdq *cmdq)
if (erdma_poll_single_cmd_completion(cmdq))
break;
- if (comp_num && cmdq->use_event)
- arm_cmdq_cq(cmdq);
-
spin_unlock_irqrestore(&cmdq->cq.lock, flags);
}
@@ -342,8 +335,7 @@ void erdma_cmdq_completion_handler(struct erdma_cmdq *cmdq)
{
int got_event = 0;
- if (!test_bit(ERDMA_CMDQ_STATE_OK_BIT, &cmdq->state) ||
- !cmdq->use_event)
+ if (!test_bit(ERDMA_CMDQ_STATE_OK_BIT, &cmdq->state))
return;
while (get_next_valid_eqe(&cmdq->eq)) {
@@ -354,6 +346,7 @@ void erdma_cmdq_completion_handler(struct erdma_cmdq *cmdq)
if (got_event) {
cmdq->cq.cmdsn++;
erdma_polling_cmd_completions(cmdq);
+ arm_cmdq_cq(cmdq);
}
notify_eq(&cmdq->eq);
@@ -372,7 +365,7 @@ static int erdma_poll_cmd_completion(struct erdma_comp_wait *comp_ctx,
if (time_is_before_jiffies(comp_timeout))
return -ETIME;
- msleep(20);
+ udelay(20);
}
return 0;
@@ -403,7 +396,7 @@ void erdma_cmdq_build_reqhdr(u64 *hdr, u32 mod, u32 op)
}
int erdma_post_cmd_wait(struct erdma_cmdq *cmdq, void *req, u32 req_size,
- u64 *resp0, u64 *resp1)
+ u64 *resp0, u64 *resp1, bool sleepable)
{
struct erdma_comp_wait *comp_wait;
int ret;
@@ -411,7 +404,12 @@ int erdma_post_cmd_wait(struct erdma_cmdq *cmdq, void *req, u32 req_size,
if (!test_bit(ERDMA_CMDQ_STATE_OK_BIT, &cmdq->state))
return -ENODEV;
- down(&cmdq->credits);
+ if (!sleepable) {
+ while (down_trylock(&cmdq->credits))
+ ;
+ } else {
+ down(&cmdq->credits);
+ }
comp_wait = get_comp_wait(cmdq);
if (IS_ERR(comp_wait)) {
@@ -425,7 +423,7 @@ int erdma_post_cmd_wait(struct erdma_cmdq *cmdq, void *req, u32 req_size,
push_cmdq_sqe(cmdq, req, req_size, comp_wait);
spin_unlock(&cmdq->sq.lock);
- if (cmdq->use_event)
+ if (sleepable)
ret = erdma_wait_cmd_completion(comp_wait, cmdq,
ERDMA_CMDQ_TIMEOUT_MS);
else
diff --git a/drivers/infiniband/hw/erdma/erdma_eq.c b/drivers/infiniband/hw/erdma/erdma_eq.c
index a238626c40d12..5610e7f4c6bf7 100644
--- a/drivers/infiniband/hw/erdma/erdma_eq.c
+++ b/drivers/infiniband/hw/erdma/erdma_eq.c
@@ -237,7 +237,8 @@ static int create_eq_cmd(struct erdma_dev *dev, u32 eqn, struct erdma_eq *eq)
req.db_dma_addr_l = lower_32_bits(eq->dbrec_dma);
req.db_dma_addr_h = upper_32_bits(eq->dbrec_dma);
- return erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL);
+ return erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL,
+ false);
}
static int erdma_ceq_init_one(struct erdma_dev *dev, u16 ceqn)
@@ -279,7 +280,8 @@ static void erdma_ceq_uninit_one(struct erdma_dev *dev, u16 ceqn)
req.qtype = ERDMA_EQ_TYPE_CEQ;
req.vector_idx = ceqn + 1;
- err = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL);
+ err = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL,
+ false);
if (err)
return;
diff --git a/drivers/infiniband/hw/erdma/erdma_main.c b/drivers/infiniband/hw/erdma/erdma_main.c
index 51cc8b17b9e9a..37723054f0645 100644
--- a/drivers/infiniband/hw/erdma/erdma_main.c
+++ b/drivers/infiniband/hw/erdma/erdma_main.c
@@ -392,7 +392,7 @@ static int erdma_dev_attrs_init(struct erdma_dev *dev)
CMDQ_OPCODE_QUERY_DEVICE);
err = erdma_post_cmd_wait(&dev->cmdq, &req_hdr, sizeof(req_hdr), &cap0,
- &cap1);
+ &cap1, true);
if (err)
return err;
@@ -425,7 +425,7 @@ static int erdma_dev_attrs_init(struct erdma_dev *dev)
CMDQ_OPCODE_QUERY_FW_INFO);
err = erdma_post_cmd_wait(&dev->cmdq, &req_hdr, sizeof(req_hdr), &cap0,
- &cap1);
+ &cap1, true);
if (!err)
dev->attrs.fw_version =
FIELD_GET(ERDMA_CMD_INFO0_FW_VER_MASK, cap0);
@@ -446,7 +446,8 @@ static int erdma_device_config(struct erdma_dev *dev)
req.cfg = FIELD_PREP(ERDMA_CMD_CONFIG_DEVICE_PGSHIFT_MASK, PAGE_SHIFT) |
FIELD_PREP(ERDMA_CMD_CONFIG_DEVICE_PS_EN_MASK, 1);
- return erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL);
+ return erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL,
+ true);
}
static int erdma_res_cb_init(struct erdma_dev *dev)
diff --git a/drivers/infiniband/hw/erdma/erdma_qp.c b/drivers/infiniband/hw/erdma/erdma_qp.c
index e6856e3ca9709..b1bba54d87352 100644
--- a/drivers/infiniband/hw/erdma/erdma_qp.c
+++ b/drivers/infiniband/hw/erdma/erdma_qp.c
@@ -98,7 +98,8 @@ erdma_modify_qp_state_to_rts(struct erdma_qp *qp,
req.send_nxt += MPA_DEFAULT_HDR_LEN + params->pd_len;
req.recv_nxt = tp->rcv_nxt;
- ret = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL);
+ ret = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL,
+ true);
if (ret)
return ret;
@@ -131,7 +132,8 @@ erdma_modify_qp_state_to_stop(struct erdma_qp *qp,
req.cfg = FIELD_PREP(ERDMA_CMD_MODIFY_QP_STATE_MASK, params->state) |
FIELD_PREP(ERDMA_CMD_MODIFY_QP_QPN_MASK, QP_ID(qp));
- ret = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL);
+ ret = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL,
+ true);
if (ret)
return ret;
@@ -246,7 +248,7 @@ static int modify_qp_cmd_rocev2(struct erdma_qp *qp,
req.attr_mask = attr_mask;
return erdma_post_cmd_wait(&qp->dev->cmdq, &req, sizeof(req), NULL,
- NULL);
+ NULL, true);
}
static void erdma_reset_qp(struct erdma_qp *qp)
diff --git a/drivers/infiniband/hw/erdma/erdma_verbs.c b/drivers/infiniband/hw/erdma/erdma_verbs.c
index 2e5d6e721952b..41cb806da54a6 100644
--- a/drivers/infiniband/hw/erdma/erdma_verbs.c
+++ b/drivers/infiniband/hw/erdma/erdma_verbs.c
@@ -119,8 +119,8 @@ static int create_qp_cmd(struct erdma_ucontext *uctx, struct erdma_qp *qp)
}
}
- err = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), &resp0,
- &resp1);
+ err = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), &resp0, &resp1,
+ true);
if (!err && erdma_device_iwarp(dev))
qp->attrs.iwarp.cookie =
FIELD_GET(ERDMA_CMDQ_CREATE_QP_RESP_COOKIE_MASK, resp0);
@@ -178,7 +178,8 @@ static int regmr_cmd(struct erdma_dev *dev, struct erdma_mr *mr)
}
post_cmd:
- return erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL);
+ return erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL,
+ true);
}
static int create_cq_cmd(struct erdma_ucontext *uctx, struct erdma_cq *cq)
@@ -240,7 +241,8 @@ static int create_cq_cmd(struct erdma_ucontext *uctx, struct erdma_cq *cq)
}
}
- return erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL);
+ return erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL,
+ true);
}
static int erdma_alloc_idx(struct erdma_resource_cb *res_cb)
@@ -460,7 +462,8 @@ static void erdma_flush_worker(struct work_struct *work)
req.qpn = QP_ID(qp);
req.sq_pi = qp->kern_qp.sq_pi;
req.rq_pi = qp->kern_qp.rq_pi;
- erdma_post_cmd_wait(&qp->dev->cmdq, &req, sizeof(req), NULL, NULL);
+ erdma_post_cmd_wait(&qp->dev->cmdq, &req, sizeof(req), NULL, NULL,
+ true);
}
static int erdma_qp_validate_cap(struct erdma_dev *dev,
@@ -1249,7 +1252,8 @@ int erdma_dereg_mr(struct ib_mr *ibmr, struct ib_udata *udata)
req.cfg = FIELD_PREP(ERDMA_CMD_MR_MPT_IDX_MASK, ibmr->lkey >> 8) |
FIELD_PREP(ERDMA_CMD_MR_KEY_MASK, ibmr->lkey & 0xFF);
- ret = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL);
+ ret = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL,
+ true);
if (ret)
return ret;
@@ -1274,7 +1278,8 @@ int erdma_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata)
CMDQ_OPCODE_DESTROY_CQ);
req.cqn = cq->cqn;
- err = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL);
+ err = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL,
+ true);
if (err)
return err;
@@ -1321,7 +1326,8 @@ int erdma_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata)
CMDQ_OPCODE_DESTROY_QP);
req.qpn = QP_ID(qp);
- err = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL);
+ err = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL,
+ true);
if (err)
return err;
@@ -1419,7 +1425,8 @@ static int alloc_db_resources(struct erdma_dev *dev, struct erdma_ucontext *ctx,
FIELD_PREP(ERDMA_CMD_EXT_DB_RQ_EN_MASK, 1) |
FIELD_PREP(ERDMA_CMD_EXT_DB_SQ_EN_MASK, 1);
- ret = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), &val0, &val1);
+ ret = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), &val0, &val1,
+ true);
if (ret)
return ret;
@@ -1454,7 +1461,8 @@ static void free_db_resources(struct erdma_dev *dev, struct erdma_ucontext *ctx)
req.rdb_off = ctx->ext_db.rdb_off;
req.cdb_off = ctx->ext_db.cdb_off;
- ret = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL);
+ ret = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL,
+ true);
if (ret)
ibdev_err_ratelimited(&dev->ibdev,
"free db resources failed %d", ret);
@@ -1818,7 +1826,7 @@ int erdma_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr,
req.qpn = QP_ID(qp);
ret = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), &resp0,
- &resp1);
+ &resp1, true);
if (ret)
return ret;
@@ -1981,7 +1989,7 @@ void erdma_set_mtu(struct erdma_dev *dev, u32 mtu)
CMDQ_OPCODE_CONF_MTU);
req.mtu = mtu;
- erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL);
+ erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL, true);
}
void erdma_port_event(struct erdma_dev *dev, enum ib_event_type reason)
@@ -2051,7 +2059,8 @@ static int erdma_query_hw_stats(struct erdma_dev *dev,
req.target_addr = dma_addr;
req.target_length = ERDMA_HW_RESP_SIZE;
- err = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL);
+ err = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL,
+ true);
if (err)
goto out;
@@ -2112,7 +2121,8 @@ static int erdma_set_gid(struct erdma_dev *dev, u8 op, u32 idx,
erdma_cmdq_build_reqhdr(&req.hdr, CMDQ_SUBMOD_RDMA,
CMDQ_OPCODE_SET_GID);
- return erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL);
+ return erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL,
+ true);
}
int erdma_add_gid(const struct ib_gid_attr *attr, void **context)
@@ -2196,7 +2206,8 @@ int erdma_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr,
req.ahn = ah->ahn;
erdma_set_av_cfg(&req.av_cfg, &ah->av);
- ret = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL);
+ ret = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL,
+ true);
if (ret) {
erdma_free_idx(&dev->res_cb[ERDMA_RES_TYPE_AH], ah->ahn);
return ret;
@@ -2219,7 +2230,8 @@ int erdma_destroy_ah(struct ib_ah *ibah, u32 flags)
req.pdn = pd->pdn;
req.ahn = ah->ahn;
- ret = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL);
+ ret = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL,
+ true);
if (ret)
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0675/1376] RDMA/erdma: complete object teardown when the destroy command fails
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (673 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0674/1376] RDMA/erdma: Support non-sleeping erdma_post_cmd_wait() Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0676/1376] PM: hibernate: Fix memory leak in snapshot_write_next() error path Greg Kroah-Hartman
` (323 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Leon Romanovsky, Cheng Xu,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <leonro@nvidia.com>
[ Upstream commit 652befcba956ef357f480525ccbe25c59bc81d4d ]
erdma_destroy_qp(), erdma_destroy_cq(), erdma_dereg_mr(), and
erdma_destroy_ah() returned early when erdma_post_cmd_wait() failed,
leaking the queue buffers, MTTs, doorbells and the STAG, QPN, CQN and AHN
identifiers. A command timeout clears ERDMA_CMDQ_STATE_OK_BIT and
permanently disables the command queue, so no retry can succeed; the RDMA
core keeps the object after a failed destructor and forced uverbs cleanup
then nulls the pointers, making the resources unreachable.
Warn on failure but release every software-owned resource and return
success, since during terminal destruction the hardware command result is
only diagnostic.
Fixes: 155055771704 ("RDMA/erdma: Add verbs implementation")
Link: https://patch.msgid.link/20260722-b4-qp-and-cq-memory-are-leaked-if-the-d-v1-1-97e223dc1c96@nvidia.com
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Acked-by: Cheng Xu <chengyou@linux.alibaba.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/erdma/erdma_verbs.c | 21 +++++++++++++++++----
1 file changed, 17 insertions(+), 4 deletions(-)
diff --git a/drivers/infiniband/hw/erdma/erdma_verbs.c b/drivers/infiniband/hw/erdma/erdma_verbs.c
index 41cb806da54a6..3a65cbe5839ad 100644
--- a/drivers/infiniband/hw/erdma/erdma_verbs.c
+++ b/drivers/infiniband/hw/erdma/erdma_verbs.c
@@ -1254,8 +1254,15 @@ int erdma_dereg_mr(struct ib_mr *ibmr, struct ib_udata *udata)
ret = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL,
true);
+ /*
+ * A timeout disables the command queue, so retry cannot succeed. Treat
+ * terminal command failures as diagnostic; propagating them can make
+ * forced uverbs cleanup discard the last software resource pointers.
+ */
if (ret)
- return ret;
+ ibdev_warn_ratelimited(&dev->ibdev,
+ "failed to deregister MR 0x%x: %d\n",
+ ibmr->lkey, ret);
erdma_free_idx(&dev->res_cb[ERDMA_RES_TYPE_STAG_IDX], ibmr->lkey >> 8);
@@ -1281,7 +1288,9 @@ int erdma_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata)
err = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL,
true);
if (err)
- return err;
+ ibdev_warn_ratelimited(&dev->ibdev,
+ "failed to destroy CQ %u: %d\n",
+ cq->cqn, err);
if (rdma_is_kernel_res(&cq->ibcq.res)) {
dma_free_coherent(&dev->pdev->dev, cq->depth << CQE_SHIFT,
@@ -1329,7 +1338,9 @@ int erdma_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata)
err = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL,
true);
if (err)
- return err;
+ ibdev_warn_ratelimited(&dev->ibdev,
+ "failed to destroy QP %u: %d\n",
+ QP_ID(qp), err);
erdma_qp_put(qp);
wait_for_completion(&qp->safe_free);
@@ -2233,7 +2244,9 @@ int erdma_destroy_ah(struct ib_ah *ibah, u32 flags)
ret = erdma_post_cmd_wait(&dev->cmdq, &req, sizeof(req), NULL, NULL,
true);
if (ret)
- return ret;
+ ibdev_warn_ratelimited(&dev->ibdev,
+ "failed to destroy AH %u: %d\n",
+ ah->ahn, ret);
erdma_free_idx(&dev->res_cb[ERDMA_RES_TYPE_AH], ah->ahn);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0676/1376] PM: hibernate: Fix memory leak in snapshot_write_next() error path
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (674 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0675/1376] RDMA/erdma: complete object teardown when the destroy command fails Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0677/1376] leds: pca9532: Fix phantom device registration on missing hardware Greg Kroah-Hartman
` (322 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Malaya Kumar Rout, Brian Geffon,
Rafael J. Wysocki, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Malaya Kumar Rout <malayarout91@gmail.com>
[ Upstream commit 21d5c4cee31c5ce78f6decc7fafc7e7759af391f ]
When memory_bm_create() succeeds for copy_bm but fails for zero_bm,
the function returns without freeing the resources allocated for
copy_bm. This results in a memory leak that includes radix tree nodes,
zone structures, and page lists.
Fix this by calling memory_bm_free() to release copy_bm's resources
before returning the error code when zero_bm allocation fails.
Fixes: 005e8dddd497 ("PM: hibernate: don't store zero pages in the image file")
Signed-off-by: Malaya Kumar Rout <malayarout91@gmail.com>
Acked-by: Brian Geffon <bgeffon@google.com>
Link: https://patch.msgid.link/20260711145246.8625-1-malayarout91@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/power/snapshot.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
index c56b08121dbc5..38bab282d1b1f 100644
--- a/kernel/power/snapshot.c
+++ b/kernel/power/snapshot.c
@@ -2803,9 +2803,10 @@ int snapshot_write_next(struct snapshot_handle *handle)
return error;
error = memory_bm_create(&zero_bm, GFP_ATOMIC, PG_ANY);
- if (error)
+ if (error) {
+ memory_bm_free(©_bm, PG_UNSAFE_CLEAR);
return error;
-
+ }
nr_zero_pages = 0;
hibernate_restore_protection_begin();
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0677/1376] leds: pca9532: Fix phantom device registration on missing hardware
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (675 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0676/1376] PM: hibernate: Fix memory leak in snapshot_write_next() error path Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0678/1376] drm/tve200: add OF module alias for autoloading Greg Kroah-Hartman
` (321 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cosmo Chou, Bartosz Golaszewski,
Lee Jones, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cosmo Chou <chou.cosmo@gmail.com>
[ Upstream commit 8d6b6c05b8e33d11e3fb3203309385e1a9cceecd ]
The initial PWM and PSC register writes in pca9532_configure() do not
check the return values of i2c_smbus_write_byte_data(). If the I2C
device is physically absent from the bus, the write fails with -ENXIO.
However, the driver ignores this error and allows probe() to complete
successfully.
This results in the registration of phantom LED class devices and
gpiochips backed by non-existent hardware. Subsequent GPIO reads from
these phantom chips return bogus values (due to -ENXIO being truncated
to an unsigned char in pca9532_gpio_get_value()), silently corrupting
hardware state tracking in userspace.
Propagate the I2C write failures back to probe() so the driver core
can gracefully abort binding and release devres-managed resources.
Fixes: e14fa82439d3 ("leds: Add pca9532 led driver")
Signed-off-by: Cosmo Chou <chou.cosmo@gmail.com>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Link: https://patch.msgid.link/20260715080747.1638097-1-chou.cosmo@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/leds/leds-pca9532.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/drivers/leds/leds-pca9532.c b/drivers/leds/leds-pca9532.c
index 66ed6a77961ad..4ecdfee14809f 100644
--- a/drivers/leds/leds-pca9532.c
+++ b/drivers/leds/leds-pca9532.c
@@ -394,10 +394,14 @@ static int pca9532_configure(struct i2c_client *client,
for (i = 0; i < 2; i++) {
data->pwm[i] = pdata->pwm[i];
data->psc[i] = pdata->psc[i];
- i2c_smbus_write_byte_data(client, PCA9532_REG_PWM(maxleds, i),
- data->pwm[i]);
- i2c_smbus_write_byte_data(client, PCA9532_REG_PSC(maxleds, i),
- data->psc[i]);
+ err = i2c_smbus_write_byte_data(client, PCA9532_REG_PWM(maxleds, i),
+ data->pwm[i]);
+ if (err < 0)
+ return err;
+ err = i2c_smbus_write_byte_data(client, PCA9532_REG_PSC(maxleds, i),
+ data->psc[i]);
+ if (err < 0)
+ return err;
}
data->hw_blink = true;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0678/1376] drm/tve200: add OF module alias for autoloading
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (676 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0677/1376] leds: pca9532: Fix phantom device registration on missing hardware Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0679/1376] netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet Greg Kroah-Hartman
` (320 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Can Peng, Linus Walleij, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Can Peng <pengcan@kylinos.cn>
[ Upstream commit b6c3585f2058e0fbfa8cb403458f5cc6cf5c5e06 ]
The TVE200 DRM driver can be built as a module and uses tve200_of_match
as its OF match table, but the table is not exported for module alias
generation.
Add the MODULE_DEVICE_TABLE(of, ...) entry so modpost can generate OF
module aliases for OF based module autoloading.
Fixes: 179c02fe90a4 ("drm/tve200: Add new driver for TVE200")
Signed-off-by: Can Peng <pengcan@kylinos.cn>
Signed-off-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260715024130.186416-1-pengcan@kylinos.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/tve200/tve200_drv.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/tve200/tve200_drv.c b/drivers/gpu/drm/tve200/tve200_drv.c
index acce210e25547..0f55ead3ddbbb 100644
--- a/drivers/gpu/drm/tve200/tve200_drv.c
+++ b/drivers/gpu/drm/tve200/tve200_drv.c
@@ -261,6 +261,7 @@ static const struct of_device_id tve200_of_match[] = {
},
{},
};
+MODULE_DEVICE_TABLE(of, tve200_of_match);
static struct platform_driver tve200_driver = {
.driver = {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0679/1376] netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (677 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0678/1376] drm/tve200: add OF module alias for autoloading Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0680/1376] fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init Greg Kroah-Hartman
` (319 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Westphal, Pablo Neira Ayuso,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
[ Upstream commit 16aecbe3036f6097c26b51b12e4c1cf207769690 ]
sashiko says:
If map_addr() changes the packet length, such as when the public NAT IP
string is shorter or longer than the internal IP, coff will still point to
the offset relative to the pre-mangled packet.
If the packet shrinks, coff could overshoot the correct position,
potentially causing the next ct_sip_parse_header_uri() call to silently
skip bytes and miss subsequent Contact headers. Could this lead to a
failure to NAT those subsequent headers and leak internal network details?
Fixes: c978cd3a9371 ("[NETFILTER]: nf_nat_sip: translate all Contact headers")
Assisted-by: Claude:claude-sonnet-4-6
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_nat_sip.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/net/netfilter/nf_nat_sip.c b/net/netfilter/nf_nat_sip.c
index a1c41defaf22d..6b00c81084fe2 100644
--- a/net/netfilter/nf_nat_sip.c
+++ b/net/netfilter/nf_nat_sip.c
@@ -267,12 +267,17 @@ static unsigned int nf_nat_sip(struct sk_buff *skb, unsigned int protoff,
SIP_HDR_CONTACT, &in_header,
&matchoff, &matchlen,
&addr, &port) > 0) {
+ int old_len = skb->len, delta;
+
if (!map_addr(skb, protoff, dataoff, dptr, datalen,
matchoff, matchlen,
&addr, port)) {
nf_ct_helper_log(skb, ct, "cannot mangle contact");
return NF_DROP;
}
+
+ delta = (int)skb->len - old_len;
+ coff += delta;
}
if (!map_sip_addr(skb, protoff, dataoff, dptr, datalen, SIP_HDR_FROM) ||
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0680/1376] fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (678 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0679/1376] netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0681/1376] drm/panthor: return PTR_ERR() from devm_drm_dev_alloc() Greg Kroah-Hartman
` (318 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiang Mei, Weiming Wu,
Konstantin Komarov, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Wu <weiming3@asu.edu>
[ Upstream commit 2064bc663f89e61b8681c1fb9d1ce445de72063d ]
ntfs_reparse_init() and ntfs_objid_init() parse the index root of the
$Extend/$Reparse and $Extend/$ObjId metafiles (the INDEX_ROOT attributes
named $R and $O). They read its type and rule fields through
resident_data(), which does not check that the resident attribute is
large enough to hold them.
mi_enum_attr() accepts a resident attribute with data_off == asize and
data_size == 0. For such an attribute placed last in its MFT record,
resident_data() returns a pointer to the end of the record_size buffer,
so reading root->type / root->rule reads past the allocation.
Use resident_data_ex(attr, sizeof(struct INDEX_ROOT)) and bail out when
it returns NULL, as ntfs_security_init() already does for $SDH / $SII.
The attribute is only parsed while mounting a crafted image, so this
needs CAP_SYS_ADMIN.
BUG: KASAN: slab-out-of-bounds in ntfs_reparse_init (fs/ntfs3/fsntfs.c:2306)
Read of size 4 at addr ffff88801219dc00 by task mount
ntfs_reparse_init (fs/ntfs3/fsntfs.c:2306)
ntfs_fill_super (fs/ntfs3/super.c:1604)
get_tree_bdev_flags (fs/super.c:1703)
vfs_get_tree (fs/super.c:1758)
path_mount (fs/namespace.c:4131)
__x64_sys_mount (fs/namespace.c:4360)
Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block")
Reported-by: Xiang Mei <xmei5@asu.edu>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Weiming Wu <weiming3@asu.edu>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/fsntfs.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c
index 5972f160e566e..170836749de68 100644
--- a/fs/ntfs3/fsntfs.c
+++ b/fs/ntfs3/fsntfs.c
@@ -2317,8 +2317,8 @@ int ntfs_reparse_init(struct ntfs_sb_info *sbi)
goto out;
}
- root_r = resident_data(attr);
- if (root_r->type != ATTR_ZERO ||
+ root_r = resident_data_ex(attr, sizeof(struct INDEX_ROOT));
+ if (!root_r || root_r->type != ATTR_ZERO ||
root_r->rule != NTFS_COLLATION_TYPE_UINTS) {
err = -EINVAL;
goto out;
@@ -2355,8 +2355,8 @@ int ntfs_objid_init(struct ntfs_sb_info *sbi)
goto out;
}
- root = resident_data(attr);
- if (root->type != ATTR_ZERO ||
+ root = resident_data_ex(attr, sizeof(struct INDEX_ROOT));
+ if (!root || root->type != ATTR_ZERO ||
root->rule != NTFS_COLLATION_TYPE_UINTS) {
err = -EINVAL;
goto out;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0681/1376] drm/panthor: return PTR_ERR() from devm_drm_dev_alloc()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (679 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0680/1376] fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0682/1376] arm64: dts: rockchip: Fix Gru WLAN sideband interrupt Greg Kroah-Hartman
` (317 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Osama Abdelkader, Steven Price,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Osama Abdelkader <osama.abdelkader@gmail.com>
[ Upstream commit abc1e559f8e5996eee506dfdc8e3781c2a1e04f9 ]
devm_drm_dev_alloc() returns an ERR_PTR() on failure, but panthor_probe()
always converts that failure to -ENOMEM. Preserve the actual error code
returned by the DRM core instead.
Fixes: 4bdca1150792 ("drm/panthor: Add the driver frontend block")
Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Signed-off-by: Steven Price <steven.price@arm.com>
Link: https://patch.msgid.link/20260716140337.10679-1-osama.abdelkader@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panthor/panthor_drv.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/panthor/panthor_drv.c b/drivers/gpu/drm/panthor/panthor_drv.c
index 9d4bf7406e246..46aa5ed815896 100644
--- a/drivers/gpu/drm/panthor/panthor_drv.c
+++ b/drivers/gpu/drm/panthor/panthor_drv.c
@@ -1427,7 +1427,7 @@ static int panthor_probe(struct platform_device *pdev)
ptdev = devm_drm_dev_alloc(&pdev->dev, &panthor_drm_driver,
struct panthor_device, base);
if (IS_ERR(ptdev))
- return -ENOMEM;
+ return PTR_ERR(ptdev);
platform_set_drvdata(pdev, ptdev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0682/1376] arm64: dts: rockchip: Fix Gru WLAN sideband interrupt
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (680 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0681/1376] drm/panthor: return PTR_ERR() from devm_drm_dev_alloc() Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0683/1376] ARM: lpc32xx: only run SoC init on LPC32xx hardware Greg Kroah-Hartman
` (316 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fabio Estevam, Heiko Stuebner,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <festevam@gmail.com>
[ Upstream commit a761818d9ee11183df0aefd16bf9fe46cc1c4c6d ]
The Marvell WLAN host wake interrupt is wired to GPIO0 8 and is not
one of the PCI INTx interrupts. The PCI device schema therefore
interprets the two-cell GPIO interrupt specifier as an invalid PCI
interrupt and reports dtbs_check warnings:
pcie@0,0: wifi@0,0:interrupts:0:0: 8 is not one of [1, 2, 3, 4]
pcie@0,0: wifi@0,0:interrupts:0: [8, 8] is too long
Describe the sideband interrupt with interrupts-extended, which
explicitly carries the interrupt controller and removes the ambiguity.
Fixes: 48f4d9796d99 ("arm64: dts: rockchip: add Gru/Kevin DTS")
Signed-off-by: Fabio Estevam <festevam@gmail.com>
Link: https://patch.msgid.link/20260721133445.44283-1-festevam@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi
index cacbad35cfc85..cf9fdb7d0cfb0 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi
@@ -510,8 +510,7 @@ &pci_rootport {
mvl_wifi: wifi@0,0 {
compatible = "pci1b4b,2b42";
reg = <0x0000 0x0 0x0 0x0 0x0>;
- interrupt-parent = <&gpio0>;
- interrupts = <8 IRQ_TYPE_LEVEL_LOW>;
+ interrupts-extended = <&gpio0 8 IRQ_TYPE_LEVEL_LOW>;
pinctrl-names = "default";
pinctrl-0 = <&wlan_host_wake_l>;
wakeup-source;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0683/1376] ARM: lpc32xx: only run SoC init on LPC32xx hardware
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (681 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0682/1376] arm64: dts: rockchip: Fix Gru WLAN sideband interrupt Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0684/1376] selftests/bpf: Fix incorrect error checking for pthread_create Greg Kroah-Hartman
` (315 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Karl Mehltretter,
Vladimir Zapolskiy, Vladimir Zapolskiy, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 717ea4000867e6dffee5e1ed92150a9704ae9f68 ]
lpc32xx_check_uid() and lpc32xx_pm_init() are arch_initcalls that poke
LPC32xx-only registers. Since the multiplatform conversion they also
run on other ARCH_MULTI_V5 boards where access faults e.g. on versatile:
Unable to handle kernel paging request at virtual address f4004130
PC is at lpc32xx_check_uid+0x2c/0x9c
Drop the arch_initcall() registrations and call both functions directly
from lpc3250_machine_init(), the machine's .init_machine hook.
The calls are placed in link order (common.c, pm.c, phy3250.c) to
keep their previous relative ordering.
Fixes: 75bf1bd7d2f9 ("ARM: lpc32xx: allow multiplatform build")
Suggested-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Reviewed-by: Vladimir Zapolskiy <vz@kernel.org>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mach-lpc32xx/common.c | 5 +----
arch/arm/mach-lpc32xx/common.h | 2 ++
arch/arm/mach-lpc32xx/phy3250.c | 2 ++
arch/arm/mach-lpc32xx/pm.c | 5 +----
4 files changed, 6 insertions(+), 8 deletions(-)
diff --git a/arch/arm/mach-lpc32xx/common.c b/arch/arm/mach-lpc32xx/common.c
index 304ea61a07160..35ed3569c5a35 100644
--- a/arch/arm/mach-lpc32xx/common.c
+++ b/arch/arm/mach-lpc32xx/common.c
@@ -106,7 +106,7 @@ void __init lpc32xx_map_io(void)
iotable_init(lpc32xx_io_desc, ARRAY_SIZE(lpc32xx_io_desc));
}
-static int __init lpc32xx_check_uid(void)
+void __init lpc32xx_check_uid(void)
{
u32 uid[4];
@@ -119,7 +119,4 @@ static int __init lpc32xx_check_uid(void)
system_serial_low = uid[0];
system_serial_high = uid[1];
}
-
- return 1;
}
-arch_initcall(lpc32xx_check_uid);
diff --git a/arch/arm/mach-lpc32xx/common.h b/arch/arm/mach-lpc32xx/common.h
index 32f0ad2178077..06b20bea324e1 100644
--- a/arch/arm/mach-lpc32xx/common.h
+++ b/arch/arm/mach-lpc32xx/common.h
@@ -16,6 +16,8 @@
* Other arch specific structures and functions
*/
extern void __init lpc32xx_map_io(void);
+extern void __init lpc32xx_check_uid(void);
+extern void __init lpc32xx_pm_init(void);
extern void __init lpc32xx_serial_init(void);
/*
diff --git a/arch/arm/mach-lpc32xx/phy3250.c b/arch/arm/mach-lpc32xx/phy3250.c
index 66701bf432488..ddc6333ca55da 100644
--- a/arch/arm/mach-lpc32xx/phy3250.c
+++ b/arch/arm/mach-lpc32xx/phy3250.c
@@ -71,6 +71,8 @@ static const struct of_dev_auxdata lpc32xx_auxdata_lookup[] __initconst = {
static void __init lpc3250_machine_init(void)
{
+ lpc32xx_check_uid();
+ lpc32xx_pm_init();
lpc32xx_serial_init();
of_platform_default_populate(NULL, lpc32xx_auxdata_lookup, NULL);
diff --git a/arch/arm/mach-lpc32xx/pm.c b/arch/arm/mach-lpc32xx/pm.c
index 2572bd89a5e8d..9b5c5e1462ed3 100644
--- a/arch/arm/mach-lpc32xx/pm.c
+++ b/arch/arm/mach-lpc32xx/pm.c
@@ -120,7 +120,7 @@ static const struct platform_suspend_ops lpc32xx_pm_ops = {
#define EMC_DYN_MEM_CTRL_OFS 0x20
#define EMC_SRMMC (1 << 3)
#define EMC_CTRL_REG io_p2v(LPC32XX_EMC_BASE + EMC_DYN_MEM_CTRL_OFS)
-static int __init lpc32xx_pm_init(void)
+void __init lpc32xx_pm_init(void)
{
/*
* Setup SDRAM self-refresh clock to automatically disable o
@@ -129,7 +129,4 @@ static int __init lpc32xx_pm_init(void)
__raw_writel(__raw_readl(EMC_CTRL_REG) | EMC_SRMMC, EMC_CTRL_REG);
suspend_set_ops(&lpc32xx_pm_ops);
-
- return 0;
}
-arch_initcall(lpc32xx_pm_init);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0684/1376] selftests/bpf: Fix incorrect error checking for pthread_create
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (682 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0683/1376] ARM: lpc32xx: only run SoC init on LPC32xx hardware Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0685/1376] selftests/bpf: Fix memory leak on subtest_states reallocation Greg Kroah-Hartman
` (314 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Feng Yang, Kumar Kartikeya Dwivedi,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Feng Yang <yangfeng@kylinos.cn>
[ Upstream commit b04b8d4e198aefc863e7b702ececb957845b0c25 ]
pthread_create returns 0 on success and a positive error code on failure;
it never returns a negative value. The current conditional branch can never be taken.
Failures during thread creation are silently ignored, which will lead to
invalid memory access when waiting on threads or dereferencing thread handles later.
Fixes: 91b2c0afd00c ("selftests/bpf: Add parallelism to test_progs")
Signed-off-by: Feng Yang <yangfeng@kylinos.cn>
Link: https://lore.kernel.org/bpf/20260723085100.482147-3-yangfeng59949@163.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/bpf/test_progs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
index fa829a7854f24..a48a3b1f687e6 100644
--- a/tools/testing/selftests/bpf/test_progs.c
+++ b/tools/testing/selftests/bpf/test_progs.c
@@ -1561,7 +1561,7 @@ static void server_main(void)
data[i].worker_id = i;
data[i].sock_fd = env.worker_socks[i];
rc = pthread_create(&dispatcher_threads[i], NULL, dispatch_thread, &data[i]);
- if (rc < 0) {
+ if (rc) {
perror("Failed to launch dispatcher thread");
exit(EXIT_ERR_SETUP_INFRA);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0685/1376] selftests/bpf: Fix memory leak on subtest_states reallocation
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (683 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0684/1376] selftests/bpf: Fix incorrect error checking for pthread_create Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0686/1376] cxl/region: Fix use-after-free in find_pos_and_ways() error path Greg Kroah-Hartman
` (313 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Feng Yang, Kumar Kartikeya Dwivedi,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Feng Yang <yangfeng@kylinos.cn>
[ Upstream commit 06efb01c6530e9cfc247178cb96aa8adb3beaf61 ]
Fix memory leak in subtest_states reallocation,
and revert subtest_num if allocation fails.
Fixes: 0925225956bb ("bpf/selftests: Add granular subtest output for prog_test")
Signed-off-by: Feng Yang <yangfeng@kylinos.cn>
Link: https://lore.kernel.org/bpf/20260723085100.482147-6-yangfeng59949@163.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/bpf/test_progs.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
index a48a3b1f687e6..3a89cf01db90e 100644
--- a/tools/testing/selftests/bpf/test_progs.c
+++ b/tools/testing/selftests/bpf/test_progs.c
@@ -468,18 +468,19 @@ bool test__start_subtest(const char *subtest_name)
struct test_state *state = env.test_state;
struct subtest_state *subtest_state;
size_t sub_state_size = sizeof(*subtest_state);
+ void *tmp;
if (env.subtest_state)
test__end_subtest();
state->subtest_num++;
- state->subtest_states =
- realloc(state->subtest_states,
- state->subtest_num * sub_state_size);
- if (!state->subtest_states) {
+ tmp = realloc(state->subtest_states, state->subtest_num * sub_state_size);
+ if (!tmp) {
+ state->subtest_num--;
fprintf(stderr, "Not enough memory to allocate subtest result\n");
return false;
}
+ state->subtest_states = tmp;
subtest_state = &state->subtest_states[state->subtest_num - 1];
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0686/1376] cxl/region: Fix use-after-free in find_pos_and_ways() error path
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (684 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0685/1376] selftests/bpf: Fix memory leak on subtest_states reallocation Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0687/1376] pinctrl: mediatek: Add EINT support for multiple addresses Greg Kroah-Hartman
` (312 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Li Ming, Jonathan Cameron,
Alison Schofield, Dave Jiang, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alison Schofield <alison.schofield@intel.com>
[ Upstream commit 15da704b732332cc1e8f121f624e5e6c05124c5d ]
The error path releases its reference to a switch decoder before
logging an error that includes the decoder name. If the released
reference is the last one, the decoder can be freed before the error
message accesses its name.
Drop the reference after the error is reported.
Fixes: d90acdf49e18 ("cxl/region: Add a dev_err() on missing target list entries")
Reviewed-by: Li Ming <ming.li@zohomail.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Alison Schofield <alison.schofield@intel.com>
Link: https://patch.msgid.link/10deb519b543ef693ce23148b509a03fe1c07d0c.1784931354.git.alison.schofield@intel.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cxl/core/region.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
index f5429666822f0..009c0a262ee8d 100644
--- a/drivers/cxl/core/region.c
+++ b/drivers/cxl/core/region.c
@@ -1779,14 +1779,13 @@ static int find_pos_and_ways(struct cxl_port *port, struct range *range,
break;
}
}
- put_device(dev);
-
if (rc)
dev_err(port->uport_dev,
"failed to find %s:%s in target list of %s\n",
dev_name(&port->dev),
- dev_name(port->parent_dport->dport_dev),
- dev_name(&cxlsd->cxld.dev));
+ dev_name(port->parent_dport->dport_dev), dev_name(dev));
+
+ put_device(dev);
return rc;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0687/1376] pinctrl: mediatek: Add EINT support for multiple addresses
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (685 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0686/1376] cxl/region: Fix use-after-free in find_pos_and_ways() error path Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0688/1376] pinctrl: mediatek: Fix the invalid conditions Greg Kroah-Hartman
` (311 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hao Chang, Qingliang Li,
Linus Walleij, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao Chang <ot_chhao.chang@mediatek.com>
[ Upstream commit 3ef9f710efcb5cc1335b5b09c16c757f703d7e5f ]
For flexible routing, eint will be divided into 5 bases,
and it will obtain the operation address through the pins array.
Signed-off-by: Hao Chang <ot_chhao.chang@mediatek.com>
Signed-off-by: Qingliang Li <qingliang.li@mediatek.com>
Link: https://lore.kernel.org/20250322035307.4811-2-ot_chhao.chang@mediatek.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Stable-dep-of: 88292b7103d2 ("pinctrl: mediatek: free EINT resources on unbind")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/mediatek/mtk-eint.c | 313 +++++++++++-------
drivers/pinctrl/mediatek/mtk-eint.h | 23 +-
.../pinctrl/mediatek/pinctrl-mtk-common-v2.c | 37 ++-
.../pinctrl/mediatek/pinctrl-mtk-common-v2.h | 1 +
drivers/pinctrl/mediatek/pinctrl-paris.h | 7 +
5 files changed, 254 insertions(+), 127 deletions(-)
diff --git a/drivers/pinctrl/mediatek/mtk-eint.c b/drivers/pinctrl/mediatek/mtk-eint.c
index 27f0a54e12bfe..ced4ee509b5b6 100644
--- a/drivers/pinctrl/mediatek/mtk-eint.c
+++ b/drivers/pinctrl/mediatek/mtk-eint.c
@@ -1,11 +1,13 @@
// SPDX-License-Identifier: GPL-2.0
-// Copyright (c) 2014-2018 MediaTek Inc.
+// Copyright (c) 2014-2025 MediaTek Inc.
/*
* Library for MediaTek External Interrupt Support
*
* Author: Maoguang Meng <maoguang.meng@mediatek.com>
* Sean Wang <sean.wang@mediatek.com>
+ * Hao Chang <ot_chhao.chang@mediatek.com>
+ * Qingliang Li <qingliang.li@mediatek.com>
*
*/
@@ -20,6 +22,7 @@
#include <linux/platform_device.h>
#include "mtk-eint.h"
+#include "pinctrl-mtk-common-v2.h"
#define MTK_EINT_EDGE_SENSITIVE 0
#define MTK_EINT_LEVEL_SENSITIVE 1
@@ -68,13 +71,11 @@ static void __iomem *mtk_eint_get_offset(struct mtk_eint *eint,
unsigned int eint_num,
unsigned int offset)
{
- unsigned int eint_base = 0;
+ unsigned int idx = eint->pins[eint_num].index;
+ unsigned int inst = eint->pins[eint_num].instance;
void __iomem *reg;
- if (eint_num >= eint->hw->ap_num)
- eint_base = eint->hw->ap_num;
-
- reg = eint->base + offset + ((eint_num - eint_base) / 32) * 4;
+ reg = eint->base[inst] + offset + (idx / 32 * 4);
return reg;
}
@@ -83,7 +84,7 @@ static unsigned int mtk_eint_can_en_debounce(struct mtk_eint *eint,
unsigned int eint_num)
{
unsigned int sens;
- unsigned int bit = BIT(eint_num % 32);
+ unsigned int bit = BIT(eint->pins[eint_num].index % 32);
void __iomem *reg = mtk_eint_get_offset(eint, eint_num,
eint->regs->sens);
@@ -92,7 +93,7 @@ static unsigned int mtk_eint_can_en_debounce(struct mtk_eint *eint,
else
sens = MTK_EINT_EDGE_SENSITIVE;
- if (eint_num < eint->hw->db_cnt && sens != MTK_EINT_EDGE_SENSITIVE)
+ if (eint->pins[eint_num].debounce && sens != MTK_EINT_EDGE_SENSITIVE)
return 1;
else
return 0;
@@ -102,9 +103,9 @@ static int mtk_eint_flip_edge(struct mtk_eint *eint, int hwirq)
{
int start_level, curr_level;
unsigned int reg_offset;
- u32 mask = BIT(hwirq & 0x1f);
- u32 port = (hwirq >> 5) & eint->hw->port_mask;
- void __iomem *reg = eint->base + (port << 2);
+ unsigned int mask = BIT(eint->pins[hwirq].index & 0x1f);
+ unsigned int port = (eint->pins[hwirq].index >> 5) & eint->hw->port_mask;
+ void __iomem *reg = eint->base[eint->pins[hwirq].instance] + (port << 2);
curr_level = eint->gpio_xlate->get_gpio_state(eint->pctl, hwirq);
@@ -126,11 +127,13 @@ static int mtk_eint_flip_edge(struct mtk_eint *eint, int hwirq)
static void mtk_eint_mask(struct irq_data *d)
{
struct mtk_eint *eint = irq_data_get_irq_chip_data(d);
- u32 mask = BIT(d->hwirq & 0x1f);
+ unsigned int idx = eint->pins[d->hwirq].index;
+ unsigned int inst = eint->pins[d->hwirq].instance;
+ unsigned int mask = BIT(idx & 0x1f);
void __iomem *reg = mtk_eint_get_offset(eint, d->hwirq,
eint->regs->mask_set);
- eint->cur_mask[d->hwirq >> 5] &= ~mask;
+ eint->cur_mask[inst][idx >> 5] &= ~mask;
writel(mask, reg);
}
@@ -138,22 +141,24 @@ static void mtk_eint_mask(struct irq_data *d)
static void mtk_eint_unmask(struct irq_data *d)
{
struct mtk_eint *eint = irq_data_get_irq_chip_data(d);
- u32 mask = BIT(d->hwirq & 0x1f);
+ unsigned int idx = eint->pins[d->hwirq].index;
+ unsigned int inst = eint->pins[d->hwirq].instance;
+ unsigned int mask = BIT(idx & 0x1f);
void __iomem *reg = mtk_eint_get_offset(eint, d->hwirq,
eint->regs->mask_clr);
- eint->cur_mask[d->hwirq >> 5] |= mask;
+ eint->cur_mask[inst][idx >> 5] |= mask;
writel(mask, reg);
- if (eint->dual_edge[d->hwirq])
+ if (eint->pins[d->hwirq].dual_edge)
mtk_eint_flip_edge(eint, d->hwirq);
}
static unsigned int mtk_eint_get_mask(struct mtk_eint *eint,
unsigned int eint_num)
{
- unsigned int bit = BIT(eint_num % 32);
+ unsigned int bit = BIT(eint->pins[eint_num].index % 32);
void __iomem *reg = mtk_eint_get_offset(eint, eint_num,
eint->regs->mask);
@@ -163,7 +168,7 @@ static unsigned int mtk_eint_get_mask(struct mtk_eint *eint,
static void mtk_eint_ack(struct irq_data *d)
{
struct mtk_eint *eint = irq_data_get_irq_chip_data(d);
- u32 mask = BIT(d->hwirq & 0x1f);
+ unsigned int mask = BIT(eint->pins[d->hwirq].index & 0x1f);
void __iomem *reg = mtk_eint_get_offset(eint, d->hwirq,
eint->regs->ack);
@@ -174,7 +179,7 @@ static int mtk_eint_set_type(struct irq_data *d, unsigned int type)
{
struct mtk_eint *eint = irq_data_get_irq_chip_data(d);
bool masked;
- u32 mask = BIT(d->hwirq & 0x1f);
+ unsigned int mask = BIT(eint->pins[d->hwirq].index & 0x1f);
void __iomem *reg;
if (((type & IRQ_TYPE_EDGE_BOTH) && (type & IRQ_TYPE_LEVEL_MASK)) ||
@@ -186,9 +191,9 @@ static int mtk_eint_set_type(struct irq_data *d, unsigned int type)
}
if ((type & IRQ_TYPE_EDGE_BOTH) == IRQ_TYPE_EDGE_BOTH)
- eint->dual_edge[d->hwirq] = 1;
+ eint->pins[d->hwirq].dual_edge = 1;
else
- eint->dual_edge[d->hwirq] = 0;
+ eint->pins[d->hwirq].dual_edge = 0;
if (!mtk_eint_get_mask(eint, d->hwirq)) {
mtk_eint_mask(d);
@@ -223,27 +228,32 @@ static int mtk_eint_set_type(struct irq_data *d, unsigned int type)
static int mtk_eint_irq_set_wake(struct irq_data *d, unsigned int on)
{
struct mtk_eint *eint = irq_data_get_irq_chip_data(d);
- int shift = d->hwirq & 0x1f;
- int reg = d->hwirq >> 5;
+ unsigned int idx = eint->pins[d->hwirq].index;
+ unsigned int inst = eint->pins[d->hwirq].instance;
+ unsigned int shift = idx & 0x1f;
+ unsigned int port = idx >> 5;
if (on)
- eint->wake_mask[reg] |= BIT(shift);
+ eint->wake_mask[inst][port] |= BIT(shift);
else
- eint->wake_mask[reg] &= ~BIT(shift);
+ eint->wake_mask[inst][port] &= ~BIT(shift);
return 0;
}
static void mtk_eint_chip_write_mask(const struct mtk_eint *eint,
- void __iomem *base, u32 *buf)
+ void __iomem *base, unsigned int **buf)
{
- int port;
+ int inst, port, port_num;
void __iomem *reg;
- for (port = 0; port < eint->hw->ports; port++) {
- reg = base + (port << 2);
- writel_relaxed(~buf[port], reg + eint->regs->mask_set);
- writel_relaxed(buf[port], reg + eint->regs->mask_clr);
+ for (inst = 0; inst < eint->nbase; inst++) {
+ port_num = DIV_ROUND_UP(eint->base_pin_num[inst], 32);
+ for (port = 0; port < port_num; port++) {
+ reg = eint->base[inst] + (port << 2);
+ writel_relaxed(~buf[inst][port], reg + eint->regs->mask_set);
+ writel_relaxed(buf[inst][port], reg + eint->regs->mask_clr);
+ }
}
}
@@ -303,15 +313,18 @@ static struct irq_chip mtk_eint_irq_chip = {
static unsigned int mtk_eint_hw_init(struct mtk_eint *eint)
{
- void __iomem *dom_en = eint->base + eint->regs->dom_en;
- void __iomem *mask_set = eint->base + eint->regs->mask_set;
- unsigned int i;
-
- for (i = 0; i < eint->hw->ap_num; i += 32) {
- writel(0xffffffff, dom_en);
- writel(0xffffffff, mask_set);
- dom_en += 4;
- mask_set += 4;
+ void __iomem *dom_reg, *mask_reg;
+ unsigned int i, j;
+
+ for (i = 0; i < eint->nbase; i++) {
+ dom_reg = eint->base[i] + eint->regs->dom_en;
+ mask_reg = eint->base[i] + eint->regs->mask_set;
+ for (j = 0; j < eint->base_pin_num[i]; j += 32) {
+ writel(0xffffffff, dom_reg);
+ writel(0xffffffff, mask_reg);
+ dom_reg += 4;
+ mask_reg += 4;
+ }
}
return 0;
@@ -322,14 +335,16 @@ mtk_eint_debounce_process(struct mtk_eint *eint, int index)
{
unsigned int rst, ctrl_offset;
unsigned int bit, dbnc;
+ unsigned int inst = eint->pins[index].instance;
+ unsigned int idx = eint->pins[index].index;
- ctrl_offset = (index / 4) * 4 + eint->regs->dbnc_ctrl;
- dbnc = readl(eint->base + ctrl_offset);
- bit = MTK_EINT_DBNC_SET_EN << ((index % 4) * 8);
+ ctrl_offset = (idx / 4) * 4 + eint->regs->dbnc_ctrl;
+ dbnc = readl(eint->base[inst] + ctrl_offset);
+ bit = MTK_EINT_DBNC_SET_EN << ((idx % 4) * 8);
if ((bit & dbnc) > 0) {
- ctrl_offset = (index / 4) * 4 + eint->regs->dbnc_set;
- rst = MTK_EINT_DBNC_RST_BIT << ((index % 4) * 8);
- writel(rst, eint->base + ctrl_offset);
+ ctrl_offset = (idx / 4) * 4 + eint->regs->dbnc_set;
+ rst = MTK_EINT_DBNC_RST_BIT << ((idx % 4) * 8);
+ writel(rst, eint->base[inst] + ctrl_offset);
}
}
@@ -337,65 +352,68 @@ static void mtk_eint_irq_handler(struct irq_desc *desc)
{
struct irq_chip *chip = irq_desc_get_chip(desc);
struct mtk_eint *eint = irq_desc_get_handler_data(desc);
- unsigned int status, eint_num;
- int offset, mask_offset, index;
- void __iomem *reg = mtk_eint_get_offset(eint, 0, eint->regs->stat);
+ unsigned int i, j, port, status, shift, mask, eint_num;
+ void __iomem *reg;
int dual_edge, start_level, curr_level;
chained_irq_enter(chip, desc);
- for (eint_num = 0; eint_num < eint->hw->ap_num; eint_num += 32,
- reg += 4) {
- status = readl(reg);
- while (status) {
- offset = __ffs(status);
- mask_offset = eint_num >> 5;
- index = eint_num + offset;
- status &= ~BIT(offset);
-
- /*
- * If we get an interrupt on pin that was only required
- * for wake (but no real interrupt requested), mask the
- * interrupt (as would mtk_eint_resume do anyway later
- * in the resume sequence).
- */
- if (eint->wake_mask[mask_offset] & BIT(offset) &&
- !(eint->cur_mask[mask_offset] & BIT(offset))) {
- writel_relaxed(BIT(offset), reg -
- eint->regs->stat +
- eint->regs->mask_set);
- }
-
- dual_edge = eint->dual_edge[index];
- if (dual_edge) {
- /*
- * Clear soft-irq in case we raised it last
- * time.
- */
- writel(BIT(offset), reg - eint->regs->stat +
- eint->regs->soft_clr);
-
- start_level =
- eint->gpio_xlate->get_gpio_state(eint->pctl,
- index);
- }
-
- generic_handle_domain_irq(eint->domain, index);
-
- if (dual_edge) {
- curr_level = mtk_eint_flip_edge(eint, index);
+ for (i = 0; i < eint->nbase; i++) {
+ for (j = 0; j < eint->base_pin_num[i]; j += 32) {
+ port = j >> 5;
+ status = readl(eint->base[i] + port * 4 + eint->regs->stat);
+ while (status) {
+ shift = __ffs(status);
+ status &= ~BIT(shift);
+ mask = BIT(shift);
+ eint_num = eint->pin_list[i][shift + j];
/*
- * If level changed, we might lost one edge
- * interrupt, raised it through soft-irq.
+ * If we get an interrupt on pin that was only required
+ * for wake (but no real interrupt requested), mask the
+ * interrupt (as would mtk_eint_resume do anyway later
+ * in the resume sequence).
*/
- if (start_level != curr_level)
- writel(BIT(offset), reg -
- eint->regs->stat +
- eint->regs->soft_set);
+ if (eint->wake_mask[i][port] & mask &&
+ !(eint->cur_mask[i][port] & mask)) {
+ reg = mtk_eint_get_offset(eint, eint_num,
+ eint->regs->mask_set);
+ writel_relaxed(mask, reg);
+ }
+
+ dual_edge = eint->pins[eint_num].dual_edge;
+ if (dual_edge) {
+ /*
+ * Clear soft-irq in case we raised it last
+ * time.
+ */
+ reg = mtk_eint_get_offset(eint, eint_num,
+ eint->regs->soft_clr);
+ writel(mask, reg);
+
+ start_level =
+ eint->gpio_xlate->get_gpio_state(eint->pctl,
+ eint_num);
+ }
+
+ generic_handle_domain_irq(eint->domain, eint_num);
+
+ if (dual_edge) {
+ curr_level = mtk_eint_flip_edge(eint, eint_num);
+
+ /*
+ * If level changed, we might lost one edge
+ * interrupt, raised it through soft-irq.
+ */
+ if (start_level != curr_level) {
+ reg = mtk_eint_get_offset(eint, eint_num,
+ eint->regs->soft_set);
+ writel(mask, reg);
+ }
+ }
+
+ if (eint->pins[eint_num].debounce)
+ mtk_eint_debounce_process(eint, eint_num);
}
-
- if (index < eint->hw->db_cnt)
- mtk_eint_debounce_process(eint, index);
}
}
chained_irq_exit(chip, desc);
@@ -423,6 +441,8 @@ int mtk_eint_set_debounce(struct mtk_eint *eint, unsigned long eint_num,
int virq, eint_offset;
unsigned int set_offset, bit, clr_bit, clr_offset, rst, i, unmask,
dbnc;
+ unsigned int inst = eint->pins[eint_num].instance;
+ unsigned int idx = eint->pins[eint_num].index;
struct irq_data *d;
if (!eint->hw->db_time)
@@ -432,8 +452,8 @@ int mtk_eint_set_debounce(struct mtk_eint *eint, unsigned long eint_num,
eint_offset = (eint_num % 4) * 8;
d = irq_get_irq_data(virq);
- set_offset = (eint_num / 4) * 4 + eint->regs->dbnc_set;
- clr_offset = (eint_num / 4) * 4 + eint->regs->dbnc_clr;
+ set_offset = (idx / 4) * 4 + eint->regs->dbnc_set;
+ clr_offset = (idx / 4) * 4 + eint->regs->dbnc_clr;
if (!mtk_eint_can_en_debounce(eint, eint_num))
return -EINVAL;
@@ -454,12 +474,12 @@ int mtk_eint_set_debounce(struct mtk_eint *eint, unsigned long eint_num,
}
clr_bit = 0xff << eint_offset;
- writel(clr_bit, eint->base + clr_offset);
+ writel(clr_bit, eint->base[inst] + clr_offset);
bit = ((dbnc << MTK_EINT_DBNC_SET_DBNC_BITS) | MTK_EINT_DBNC_SET_EN) <<
eint_offset;
rst = MTK_EINT_DBNC_RST_BIT << eint_offset;
- writel(rst | bit, eint->base + set_offset);
+ writel(rst | bit, eint->base[inst] + set_offset);
/*
* Delay a while (more than 2T) to wait for hw debounce counter reset
@@ -487,32 +507,69 @@ EXPORT_SYMBOL_GPL(mtk_eint_find_irq);
int mtk_eint_do_init(struct mtk_eint *eint)
{
- int i;
+ unsigned int size, i, port, inst = 0;
+ struct mtk_pinctrl *hw = (struct mtk_pinctrl *)eint->pctl;
/* If clients don't assign a specific regs, let's use generic one */
if (!eint->regs)
eint->regs = &mtk_generic_eint_regs;
- eint->wake_mask = devm_kcalloc(eint->dev, eint->hw->ports,
- sizeof(*eint->wake_mask), GFP_KERNEL);
- if (!eint->wake_mask)
+ eint->base_pin_num = devm_kmalloc_array(eint->dev, eint->nbase, sizeof(u16),
+ GFP_KERNEL | __GFP_ZERO);
+ if (!eint->base_pin_num)
return -ENOMEM;
- eint->cur_mask = devm_kcalloc(eint->dev, eint->hw->ports,
- sizeof(*eint->cur_mask), GFP_KERNEL);
- if (!eint->cur_mask)
- return -ENOMEM;
+ if (eint->nbase == 1) {
+ size = eint->hw->ap_num * sizeof(struct mtk_eint_pin);
+ eint->pins = devm_kmalloc(eint->dev, size, GFP_KERNEL);
+ if (!eint->pins)
+ goto err_pins;
+
+ eint->base_pin_num[inst] = eint->hw->ap_num;
+ for (i = 0; i < eint->hw->ap_num; i++) {
+ eint->pins[i].instance = inst;
+ eint->pins[i].index = i;
+ eint->pins[i].debounce = (i < eint->hw->db_cnt) ? 1 : 0;
+ }
+ }
- eint->dual_edge = devm_kcalloc(eint->dev, eint->hw->ap_num,
- sizeof(int), GFP_KERNEL);
- if (!eint->dual_edge)
- return -ENOMEM;
+ if (hw && hw->soc && hw->soc->eint_pin) {
+ eint->pins = hw->soc->eint_pin;
+ for (i = 0; i < eint->hw->ap_num; i++) {
+ inst = eint->pins[i].instance;
+ if (inst >= eint->nbase)
+ continue;
+ eint->base_pin_num[inst]++;
+ }
+ }
+
+ eint->pin_list = devm_kmalloc(eint->dev, eint->nbase * sizeof(u16 *), GFP_KERNEL);
+ if (!eint->pin_list)
+ goto err_pin_list;
+
+ eint->wake_mask = devm_kmalloc(eint->dev, eint->nbase * sizeof(u32 *), GFP_KERNEL);
+ if (!eint->wake_mask)
+ goto err_wake_mask;
+
+ eint->cur_mask = devm_kmalloc(eint->dev, eint->nbase * sizeof(u32 *), GFP_KERNEL);
+ if (!eint->cur_mask)
+ goto err_cur_mask;
+
+ for (i = 0; i < eint->nbase; i++) {
+ eint->pin_list[i] = devm_kzalloc(eint->dev, eint->base_pin_num[i] * sizeof(u16),
+ GFP_KERNEL);
+ port = DIV_ROUND_UP(eint->base_pin_num[i], 32);
+ eint->wake_mask[i] = devm_kzalloc(eint->dev, port * sizeof(u32), GFP_KERNEL);
+ eint->cur_mask[i] = devm_kzalloc(eint->dev, port * sizeof(u32), GFP_KERNEL);
+ if (!eint->pin_list[i] || !eint->wake_mask[i] || !eint->cur_mask[i])
+ goto err_eint;
+ }
eint->domain = irq_domain_add_linear(eint->dev->of_node,
eint->hw->ap_num,
&irq_domain_simple_ops, NULL);
if (!eint->domain)
- return -ENOMEM;
+ goto err_eint;
if (eint->hw->db_time) {
for (i = 0; i < MTK_EINT_DBNC_MAX; i++)
@@ -523,8 +580,11 @@ int mtk_eint_do_init(struct mtk_eint *eint)
mtk_eint_hw_init(eint);
for (i = 0; i < eint->hw->ap_num; i++) {
+ inst = eint->pins[i].instance;
+ if (inst >= eint->nbase)
+ continue;
+ eint->pin_list[inst][eint->pins[i].index] = i;
int virq = irq_create_mapping(eint->domain, i);
-
irq_set_chip_and_handler(virq, &mtk_eint_irq_chip,
handle_level_irq);
irq_set_chip_data(virq, eint);
@@ -534,6 +594,27 @@ int mtk_eint_do_init(struct mtk_eint *eint)
eint);
return 0;
+
+err_eint:
+ for (i = 0; i < eint->nbase; i++) {
+ if (eint->cur_mask[i])
+ devm_kfree(eint->dev, eint->cur_mask[i]);
+ if (eint->wake_mask[i])
+ devm_kfree(eint->dev, eint->wake_mask[i]);
+ if (eint->pin_list[i])
+ devm_kfree(eint->dev, eint->pin_list[i]);
+ }
+ devm_kfree(eint->dev, eint->cur_mask);
+err_cur_mask:
+ devm_kfree(eint->dev, eint->wake_mask);
+err_wake_mask:
+ devm_kfree(eint->dev, eint->pin_list);
+err_pin_list:
+ if (eint->nbase == 1)
+ devm_kfree(eint->dev, eint->pins);
+err_pins:
+ devm_kfree(eint->dev, eint->base_pin_num);
+ return -ENOMEM;
}
EXPORT_SYMBOL_GPL(mtk_eint_do_init);
diff --git a/drivers/pinctrl/mediatek/mtk-eint.h b/drivers/pinctrl/mediatek/mtk-eint.h
index 6139b16cd225f..f7f58cca0d5e3 100644
--- a/drivers/pinctrl/mediatek/mtk-eint.h
+++ b/drivers/pinctrl/mediatek/mtk-eint.h
@@ -1,10 +1,11 @@
/* SPDX-License-Identifier: GPL-2.0 */
/*
- * Copyright (C) 2014-2018 MediaTek Inc.
+ * Copyright (C) 2014-2025 MediaTek Inc.
*
* Author: Maoguang Meng <maoguang.meng@mediatek.com>
* Sean Wang <sean.wang@mediatek.com>
- *
+ * Hao Chang <ot_chhao.chang@mediatek.com>
+ * Qingliang Li <qingliang.li@mediatek.com>
*/
#ifndef __MTK_EINT_H
#define __MTK_EINT_H
@@ -40,6 +41,14 @@ struct mtk_eint_hw {
const unsigned int *db_time;
};
+struct mtk_eint_pin {
+ u16 number;
+ u8 instance;
+ u8 index;
+ bool debounce;
+ bool dual_edge;
+};
+
extern const unsigned int debounce_time_mt2701[];
extern const unsigned int debounce_time_mt6765[];
extern const unsigned int debounce_time_mt6795[];
@@ -56,17 +65,21 @@ struct mtk_eint_xt {
struct mtk_eint {
struct device *dev;
- void __iomem *base;
+ void __iomem **base;
+ u8 nbase;
+ u16 *base_pin_num;
struct irq_domain *domain;
int irq;
int *dual_edge;
- u32 *wake_mask;
- u32 *cur_mask;
+ u16 **pin_list;
+ u32 **wake_mask;
+ u32 **cur_mask;
/* Used to fit into various EINT device */
const struct mtk_eint_hw *hw;
const struct mtk_eint_regs *regs;
+ struct mtk_eint_pin *pins;
u16 num_db_time;
/* Used to fit into various pinctrl device */
diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c
index 54301fbba524a..d220d8c0aa654 100644
--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c
+++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c
@@ -13,6 +13,7 @@
#include <linux/platform_device.h>
#include <linux/io.h>
#include <linux/module.h>
+#include <linux/of_address.h>
#include <linux/of_irq.h>
#include "mtk-eint.h"
@@ -367,7 +368,7 @@ static const struct mtk_eint_xt mtk_eint_xt = {
int mtk_build_eint(struct mtk_pinctrl *hw, struct platform_device *pdev)
{
struct device_node *np = pdev->dev.of_node;
- int ret;
+ int ret, i, j, count_reg_names;
if (!IS_ENABLED(CONFIG_EINT_MTK))
return 0;
@@ -379,10 +380,24 @@ int mtk_build_eint(struct mtk_pinctrl *hw, struct platform_device *pdev)
if (!hw->eint)
return -ENOMEM;
- hw->eint->base = devm_platform_ioremap_resource_byname(pdev, "eint");
- if (IS_ERR(hw->eint->base)) {
- ret = PTR_ERR(hw->eint->base);
- goto err_free_eint;
+ count_reg_names = of_property_count_strings(np, "reg-names");
+ if (count_reg_names < hw->soc->nbase_names)
+ return -EINVAL;
+
+ hw->eint->nbase = count_reg_names - hw->soc->nbase_names;
+ hw->eint->base = devm_kmalloc_array(&pdev->dev, hw->eint->nbase,
+ sizeof(*hw->eint->base), GFP_KERNEL | __GFP_ZERO);
+ if (!hw->eint->base) {
+ ret = -ENOMEM;
+ goto err_free_base;
+ }
+
+ for (i = hw->soc->nbase_names, j = 0; i < count_reg_names; i++, j++) {
+ hw->eint->base[j] = of_iomap(np, i);
+ if (IS_ERR(hw->eint->base[j])) {
+ ret = PTR_ERR(hw->eint->base[j]);
+ goto err_free_eint;
+ }
}
hw->eint->irq = irq_of_parse_and_map(np, 0);
@@ -401,9 +416,19 @@ int mtk_build_eint(struct mtk_pinctrl *hw, struct platform_device *pdev)
hw->eint->pctl = hw;
hw->eint->gpio_xlate = &mtk_eint_xt;
- return mtk_eint_do_init(hw->eint);
+ ret = mtk_eint_do_init(hw->eint);
+ if (ret)
+ goto err_free_eint;
+
+ return 0;
err_free_eint:
+ for (j = 0; j < hw->eint->nbase; j++) {
+ if (hw->eint->base[j])
+ iounmap(hw->eint->base[j]);
+ }
+ devm_kfree(hw->dev, hw->eint->base);
+err_free_base:
devm_kfree(hw->dev, hw->eint);
hw->eint = NULL;
return ret;
diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.h b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.h
index 23688ca6d04e8..1dc2ed8a7df23 100644
--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.h
+++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.h
@@ -241,6 +241,7 @@ struct mtk_pin_soc {
unsigned int nfuncs;
const struct mtk_eint_regs *eint_regs;
const struct mtk_eint_hw *eint_hw;
+ struct mtk_eint_pin *eint_pin;
/* Specific parameters per SoC */
u8 gpio_m;
diff --git a/drivers/pinctrl/mediatek/pinctrl-paris.h b/drivers/pinctrl/mediatek/pinctrl-paris.h
index 948ce126aa0cb..d8c1822662fc7 100644
--- a/drivers/pinctrl/mediatek/pinctrl-paris.h
+++ b/drivers/pinctrl/mediatek/pinctrl-paris.h
@@ -49,6 +49,13 @@
__VA_ARGS__, { } }, \
}
+#define MTK_EINT_PIN(_number, _instance, _index, _debounce) { \
+ .number = _number, \
+ .instance = _instance, \
+ .index = _index, \
+ .debounce = _debounce, \
+ }
+
#define PINCTRL_PIN_GROUP(_name_, id) \
{ \
.grp = PINCTRL_PINGROUP(_name_,id##_pins, ARRAY_SIZE(id##_pins)), \
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0688/1376] pinctrl: mediatek: Fix the invalid conditions
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (686 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0687/1376] pinctrl: mediatek: Add EINT support for multiple addresses Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0689/1376] pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms Greg Kroah-Hartman
` (310 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hao Chang, Qingliang Li,
Linus Walleij, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao Chang <ot_chhao.chang@mediatek.com>
[ Upstream commit 86dee87f4b2e6ac119b03810e58723d0b27787a4 ]
The variable count_reg_names is defined as an int type and cannot be
directly compared to an unsigned int. To resolve this issue,
first verify the correctness of count_reg_names.
Link: https://lore.kernel.org/all/5ae93d42e4c4e70fb33bf35dcc37caebf324c8d3.camel@mediatek.com/T/
Signed-off-by: Hao Chang <ot_chhao.chang@mediatek.com>
Signed-off-by: Qingliang Li <qingliang.li@mediatek.com>
Link: https://lore.kernel.org/20250329024533.5279-1-ot_chhao.chang@mediatek.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Stable-dep-of: 88292b7103d2 ("pinctrl: mediatek: free EINT resources on unbind")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/mediatek/mtk-eint.c | 4 ++--
drivers/pinctrl/mediatek/mtk-eint.h | 2 +-
drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c | 7 +++++--
3 files changed, 8 insertions(+), 5 deletions(-)
diff --git a/drivers/pinctrl/mediatek/mtk-eint.c b/drivers/pinctrl/mediatek/mtk-eint.c
index ced4ee509b5b6..557dec75fa031 100644
--- a/drivers/pinctrl/mediatek/mtk-eint.c
+++ b/drivers/pinctrl/mediatek/mtk-eint.c
@@ -507,7 +507,7 @@ EXPORT_SYMBOL_GPL(mtk_eint_find_irq);
int mtk_eint_do_init(struct mtk_eint *eint)
{
- unsigned int size, i, port, inst = 0;
+ unsigned int size, i, port, virq, inst = 0;
struct mtk_pinctrl *hw = (struct mtk_pinctrl *)eint->pctl;
/* If clients don't assign a specific regs, let's use generic one */
@@ -584,7 +584,7 @@ int mtk_eint_do_init(struct mtk_eint *eint)
if (inst >= eint->nbase)
continue;
eint->pin_list[inst][eint->pins[i].index] = i;
- int virq = irq_create_mapping(eint->domain, i);
+ virq = irq_create_mapping(eint->domain, i);
irq_set_chip_and_handler(virq, &mtk_eint_irq_chip,
handle_level_irq);
irq_set_chip_data(virq, eint);
diff --git a/drivers/pinctrl/mediatek/mtk-eint.h b/drivers/pinctrl/mediatek/mtk-eint.h
index f7f58cca0d5e3..0c6bf7cbdc3a4 100644
--- a/drivers/pinctrl/mediatek/mtk-eint.h
+++ b/drivers/pinctrl/mediatek/mtk-eint.h
@@ -66,7 +66,7 @@ struct mtk_eint_xt {
struct mtk_eint {
struct device *dev;
void __iomem **base;
- u8 nbase;
+ int nbase;
u16 *base_pin_num;
struct irq_domain *domain;
int irq;
diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c
index d220d8c0aa654..26fe53d9a53fb 100644
--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c
+++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c
@@ -381,10 +381,13 @@ int mtk_build_eint(struct mtk_pinctrl *hw, struct platform_device *pdev)
return -ENOMEM;
count_reg_names = of_property_count_strings(np, "reg-names");
- if (count_reg_names < hw->soc->nbase_names)
+ if (count_reg_names < 0)
+ return -EINVAL;
+
+ hw->eint->nbase = count_reg_names - (int)hw->soc->nbase_names;
+ if (hw->eint->nbase <= 0)
return -EINVAL;
- hw->eint->nbase = count_reg_names - hw->soc->nbase_names;
hw->eint->base = devm_kmalloc_array(&pdev->dev, hw->eint->nbase,
sizeof(*hw->eint->base), GFP_KERNEL | __GFP_ZERO);
if (!hw->eint->base) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0689/1376] pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (687 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0688/1376] pinctrl: mediatek: Fix the invalid conditions Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0690/1376] pinctrl: mediatek: free EINT resources on unbind Greg Kroah-Hartman
` (309 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, AngeloGioacchino Del Regno,
Nícolas F . R . A . Prado, Linus Walleij, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nícolas F. R. A. Prado <nfraprado@collabora.com>
[ Upstream commit 1c9977b263475373b31bbf86af94a5c9ae2be42c ]
Commit 3ef9f710efcb ("pinctrl: mediatek: Add EINT support for multiple
addresses") introduced an access to the 'soc' field of struct
mtk_pinctrl in mtk_eint_do_init() and for that an include of
pinctrl-mtk-common-v2.h.
However, pinctrl drivers relying on the v1 common driver include
pinctrl-mtk-common.h instead, which provides another definition of
struct mtk_pinctrl that does not contain an 'soc' field.
Since mtk_eint_do_init() can be called both by v1 and v2 drivers, it
will now try to dereference an invalid pointer when called on v1
platforms. This has been observed on Genio 350 EVK (MT8365), which
crashes very early in boot (the kernel trace can only be seen with
earlycon).
In order to fix this, since 'struct mtk_pinctrl' was only needed to get
a 'struct mtk_eint_pin', make 'struct mtk_eint_pin' a parameter
of mtk_eint_do_init() so that callers need to supply it, removing
mtk_eint_do_init()'s dependency on any particular 'struct mtk_pinctrl'.
Fixes: 3ef9f710efcb ("pinctrl: mediatek: Add EINT support for multiple addresses")
Suggested-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
Link: https://lore.kernel.org/20250520-genio-350-eint-null-ptr-deref-fix-v2-1-6a3ca966a7ba@collabora.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Stable-dep-of: 88292b7103d2 ("pinctrl: mediatek: free EINT resources on unbind")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/mediatek/mtk-eint.c | 26 ++++++++-----------
drivers/pinctrl/mediatek/mtk-eint.h | 5 ++--
.../pinctrl/mediatek/pinctrl-mtk-common-v2.c | 2 +-
drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 2 +-
4 files changed, 16 insertions(+), 19 deletions(-)
diff --git a/drivers/pinctrl/mediatek/mtk-eint.c b/drivers/pinctrl/mediatek/mtk-eint.c
index 557dec75fa031..c2e452c699cfa 100644
--- a/drivers/pinctrl/mediatek/mtk-eint.c
+++ b/drivers/pinctrl/mediatek/mtk-eint.c
@@ -22,7 +22,6 @@
#include <linux/platform_device.h>
#include "mtk-eint.h"
-#include "pinctrl-mtk-common-v2.h"
#define MTK_EINT_EDGE_SENSITIVE 0
#define MTK_EINT_LEVEL_SENSITIVE 1
@@ -505,10 +504,9 @@ int mtk_eint_find_irq(struct mtk_eint *eint, unsigned long eint_n)
}
EXPORT_SYMBOL_GPL(mtk_eint_find_irq);
-int mtk_eint_do_init(struct mtk_eint *eint)
+int mtk_eint_do_init(struct mtk_eint *eint, struct mtk_eint_pin *eint_pin)
{
unsigned int size, i, port, virq, inst = 0;
- struct mtk_pinctrl *hw = (struct mtk_pinctrl *)eint->pctl;
/* If clients don't assign a specific regs, let's use generic one */
if (!eint->regs)
@@ -519,7 +517,15 @@ int mtk_eint_do_init(struct mtk_eint *eint)
if (!eint->base_pin_num)
return -ENOMEM;
- if (eint->nbase == 1) {
+ if (eint_pin) {
+ eint->pins = eint_pin;
+ for (i = 0; i < eint->hw->ap_num; i++) {
+ inst = eint->pins[i].instance;
+ if (inst >= eint->nbase)
+ continue;
+ eint->base_pin_num[inst]++;
+ }
+ } else {
size = eint->hw->ap_num * sizeof(struct mtk_eint_pin);
eint->pins = devm_kmalloc(eint->dev, size, GFP_KERNEL);
if (!eint->pins)
@@ -533,16 +539,6 @@ int mtk_eint_do_init(struct mtk_eint *eint)
}
}
- if (hw && hw->soc && hw->soc->eint_pin) {
- eint->pins = hw->soc->eint_pin;
- for (i = 0; i < eint->hw->ap_num; i++) {
- inst = eint->pins[i].instance;
- if (inst >= eint->nbase)
- continue;
- eint->base_pin_num[inst]++;
- }
- }
-
eint->pin_list = devm_kmalloc(eint->dev, eint->nbase * sizeof(u16 *), GFP_KERNEL);
if (!eint->pin_list)
goto err_pin_list;
@@ -610,7 +606,7 @@ int mtk_eint_do_init(struct mtk_eint *eint)
err_wake_mask:
devm_kfree(eint->dev, eint->pin_list);
err_pin_list:
- if (eint->nbase == 1)
+ if (!eint_pin)
devm_kfree(eint->dev, eint->pins);
err_pins:
devm_kfree(eint->dev, eint->base_pin_num);
diff --git a/drivers/pinctrl/mediatek/mtk-eint.h b/drivers/pinctrl/mediatek/mtk-eint.h
index 0c6bf7cbdc3a4..fc31a4c0c77bf 100644
--- a/drivers/pinctrl/mediatek/mtk-eint.h
+++ b/drivers/pinctrl/mediatek/mtk-eint.h
@@ -88,7 +88,7 @@ struct mtk_eint {
};
#if IS_ENABLED(CONFIG_EINT_MTK)
-int mtk_eint_do_init(struct mtk_eint *eint);
+int mtk_eint_do_init(struct mtk_eint *eint, struct mtk_eint_pin *eint_pin);
int mtk_eint_do_suspend(struct mtk_eint *eint);
int mtk_eint_do_resume(struct mtk_eint *eint);
int mtk_eint_set_debounce(struct mtk_eint *eint, unsigned long eint_n,
@@ -96,7 +96,8 @@ int mtk_eint_set_debounce(struct mtk_eint *eint, unsigned long eint_n,
int mtk_eint_find_irq(struct mtk_eint *eint, unsigned long eint_n);
#else
-static inline int mtk_eint_do_init(struct mtk_eint *eint)
+static inline int mtk_eint_do_init(struct mtk_eint *eint,
+ struct mtk_eint_pin *eint_pin)
{
return -EOPNOTSUPP;
}
diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c
index 26fe53d9a53fb..882733516b45e 100644
--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c
+++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c
@@ -419,7 +419,7 @@ int mtk_build_eint(struct mtk_pinctrl *hw, struct platform_device *pdev)
hw->eint->pctl = hw;
hw->eint->gpio_xlate = &mtk_eint_xt;
- ret = mtk_eint_do_init(hw->eint);
+ ret = mtk_eint_do_init(hw->eint, hw->soc->eint_pin);
if (ret)
goto err_free_eint;
diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
index e5d6dc6b0069f..dd3222a0b8e5f 100644
--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
+++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
@@ -1033,7 +1033,7 @@ static int mtk_eint_init(struct mtk_pinctrl *pctl, struct platform_device *pdev)
pctl->eint->pctl = pctl;
pctl->eint->gpio_xlate = &mtk_eint_xt;
- return mtk_eint_do_init(pctl->eint);
+ return mtk_eint_do_init(pctl->eint, NULL);
}
/* This is used as a common probe function */
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0690/1376] pinctrl: mediatek: free EINT resources on unbind
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (688 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0689/1376] pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0691/1376] tools/build: Add bpftool-skeletons feature test Greg Kroah-Hartman
` (308 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Justin Yeh,
AngeloGioacchino Del Regno, Linus Walleij, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Yeh <justin.yeh@mediatek.com>
[ Upstream commit 88292b7103d260e3e606eb3bb2794060a5fde48e ]
mtk_eint_do_init() creates an IRQ domain, populates it with a mapping for
every EINT line and installs a chained handler on the parent interrupt,
but none of these are ever released. This was harmless while the drivers
were built-in, but now that they can be built as modules and
unbound/rmmod'd it leaves behind a dangling IRQ domain, interrupt mappings
whose chip data points at freed memory, and a chained handler that keeps
firing into that freed data.
The plain allocations in mtk_eint_do_init() already use the device-managed
devm_*() helpers, so tear the remaining resources down the same way:
register a devm action that detaches the chained handler, waits for any
in-flight handler to finish, disposes of the per-line mappings and removes
the IRQ domain. This mirrors the device-managed lifecycle adopted for the
GPIO chip and keeps the whole EINT setup self-cleaning on unbind.
Fixes: e46df235b4e6 ("pinctrl: mediatek: refactor EINT related code for all MediaTek pinctrl can fit")
Signed-off-by: Justin Yeh <justin.yeh@mediatek.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/mediatek/mtk-eint.c | 25 ++++++++++++++++++++++++-
1 file changed, 24 insertions(+), 1 deletion(-)
diff --git a/drivers/pinctrl/mediatek/mtk-eint.c b/drivers/pinctrl/mediatek/mtk-eint.c
index c2e452c699cfa..6787596167b92 100644
--- a/drivers/pinctrl/mediatek/mtk-eint.c
+++ b/drivers/pinctrl/mediatek/mtk-eint.c
@@ -12,8 +12,10 @@
*/
#include <linux/delay.h>
+#include <linux/device.h>
#include <linux/err.h>
#include <linux/gpio/driver.h>
+#include <linux/interrupt.h>
#include <linux/io.h>
#include <linux/irqchip/chained_irq.h>
#include <linux/irqdomain.h>
@@ -504,6 +506,27 @@ int mtk_eint_find_irq(struct mtk_eint *eint, unsigned long eint_n)
}
EXPORT_SYMBOL_GPL(mtk_eint_find_irq);
+static void mtk_eint_teardown(void *data)
+{
+ struct mtk_eint *eint = data;
+ unsigned int i, virq;
+
+ /* Detach the demux handler so it can no longer reference freed data. */
+ irq_set_chained_handler_and_data(eint->irq, NULL, NULL);
+
+ /* Wait for any in-flight handler to finish before tearing down. */
+ synchronize_irq(eint->irq);
+
+ /* Dispose of all child mappings before the domain is removed. */
+ for (i = 0; i < eint->hw->ap_num; i++) {
+ virq = irq_find_mapping(eint->domain, i);
+ if (virq)
+ irq_dispose_mapping(virq);
+ }
+
+ irq_domain_remove(eint->domain);
+}
+
int mtk_eint_do_init(struct mtk_eint *eint, struct mtk_eint_pin *eint_pin)
{
unsigned int size, i, port, virq, inst = 0;
@@ -589,7 +612,7 @@ int mtk_eint_do_init(struct mtk_eint *eint, struct mtk_eint_pin *eint_pin)
irq_set_chained_handler_and_data(eint->irq, mtk_eint_irq_handler,
eint);
- return 0;
+ return devm_add_action_or_reset(eint->dev, mtk_eint_teardown, eint);
err_eint:
for (i = 0; i < eint->nbase; i++) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0691/1376] tools/build: Add bpftool-skeletons feature test
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (689 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0690/1376] pinctrl: mediatek: free EINT resources on unbind Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0692/1376] tools/build: Allow versioning of all LLVM tools defined in Makefile.include Greg Kroah-Hartman
` (307 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, John Kacur, Luis Goncalves,
Gabriele Monaco, Clark Williams, Tomas Glozar,
Steven Rostedt (Google), Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomas Glozar <tglozar@redhat.com>
[ Upstream commit 8a635c3856ddb74ed3fe7c856b271cdfeb65f293 ]
Add bpftool-skeletons feature test, testing the presence of a bpftool
capable of generating skeletons.
This is to be used for tools that do not require building their own
bootstrap bpftool from the kernel source tree.
Cc: John Kacur <jkacur@redhat.com>
Cc: Luis Goncalves <lgoncalv@redhat.com>
Cc: Gabriele Monaco <gmonaco@redhat.com>
Cc: Clark Williams <williams@redhat.com>
Link: https://lore.kernel.org/20250218145859.27762-3-tglozar@redhat.com
Signed-off-by: Tomas Glozar <tglozar@redhat.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Stable-dep-of: d5a1d1270c89 ("tools/build: Allow versioning of all LLVM tools defined in Makefile.include")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/build/Makefile.feature | 3 ++-
tools/build/feature/Makefile | 3 +++
tools/scripts/Makefile.include | 3 +++
3 files changed, 8 insertions(+), 1 deletion(-)
diff --git a/tools/build/Makefile.feature b/tools/build/Makefile.feature
index ffd117135094c..24e9acf84708a 100644
--- a/tools/build/Makefile.feature
+++ b/tools/build/Makefile.feature
@@ -110,7 +110,8 @@ FEATURE_TESTS_EXTRA := \
libbpf-bpf_create_map \
libpfm4 \
libdebuginfod \
- clang-bpf-co-re
+ clang-bpf-co-re \
+ bpftool-skeletons
FEATURE_TESTS ?= $(FEATURE_TESTS_BASIC)
diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile
index 592ca17b4b74a..af33e3fe69eac 100644
--- a/tools/build/feature/Makefile
+++ b/tools/build/feature/Makefile
@@ -426,6 +426,9 @@ $(OUTPUT)test-file-handle.bin:
$(OUTPUT)test-libpfm4.bin:
$(BUILD) -lpfm
+$(OUTPUT)test-bpftool-skeletons.bin:
+ $(BPFTOOL) version | grep '^features:.*skeletons' \
+ > $(@:.bin=.make.output) 2>&1
###############################
clean:
diff --git a/tools/scripts/Makefile.include b/tools/scripts/Makefile.include
index 5f2afd95de430..8a7a6f07a61af 100644
--- a/tools/scripts/Makefile.include
+++ b/tools/scripts/Makefile.include
@@ -91,6 +91,9 @@ LLVM_CONFIG ?= llvm-config
LLVM_OBJCOPY ?= llvm-objcopy
LLVM_STRIP ?= llvm-strip
+# Some tools require bpftool
+BPFTOOL ?= bpftool
+
ifeq ($(CC_NO_CLANG), 1)
EXTRA_WARNINGS += -Wstrict-aliasing=3
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0692/1376] tools/build: Allow versioning of all LLVM tools defined in Makefile.include
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (690 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0691/1376] tools/build: Add bpftool-skeletons feature test Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0693/1376] power: supply: sbs-battery: Use a per-device serial number buffer Greg Kroah-Hartman
` (306 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, James Clark, Ian Rogers,
Kumar Kartikeya Dwivedi, Namhyung Kim, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Clark <james.clark@linaro.org>
[ Upstream commit d5a1d1270c898057afc5b51fb6d0f2defa89d56d ]
The version of LLVM tools can be given on the build command with
LLVM=-15, but this isn't applied to all tools. For example $(CC) gets
versioned, but $(CLANG) doesn't. This causes a Perf build with LTO=1 to
fail with an error about mixed clang versions:
ld.lld: error: libperf/core.o: Unknown attribute kind (86)
(Producer: 'LLVM18.1.8' Reader: 'LLVM 15.0.7')
This file has two "ifneq ($(LLVM),)" blocks adjacent to each other, so
merge these blocks making it obvious that all tools should be versioned
consistently and there is nothing special about each block.
This also reveals that ?= and "allow-override" are used inconsistently
between the blocks. "allow-override" is technically only required for
builtin variables, but isn't only used on them, and doesn't do any harm
if used on a non-builtin. Make them all "allow-override" for
consistency. The only functional difference this will cause is if there
is a file level definition of one of the variables followed by an
"#include of Makefile.include" which will now overwrite. But this isn't
done and in a later commit some of the duplicate definitions will be
removed for good measure.
There are also some other LLVM tools that are not defined here and will
be moved in a later commit.
Signed-off-by: James Clark <james.clark@linaro.org>
Reviewed-by: Ian Rogers <irogers@google.com>
Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Fixes: e9c281928c24 ("kbuild: Make $(LLVM) more flexible")
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/scripts/Makefile.include | 37 ++++++++++++++++++----------------
1 file changed, 20 insertions(+), 17 deletions(-)
diff --git a/tools/scripts/Makefile.include b/tools/scripts/Makefile.include
index 8a7a6f07a61af..7e6721b98996f 100644
--- a/tools/scripts/Makefile.include
+++ b/tools/scripts/Makefile.include
@@ -59,10 +59,18 @@ LLVM_SUFFIX := $(LLVM)
endif
$(call allow-override,CC,$(LLVM_PREFIX)clang$(LLVM_SUFFIX))
+$(call allow-override,CLANG,$(LLVM_PREFIX)clang$(LLVM_SUFFIX))
+$(call allow-override,HOSTCC,$(LLVM_PREFIX)clang$(LLVM_SUFFIX))
$(call allow-override,AR,$(LLVM_PREFIX)llvm-ar$(LLVM_SUFFIX))
+$(call allow-override,HOSTAR,$(LLVM_PREFIX)llvm-ar$(LLVM_SUFFIX))
$(call allow-override,LD,$(LLVM_PREFIX)ld.lld$(LLVM_SUFFIX))
+$(call allow-override,HOSTLD,$(LLVM_PREFIX)ld.lld$(LLVM_SUFFIX))
$(call allow-override,CXX,$(LLVM_PREFIX)clang++$(LLVM_SUFFIX))
$(call allow-override,STRIP,$(LLVM_PREFIX)llvm-strip$(LLVM_SUFFIX))
+$(call allow-override,LLVM_STRIP,$(LLVM_PREFIX)llvm-strip$(LLVM_SUFFIX))
+$(call allow-override,LLC,$(LLVM_PREFIX)llc$(LLVM_SUFFIX))
+$(call allow-override,LLVM_CONFIG,$(LLVM_PREFIX)llvm-config$(LLVM_SUFFIX))
+$(call allow-override,LLVM_OBJCOPY,$(LLVM_PREFIX)llvm-objcopy$(LLVM_SUFFIX))
else
# Allow setting various cross-compile vars or setting CROSS_COMPILE as a prefix.
$(call allow-override,CC,$(CROSS_COMPILE)gcc)
@@ -70,26 +78,21 @@ $(call allow-override,AR,$(CROSS_COMPILE)ar)
$(call allow-override,LD,$(CROSS_COMPILE)ld)
$(call allow-override,CXX,$(CROSS_COMPILE)g++)
$(call allow-override,STRIP,$(CROSS_COMPILE)strip)
-endif
-
-CC_NO_CLANG := $(shell $(CC) -dM -E -x c /dev/null | grep -Fq "__clang__"; echo $$?)
-ifneq ($(LLVM),)
-HOSTAR ?= $(LLVM_PREFIX)llvm-ar$(LLVM_SUFFIX)
-HOSTCC ?= $(LLVM_PREFIX)clang$(LLVM_SUFFIX)
-HOSTLD ?= $(LLVM_PREFIX)ld.lld$(LLVM_SUFFIX)
-else
-HOSTAR ?= ar
-HOSTCC ?= gcc
-HOSTLD ?= ld
+# Host versions aren't prefixed
+$(call allow-override,HOSTAR,ar)
+$(call allow-override,HOSTCC,gcc)
+$(call allow-override,HOSTLD,ld)
+
+# Some tools still require Clang, LLC and/or LLVM utils
+$(call allow-override,CLANG,clang)
+$(call allow-override,LLC,llc)
+$(call allow-override,LLVM_CONFIG,llvm-config)
+$(call allow-override,LLVM_OBJCOPY,llvm-objcopy)
+$(call allow-override,LLVM_STRIP,llvm-strip)
endif
-# Some tools require Clang, LLC and/or LLVM utils
-CLANG ?= clang
-LLC ?= llc
-LLVM_CONFIG ?= llvm-config
-LLVM_OBJCOPY ?= llvm-objcopy
-LLVM_STRIP ?= llvm-strip
+CC_NO_CLANG := $(shell $(CC) -dM -E -x c /dev/null | grep -Fq "__clang__"; echo $$?)
# Some tools require bpftool
BPFTOOL ?= bpftool
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0693/1376] power: supply: sbs-battery: Use a per-device serial number buffer
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (691 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0692/1376] tools/build: Allow versioning of all LLVM tools defined in Makefile.include Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0694/1376] scsi: ufs: debugfs: Reserve space for a string terminator Greg Kroah-Hartman
` (305 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Babanpreet Singh, Sebastian Reichel,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Babanpreet Singh <bbnpreetsingh@gmail.com>
[ Upstream commit 6027892925b8d19d2245c2d077e2ae35b49cc2b1 ]
sbs_get_battery_serial_number() formats the battery serial number into
sbs_serial[], a single file-scope buffer shared by every sbs-battery
instance, and points val->strval at it.
Nothing restricts this driver to one instance. It binds per I2C client,
and sbs-manager registers one muxed I2C channel per supported battery
specifically so that the smart battery driver can be bound to each of
them, so several sbs-battery instances on one system is a supported
configuration.
The power supply core reads strval after the driver's get_property()
callback has returned: power_supply_show_property() fills a local
union power_supply_propval, then formats it with sysfs_emit(). Two
concurrent POWER_SUPPLY_PROP_SERIAL_NUMBER reads on different batteries
therefore race for the shared buffer - battery B's sprintf() can land
between battery A filling the buffer and the core reading it, and
battery A then reports battery B's serial number.
Move the buffer into struct sbs_info so that each battery formats into
its own storage. It is deliberately not added to the chip->strings[]
array: those entries hold the cached constant strings that
sbs_invalidate_cached_props() clears on presence changes, whereas the
serial number is re-read from its word register on every access.
Fixes: d3ab61ecbab2 ("bq20z75: Add support for more power supply properties")
Assisted-by: Claude:claude-opus-5
Signed-off-by: Babanpreet Singh <bbnpreetsingh@gmail.com>
Link: https://patch.msgid.link/20260726072206.7-2-bbnpreetsingh@gmail.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/sbs-battery.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/power/supply/sbs-battery.c b/drivers/power/supply/sbs-battery.c
index f80edceafc3cf..4e2b8e252d5e9 100644
--- a/drivers/power/supply/sbs-battery.c
+++ b/drivers/power/supply/sbs-battery.c
@@ -216,6 +216,7 @@ struct sbs_info {
u32 flags;
int technology;
char strings[NR_STRING_BUFFERS][I2C_SMBUS_BLOCK_MAX + 1];
+ char serial[5];
};
static char *sbs_get_string_buf(struct sbs_info *chip,
@@ -820,18 +821,18 @@ static int sbs_get_battery_capacity(struct i2c_client *client,
return 0;
}
-static char sbs_serial[5];
static int sbs_get_battery_serial_number(struct i2c_client *client,
union power_supply_propval *val)
{
+ struct sbs_info *chip = i2c_get_clientdata(client);
int ret;
ret = sbs_read_word_data(client, sbs_data[REG_SERIAL_NUMBER].addr);
if (ret < 0)
return ret;
- sprintf(sbs_serial, "%04x", ret);
- val->strval = sbs_serial;
+ sprintf(chip->serial, "%04x", ret);
+ val->strval = chip->serial;
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0694/1376] scsi: ufs: debugfs: Reserve space for a string terminator
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (692 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 6.12 0693/1376] power: supply: sbs-battery: Use a per-device serial number buffer Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0695/1376] crypto: keembay - Initialize completion before requesting IRQ Greg Kroah-Hartman
` (304 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Li Qiang, Bart Van Assche,
Peter Wang, Martin K. Petersen, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Qiang <liqiang01@kylinos.cn>
[ Upstream commit abd26e6b53c4169122d61fdd4cabe09bdd916aac ]
ufs_saved_err_write() copies user input into a zero-initialized stack
buffer and passes it to kstrtoint(). A write that fills the entire buffer
overwrites its only terminator.
Reject an input whose length leaves no room for the trailing NUL.
Fixes: 7340faae9474 ("scsi: ufs: core: Add debugfs attributes for triggering the UFS EH")
Signed-off-by: Li Qiang <liqiang01@kylinos.cn>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Peter Wang <peter.wang@mediatek.com>
Link: https://patch.msgid.link/20260717153914.26321-7-liqiang01@kylinos.cn
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ufs/core/ufs-debugfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/ufs/core/ufs-debugfs.c b/drivers/ufs/core/ufs-debugfs.c
index e3baed6c70bd9..6dece24baad15 100644
--- a/drivers/ufs/core/ufs-debugfs.c
+++ b/drivers/ufs/core/ufs-debugfs.c
@@ -165,7 +165,7 @@ static ssize_t ufs_saved_err_write(struct file *file, const char __user *buf,
char val_str[16] = { };
int val, ret;
- if (count > sizeof(val_str))
+ if (count >= sizeof(val_str))
return -EINVAL;
if (copy_from_user(val_str, buf, count))
return -EFAULT;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0695/1376] crypto: keembay - Initialize completion before requesting IRQ
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (693 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0694/1376] scsi: ufs: debugfs: Reserve space for a string terminator Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0696/1376] crypto: keembay - publish OF module alias for OCS AES/SM4 Greg Kroah-Hartman
` (303 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Linmao Li, Herbert Xu, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linmao Li <lilinmao@kylinos.cn>
[ Upstream commit fce20289dd622cc7ab78d72c8a979a9f8b7cb10e ]
kmb_ocs_aes_probe() requests the device IRQ before initializing
irq_completion. Once the handler is registered it can run immediately,
and ocs_aes_irq_handler() unconditionally calls complete(). An
interrupt in this window would therefore use an uninitialized
completion.
Initialize the completion before requesting the IRQ, as the sibling
OCS HCU and ECC drivers already do.
Fixes: 885743324513 ("crypto: keembay - Add support for Keem Bay OCS AES/SM4")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/intel/keembay/keembay-ocs-aes-core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/crypto/intel/keembay/keembay-ocs-aes-core.c b/drivers/crypto/intel/keembay/keembay-ocs-aes-core.c
index a02a75bd29860..9dc69a2706663 100644
--- a/drivers/crypto/intel/keembay/keembay-ocs-aes-core.c
+++ b/drivers/crypto/intel/keembay/keembay-ocs-aes-core.c
@@ -1602,6 +1602,8 @@ static int kmb_ocs_aes_probe(struct platform_device *pdev)
if (IS_ERR(aes_dev->base_reg))
return PTR_ERR(aes_dev->base_reg);
+ init_completion(&aes_dev->irq_completion);
+
/* Get and request IRQ */
aes_dev->irq = platform_get_irq(pdev, 0);
if (aes_dev->irq < 0)
@@ -1619,8 +1621,6 @@ static int kmb_ocs_aes_probe(struct platform_device *pdev)
list_add_tail(&aes_dev->list, &ocs_aes.dev_list);
spin_unlock(&ocs_aes.lock);
- init_completion(&aes_dev->irq_completion);
-
/* Initialize crypto engine */
aes_dev->engine = crypto_engine_alloc_init(dev, true);
if (!aes_dev->engine) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0696/1376] crypto: keembay - publish OF module alias for OCS AES/SM4
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (694 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0695/1376] crypto: keembay - Initialize completion before requesting IRQ Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0697/1376] RDMA/mlx5: Fix integer overflow of user QP buffer size Greg Kroah-Hartman
` (302 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Can Peng, Herbert Xu, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Can Peng <pengcan@kylinos.cn>
[ Upstream commit 0a94091e29f914e4f233a208599ca4055882c01b ]
The Keem Bay OCS AES/SM4 driver has an OF match table wired to
.of_match_table, but does not export the table with MODULE_DEVICE_TABLE().
Although the match table lives in keembay-ocs-aes-core.o, that object is
part of the composite keembay-ocs-aes module. Add the missing
MODULE_DEVICE_TABLE(of, ...) entry so modpost can generate OF module alias
information for OF based module autoloading.
This is a source-level fix. It does not claim dynamic hardware
reproduction; the evidence is the driver-owned match table, its use by the
platform driver, and the missing module alias publication.
Fixes: 885743324513 ("crypto: keembay - Add support for Keem Bay OCS AES/SM4")
Signed-off-by: Can Peng <pengcan@kylinos.cn>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/intel/keembay/keembay-ocs-aes-core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/crypto/intel/keembay/keembay-ocs-aes-core.c b/drivers/crypto/intel/keembay/keembay-ocs-aes-core.c
index 9dc69a2706663..9ef6a6d58c68e 100644
--- a/drivers/crypto/intel/keembay/keembay-ocs-aes-core.c
+++ b/drivers/crypto/intel/keembay/keembay-ocs-aes-core.c
@@ -1561,6 +1561,7 @@ static const struct of_device_id kmb_ocs_aes_of_match[] = {
},
{}
};
+MODULE_DEVICE_TABLE(of, kmb_ocs_aes_of_match);
static void kmb_ocs_aes_remove(struct platform_device *pdev)
{
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0697/1376] RDMA/mlx5: Fix integer overflow of user QP buffer size
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (695 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0696/1376] crypto: keembay - publish OF module alias for OCS AES/SM4 Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0698/1376] powercap: intel_rapl_tpmi: Handle PMU registration failure during probe Greg Kroah-Hartman
` (301 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maher Sanalla, Edward Srouji,
Leon Romanovsky, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maher Sanalla <msanalla@nvidia.com>
[ Upstream commit dec47e4b0fe34afdf38caa72b4408ba95502e5de ]
set_user_buf_size() computes the QP buffer size by left-shifting the
user-supplied rq.wqe_cnt and rq.wqe_shift values as signed integers.
A sufficiently large rq.wqe_cnt causes signed integer overflow, which
is undefined behavior, and yields a small or negative buf_size, causing
ib_umem_get() to map a buffer smaller than the hardware will actually
write into.
Replace the shifts and addition with check_shl_overflow() and
check_add_overflow(), rejecting invalid user inputs.
Moreover, guard the identical shift computing qp->sq.offset in
_create_user_qp() before set_user_buf_size() is reached.
Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
Signed-off-by: Maher Sanalla <msanalla@nvidia.com>
Signed-off-by: Edward Srouji <edwards@nvidia.com>
Link: https://patch.msgid.link/20260723-fix-qp-buf-size-overflow-v1-1-ccb05ee43a7b@nvidia.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/mlx5/qp.c | 25 ++++++++++++++++++++-----
1 file changed, 20 insertions(+), 5 deletions(-)
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index badec2e339729..2b0047e6fd49a 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -637,6 +637,7 @@ static int set_user_buf_size(struct mlx5_ib_dev *dev,
struct ib_qp_init_attr *attr)
{
int desc_sz = 1 << qp->sq.wqe_shift;
+ int rq_buf_size, sq_buf_size;
if (desc_sz > MLX5_CAP_GEN(dev->mdev, max_wqe_sz_sq)) {
mlx5_ib_warn(dev, "desc_sz %d, max_sq_desc_sz %d\n",
@@ -661,11 +662,21 @@ static int set_user_buf_size(struct mlx5_ib_dev *dev,
if (attr->qp_type == IB_QPT_RAW_PACKET ||
qp->flags & IB_QP_CREATE_SOURCE_QPN) {
- base->ubuffer.buf_size = qp->rq.wqe_cnt << qp->rq.wqe_shift;
- qp->raw_packet_qp.sq.ubuffer.buf_size = qp->sq.wqe_cnt << 6;
+ if (check_shl_overflow(qp->rq.wqe_cnt, qp->rq.wqe_shift,
+ &base->ubuffer.buf_size))
+ return -EINVAL;
+ if (check_shl_overflow(qp->sq.wqe_cnt, 6,
+ &qp->raw_packet_qp.sq.ubuffer.buf_size))
+ return -EINVAL;
} else {
- base->ubuffer.buf_size = (qp->rq.wqe_cnt << qp->rq.wqe_shift) +
- (qp->sq.wqe_cnt << 6);
+ if (check_shl_overflow(qp->rq.wqe_cnt, qp->rq.wqe_shift,
+ &rq_buf_size))
+ return -EINVAL;
+ if (check_shl_overflow(qp->sq.wqe_cnt, 6, &sq_buf_size))
+ return -EINVAL;
+ if (check_add_overflow(rq_buf_size, sq_buf_size,
+ &base->ubuffer.buf_size))
+ return -EINVAL;
}
return 0;
@@ -989,7 +1000,11 @@ static int _create_user_qp(struct mlx5_ib_dev *dev, struct ib_pd *pd,
qp->rq.offset = 0;
qp->sq.wqe_shift = ilog2(MLX5_SEND_WQE_BB);
- qp->sq.offset = qp->rq.wqe_cnt << qp->rq.wqe_shift;
+ if (check_shl_overflow(qp->rq.wqe_cnt, qp->rq.wqe_shift,
+ &qp->sq.offset)) {
+ err = -EINVAL;
+ goto err_bfreg;
+ }
err = set_user_buf_size(dev, qp, ucmd, base, attr);
if (err)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0698/1376] powercap: intel_rapl_tpmi: Handle PMU registration failure during probe
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (696 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0697/1376] RDMA/mlx5: Fix integer overflow of user QP buffer size Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0699/1376] isofs: release zisofs block pointer buffer head Greg Kroah-Hartman
` (300 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sumeet Pawnikar, Rafael J. Wysocki,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sumeet Pawnikar <sumeet4linux@gmail.com>
[ Upstream commit 9229916d59918ec9d3639e7263e1e97be638e361 ]
intel_rapl_tpmi_probe() invokes rapl_package_add_pmu() but ignores its
return value, so a PMU registration failure would leave the driver
reporting probe success despite the PMU being absent, with no log
trace.
Since PMU registration is an optional auxiliary feature for perf energy
counters, its failure should not break the primary powercap functionality.
Check the return value and log a warning to ensure graceful degradation.
Fixes: 963a9ad3c589 ("powercap: intel_rapl_tpmi: Enable PMU support")
Signed-off-by: Sumeet Pawnikar <sumeet4linux@gmail.com>
[ rjw: Changed the log level of the new message to "info" ]
Link: https://patch.msgid.link/20260723172321.5960-1-sumeet4linux@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/powercap/intel_rapl_tpmi.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/powercap/intel_rapl_tpmi.c b/drivers/powercap/intel_rapl_tpmi.c
index 1618138c5cac1..1fae66a609298 100644
--- a/drivers/powercap/intel_rapl_tpmi.c
+++ b/drivers/powercap/intel_rapl_tpmi.c
@@ -313,7 +313,10 @@ static int intel_rapl_tpmi_probe(struct auxiliary_device *auxdev,
goto err;
}
- rapl_package_add_pmu(trp->rp);
+ ret = rapl_package_add_pmu(trp->rp);
+ if (ret)
+ dev_info(&auxdev->dev, "Failed to add RAPL PMU for Package%d, %d\n",
+ info->package_id, ret);
auxiliary_set_drvdata(auxdev, trp);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0699/1376] isofs: release zisofs block pointer buffer head
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (697 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0698/1376] powercap: intel_rapl_tpmi: Handle PMU registration failure during probe Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0700/1376] spi: oc-tiny: switch to managed controller allocation Greg Kroah-Hartman
` (299 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yichong Chen, Jan Kara, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yichong Chen <chenyichong@uniontech.com>
[ Upstream commit 2f7dd9b86fe4076059e6a4a2a2c5d565afd76b9e ]
zisofs_fill_pages() reads the compressed block pointer table. The error
paths release the current buffer_head, the loop also releases the old
buffer_head when it advances. However, the success path leaves the last
buffer_head referenced. Release it before returning success.
Fixes: 59bc055211b8 ("zisofs: Implement reading of compressed files when PAGE_CACHE_SIZE > compress block size")
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Link: https://patch.msgid.link/20260721091152.1450622-1-chenyichong@uniontech.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/isofs/compress.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/isofs/compress.c b/fs/isofs/compress.c
index 05b9fa80ba9c2..7d701eb7af52a 100644
--- a/fs/isofs/compress.c
+++ b/fs/isofs/compress.c
@@ -293,6 +293,7 @@ static int zisofs_fill_pages(struct inode *inode, int full_page, int pcount,
memzero_page(*pages, poffset, PAGE_SIZE - poffset);
SetPageUptodate(*pages);
}
+ brelse(bh);
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0700/1376] spi: oc-tiny: switch to managed controller allocation
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (698 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0699/1376] isofs: release zisofs block pointer buffer head Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0701/1376] w1: ds2482: Fix signedness bug in ds2482_w1_triplet() Greg Kroah-Hartman
` (298 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fan Wu, Mark Brown, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
[ Upstream commit d710f43ce30975d197f73c543bfe47b958d8ba17 ]
The controller is allocated with the non-managed spi_alloc_host() while
the interrupt is registered with devm_request_irq(). During removal,
spi_bitbang_stop() only unregisters the controller; the subsequent
spi_controller_put() then frees the controller together with its
embedded driver-private devdata, which is the IRQ handler's dev_id. The
devm_request_irq() release action (free_irq()), which drains the
handler, does not run until after .remove() returns. A late or latched
interrupt can therefore reach tiny_spi_irq() and dereference
already-freed memory (e.g. hw->base).
Switch to devm_spi_alloc_host() so that the devres LIFO order releases
the controller only after free_irq() has drained the handler, and drop
the now-redundant spi_controller_put() from .remove(). The probe error
path is simplified to direct returns.
This issue was found by an in-house static analysis tool.
Fixes: ce792580ea2c ("spi: add OpenCores tiny SPI driver")
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Link: https://patch.msgid.link/20260719010014.3163356-1-fanwu01@zju.edu.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-oc-tiny.c | 24 ++++++++----------------
1 file changed, 8 insertions(+), 16 deletions(-)
diff --git a/drivers/spi/spi-oc-tiny.c b/drivers/spi/spi-oc-tiny.c
index 7d8c5cd680d1d..2e5df685c2779 100644
--- a/drivers/spi/spi-oc-tiny.c
+++ b/drivers/spi/spi-oc-tiny.c
@@ -211,11 +211,11 @@ static int tiny_spi_probe(struct platform_device *pdev)
struct tiny_spi_platform_data *platp = dev_get_platdata(&pdev->dev);
struct tiny_spi *hw;
struct spi_controller *host;
- int err = -ENODEV;
+ int err;
- host = spi_alloc_host(&pdev->dev, sizeof(struct tiny_spi));
+ host = devm_spi_alloc_host(&pdev->dev, sizeof(struct tiny_spi));
if (!host)
- return err;
+ return -ENOMEM;
/* setup the host state. */
host->bus_num = pdev->id;
@@ -233,10 +233,8 @@ static int tiny_spi_probe(struct platform_device *pdev)
/* find and map our resources */
hw->base = devm_platform_ioremap_resource(pdev, 0);
- if (IS_ERR(hw->base)) {
- err = PTR_ERR(hw->base);
- goto exit;
- }
+ if (IS_ERR(hw->base))
+ return PTR_ERR(hw->base);
/* irq is optional */
hw->irq = platform_get_irq(pdev, 0);
if (hw->irq >= 0) {
@@ -244,7 +242,7 @@ static int tiny_spi_probe(struct platform_device *pdev)
err = devm_request_irq(&pdev->dev, hw->irq, tiny_spi_irq, 0,
pdev->name, hw);
if (err)
- goto exit;
+ return err;
}
/* find platform data */
if (platp) {
@@ -253,29 +251,23 @@ static int tiny_spi_probe(struct platform_device *pdev)
} else {
err = tiny_spi_of_probe(pdev);
if (err)
- goto exit;
+ return err;
}
/* register our spi controller */
err = spi_bitbang_start(&hw->bitbang);
if (err)
- goto exit;
+ return err;
dev_info(&pdev->dev, "base %p, irq %d\n", hw->base, hw->irq);
return 0;
-
-exit:
- spi_controller_put(host);
- return err;
}
static void tiny_spi_remove(struct platform_device *pdev)
{
struct tiny_spi *hw = platform_get_drvdata(pdev);
- struct spi_controller *host = hw->bitbang.ctlr;
spi_bitbang_stop(&hw->bitbang);
- spi_controller_put(host);
}
#ifdef CONFIG_OF
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0701/1376] w1: ds2482: Fix signedness bug in ds2482_w1_triplet()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (699 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0700/1376] spi: oc-tiny: switch to managed controller allocation Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0702/1376] remoteproc: core: Drop redundant initialization of ret in rproc_shutdown() Greg Kroah-Hartman
` (297 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Babanpreet Singh,
Krzysztof Kozlowski, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Babanpreet Singh <bbnpreetsingh@gmail.com>
[ Upstream commit 4d3721b204f961e905714954ff95633337b768e3 ]
ds2482_wait_1wire_idle() returns the status register value (0..255) on
success, or a negative value on I2C failure: -1 when selecting the
status register fails, or a negative errno from i2c_smbus_read_byte().
ds2482_w1_triplet() feeds that result into "return (status >> 5);"
without checking for errors, and the function returns u8. For a
negative status the arithmetic shift keeps the sign and the u8
truncation fabricates a triplet result whose meaning depends on the
errno value: -1 and -EIO happen to become 0xff, whose set low bits make
w1_search() abort, but -ETIMEDOUT (-110 >> 5 = -4) becomes 0xfc -
"devices responded on both branches, wrote 1" - and -EOPNOTSUPP
(-95 >> 5 = -3) becomes 0xfd - "only the zero branch responded".
w1_search() then continues the ROM search with a fabricated direction
bit instead of aborting, and the corrupted id is either rejected by the
ROM CRC (existing device missed) or registers a phantom slave.
The function already defines an in-band error value: status is
initialized to (3 << 5), which decodes to 3 (both branch bits set, "no
device responded") and makes w1_search() terminate the search when
sending the triplet command fails. Decode a negative status to the same
value.
Found by smatch:
drivers/w1/masters/ds2482.c:314 ds2482_w1_triplet() warn: signedness bug returning '(-67108864)'
Fixes: baf12ae29ab4 ("[PATCH] W1: Add the DS2482 I2C-to-w1 bridge driver.")
Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Babanpreet Singh <bbnpreetsingh@gmail.com>
Link: https://patch.msgid.link/20260714041011.7-1-bbnpreetsingh@gmail.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/w1/masters/ds2482.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/w1/masters/ds2482.c b/drivers/w1/masters/ds2482.c
index a2ecbb863c57f..a7fc6ec31938e 100644
--- a/drivers/w1/masters/ds2482.c
+++ b/drivers/w1/masters/ds2482.c
@@ -309,6 +309,10 @@ static u8 ds2482_w1_triplet(void *data, u8 dbit)
mutex_unlock(&pdev->access_lock);
+ /* On bus error, decode to 3 (no device responded) to abort the search */
+ if (status < 0)
+ status = 3 << 5;
+
/* Decode the status */
return (status >> 5);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0702/1376] remoteproc: core: Drop redundant initialization of ret in rproc_shutdown()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (700 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0701/1376] w1: ds2482: Fix signedness bug in ds2482_w1_triplet() Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0703/1376] remoteproc: Allow shutdown of crashed processors Greg Kroah-Hartman
` (296 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peng Fan, Andrew Davis,
Mathieu Poirier, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <peng.fan@nxp.com>
[ Upstream commit 4531b6bad5af669511c348ad5225d9f697af221b ]
The variable ret is immediately assigned the return value of
mutex_lock_interruptible(), making its prior initialization to zero
unnecessary. Remove the redundant assignment
No functional changes.
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Acked-by: Andrew Davis <afd@ti.com>
Link: https://lore.kernel.org/r/20251016-rproc-cleanup-v3-v3-1-774083716e8a@nxp.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Stable-dep-of: 2482ca875ef5 ("remoteproc: Allow shutdown of crashed processors")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/remoteproc/remoteproc_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
index b7011eb384a5d..04595ac995632 100644
--- a/drivers/remoteproc/remoteproc_core.c
+++ b/drivers/remoteproc/remoteproc_core.c
@@ -1989,7 +1989,7 @@ EXPORT_SYMBOL(rproc_boot);
int rproc_shutdown(struct rproc *rproc)
{
struct device *dev = &rproc->dev;
- int ret = 0;
+ int ret;
ret = mutex_lock_interruptible(&rproc->lock);
if (ret) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0703/1376] remoteproc: Allow shutdown of crashed processors
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (701 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0702/1376] remoteproc: core: Drop redundant initialization of ret in rproc_shutdown() Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0704/1376] remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work() Greg Kroah-Hartman
` (295 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bjorn Andersson, Mukesh Ojha,
Konrad Dybcio, Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
[ Upstream commit 2482ca875ef5993df8daee563033d70e2523a25f ]
rproc_shutdown() rejects a remoteproc in RPROC_CRASHED state, and
rproc_del() ignores that error. The result of these two decisions is
that a user cannot stop a remoteproc that with recovery disabled that
has entered a crash state, and removal of an associated remoteproc
driver will release resources without first stopping the remoteproc.
Allow rproc_shutdown() to stop crashed processors. Propagate the crash
state to subdevice teardown, to allow subdevices to dismantle things
appropriately.
Assisted-by: OpenCode:GPT-5.5
Fixes: 5e6a0e05270e ("remoteproc: core: Move state checking to remoteproc_core")
Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260723-rproc-rmmod-not-crashing-v1-1-546dfd5de0e6@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/remoteproc/remoteproc_core.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
index 04595ac995632..bb905076f31b9 100644
--- a/drivers/remoteproc/remoteproc_core.c
+++ b/drivers/remoteproc/remoteproc_core.c
@@ -1989,6 +1989,7 @@ EXPORT_SYMBOL(rproc_boot);
int rproc_shutdown(struct rproc *rproc)
{
struct device *dev = &rproc->dev;
+ bool crashed;
int ret;
ret = mutex_lock_interruptible(&rproc->lock);
@@ -1998,16 +1999,18 @@ int rproc_shutdown(struct rproc *rproc)
}
if (rproc->state != RPROC_RUNNING &&
- rproc->state != RPROC_ATTACHED) {
+ rproc->state != RPROC_ATTACHED &&
+ rproc->state != RPROC_CRASHED) {
ret = -EINVAL;
goto out;
}
+ crashed = rproc->state == RPROC_CRASHED;
/* if the remote proc is still needed, bail out */
if (!atomic_dec_and_test(&rproc->power))
goto out;
- ret = rproc_stop(rproc, false);
+ ret = rproc_stop(rproc, crashed);
if (ret) {
atomic_inc(&rproc->power);
goto out;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0704/1376] remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (702 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0703/1376] remoteproc: Allow shutdown of crashed processors Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0705/1376] remoteproc: Prevent crash handling to race with rproc_del() Greg Kroah-Hartman
` (294 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jingyi Wang, Bjorn Andersson,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jingyi Wang <jingyi.wang@oss.qualcomm.com>
[ Upstream commit 026a3fada43261e403c6c4d9bda9501547e3f108 ]
Unlike the remoteproc firmware load path where rproc_add() call
rproc_auto_boot_callback() asynchronously and ignores the return value of
rproc_boot(), the attach path calls rproc_boot() synchronously and
propagates its return value back to rproc_add(). This means a failure
during rproc_attach() causes rproc_add() to fail and triggers resource
release, removing the remoteproc from sysfs and making it unavailable for
recovery or further boot attempts.
Align the remoteproc attach path with the firmware load path by
introducing attach_work and scheduling rproc_boot() asynchronously via
schedule_work(). This keeps the remoteproc registered and available in
sysfs even if the initial attach attempt fails, and avoids blocking
rproc_add() on the attach result.
Signed-off-by: Jingyi Wang <jingyi.wang@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260623-rproc-attach-issue-v3-1-8e24310707ce@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Stable-dep-of: 74ee3b2f5767 ("remoteproc: Prevent crash handling to race with rproc_del()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/remoteproc/remoteproc_core.c | 20 ++++++++++++--------
include/linux/remoteproc.h | 2 ++
2 files changed, 14 insertions(+), 8 deletions(-)
diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
index bb905076f31b9..4279def9e1779 100644
--- a/drivers/remoteproc/remoteproc_core.c
+++ b/drivers/remoteproc/remoteproc_core.c
@@ -1678,18 +1678,21 @@ static void rproc_auto_boot_callback(const struct firmware *fw, void *context)
release_firmware(fw);
}
+static void rproc_attach_work(struct work_struct *work)
+{
+ struct rproc *rproc = container_of(work, struct rproc, attach_work);
+
+ rproc_boot(rproc);
+}
+
static int rproc_trigger_auto_boot(struct rproc *rproc)
{
int ret;
- /*
- * Since the remote processor is in a detached state, it has already
- * been booted by another entity. As such there is no point in waiting
- * for a firmware image to be loaded, we can simply initiate the process
- * of attaching to it immediately.
- */
- if (rproc->state == RPROC_DETACHED)
- return rproc_boot(rproc);
+ if (rproc->state == RPROC_DETACHED) {
+ schedule_work(&rproc->attach_work);
+ return 0;
+ }
/*
* We're initiating an asynchronous firmware loading, so we can
@@ -2521,6 +2524,7 @@ struct rproc *rproc_alloc(struct device *dev, const char *name,
INIT_LIST_HEAD(&rproc->dump_segments);
INIT_WORK(&rproc->crash_handler, rproc_crash_handler_work);
+ INIT_WORK(&rproc->attach_work, rproc_attach_work);
rproc->state = RPROC_OFFLINE;
diff --git a/include/linux/remoteproc.h b/include/linux/remoteproc.h
index b4795698d8c2a..580d324a1e8ff 100644
--- a/include/linux/remoteproc.h
+++ b/include/linux/remoteproc.h
@@ -526,6 +526,7 @@ enum rproc_features {
* @subdevs: list of subdevices, to following the running state
* @notifyids: idr for dynamically assigning rproc-wide unique notify ids
* @index: index of this rproc device
+ * @attach_work: workqueue for attaching rproc
* @crash_handler: workqueue for handling a crash
* @crash_cnt: crash counter
* @recovery_disabled: flag that state if recovery was disabled
@@ -568,6 +569,7 @@ struct rproc {
struct list_head subdevs;
struct idr notifyids;
int index;
+ struct work_struct attach_work;
struct work_struct crash_handler;
unsigned int crash_cnt;
bool recovery_disabled;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0705/1376] remoteproc: Prevent crash handling to race with rproc_del()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (703 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0704/1376] remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work() Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0706/1376] staging: rtl8723bs: use kfree_sensitive() for key material Greg Kroah-Hartman
` (293 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bjorn Andersson, Pradnya Dahiwale,
Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
[ Upstream commit 74ee3b2f5767447c57959994341e5b95f1079977 ]
There's no synchronization between rproc_crash_handler_work() and
rproc_del(), as such it's possible for a driver to be removed while
crash-handler work is scheduled, or even executing - resulting in
use-after-free issues.
To avoid this the scheduled work need to be cancelled and synchronized
against before the removal proceeds.
In order to ensure that this doesn't race with the reporting, and
thereby scheduling new work, a "deleting" flag is introduced. This is
similar to the RPROC_DELETE state that was introduced to ensure that
"start" didn't race with rproc_del(), but the existing mechanism can not
be used as it's valid to call rproc_report_crash() in atomic context -
and the "state" is protected by a mutex.
In the event that work is cancelled the pm_stay_awake() is left
unbalanced and need to be unrolled.
The blocking and cancelling of crash-handler work prior to the actual
rproc_shutdown() call does have the explicit side-effect that crashes
resulting from the shutdown process will not enter the crash-handling
path, and as such will not generate devcoredumps etc. Due to the
existing mutual exclusion between these code paths there's no concrete
reduction in functionality, but further work would be needed to handle
this case.
Assisted-by: OpenCode:GPT-5.5
Fixes: 8afd519c3470 ("remoteproc: add rproc_report_crash function to notify rproc crashes")
Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
Reviewed-by: Pradnya Dahiwale <pradnya.dahiwale@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260723-rproc-rmmod-not-crashing-v1-2-546dfd5de0e6@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/remoteproc/remoteproc_core.c | 42 +++++++++++++++++++++------
drivers/remoteproc/remoteproc_sysfs.c | 1 -
include/linux/remoteproc.h | 13 +++++----
3 files changed, 41 insertions(+), 15 deletions(-)
diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
index 4279def9e1779..86dd92067da82 100644
--- a/drivers/remoteproc/remoteproc_core.c
+++ b/drivers/remoteproc/remoteproc_core.c
@@ -1841,6 +1841,11 @@ int rproc_trigger_recovery(struct rproc *rproc)
if (ret)
return ret;
+ if (READ_ONCE(rproc->deleting)) {
+ ret = -ENODEV;
+ goto unlock_mutex;
+ }
+
/* State could have changed before we got the mutex */
if (rproc->state != RPROC_CRASHED)
goto unlock_mutex;
@@ -1873,6 +1878,11 @@ static void rproc_crash_handler_work(struct work_struct *work)
mutex_lock(&rproc->lock);
+ if (READ_ONCE(rproc->deleting)) {
+ mutex_unlock(&rproc->lock);
+ goto out;
+ }
+
if (rproc->state == RPROC_CRASHED) {
/* handle only the first crash detected */
mutex_unlock(&rproc->lock);
@@ -1928,9 +1938,9 @@ int rproc_boot(struct rproc *rproc)
return ret;
}
- if (rproc->state == RPROC_DELETED) {
+ if (READ_ONCE(rproc->deleting)) {
ret = -ENODEV;
- dev_err(dev, "can't boot deleted rproc %s\n", rproc->name);
+ dev_err(dev, "can't boot deleting rproc %s\n", rproc->name);
goto unlock_mutex;
}
@@ -2523,8 +2533,9 @@ struct rproc *rproc_alloc(struct device *dev, const char *name,
INIT_LIST_HEAD(&rproc->subdevs);
INIT_LIST_HEAD(&rproc->dump_segments);
- INIT_WORK(&rproc->crash_handler, rproc_crash_handler_work);
INIT_WORK(&rproc->attach_work, rproc_attach_work);
+ INIT_WORK(&rproc->crash_handler, rproc_crash_handler_work);
+ spin_lock_init(&rproc->crash_handler_lock);
rproc->state = RPROC_OFFLINE;
@@ -2588,16 +2599,21 @@ EXPORT_SYMBOL(rproc_put);
*/
int rproc_del(struct rproc *rproc)
{
+ unsigned long flags;
+
if (!rproc)
return -EINVAL;
+ spin_lock_irqsave(&rproc->crash_handler_lock, flags);
+ WRITE_ONCE(rproc->deleting, true);
+ spin_unlock_irqrestore(&rproc->crash_handler_lock, flags);
+
+ if (cancel_work_sync(&rproc->crash_handler))
+ pm_relax(rproc->dev.parent);
+
/* TODO: make sure this works with rproc->power > 1 */
rproc_shutdown(rproc);
- mutex_lock(&rproc->lock);
- rproc->state = RPROC_DELETED;
- mutex_unlock(&rproc->lock);
-
rproc_delete_debug_dir(rproc);
/* the rproc is downref'ed as soon as it's removed from the klist */
@@ -2709,18 +2725,26 @@ EXPORT_SYMBOL(rproc_get_by_child);
*/
void rproc_report_crash(struct rproc *rproc, enum rproc_crash_type type)
{
+ unsigned long flags;
+
if (!rproc) {
pr_err("NULL rproc pointer\n");
return;
}
+ spin_lock_irqsave(&rproc->crash_handler_lock, flags);
+ if (READ_ONCE(rproc->deleting)) {
+ spin_unlock_irqrestore(&rproc->crash_handler_lock, flags);
+ return;
+ }
+
/* Prevent suspend while the remoteproc is being recovered */
pm_stay_awake(rproc->dev.parent);
+ queue_work(rproc_recovery_wq, &rproc->crash_handler);
+ spin_unlock_irqrestore(&rproc->crash_handler_lock, flags);
dev_err(&rproc->dev, "crash detected in %s: type %s\n",
rproc->name, rproc_crash_to_string(type));
-
- queue_work(rproc_recovery_wq, &rproc->crash_handler);
}
EXPORT_SYMBOL(rproc_report_crash);
diff --git a/drivers/remoteproc/remoteproc_sysfs.c b/drivers/remoteproc/remoteproc_sysfs.c
index 138e752c5e4e0..925b0cdbe5778 100644
--- a/drivers/remoteproc/remoteproc_sysfs.c
+++ b/drivers/remoteproc/remoteproc_sysfs.c
@@ -168,7 +168,6 @@ static const char * const rproc_state_string[] = {
[RPROC_SUSPENDED] = "suspended",
[RPROC_RUNNING] = "running",
[RPROC_CRASHED] = "crashed",
- [RPROC_DELETED] = "deleted",
[RPROC_ATTACHED] = "attached",
[RPROC_DETACHED] = "detached",
[RPROC_LAST] = "invalid",
diff --git a/include/linux/remoteproc.h b/include/linux/remoteproc.h
index 580d324a1e8ff..023fa91bd2a48 100644
--- a/include/linux/remoteproc.h
+++ b/include/linux/remoteproc.h
@@ -37,6 +37,7 @@
#include <linux/types.h>
#include <linux/mutex.h>
+#include <linux/spinlock.h>
#include <linux/virtio.h>
#include <linux/cdev.h>
#include <linux/completion.h>
@@ -412,7 +413,6 @@ struct rproc_ops {
* a message.
* @RPROC_RUNNING: device is up and running
* @RPROC_CRASHED: device has crashed; need to start recovery
- * @RPROC_DELETED: device is deleted
* @RPROC_ATTACHED: device has been booted by another entity and the core
* has attached to it
* @RPROC_DETACHED: device has been booted by another entity and waiting
@@ -430,10 +430,9 @@ enum rproc_state {
RPROC_SUSPENDED = 1,
RPROC_RUNNING = 2,
RPROC_CRASHED = 3,
- RPROC_DELETED = 4,
- RPROC_ATTACHED = 5,
- RPROC_DETACHED = 6,
- RPROC_LAST = 7,
+ RPROC_ATTACHED = 4,
+ RPROC_DETACHED = 5,
+ RPROC_LAST = 6,
};
/**
@@ -528,6 +527,8 @@ enum rproc_features {
* @index: index of this rproc device
* @attach_work: workqueue for attaching rproc
* @crash_handler: workqueue for handling a crash
+ * @crash_handler_lock: serializes crash handler queueing and deletion
+ * @deleting: remoteproc deletion has begun
* @crash_cnt: crash counter
* @recovery_disabled: flag that state if recovery was disabled
* @max_notifyid: largest allocated notify id.
@@ -571,6 +572,8 @@ struct rproc {
int index;
struct work_struct attach_work;
struct work_struct crash_handler;
+ spinlock_t crash_handler_lock;
+ bool deleting;
unsigned int crash_cnt;
bool recovery_disabled;
int max_notifyid;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0706/1376] staging: rtl8723bs: use kfree_sensitive() for key material
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (704 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0705/1376] remoteproc: Prevent crash handling to race with rproc_del() Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0707/1376] fs/ntfs3: reject restart table growth beyond U16_MAX entries Greg Kroah-Hartman
` (292 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ivy Lopez, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivy Lopez <skunkolee@gmail.com>
[ Upstream commit d205dfa8cb825f1954ca1cfa474fc50bf06ee4aa ]
The set_stakey_parm struct contains a 16-byte encryption key.
Use kfree_sensitive() instead of kfree() to ensure the key
material is zeroed before the memory is freed, preventing
potential information leaks.
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Signed-off-by: Ivy Lopez <skunkolee@gmail.com>
Link: https://patch.msgid.link/20260717220135.17836-1-skunkolee@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/rtl8723bs/core/rtw_cmd.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/staging/rtl8723bs/core/rtw_cmd.c b/drivers/staging/rtl8723bs/core/rtw_cmd.c
index 84ce7307d8f3d..e9a95a2733ad9 100644
--- a/drivers/staging/rtl8723bs/core/rtw_cmd.c
+++ b/drivers/staging/rtl8723bs/core/rtw_cmd.c
@@ -894,7 +894,7 @@ u8 rtw_setstakey_cmd(struct adapter *padapter, struct sta_info *sta, u8 unicast_
if (enqueue) {
ph2c = rtw_zmalloc(sizeof(struct cmd_obj));
if (!ph2c) {
- kfree(psetstakey_para);
+ kfree_sensitive(psetstakey_para);
res = _FAIL;
goto exit;
}
@@ -902,7 +902,7 @@ u8 rtw_setstakey_cmd(struct adapter *padapter, struct sta_info *sta, u8 unicast_
psetstakey_rsp = rtw_zmalloc(sizeof(struct set_stakey_rsp));
if (!psetstakey_rsp) {
kfree(ph2c);
- kfree(psetstakey_para);
+ kfree_sensitive(psetstakey_para);
res = _FAIL;
goto exit;
}
@@ -913,7 +913,7 @@ u8 rtw_setstakey_cmd(struct adapter *padapter, struct sta_info *sta, u8 unicast_
res = rtw_enqueue_cmd(pcmdpriv, ph2c);
} else {
set_stakey_hdl(padapter, (u8 *)psetstakey_para);
- kfree(psetstakey_para);
+ kfree_sensitive(psetstakey_para);
}
exit:
return res;
@@ -953,7 +953,7 @@ u8 rtw_clearstakey_cmd(struct adapter *padapter, struct sta_info *sta, u8 enqueu
psetstakey_rsp = rtw_zmalloc(sizeof(struct set_stakey_rsp));
if (!psetstakey_rsp) {
kfree(ph2c);
- kfree(psetstakey_para);
+ kfree_sensitive(psetstakey_para);
res = _FAIL;
goto exit;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0707/1376] fs/ntfs3: reject restart table growth beyond U16_MAX entries
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (705 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0706/1376] staging: rtl8723bs: use kfree_sensitive() for key material Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0708/1376] iommu/tegra241-cmdqv: Use request_threaded_irq Greg Kroah-Hartman
` (291 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiang Mei, Weiming Shi,
Konstantin Komarov, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <bestswngs@gmail.com>
[ Upstream commit 111f8d74a19d85942ecbb3aba78f6f3c88e59391 ]
During $LogFile replay, log_replay() indexes the transaction table by the
transact_id taken from the log record header. check_log_rec() only
verifies that transact_id is non-zero and properly aligned, not its
magnitude, so a crafted image can request an arbitrarily large index.
alloc_rsttbl_from_idx() grows the table to cover that index via
extend_rsttbl(), which passes the new entry count to init_rsttbl():
rt = init_rsttbl(esize, used + add);
used + add is computed as u32 but init_rsttbl() takes a u16, and the
count is stored in struct RESTART_TABLE as a __le16. When used + add
exceeds U16_MAX it is truncated, init_rsttbl() allocates a table far
smaller than the index requires, and alloc_rsttbl_from_idx() then
dereferences and writes at the original, untruncated offset -- an
out-of-bounds access past the allocation, reachable by mounting a
crafted NTFS image.
BUG: KASAN: use-after-free in alloc_rsttbl_from_idx (fs/ntfs3/fslog.c:950)
Read of size 4 at addr ffff8880327ffff8 by task exploit
alloc_rsttbl_from_idx (fs/ntfs3/fslog.c:950)
log_replay (fs/ntfs3/fslog.c:4562)
ntfs_loadlog_and_replay (fs/ntfs3/fsntfs.c:324)
ntfs_fill_super (fs/ntfs3/super.c:1393)
get_tree_bdev_flags
vfs_get_tree
path_mount
__x64_sys_mount
A restart table is limited to U16_MAX entries by its __le16 count, so a
larger growth request is invalid input. Reject it in extend_rsttbl();
all callers already handle a NULL return.
Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Reported-by: Xiang Mei <xmei5@asu.edu>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/fslog.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
index 49f4ce2e676f9..09dc29e434e3b 100644
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -875,6 +875,9 @@ static inline struct RESTART_TABLE *extend_rsttbl(struct RESTART_TABLE *tbl,
u32 used = le16_to_cpu(tbl->used);
struct RESTART_TABLE *rt;
+ if (used + add > U16_MAX)
+ return NULL;
+
rt = init_rsttbl(esize, used + add);
if (!rt)
return NULL;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0708/1376] iommu/tegra241-cmdqv: Use request_threaded_irq
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (706 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0707/1376] fs/ntfs3: reject restart table growth beyond U16_MAX entries Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0709/1376] iommu/tegra241-cmdqv: Dont run the error ISR before probe sets up vintfs Greg Kroah-Hartman
` (290 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pranjal Shrivastava, Jason Gunthorpe,
Kevin Tian, Nicolin Chen, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolin Chen <nicolinc@nvidia.com>
[ Upstream commit 1eb468744ccaafeaee145505d0aa5fd6227bd72f ]
A vEVENT can be reported only from a threaded IRQ context. Change to using
request_threaded_irq to support that.
Link: https://patch.msgid.link/r/f160193980e3b273afbd1d9cfc3e360084c05ba6.1752126748.git.nicolinc@nvidia.com
Acked-by: Pranjal Shrivastava <praan@google.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Stable-dep-of: 5acd67ceb38d ("iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
index a76839cf571d2..85f851ce8ff1b 100644
--- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
+++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
@@ -825,8 +825,9 @@ __tegra241_cmdqv_probe(struct arm_smmu_device *smmu, struct resource *res,
cmdqv->dev = smmu->impl_dev;
if (cmdqv->irq > 0) {
- ret = request_irq(irq, tegra241_cmdqv_isr, 0, "tegra241-cmdqv",
- cmdqv);
+ ret = request_threaded_irq(irq, NULL, tegra241_cmdqv_isr,
+ IRQF_ONESHOT, "tegra241-cmdqv",
+ cmdqv);
if (ret) {
dev_err(cmdqv->dev, "failed to request irq (%d): %d\n",
cmdqv->irq, ret);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0709/1376] iommu/tegra241-cmdqv: Dont run the error ISR before probe sets up vintfs
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (707 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0708/1376] iommu/tegra241-cmdqv: Use request_threaded_irq Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0710/1376] iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs Greg Kroah-Hartman
` (289 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Nicolin Chen, Will Deacon,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolin Chen <nicolinc@nvidia.com>
[ Upstream commit 5acd67ceb38debe2fbf70ea35e2dec9f7ab01bbd ]
__tegra241_cmdqv_probe() requests the error IRQ before it has allocated the
cmdqv->vintfs array and set cmdqv->num_vintfs. A CMDQV left enabled with a
latched error across a kexec fires the IRQ as soon as it is requested, and
tegra241_cmdqv_isr() then walks the uninitialized cmdqv->vintfs array.
Request the IRQ only after cmdqv->vintfs is allocated and zeroed, so that
a latched interrupt firing early runs the ISR against a valid array of NULL
slots that it safely skips.
Fixes: 918eb5c856f6 ("iommu/arm-smmu-v3: Add in-kernel support for NVIDIA Tegra241 (Grace) CMDQV")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 34 +++++++++++--------
1 file changed, 19 insertions(+), 15 deletions(-)
diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
index 85f851ce8ff1b..51aca5269de9b 100644
--- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
+++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
@@ -824,17 +824,6 @@ __tegra241_cmdqv_probe(struct arm_smmu_device *smmu, struct resource *res,
cmdqv->base = base;
cmdqv->dev = smmu->impl_dev;
- if (cmdqv->irq > 0) {
- ret = request_threaded_irq(irq, NULL, tegra241_cmdqv_isr,
- IRQF_ONESHOT, "tegra241-cmdqv",
- cmdqv);
- if (ret) {
- dev_err(cmdqv->dev, "failed to request irq (%d): %d\n",
- cmdqv->irq, ret);
- goto iounmap;
- }
- }
-
regval = readl_relaxed(REG_CMDQV(cmdqv, PARAM));
cmdqv->num_vintfs = 1 << FIELD_GET(CMDQV_NUM_VINTF_LOG2, regval);
cmdqv->num_vcmdqs = 1 << FIELD_GET(CMDQV_NUM_VCMDQ_LOG2, regval);
@@ -843,10 +832,25 @@ __tegra241_cmdqv_probe(struct arm_smmu_device *smmu, struct resource *res,
cmdqv->vintfs =
kcalloc(cmdqv->num_vintfs, sizeof(*cmdqv->vintfs), GFP_KERNEL);
if (!cmdqv->vintfs)
- goto free_irq;
+ goto iounmap;
ida_init(&cmdqv->vintf_ids);
+ /*
+ * Request the IRQ only after cmdqv->vintfs is allocated and zeroed, so
+ * the ISR would not walk an uninitialized array.
+ */
+ if (cmdqv->irq > 0) {
+ ret = request_threaded_irq(irq, NULL, tegra241_cmdqv_isr,
+ IRQF_ONESHOT, "tegra241-cmdqv",
+ cmdqv);
+ if (ret) {
+ dev_err(cmdqv->dev, "failed to request irq (%d): %d\n",
+ cmdqv->irq, ret);
+ goto free_vintfs;
+ }
+ }
+
#ifdef CONFIG_IOMMU_DEBUGFS
if (!cmdqv_debugfs_dir) {
cmdqv_debugfs_dir =
@@ -861,9 +865,9 @@ __tegra241_cmdqv_probe(struct arm_smmu_device *smmu, struct resource *res,
return new_smmu;
-free_irq:
- if (cmdqv->irq > 0)
- free_irq(cmdqv->irq, cmdqv);
+free_vintfs:
+ ida_destroy(&cmdqv->vintf_ids);
+ kfree(cmdqv->vintfs);
iounmap:
iounmap(base);
return NULL;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0710/1376] iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (708 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0709/1376] iommu/tegra241-cmdqv: Dont run the error ISR before probe sets up vintfs Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0711/1376] RDMA/efa: Fix PBL chunk length computation Greg Kroah-Hartman
` (288 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Nicolin Chen, Will Deacon,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolin Chen <nicolinc@nvidia.com>
[ Upstream commit 61f0d437988e5730b04442f6a7d30a9907339f2a ]
tegra241_cmdqv_remove() tears each VINTF down first, then calls free_irq().
Tearing a VINTF down frees vintf0 and clears cmdqv->vintfs[0]. An error in
that window makes tegra241_cmdqv_isr() read the stale slot and hand it to
tegra241_vintf0_handle_error(), which dereferences a NULL or freed pointer.
Free the IRQ before tearing the VINTFs down. free_irq() waits for in-flight
handlers to finish and blocks new ones, so no ISR can observe a VINTF as it
is torn down.
Note: a user-owned VINTF (viommu) could outlive this teardown, which unmaps
cmdqv->base and frees cmdqv->vintfs, so a later viommu close then touches
freed memory. This is neither introduced nor fixed here: a physical IOMMU
is not a pluggable device, so iommufd by design holds no reference on the
one behind a viommu, and this teardown is not expected while that viommu is
still alive.
Fixes: 918eb5c856f6 ("iommu/arm-smmu-v3: Add in-kernel support for NVIDIA Tegra241 (Grace) CMDQV")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
index 51aca5269de9b..8d42c63717b6e 100644
--- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
+++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
@@ -659,6 +659,14 @@ static void tegra241_cmdqv_remove(struct arm_smmu_device *smmu)
container_of(smmu, struct tegra241_cmdqv, smmu);
u16 idx;
+ /*
+ * Free the IRQ before tearing down the VINTFs. free_irq() waits for any
+ * in-flight tegra241_cmdqv_isr() to finish and blocks new ones, so the
+ * ISR cannot dereference a VINTF that is freed by the loop below.
+ */
+ if (cmdqv->irq > 0)
+ free_irq(cmdqv->irq, cmdqv);
+
/* Remove VINTF resources */
for (idx = 0; idx < cmdqv->num_vintfs; idx++) {
if (cmdqv->vintfs[idx]) {
@@ -671,8 +679,6 @@ static void tegra241_cmdqv_remove(struct arm_smmu_device *smmu)
/* Remove cmdqv resources */
ida_destroy(&cmdqv->vintf_ids);
- if (cmdqv->irq > 0)
- free_irq(cmdqv->irq, cmdqv);
iounmap(cmdqv->base);
kfree(cmdqv->vintfs);
put_device(cmdqv->dev); /* smmu->impl_dev */
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0711/1376] RDMA/efa: Fix PBL chunk length computation
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (709 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0710/1376] iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0712/1376] wifi: mac80211: fix per-STA profile length in cross-link CSA parsing Greg Kroah-Hartman
` (287 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Firas Jahjah, Michael Margolin,
Yonatan Nachum, Leon Romanovsky, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonatan Nachum <ynachum@amazon.com>
[ Upstream commit 229b42d7450c1cf96f45ec39ebb69211b06bc036 ]
On register MR, when creating the PBL, if it's an indirect PBL we create
a chunk list to hold the PBL pages pointers. Each chunk is 4KB in size
and can hold 510 addresses (EFA_PTRS_PER_CHUNK) and has a 12-byte
control buffer at the end of it holding the next chunk's pointer and its
length.
If the PBL number of pages is a multiple of EFA_PTRS_PER_CHUNK, the
calculated last chunk length is wrongly computed as 0, even though that
chunk is fully populated with 510 real page pointers. This wrong length
is used both to DMA map the chunk and is propagated to the device,
causing the device to see the chunk as empty and reject the memory
registration.
Fix the calculation so it will be performed only if the number of pages
isn't a multiple of EFA_PTRS_PER_CHUNK, if it is, its already handled in
the above loop correctly.
Also prevent out-of-bounds reach in the chunks array in such scenario.
Fixes: 40909f664d27 ("RDMA/efa: Add EFA verbs implementation")
Reviewed-by: Firas Jahjah <firasj@amazon.com>
Reviewed-by: Michael Margolin <mrgolin@amazon.com>
Signed-off-by: Yonatan Nachum <ynachum@amazon.com>
Link: https://patch.msgid.link/20260727090255.1175120-1-ynachum@amazon.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/efa/efa_verbs.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/drivers/infiniband/hw/efa/efa_verbs.c b/drivers/infiniband/hw/efa/efa_verbs.c
index ff36b7994af9e..03f4e97d26148 100644
--- a/drivers/infiniband/hw/efa/efa_verbs.c
+++ b/drivers/infiniband/hw/efa/efa_verbs.c
@@ -1313,9 +1313,11 @@ static int pbl_chunk_list_create(struct efa_dev *dev, struct pbl_context *pbl)
chunk_list->chunks[i].length = EFA_CHUNK_USED_SIZE;
}
- chunk_list->chunks[chunk_list_size - 1].length =
- ((page_cnt % EFA_PTRS_PER_CHUNK) * EFA_CHUNK_PAYLOAD_PTR_SIZE) +
- EFA_CHUNK_PTR_SIZE;
+
+ if (page_cnt % EFA_PTRS_PER_CHUNK != 0)
+ chunk_list->chunks[chunk_list_size - 1].length =
+ ((page_cnt % EFA_PTRS_PER_CHUNK) * EFA_CHUNK_PAYLOAD_PTR_SIZE) +
+ EFA_CHUNK_PTR_SIZE;
/* fill the dma addresses of sg list pages to chunks: */
chunk_idx = 0;
@@ -1327,9 +1329,12 @@ static int pbl_chunk_list_create(struct efa_dev *dev, struct pbl_context *pbl)
rdma_block_iter_dma_address(&biter);
if (payload_idx == EFA_PTRS_PER_CHUNK) {
+ payload_idx = 0;
chunk_idx++;
+ if (chunk_idx >= chunk_list_size)
+ break;
+
cur_chunk_buf = chunk_list->chunks[chunk_idx].buf;
- payload_idx = 0;
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0712/1376] wifi: mac80211: fix per-STA profile length in cross-link CSA parsing
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (710 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0711/1376] RDMA/efa: Fix PBL chunk length computation Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0713/1376] arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix Greg Kroah-Hartman
` (286 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhao Li, Johannes Berg, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Li <enderaoelyther@gmail.com>
[ Upstream commit 4a0bd262df757b25fc4e2a53c947317c119ced4e ]
ieee80211_mgd_check_cross_link_csa() starts parsing elements after the
fixed per-STA profile header and the STA Info field, but subtracts only
the STA Info length from the profile length. As a result,
ieee802_11_parse_elems() is given sizeof(*prof) == 3 bytes beyond the
current profile's element area, and data following the profile may be
interpreted as belonging to it.
Subtract the fixed profile header as well. The preceding
ieee80211_mle_basic_sta_prof_size_ok() check guarantees that the
corrected calculation cannot underflow, and
ieee80211_rx_uhr_link_reconfig_req() uses the same calculation.
The call site currently states that cross-link CSA parsing has no effect
because the broader parsing is still incorrect. This patch does not
address that broader problem; it only makes the per-STA profile parser
stop at the end of that profile. No production allocation over-read or
user-visible failure has been demonstrated.
Fixes: 7ef8f6821d16 ("wifi: mac80211: mlme: handle cross-link CSA")
Assisted-by: Codex:gpt-5.6-sol
Assisted-by: Kimi:K3
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
Link: https://patch.msgid.link/20260728111326.63087-1-enderaoelyther@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/mlme.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 38549b5236b84..453801b93c321 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -6660,7 +6660,7 @@ ieee80211_mgd_check_cross_link_csa(struct ieee80211_sub_if_data *sdata,
prof = (void *)sta_profiles[link_id];
prof_elems = ieee802_11_parse_elems(prof->variable +
(prof->sta_info_len - 1),
- len -
+ len - sizeof(*prof) -
(prof->sta_info_len - 1),
false, NULL);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0713/1376] arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (711 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0712/1376] wifi: mac80211: fix per-STA profile length in cross-link CSA parsing Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0714/1376] clk: tegra: tegra124-emc: put EMC node on register failure Greg Kroah-Hartman
` (285 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ondrej Jirman, Chen-Yu Tsai,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ondrej Jirman <megi@xff.cz>
[ Upstream commit dfc735fd93e4814e65894916ec5f807f25a391d1 ]
The current mount matrix for mpu6050 is wrong. The mount matrix is a
simple transform from the sensor coordinate space to the device
coordinate space described in DT, where, looking at the screen, X
points to the right, Y to the top, and Z towards the user.
The mpu6050 is mounted like this (looking at the screen from the
front; the sensor is on the near side of the PCB, so its Z axis
points towards the user; o marks the pin 1 corner):
+Xs
^
|
+------+
+Ys <--| |
| o |
+------+
so this gives:
Xd = -Ys [0, -1, 0]
Yd = Xs [1, 0, 0]
Zd = Zs [0, 0, 1]
Fixes: 2496b2aaacf1 ("arm64: dts: allwinner: pinephone: Add mount matrix to accelerometer")
Signed-off-by: Ondrej Jirman <megi@xff.cz>
Link: https://patch.msgid.link/20260725111909.2244868-1-megi@xff.cz
Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/allwinner/sun50i-a64-pinephone.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pinephone.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64-pinephone.dtsi
index b844759f52c0d..82f959aace109 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pinephone.dtsi
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pinephone.dtsi
@@ -212,8 +212,8 @@ accelerometer@68 {
interrupts = <7 5 IRQ_TYPE_EDGE_RISING>; /* PH5 */
vdd-supply = <®_dldo1>;
vddio-supply = <®_dldo1>;
- mount-matrix = "0", "1", "0",
- "-1", "0", "0",
+ mount-matrix = "0", "-1", "0",
+ "1", "0", "0",
"0", "0", "1";
};
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0714/1376] clk: tegra: tegra124-emc: put EMC node on register failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (712 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0713/1376] arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0715/1376] clk: palmas: Manage external-control prepare with devm Greg Kroah-Hartman
` (284 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Brian Masney,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit f726279f5eab813f9a8b6f38ddf2a4b062d038ff ]
tegra124_clk_register_emc() stores a device node reference returned by
of_parse_phandle() in tegra->emc_node.
If clk_register() fails, the function returns an error before that
reference can be consumed and released by the normal runtime path. The
tegra_clk_emc object is freed on this failure path, but freeing the
object does not drop the OF node reference stored in it.
Drop the EMC node reference before freeing the tegra_clk_emc object.
of_node_put() is safe for a NULL node, so this also covers the case where
the phandle is absent.
Fixes: 2db04f16b589 ("clk: tegra: Add EMC clock driver")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/tegra/clk-tegra124-emc.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/clk/tegra/clk-tegra124-emc.c b/drivers/clk/tegra/clk-tegra124-emc.c
index 5f1af6dfe7154..674aef2785394 100644
--- a/drivers/clk/tegra/clk-tegra124-emc.c
+++ b/drivers/clk/tegra/clk-tegra124-emc.c
@@ -539,6 +539,7 @@ struct clk *tegra124_clk_register_emc(void __iomem *base, struct device_node *np
clk = clk_register(NULL, &tegra->hw);
if (IS_ERR(clk)) {
+ of_node_put(tegra->emc_node);
kfree(tegra);
return clk;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0715/1376] clk: palmas: Manage external-control prepare with devm
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (713 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0714/1376] clk: tegra: tegra124-emc: put EMC node on register failure Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0716/1376] clk/x86: pmc_atom: add kasprintf return value check Greg Kroah-Hartman
` (283 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Brian Masney, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit ccda84fcbf3a972973f772384935928f41817b3a ]
palmas_clks_init_configure() prepares the clock when an external control
pin is configured. The current driver only drops that prepare reference
when external control configuration fails.
If provider registration fails after that point, or if the driver is later
removed, the prepare reference remains held.
Register a device-managed action after clk_prepare() succeeds. This
balances the prepare reference on subsequent probe failure and driver
removal.
Fixes: 942d1d674931 ("clk: Add driver for Palmas clk32kg and clk32kgaudio clocks")
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/clk-palmas.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/drivers/clk/clk-palmas.c b/drivers/clk/clk-palmas.c
index 39049f62dbbb3..86a51edac8272 100644
--- a/drivers/clk/clk-palmas.c
+++ b/drivers/clk/clk-palmas.c
@@ -194,6 +194,13 @@ static void palmas_clks_get_clk_data(struct platform_device *pdev,
cinfo->ext_control_pin = prop;
}
+static void palmas_clks_unprepare_ext_control(void *data)
+{
+ struct palmas_clock_info *cinfo = data;
+
+ clk_unprepare(cinfo->hw.clk);
+}
+
static int palmas_clks_init_configure(struct palmas_clock_info *cinfo)
{
int ret;
@@ -214,13 +221,18 @@ static int palmas_clks_init_configure(struct palmas_clock_info *cinfo)
return ret;
}
+ ret = devm_add_action_or_reset(cinfo->dev,
+ palmas_clks_unprepare_ext_control,
+ cinfo);
+ if (ret)
+ return ret;
+
ret = palmas_ext_control_req_config(cinfo->palmas,
cinfo->clk_desc->sleep_reqstr_id,
cinfo->ext_control_pin, true);
if (ret < 0) {
dev_err(cinfo->dev, "Ext config for %s failed, %d\n",
cinfo->clk_desc->clk_name, ret);
- clk_unprepare(cinfo->hw.clk);
return ret;
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0716/1376] clk/x86: pmc_atom: add kasprintf return value check
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (714 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0715/1376] clk: palmas: Manage external-control prepare with devm Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0717/1376] clk: mediatek: mt8135: Fix inverted gate control for devapc_ck Greg Kroah-Hartman
` (282 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, longlong yan, Brian Masney,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: longlong yan <yanlonglong@kylinos.cn>
[ Upstream commit 18e9d14cbac33db1c1fb933c26a736eef53dd538 ]
The kasprintf() function returns NULL on memory allocation failure, but
the code in plt_clk_register() was not checking this return value. If
kasprintf fails, init.name would be NULL and could cause NULL pointer
dereference when clkdev_hw_create() uses it.
Add proper error checking for the kasprintf() return value and return
ERR_PTR(-ENOMEM) on failure.
Fixes: 1141d9d08184 ("clk: x86: Add Atom PMC platform clocks")
Signed-off-by: longlong yan <yanlonglong@kylinos.cn>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/x86/clk-pmc-atom.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/clk/x86/clk-pmc-atom.c b/drivers/clk/x86/clk-pmc-atom.c
index 99291ba65da73..08c83e0abc41d 100644
--- a/drivers/clk/x86/clk-pmc-atom.c
+++ b/drivers/clk/x86/clk-pmc-atom.c
@@ -160,6 +160,9 @@ static struct clk_plt *plt_clk_register(struct platform_device *pdev, int id,
return ERR_PTR(-ENOMEM);
init.name = kasprintf(GFP_KERNEL, "%s_%d", PLT_CLK_NAME_BASE, id);
+ if (!init.name)
+ return ERR_PTR(-ENOMEM);
+
init.ops = &plt_clk_ops;
init.flags = 0;
init.parent_names = parent_names;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0717/1376] clk: mediatek: mt8135: Fix inverted gate control for devapc_ck
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (715 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0716/1376] clk/x86: pmc_atom: add kasprintf return value check Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0718/1376] clk: rockchip: Fix the fractional part denominator on RK3588/RK3576 PLLs Greg Kroah-Hartman
` (281 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Akari Tsuyukusa, Brian Masney,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akari Tsuyukusa <akkun11.open@gmail.com>
[ Upstream commit fd0e3e4edea6a3e4da91be608ca2fb9b348f9e32 ]
The devapc_ck (CLK_INFRA_DEVAPC) on MT8135 is currently using
"mtk_clk_gate_ops_setclr". However, checking the downstream kernel reveals
that this clock is configured with set:enable and clr:disable making
"mtk_clk_gate_ops_setclr_inv" the appropriate choice.
But, it is strange that some downstream kernels are not like that.
Amazon: INV
ChromiumOS (early): not INV
ChromiumOS 3.16 to 3.18-revew-v2: INV
ChromiumOS 3.18-review-v3 and later (sent to kernel.org): not INV
Link: https://github.com/amazon-oss/android_kernel_amazon_mt8135/blob/e2b2163a8ec4a7c8d961c89003a15b4ba0f0e371/arch/arm/mach-mt8135/mt_clkmgr.c#L1022-L1028
Link: https://github.com/mtk09422/chromiumos-third_party-kernel-mediatek/blob/4b624ee66e65d5dcd43fca36b313086efae8922a/arch/arm/boot/dts/mt8135-clocks.dtsi#L944-L948
Link: https://github.com/mtk09422/chromiumos-third_party-kernel-mediatek/blob/decd80c01d0dbe9f3afa8ff72273b5618b418180/drivers/clk/mediatek/clk-mt8135.c#L881-L882
Link: https://github.com/mtk09422/chromiumos-third_party-kernel-mediatek/blob/9b6f06cb7637100aa1a42e1fc351b36b384a1c54/drivers/clk/mediatek/clk-mt8135.c#L450
Fixes: a8aede794843 ("clk: mediatek: Add basic clocks for Mediatek MT8135.")
Signed-off-by: Akari Tsuyukusa <akkun11.open@gmail.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/mediatek/clk-mt8135.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/clk/mediatek/clk-mt8135.c b/drivers/clk/mediatek/clk-mt8135.c
index 084e48a554c26..1d20e15608f77 100644
--- a/drivers/clk/mediatek/clk-mt8135.c
+++ b/drivers/clk/mediatek/clk-mt8135.c
@@ -409,6 +409,9 @@ static const struct mtk_gate_regs infra_cg_regs = {
GATE_MTK_FLAGS(_id, _name, _parent, &infra_cg_regs, _shift, \
&mtk_clk_gate_ops_setclr, CLK_IS_CRITICAL)
+#define GATE_ICG_INV(_id, _name, _parent, _shift) \
+ GATE_MTK(_id, _name, _parent, &infra_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv)
+
static const struct mtk_gate infra_clks[] = {
GATE_DUMMY(CLK_DUMMY, "infra_dummy"),
GATE_ICG(CLK_INFRA_PMIC_WRAP, "pmic_wrap_ck", "axi_sel", 23),
@@ -419,7 +422,7 @@ static const struct mtk_gate infra_clks[] = {
GATE_ICG(CLK_INFRA_CPUM, "cpum_ck", "cpum_tck_in", 15),
GATE_ICG_AO(CLK_INFRA_M4U, "m4u_ck", "mem_sel", 8),
GATE_ICG(CLK_INFRA_MFGAXI, "mfgaxi_ck", "axi_sel", 7),
- GATE_ICG(CLK_INFRA_DEVAPC, "devapc_ck", "axi_sel", 6),
+ GATE_ICG_INV(CLK_INFRA_DEVAPC, "devapc_ck", "axi_sel", 6),
GATE_ICG(CLK_INFRA_AUDIO, "audio_ck", "aud_intbus_sel", 5),
GATE_ICG(CLK_INFRA_MFG_BUS, "mfg_bus_ck", "axi_sel", 2),
GATE_ICG(CLK_INFRA_SMI, "smi_ck", "smi_sel", 1),
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0718/1376] clk: rockchip: Fix the fractional part denominator on RK3588/RK3576 PLLs
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (716 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0717/1376] clk: mediatek: mt8135: Fix inverted gate control for devapc_ck Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0719/1376] nilfs2: fix infinite loop in nilfs_clean_segments() Greg Kroah-Hartman
` (280 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexey Charkov, Quentin Schulz,
Heiko Stuebner, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Charkov <alchark@flipper.net>
[ Upstream commit 52aef653c3d0c24013dfa9eccf692594eacdbe17 ]
According to the TRM, the fractional PLL coefficient should be divided by
65536 rather than 65535 to obtain the output rate.
Fix the denominator and add a comment with the TRM provided clock formulae
for future reference.
See RK3576 TRM Part 1 V1.2 section 2.13.1.4 Setting Guide on P, M, S and K
or equivalently RK3588 TRM part 1 V1.0 section 2.17.1.4 Setting Guide on P,
M, S and K.
Fractional PLL rates don't seem to be used by any current mainline
consumers, so this is purely a correctness fix. It will also be important
to properly support DisplayPort output going forward, as the video output
controller derives its pixel clock from system PLLs with no dedicated PHY
PLL option for DP unlike HDMI, and some display modes are only achievable
with fractional PLL rates.
Fixes: 8f6594494b1c ("clk: rockchip: add pll type for RK3588")
Signed-off-by: Alexey Charkov <alchark@flipper.net>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Link: https://patch.msgid.link/20260723-rk3588-fracpll-v2-1-3adfb9dda235@flipper.net
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/rockchip/clk-pll.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/clk/rockchip/clk-pll.c b/drivers/clk/rockchip/clk-pll.c
index fe76756e592e9..dfe02f463e249 100644
--- a/drivers/clk/rockchip/clk-pll.c
+++ b/drivers/clk/rockchip/clk-pll.c
@@ -893,6 +893,13 @@ static void rockchip_rk3588_pll_get_params(struct rockchip_clk_pll *pll,
rate->k = ((pllcon >> RK3588_PLLCON2_K_SHIFT) & RK3588_PLLCON2_K_MASK);
}
+/*
+ * 2250 MHz <= Fvco <= 4500 MHz
+ * For Fvco > 3 GHz: period jitter +-1% frac PLL, +-0.75% int PLL
+ * For Fvco < 3 GHz: period jitter +-2% frac PLL, +-1.50% int PLL
+ * Fvco = ((m + k / 65536) * Fin) / p
+ * Fout = ((m + k / 65536) * Fin) / (p * 2^s)
+ */
static unsigned long rockchip_rk3588_pll_recalc_rate(struct clk_hw *hw, unsigned long prate)
{
struct rockchip_clk_pll *pll = to_rockchip_clk_pll(hw);
@@ -908,7 +915,7 @@ static unsigned long rockchip_rk3588_pll_recalc_rate(struct clk_hw *hw, unsigned
/* fractional mode */
u64 frac_rate64 = prate * cur.k;
- postdiv = cur.p * 65535;
+ postdiv = cur.p * 65536;
do_div(frac_rate64, postdiv);
rate64 += frac_rate64;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0719/1376] nilfs2: fix infinite loop in nilfs_clean_segments()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (717 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0718/1376] clk: rockchip: Fix the fractional part denominator on RK3588/RK3576 PLLs Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0720/1376] nilfs2: prevent out-of-bounds read in super root block parsing Greg Kroah-Hartman
` (279 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+cae54346a70bbceeff2c,
Joshua Crofts, Ryusuke Konishi, Viacheslav Dubeyko, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Crofts <joshua.crofts1@gmail.com>
[ Upstream commit ce5a5ad1a8330a2fcfdd9ec2ab341be739e89a18 ]
syzbot reported a hung task in nilfs_transaction_begin(). This occurs
because the cleaner ioctl falls into an infinite loop if
nilfs_segctor_construct() repeatedly returns -EROFS (e.g. the device
is remounted as read-only after an I/O error).
Currently in nilfs_clean_segments(), if err is non-zero, it logs the
error and sleeps but doesn't abort when it encounters a terminal error
like -EROFS. This causes the thread to loop forever.
Fix this by breaking out of the loop if nilfs_segctor_construct()
returns -EROFS. This matches the behaviour in
nilfs_segctor_write_out(), which also handles -EROFS.
Reported-by: syzbot+cae54346a70bbceeff2c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=cae54346a70bbceeff2c
Fixes: 9ff05123e3bf ("nilfs2: segment constructor")
Assisted-by: gemini:gemini-3.1-pro
Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
Acked-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nilfs2/segment.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index 657a72f941b90..c598c2a4262a1 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -2580,6 +2580,10 @@ int nilfs_clean_segments(struct super_block *sb, struct nilfs_argv *argv,
break;
nilfs_warn(sb, "error %d cleaning segments", err);
+
+ if (unlikely(err == -EROFS))
+ goto out_unlock;
+
set_current_state(TASK_INTERRUPTIBLE);
schedule_timeout(sci->sc_interval);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0720/1376] nilfs2: prevent out-of-bounds read in super root block parsing
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (718 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0719/1376] nilfs2: fix infinite loop in nilfs_clean_segments() Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0721/1376] nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch Greg Kroah-Hartman
` (278 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Lee, Ryusuke Konishi,
Viacheslav Dubeyko, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lee <david.lee@trailofbits.com>
[ Upstream commit 7cb2f76a6a2ba2130b577cb8ac13e1e46c4fc689 ]
super-root inode metadata size is trusted before nilfs_read_inode_common().
Reject super-root inode sizes whose computed on-disk footprint exceeds the
filesystem block size. This prevents malformed filesystem images from
making nilfs_read_inode_common() read past the end of the super-root block.
[ryusuke: clarify the commit title]
Fixes: 8a9d2191e9f4 ("nilfs2: operations for the_nilfs core object")
Signed-off-by: David Lee <david.lee@trailofbits.com>
Assisted-by: Codex:gpt-5.5
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nilfs2/the_nilfs.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
index ecd71c1908859..6069353bb945a 100644
--- a/fs/nilfs2/the_nilfs.c
+++ b/fs/nilfs2/the_nilfs.c
@@ -448,6 +448,12 @@ static int nilfs_store_disk_layout(struct the_nilfs *nilfs,
nilfs->ns_inode_size);
return -EINVAL;
}
+ if (NILFS_SR_BYTES(nilfs->ns_inode_size) > nilfs->ns_blocksize) {
+ nilfs_err(nilfs->ns_sb,
+ "too large inode size for super root: %d bytes",
+ nilfs->ns_inode_size);
+ return -EINVAL;
+ }
nilfs->ns_first_ino = le32_to_cpu(sbp->s_first_ino);
if (nilfs->ns_first_ino < NILFS_USER_INO) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0721/1376] nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (719 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0720/1376] nilfs2: prevent out-of-bounds read in super root block parsing Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0722/1376] scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches Greg Kroah-Hartman
` (277 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+8baf9a79a3ffc6271cb6,
Ryusuke Konishi, Viacheslav Dubeyko, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
[ Upstream commit 66f4ad3ce158902e5f98afea93189972ed8750c2 ]
Syzbot reported a kernel BUG triggered within nilfs_copy_dirty_pages(),
which copies dirty DAT file folios/pages to its shadow page cache. The
BUG occurs when a retrieved dirty folio/page unexpectedly loses its
'dirty' status.
This issue arises because, since the commit referenced below, the 'dirty'
flag of a folio/page can be cleared asynchronously after the filesystem
detects metadata corruption and transitions to read-only mode.
Resolve the issue by returning an -EROFS error if the filesystem has
transitioned to read-only mode. Also change the behavior to issue a
kernel warning only once instead of triggering a kernel BUG when this
unexpected 'dirty' state is detected while the filesystem is not in
read-only mode.
Reported-by: syzbot+8baf9a79a3ffc6271cb6@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=8baf9a79a3ffc6271cb6
Fixes: 8c26c4e2694a ("nilfs2: fix issue with flush kernel thread after remount in RO mode because of driver's internal error or metadata corruption")
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nilfs2/page.c | 17 +++++++++++++++--
1 file changed, 15 insertions(+), 2 deletions(-)
diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c
index 06f18fe86407e..bc698bb66f790 100644
--- a/fs/nilfs2/page.c
+++ b/fs/nilfs2/page.c
@@ -244,6 +244,7 @@ static void nilfs_copy_folio(struct folio *dst, struct folio *src,
int nilfs_copy_dirty_pages(struct address_space *dmap,
struct address_space *smap)
{
+ struct inode *smap_inode = smap->host;
struct folio_batch fbatch;
unsigned int i;
pgoff_t index = 0;
@@ -259,8 +260,19 @@ int nilfs_copy_dirty_pages(struct address_space *dmap,
struct folio *folio = fbatch.folios[i], *dfolio;
folio_lock(folio);
- if (unlikely(!folio_test_dirty(folio)))
- NILFS_FOLIO_BUG(folio, "inconsistent dirty state");
+ if (unlikely(!folio_test_dirty(folio))) {
+ if (WARN_ONCE(!sb_rdonly(smap_inode->i_sb),
+ "inconsistent dirty state\n"))
+ goto unlock_folio;
+
+ /*
+ * If the filesystem has been forced to read-only
+ * due to metadata corruption.
+ */
+ folio_unlock(folio);
+ err = -EROFS;
+ break;
+ }
dfolio = filemap_grab_folio(dmap, folio->index);
if (IS_ERR(dfolio)) {
@@ -278,6 +290,7 @@ int nilfs_copy_dirty_pages(struct address_space *dmap,
folio_unlock(dfolio);
folio_put(dfolio);
+unlock_folio:
folio_unlock(folio);
}
folio_batch_release(&fbatch);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0722/1376] scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches.
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (720 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0721/1376] nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0723/1376] RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs Greg Kroah-Hartman
` (276 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mike McGowen, Don Brace,
David Strahan, Martin K. Petersen, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Strahan <David.Strahan@microchip.com>
[ Upstream commit 225548863f0a2350c6f34231ca56710c3dd1a5d5 ]
On recent Linux kernels the driver can enter a retry loop on the AIO fast
path when a request is retried, looping until timeout. A diagnostic path
that takes a physical drive offline on AIO-bypass failure is also never
entered on affected kernels.
Register a per-command initialization callback with the SCSI core. Its
presence causes the core to skip the per-dispatch clear, so the retry
marker now survives across the requeue and the AIO-to-RAID fallback
proceeds as intended. The driver takes over the marker's lifetime: it is
zeroed at tag allocation, preserved across the retry requeue so the error
path can act on it, and cleared on terminal completion so the tag starts
clean on its next use.
Fixes: dce5c4afd035 ("scsi: core: Clear driver private data when retrying request")
Co-developed-by: Mike McGowen <mike.mcgowen@microchip.com>
Signed-off-by: Mike McGowen <mike.mcgowen@microchip.com>
Acked-by: Don Brace <don.brace@microchip.com>
Signed-off-by: David Strahan <david.strahan@microchip.com>
Link: https://lore.kernel.org/linux-scsi/20260722220401.6357-1-david.strahan@microchip.com/
Link: https://patch.msgid.link/20260722220401.6357-2-david.strahan@microchip.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/smartpqi/smartpqi_init.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
index 4d751a2376722..32c92678d5916 100644
--- a/drivers/scsi/smartpqi/smartpqi_init.c
+++ b/drivers/scsi/smartpqi/smartpqi_init.c
@@ -65,6 +65,12 @@ static struct pqi_cmd_priv *pqi_cmd_priv(struct scsi_cmnd *cmd)
return scsi_cmd_priv(cmd);
}
+static int pqi_init_cmd_priv(struct Scsi_Host *shost, struct scsi_cmnd *cmd)
+{
+ memset(pqi_cmd_priv(cmd), 0, sizeof(struct pqi_cmd_priv));
+ return 0;
+}
+
static void pqi_verify_structures(void);
static void pqi_take_ctrl_offline(struct pqi_ctrl_info *ctrl_info,
enum pqi_ctrl_shutdown_reason ctrl_shutdown_reason);
@@ -5928,6 +5934,17 @@ void pqi_prep_for_scsi_done(struct scsi_cmnd *scmd)
struct pqi_scsi_dev *device;
struct completion *wait;
+ /*
+ * Clear the AIO-retry marker on final completion so the tag
+ * starts clean on its next dispatch. On DID_IMM_RETRY leave
+ * it intact: pqi_aio_io_complete() sets DID_IMM_RETRY and
+ * bumps the marker to steer the requeue onto the RAID path,
+ * and pqi_process_raid_io_error() consumes the non-zero
+ * marker to offline a misbehaving drive.
+ */
+ if (host_byte(scmd->result) != DID_IMM_RETRY)
+ pqi_cmd_priv(scmd)->this_residual = 0;
+
if (!scmd->device) {
set_host_byte(scmd, DID_NO_CONNECT);
return;
@@ -7582,6 +7599,7 @@ static const struct scsi_host_template pqi_driver_template = {
.sdev_groups = pqi_sdev_groups,
.shost_groups = pqi_shost_groups,
.cmd_size = sizeof(struct pqi_cmd_priv),
+ .init_cmd_priv = pqi_init_cmd_priv,
};
static int pqi_register_scsi(struct pqi_ctrl_info *ctrl_info)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0723/1376] RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (721 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0722/1376] scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0724/1376] RDMA/mlx5: Send cong param changes to the resolved port mdev Greg Kroah-Hartman
` (275 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Leon Romanovsky, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <leonro@nvidia.com>
[ Upstream commit 03826bc1fa6c90405bf05831f2b501a8368dcd27 ]
get_param() reads a congestion parameter as a u32 but formats it with the
signed "%d" into an 11-byte stack buffer. A value with bit 31 set, such as
0x80000000, renders as "-2147483648\n" whose full length is 12. snprintf()
stores only 11 bytes yet returns 12, so simple_read_from_buffer() treats 12
bytes as valid and reads one byte past lbuf[].
Size the buffer for the widest unsigned decimal, format with "%u" to match
the u32, and use scnprintf() so the length passed to
simple_read_from_buffer() reflects the bytes actually stored.
Fixes: 4a2da0b8c0782 ("IB/mlx5: Add debug control parameters for congestion control")
Link: https://patch.msgid.link/20260726-get-param-leaks-kernel-stack-memory-v1-1-d61a4d39662d@nvidia.com
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/mlx5/cong.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/infiniband/hw/mlx5/cong.c b/drivers/infiniband/hw/mlx5/cong.c
index a78a067e3ce7f..88ac5fd1038ed 100644
--- a/drivers/infiniband/hw/mlx5/cong.c
+++ b/drivers/infiniband/hw/mlx5/cong.c
@@ -399,15 +399,13 @@ static ssize_t get_param(struct file *filp, char __user *buf, size_t count,
int offset = param->offset;
u32 var = 0;
int ret;
- char lbuf[11];
+ char lbuf[12];
ret = mlx5_ib_get_cc_params(param->dev, param->port_num, offset, &var);
if (ret)
return ret;
- ret = snprintf(lbuf, sizeof(lbuf), "%d\n", var);
- if (ret < 0)
- return ret;
+ ret = scnprintf(lbuf, sizeof(lbuf), "%u\n", var);
return simple_read_from_buffer(buf, count, pos, lbuf, ret);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0724/1376] RDMA/mlx5: Send cong param changes to the resolved port mdev
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (722 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0723/1376] RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0725/1376] RDMA/cxgb4: free STAG index when TPT entry write fails Greg Kroah-Hartman
` (274 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Leon Romanovsky, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <leonro@nvidia.com>
[ Upstream commit 033a79e308e4fe832b0924347eda8c4364055174 ]
mlx5_ib_set_cc_params() resolves the port-specific mlx5_core_dev via
mlx5_ib_get_native_port_mdev() but issued MLX5_CMD_OP_MODIFY_CONG_PARAMS
through dev->mdev. On an affiliated secondary RoCE port those pointers
refer to different devices, so a write to the secondary port's cc_params
debugfs file either altered the master port or failed with a master-side
command error, while the read path already used the resolved mdev and
returned the unchanged secondary value.
Issue the command to the resolved mdev, the same device whose capabilities
were checked when its debugfs directory was created. It is already
referenced by the get/put pair, so its lifetime is safe.
Fixes: 31578defe4eb ("RDMA/mlx5: Update mlx5_ib to use new cmd interface")
Link: https://patch.msgid.link/20260726-mlx5-ib-set-cc-params-applies-conges-v1-1-a253edafe1f3@nvidia.com
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/mlx5/cong.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/mlx5/cong.c b/drivers/infiniband/hw/mlx5/cong.c
index 88ac5fd1038ed..e3c4b1c928169 100644
--- a/drivers/infiniband/hw/mlx5/cong.c
+++ b/drivers/infiniband/hw/mlx5/cong.c
@@ -361,7 +361,7 @@ static int mlx5_ib_set_cc_params(struct mlx5_ib_dev *dev, u32 port_num,
MLX5_SET(field_select_r_roce_rp, field, field_select_r_roce_rp,
attr_mask);
- err = mlx5_cmd_exec_in(dev->mdev, modify_cong_params, in);
+ err = mlx5_cmd_exec_in(mdev, modify_cong_params, in);
kvfree(in);
alloc_err:
mlx5_ib_put_native_port_mdev(dev, port_num + 1);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0725/1376] RDMA/cxgb4: free STAG index when TPT entry write fails
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (723 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0724/1376] RDMA/mlx5: Send cong param changes to the resolved port mdev Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0726/1376] IB/isert: reject PDUs declaring more data than was received Greg Kroah-Hartman
` (273 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Leon Romanovsky, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <leonro@nvidia.com>
[ Upstream commit fdfb5cea4bf070cdb31d997efd87bb684df041fd ]
write_tpt_entry() allocates a new STAG index with c4iw_get_resource() and
bumps stats.stag.cur before programming the entry. When
write_adapter_mem() fails, it returns the error without releasing the index
or reversing the statistic. No MR is inserted into rhp->mrs, so
deregistration never reclaims it, leaking the index until device teardown.
Record whether this call allocated the index and, on a failed write, return
it to tpt_table and decrement stats.stag.cur. Key the rollback on both the
write error and that flag, not the error alone: a non-reset update carries
a caller-owned STAG that this call did not allocate and must not free.
Fixes: ec3eead21718 ("RDMA/cxgb4: Remove kfifo usage")
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/cxgb4/mem.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
index 88db7e527728c..9c24789bbb54b 100644
--- a/drivers/infiniband/hw/cxgb4/mem.c
+++ b/drivers/infiniband/hw/cxgb4/mem.c
@@ -277,6 +277,7 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
int err;
struct fw_ri_tpte *tpt;
u32 stag_idx;
+ bool stag_idx_allocated = false;
static atomic_t key;
if (c4iw_fatal_error(rdev))
@@ -299,6 +300,7 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
return -ENOMEM;
}
mutex_lock(&rdev->stats.lock);
+ stag_idx_allocated = true;
rdev->stats.stag.cur += 32;
if (rdev->stats.stag.cur > rdev->stats.stag.max)
rdev->stats.stag.max = rdev->stats.stag.cur;
@@ -333,7 +335,7 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
(rdev->lldi.vr->stag.start >> 5),
sizeof(*tpt), tpt, skb, wr_waitp);
- if (reset_tpt_entry) {
+ if (reset_tpt_entry || (err && stag_idx_allocated)) {
c4iw_put_resource(&rdev->resource.tpt_table, stag_idx);
mutex_lock(&rdev->stats.lock);
rdev->stats.stag.cur -= 32;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0726/1376] IB/isert: reject PDUs declaring more data than was received
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (724 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0725/1376] RDMA/cxgb4: free STAG index when TPT entry write fails Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0727/1376] IB/isert: reject login " Greg Kroah-Hartman
` (272 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yehyeong Lee, Leon Romanovsky,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
[ Upstream commit 957f92ea4022fb6af4618271615a2a21a7b5bef9 ]
isert_recv_done() hands each received PDU to the opcode handlers without
ever looking at wc->byte_len, the number of bytes the HCA actually placed
in the receive descriptor. The handlers then copy that many bytes - the
data-segment length the initiator declared in the BHS
(ntoh24(hdr->dlength), via the derived unsol_data_len / imm_data_len) -
out of the fixed-size descriptor:
isert_handle_iscsi_dataout():
sg_copy_from_buffer(sg_start, sg_nents, isert_get_data(rx_desc),
unsol_data_len);
isert_handle_scsi_cmd():
sg_copy_from_buffer(cmd->se_cmd.t_data_sg, sg_nents,
isert_get_data(rx_desc), imm_data_len);
Because the declared length is never checked against wc->byte_len, an
initiator can declare a data segment larger than the bytes it actually
sent (and larger than the descriptor) and cause an out-of-bounds read of
the receive buffer.
Nothing upstream of isert closes this door:
- __iscsit_check_dataout_hdr() bounds the inbound payload against
conn_ops->MaxXmitDataSegmentLength (MXDSL) - a transmit parameter,
used here for the inbound check.
- iscsi_set_connection_parameters() sets
ops->MaxXmitDataSegmentLength = ops->TargetRecvDataSegmentLength;
and TARGETRECVDATASEGMENTLENGTH is absent from the min()-clamp list in
iscsi_check_acceptor_state(), so the value the initiator declares is
adopted verbatim (type range 512..16777215). The initiator effectively
raises its own ceiling.
- isert never clamps the negotiated value to its own fixed receive
descriptor (ISER_RX_SIZE, 9216 bytes), so the target core's bound and
the descriptor size are unrelated.
The imm_data_len == data_len path is more than an over-read: it aliases
the receive descriptor via sg_set_buf() and passes it to the backend as
the data source for the SCSI WRITE, so an over-declared length causes heap
contents past the descriptor to be written through the backend to the
backing store. The backend is the victim of the oversized scatterlist
isert hands it, not the cause; no read-back of the written bytes was
demonstrated.
Trigger: after login completes (full feature phase), an initiator that has
declared a large TargetRecvDataSegmentLength and a FirstBurstLength that
permits unsolicited/immediate data sends a PDU whose declared data-segment
length exceeds what was received. With KASAN:
BUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0x150/0x1c0
Read of size 4096 at addr ffff888109720800 by task kworker/1:0H/25
Workqueue: ib-comp-wq ib_cq_poll_work
Call Trace:
sg_copy_buffer+0x150/0x1c0
isert_recv_done+0xba6/0x2390
__ib_process_cq+0xe1/0x390
ib_cq_poll_work+0x46/0x150
isert_recv_done+0xba6 resolves to isert_handle_iscsi_dataout()
(ib_isert.c:1160), inlined through isert_rx_opcode().
Validate wc->byte_len against the framing in isert_recv_done() before the
PDU reaches any handler, and reinstate the connection if it is short.
Because the test compares without subtracting the header length, it also
rejects PDUs shorter than the iSER and iSCSI headers, which would otherwise
be parsed out of stale descriptor contents. The login handler rejects PDUs
shorter than ISER_HEADERS_LEN (commit 29e7b925ae6d ("IB/isert: Reject login
PDUs shorter than ISER_HEADERS_LEN")) but does not bound the declared
length either; that is fixed in the next patch. The data handlers had no
length check at all.
isert reads the data segment from a fixed offset: isert_get_data()
returns the iSER header plus ISER_HEADERS_LEN and makes no adjustment for
an AHS. The bytes the handlers touch are therefore exactly
[ISER_HEADERS_LEN, ISER_HEADERS_LEN + dlength), and comparing that sum
against wc->byte_len bounds precisely the region that is read. An AHS
term would only make the test stricter without bounding anything further,
and cannot cause a false reject: a PDU carrying an AHS is longer, not
shorter.
This is a memory-safety fix that verifies the bytes that were actually
received; it does not touch RFC 7145 length negotiation and is not the
MaxXmitDataSegmentLength negotiation redesign raised in the 2017 "[Query]
iSER-Target: QP errors observed on increasing MaxXmitDataSegmentLength"
discussion. That redesign is explicitly out of scope here.
The patched kernel rejects the malformed DataOut PDU and both
immediate-data variants with "PDU declares ... bytes were received" and
continues to pass normal traffic with no regression.
Reproduced with soft-RoCE (rdma_rxe) and a raw rdma_cm/ibv initiator; no
kernel-side test hooks were needed.
Fixes: b8d26b3be8b3 ("iser-target: Add iSCSI Extensions for RDMA (iSER) target driver")
Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Link: https://patch.msgid.link/20260726163931.971063-2-yhlee@isslab.korea.ac.kr
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/ulp/isert/ib_isert.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index 640634f96d72a..9426aeeaddecc 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -1335,6 +1335,21 @@ isert_recv_done(struct ib_cq *cq, struct ib_wc *wc)
ib_dma_sync_single_for_cpu(ib_dev, rx_desc->dma_addr,
ISER_RX_SIZE, DMA_FROM_DEVICE);
+ /*
+ * The data segment length declared in the BHS is attacker controlled
+ * and is used further down to read that many bytes out of the fixed
+ * size receive descriptor, so it has to be checked against the number
+ * of bytes that were actually received. Comparing without subtracting
+ * also rejects PDUs shorter than the iSER and iSCSI headers, which
+ * would otherwise be parsed out of stale descriptor contents.
+ */
+ if (unlikely(wc->byte_len < ISER_HEADERS_LEN + ntoh24(hdr->dlength))) {
+ isert_err("PDU declares %u data bytes but only %u bytes were received\n",
+ ntoh24(hdr->dlength), wc->byte_len);
+ iscsit_cause_connection_reinstatement(isert_conn->conn, 0);
+ return;
+ }
+
isert_dbg("DMA: 0x%llx, iSCSI opcode: 0x%02x, ITT: 0x%08x, flags: 0x%02x dlen: %d\n",
rx_desc->dma_addr, hdr->opcode, hdr->itt, hdr->flags,
(int)(wc->byte_len - ISER_HEADERS_LEN));
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0727/1376] IB/isert: reject login PDUs declaring more data than was received
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (725 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0726/1376] IB/isert: reject PDUs declaring more data than was received Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0728/1376] nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request Greg Kroah-Hartman
` (271 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Leon Romanovsky, Yehyeong Lee,
Leon Romanovsky, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
[ Upstream commit 2488b5b4827e5415768afc8daf097e8eb83c98df ]
isert_login_recv_done() records how many bytes the HCA actually placed in
the login buffer, but nothing compares that against the length the login
PDU's BHS declares. isert_rx_login_req() copies min(login_req_len,
MAX_KEY_VALUE_PAIRS) bytes into login->req_buf, and the login code then
reads the declared length back out of that buffer - for the first PDU in
iscsi_target_locate_portal(),
payload_length = ntoh24(login_req->dlength);
tmpbuf = kmemdup_nul(login->req_buf, payload_length, GFP_KERNEL);
and for the ones after it in iscsi_decode_text_input(), reached from
iscsi_target_do_login().
login->req_buf is a fixed MAX_KEY_VALUE_PAIRS (8192) byte allocation, so
an initiator that declares more than it sends reads off the end of it,
before authentication and with the length under its control:
BUG: KASAN: slab-out-of-bounds in kmemdup_nul+0x43/0x80
Read of size 8193 at addr ffff8881056a8000 by task iscsi_np/167
__asan_memcpy+0x23/0x60
kmemdup_nul+0x43/0x80
iscsi_target_locate_portal+0x48d/0x1180
iscsi_target_login_thread+0x19a9/0x3350
Allocated by task 167:
__kmalloc_cache_noprof+0x158/0x370
iscsi_target_login_thread+0x971/0x3350
which belongs to the cache kmalloc-8k of size 8192
allocated 8192-byte region
Falsifying the second login PDU instead reaches the other reader, on the
same buffer:
BUG: KASAN: slab-out-of-bounds in kmemdup_nul+0x43/0x80
Read of size 8193 at addr ffff888104d10000 by task kworker/1:1/50
Workqueue: isert_login_wq iscsi_target_do_login_rx
__asan_memcpy+0x23/0x60
kmemdup_nul+0x43/0x80
iscsi_decode_text_input+0xc6/0x11c0
iscsi_target_do_login+0x261/0x1470
iscsi_target_do_login_rx+0x51d/0x7d0
iscsit over TCP is not exposed: iscsit_get_login_rx() validates the
declared length with iscsi_target_check_login_request() and then reads
exactly that many bytes off the socket, so the declared length governs
how much arrives rather than how much is copied out of an already-filled
buffer. isert does not call iscsi_target_check_login_request() at all.
Reject a login PDU whose declared DataSegmentLength exceeds what was
received, in both paths that reach isert_rx_login_req():
isert_get_login_rx() for the first login PDU and isert_login_recv_done()
for the ones after it. dlength <= login_req_len is allowed because the
received count can include up to three bytes of iSCSI padding.
Once the check is in place the copy out can no longer exceed the copy in:
the posted login SGE is ISER_RX_PAYLOAD_SIZE, so login_req_len cannot
exceed MAX_KEY_VALUE_PAIRS and the min() in isert_rx_login_req() is
login_req_len.
Like the existing short-PDU check added by 29e7b925ae6d, the reject in
isert_login_recv_done() returns without completing login_req_comp, so a
malformed subsequent PDU leaves the login to be torn down by the login
timer rather than failing immediately. The first-PDU path returns an
error and fails straight away.
Reproduced on 7.2.0-rc4 with soft-RoCE (rdma_rxe) under KASAN, using an
initiator that sends the real key=value payload while declaring 8193 in
the BHS, on the first login PDU and on the second in separate runs. The
reported read size tracks the declared value exactly; 16384 and 61440
behave the same. Unpatched 3 of 3 runs report on each of the two paths,
patched 0 of 3 on both, run alternately in a single session, and a normal
login still completes on the patched build.
Fixes: b8d26b3be8b3 ("iser-target: Add iSCSI Extensions for RDMA (iSER) target driver")
Suggested-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Link: https://patch.msgid.link/20260726163931.971063-3-yhlee@isslab.korea.ac.kr
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/ulp/isert/ib_isert.c | 25 ++++++++++++++++++++++++-
1 file changed, 24 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index 9426aeeaddecc..1fcaf7df8b398 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -973,6 +973,21 @@ isert_put_login_tx(struct iscsit_conn *conn, struct iscsi_login *login,
return 0;
}
+static int
+isert_check_login_req(struct isert_conn *isert_conn)
+{
+ struct iscsi_hdr *hdr = isert_get_iscsi_hdr(isert_conn->login_desc);
+ u32 dlength = ntoh24(hdr->dlength);
+
+ if (unlikely(dlength > (u32)isert_conn->login_req_len)) {
+ isert_dbg("login PDU declares %u data bytes but only %d were received\n",
+ dlength, isert_conn->login_req_len);
+ return -EINVAL;
+ }
+
+ return 0;
+}
+
static void
isert_rx_login_req(struct isert_conn *isert_conn)
{
@@ -1411,8 +1426,12 @@ isert_login_recv_done(struct ib_cq *cq, struct ib_wc *wc)
if (isert_conn->conn) {
struct iscsi_login *login = isert_conn->conn->conn_login;
- if (login && !login->first_request)
+ if (login && !login->first_request) {
+ if (isert_check_login_req(isert_conn))
+ return;
+
isert_rx_login_req(isert_conn);
+ }
}
mutex_lock(&isert_conn->mutex);
@@ -2377,6 +2396,10 @@ isert_get_login_rx(struct iscsit_conn *conn, struct iscsi_login *login)
if (!login->first_request)
return 0;
+ ret = isert_check_login_req(isert_conn);
+ if (ret)
+ return ret;
+
isert_rx_login_req(isert_conn);
isert_info("before login_comp conn: %p\n", conn);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0728/1376] nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (726 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0727/1376] IB/isert: reject login " Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0729/1376] spi: davinci: switch to managed controller allocation Greg Kroah-Hartman
` (270 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Guixin Liu,
Keith Busch, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guixin Liu <kanie@linux.alibaba.com>
[ Upstream commit f49d0c3a8d56a7cda1628ae17341a4a42063563c ]
__nvme_fc_init_request() maps cmd_iu and then rsp_iu for DMA. If the
rsp_iu mapping fails, the original code only recorded the error and fell
through: it left the already-mapped cmd_iu unmapped and still marked the
op as FCPOP_STATE_IDLE before returning. Since blk-mq does not call
.exit_request() when .init_request() fails, the cmd_iu mapping is leaked
for every op whose rsp_iu mapping fails.
Jump to an error path on rsp_iu mapping failure that unmaps cmd_iu and
returns the error without marking the op idle, so it stays in the
FCPOP_STATE_UNINIT state set by the initial memset().
Fixes: e399441de911 ("nvme-fabrics: Add host support for FC transport")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/fc.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index 2bee5873d1558..fd0d99c0f97d9 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -2092,9 +2092,15 @@ __nvme_fc_init_request(struct nvme_fc_ctrl *ctrl,
dev_err(ctrl->dev,
"FCP Op failed - rspiu dma mapping failed.\n");
ret = -EFAULT;
+ goto out_unmap;
}
atomic_set(&op->state, FCPOP_STATE_IDLE);
+ return 0;
+
+out_unmap:
+ fc_dma_unmap_single(ctrl->lport->dev, op->fcp_req.cmddma,
+ sizeof(op->cmd_iu), DMA_TO_DEVICE);
out_on_error:
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0729/1376] spi: davinci: switch to managed controller allocation
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (727 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0728/1376] nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0730/1376] wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() Greg Kroah-Hartman
` (269 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fan Wu, Mark Brown, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
[ Upstream commit ea408a05dc8f18b4a184b88d6e19d2fd1acc1527 ]
The controller is allocated with the non-managed spi_alloc_host() while
the interrupt is registered with devm_request_threaded_irq(). During
removal, spi_bitbang_stop() only unregisters the controller; the
subsequent spi_controller_put() then frees the controller together with
its embedded davinci_spi devdata, which is the IRQ handler's dev_id.
The devm_request_threaded_irq() release action (free_irq()), which
drains the handler, does not run until after .remove() returns. A late
or latched interrupt can therefore reach davinci_spi_irq() and
dereference already-freed memory.
Switch to devm_spi_alloc_host() so that the devres LIFO order releases
the controller only after free_irq() has drained the handler, and drop
the now-redundant spi_controller_put() from .remove(). The probe error
path is simplified to direct returns.
The clock is acquired with devm_clk_get_enabled(), which is registered
after the IRQ and thus released before it by the devres LIFO order.
Drain the interrupt explicitly with devm_free_irq() before disabling the
controller so that a late interrupt cannot access the registers of a
clock-gated controller.
This issue was found by an in-house static analysis tool.
Fixes: 5b3bb5963ff2 ("spi: davinci: Use devm_*() functions")
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Link: https://patch.msgid.link/20260719010014.3163356-2-fanwu01@zju.edu.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-davinci.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/spi/spi-davinci.c b/drivers/spi/spi-davinci.c
index ad26c8409733c..cfe4f8edfcbdf 100644
--- a/drivers/spi/spi-davinci.c
+++ b/drivers/spi/spi-davinci.c
@@ -868,7 +868,7 @@ static int davinci_spi_probe(struct platform_device *pdev)
int ret = 0;
u32 spipc0;
- host = spi_alloc_host(&pdev->dev, sizeof(struct davinci_spi));
+ host = devm_spi_alloc_host(&pdev->dev, sizeof(struct davinci_spi));
if (host == NULL) {
ret = -ENOMEM;
goto err;
@@ -998,7 +998,6 @@ static int davinci_spi_probe(struct platform_device *pdev)
dma_release_channel(dspi->dma_tx);
}
free_host:
- spi_controller_put(host);
err:
return ret;
}
@@ -1022,6 +1021,8 @@ static void davinci_spi_remove(struct platform_device *pdev)
spi_bitbang_stop(&dspi->bitbang);
+ devm_free_irq(&pdev->dev, dspi->irq, dspi);
+
/* This bit needs to be cleared to disable dpsi->clk */
clear_io_bits(dspi->base + SPIGCR1, SPIGCR1_POWERDOWN_MASK);
@@ -1029,8 +1030,6 @@ static void davinci_spi_remove(struct platform_device *pdev)
dma_release_channel(dspi->dma_rx);
dma_release_channel(dspi->dma_tx);
}
-
- spi_controller_put(host);
}
static struct platform_driver davinci_spi_driver = {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0730/1376] wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (728 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0729/1376] spi: davinci: switch to managed controller allocation Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0731/1376] PCI: starfive: Fix Runtime PM handling and teardown ordering Greg Kroah-Hartman
` (268 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rameshkumar Sundaram, Baochen Qiang,
Jeff Johnson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
[ Upstream commit 208d7fdb85976a737a715b81d54efaff6703880c ]
There is no policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so
the parse infrastructure does not enforce a minimum length for the event
struct. Additionally, the num_vdevs field is taken directly from firmware
and used as a loop bound over the vdev_ids array without checking that it
fits within the TLV payload. Either condition can cause an out-of-bounds
read.
Add a TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT so
the parse infrastructure enforces a minimum length for the fixed-size event
struct. Add a helper ath11k_wmi_tlv_data_len() to recover the payload
length of a parsed TLV from the header preceding its data pointer. Use it
in ath11k_wmi_process_csa_switch_count_event() to bound num_vdevs before
the loop.
Compile tested only.
Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260724-ath12k_wmi_process_csa_switch_count_event-cleanup-v2-2-02a45d7246c0@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath11k/wmi.c | 21 +++++++++++++++++++--
1 file changed, 19 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c
index 570c5e051b8c9..d0dbc1871ee7f 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.c
+++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -159,6 +159,8 @@ static const struct wmi_tlv_policy wmi_tlv_policies[] = {
.min_len = sizeof(struct ath11k_wmi_p2p_noa_info) },
[WMI_TAG_P2P_NOA_EVENT] = {
.min_len = sizeof(struct wmi_p2p_noa_event) },
+ [WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT] = {
+ .min_len = sizeof(struct wmi_pdev_csa_switch_ev) },
};
#define PRIMAP(_hw_mode_) \
@@ -262,6 +264,13 @@ const void **ath11k_wmi_tlv_parse_alloc(struct ath11k_base *ab,
return tb;
}
+static u32 ath11k_wmi_tlv_data_len(const void *data)
+{
+ const struct wmi_tlv *tlv = (const struct wmi_tlv *)data - 1;
+
+ return FIELD_GET(WMI_TLV_LEN, tlv->header);
+}
+
static int ath11k_wmi_cmd_send_nowait(struct ath11k_pdev_wmi *wmi, struct sk_buff *skb,
u32 cmd_id)
{
@@ -8302,15 +8311,23 @@ ath11k_wmi_process_csa_switch_count_event(struct ath11k_base *ab,
const struct wmi_pdev_csa_switch_ev *ev,
const u32 *vdev_ids)
{
- int i;
+ u32 vdev_ids_len = ath11k_wmi_tlv_data_len(vdev_ids);
+ u32 num_vdevs = ev->num_vdevs;
struct ath11k_vif *arvif;
+ int i;
/* Finish CSA once the switch count becomes NULL */
if (ev->current_switch_count)
return;
+ if (num_vdevs > vdev_ids_len / sizeof(*vdev_ids)) {
+ ath11k_warn(ab, "csa switch count num_vdevs %u exceeds tlv array length %u\n",
+ num_vdevs, vdev_ids_len);
+ return;
+ }
+
rcu_read_lock();
- for (i = 0; i < ev->num_vdevs; i++) {
+ for (i = 0; i < num_vdevs; i++) {
arvif = ath11k_mac_get_arvif_by_vdev_id(ab, vdev_ids[i]);
if (!arvif) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0731/1376] PCI: starfive: Fix Runtime PM handling and teardown ordering
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (729 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0730/1376] wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0732/1376] PCI: starfive: Fix unchecked pm_runtime_get_sync() in probe Greg Kroah-Hartman
` (267 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ali Tariq, Manivannan Sadhasivam,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ali Tariq <alitariq45892@gmail.com>
[ Upstream commit fb9f7973473fc30d62e0f5f90d59df8ef5223777 ]
The starfive_pcie_remove() path incorrectly disabled runtime PM
before executing plda_pcie_host_deinit(), which can cause unmanaged
hardware register access in plda_pcie_host_deinit() while power domains or
clocks are disabled.
Fix this by restructuring starfive_pcie_remove() to deinitialize the host
controller first while runtime PM is active, followed by a synchronous
pm_runtime_put_sync() and pm_runtime_disable().
This bug was found in automated AI review by sashiko-bot.
Fixes: 39b91eb40c6a ("PCI: starfive: Add JH7110 PCIe controller")
Closes: https://lore.kernel.org/linux-pci/20260712180440.423421F000E9@smtp.kernel.org/
Signed-off-by: Ali Tariq <alitariq45892@gmail.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Link: https://patch.msgid.link/20260718133825.445041-1-alitariq45892@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/plda/pcie-starfive.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/pci/controller/plda/pcie-starfive.c b/drivers/pci/controller/plda/pcie-starfive.c
index 0a0b5a7d84d7e..d859c14eb1e23 100644
--- a/drivers/pci/controller/plda/pcie-starfive.c
+++ b/drivers/pci/controller/plda/pcie-starfive.c
@@ -431,9 +431,9 @@ static void starfive_pcie_remove(struct platform_device *pdev)
{
struct starfive_jh7110_pcie *pcie = platform_get_drvdata(pdev);
- pm_runtime_put(&pdev->dev);
- pm_runtime_disable(&pdev->dev);
plda_pcie_host_deinit(&pcie->plda);
+ pm_runtime_put_sync(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
platform_set_drvdata(pdev, NULL);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0732/1376] PCI: starfive: Fix unchecked pm_runtime_get_sync() in probe
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (730 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0731/1376] PCI: starfive: Fix Runtime PM handling and teardown ordering Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0733/1376] platform/chrome: cros_ec_debugfs: Clean up console log on probe failure Greg Kroah-Hartman
` (266 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ali Tariq, Manivannan Sadhasivam,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ali Tariq <alitariq45892@gmail.com>
[ Upstream commit aaae917990623a6ca6b638557056606a1ae4a8d6 ]
pm_runtime_get_sync() is called in starfive_pcie_probe() without
checking its return value. If runtime resume fails, the driver
proceeds to configure PCIe hardware through regmap_update_bits(),
enable clocks and resets, and power on the PHY, even though the
device may not actually be powered.
pm_runtime_get_sync() also increments the usage counter even when
resume fails, which would leave the counter unbalanced if this
error path were later handled without additional cleanup.
Switch to pm_runtime_resume_and_get(), which balances the usage
counter internally on failure, and bail out of probe before any
hardware is touched if resume does not succeed.
Tested on StarFive VisionFive 2 v1.2A board.
Fixes: 6168efbebace ("PCI: starfive: Enable controller runtime PM before probing host bridge")
Signed-off-by: Ali Tariq <alitariq45892@gmail.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Link: https://patch.msgid.link/20260718153352.661930-1-alitariq45892@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/plda/pcie-starfive.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/pci/controller/plda/pcie-starfive.c b/drivers/pci/controller/plda/pcie-starfive.c
index d859c14eb1e23..aeaebe9cd3608 100644
--- a/drivers/pci/controller/plda/pcie-starfive.c
+++ b/drivers/pci/controller/plda/pcie-starfive.c
@@ -405,7 +405,11 @@ static int starfive_pcie_probe(struct platform_device *pdev)
return ret;
pm_runtime_enable(&pdev->dev);
- pm_runtime_get_sync(&pdev->dev);
+ ret = pm_runtime_resume_and_get(&pdev->dev);
+ if (ret < 0) {
+ pm_runtime_disable(&pdev->dev);
+ return dev_err_probe(dev, ret, "failed to resume device\n");
+ }
plda->host_ops = &sf_host_ops;
plda->num_events = PLDA_MAX_EVENT_NUM;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0733/1376] platform/chrome: cros_ec_debugfs: Clean up console log on probe failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (731 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0732/1376] PCI: starfive: Fix unchecked pm_runtime_get_sync() in probe Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0734/1376] platform/chrome: cros_ec_debugfs: Unregister panic notifier Greg Kroah-Hartman
` (265 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hongyan Xu, Tzung-Bi Shih,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongyan Xu <getshell@seu.edu.cn>
[ Upstream commit 5d187600c4603b8f7812b12ce359a11ad7a7fd3a ]
Add a dedicated error label for failures after successful console log
setup.
Fixes: d90fa2c64d59 ("platform/chrome: cros_ec: Poll EC log on EC panic")
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
Link: https://lore.kernel.org/r/c00974953a1b952f51f0f021d7f9fad134159909.1785320940.git.getshell@seu.edu.cn
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/chrome/cros_ec_debugfs.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/platform/chrome/cros_ec_debugfs.c b/drivers/platform/chrome/cros_ec_debugfs.c
index 839154c46e46c..ef93b34c7dd07 100644
--- a/drivers/platform/chrome/cros_ec_debugfs.c
+++ b/drivers/platform/chrome/cros_ec_debugfs.c
@@ -525,7 +525,7 @@ static int cros_ec_debugfs_probe(struct platform_device *pd)
ret = blocking_notifier_chain_register(&ec->ec_dev->panic_notifier,
&debug_info->notifier_panic);
if (ret)
- goto remove_debugfs;
+ goto cleanup_console_log;
ec->debug_info = debug_info;
@@ -533,6 +533,8 @@ static int cros_ec_debugfs_probe(struct platform_device *pd)
return 0;
+cleanup_console_log:
+ cros_ec_cleanup_console_log(debug_info);
remove_debugfs:
debugfs_remove_recursive(debug_info->dir);
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0734/1376] platform/chrome: cros_ec_debugfs: Unregister panic notifier
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (732 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0733/1376] platform/chrome: cros_ec_debugfs: Clean up console log on probe failure Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0735/1376] wifi: rtlwifi: pci: fix error path in rtl_pci_probe() Greg Kroah-Hartman
` (264 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hongyan Xu, Tzung-Bi Shih,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongyan Xu <getshell@seu.edu.cn>
[ Upstream commit e5954d3031fb55dd31aa59bae477d63c68e941c0 ]
cros_ec_debugfs_probe() registers notifier_panic with the EC panic
notifier chain. The remove path tears down debugfs and the console log,
but leaves the notifier registered. A later panic notification can call
back into the removed instance and queue work that accesses released
data.
Unregister the panic notifier before tearing down the debugfs and
console log state.
This issue was found by a static analysis tool.
Fixes: d90fa2c64d59 ("platform/chrome: cros_ec: Poll EC log on EC panic")
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
Link: https://lore.kernel.org/r/f3ab74ef8034be63bb45a325f3d54656d658817f.1785320940.git.getshell@seu.edu.cn
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/chrome/cros_ec_debugfs.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/platform/chrome/cros_ec_debugfs.c b/drivers/platform/chrome/cros_ec_debugfs.c
index ef93b34c7dd07..21b328ea9a331 100644
--- a/drivers/platform/chrome/cros_ec_debugfs.c
+++ b/drivers/platform/chrome/cros_ec_debugfs.c
@@ -544,6 +544,8 @@ static void cros_ec_debugfs_remove(struct platform_device *pd)
{
struct cros_ec_dev *ec = dev_get_drvdata(pd->dev.parent);
+ blocking_notifier_chain_unregister(&ec->ec_dev->panic_notifier,
+ &ec->debug_info->notifier_panic);
debugfs_remove_recursive(ec->debug_info->dir);
cros_ec_cleanup_console_log(ec->debug_info);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0735/1376] wifi: rtlwifi: pci: fix error path in rtl_pci_probe()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (733 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0734/1376] platform/chrome: cros_ec_debugfs: Unregister panic notifier Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0736/1376] bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET Greg Kroah-Hartman
` (263 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Ping-Ke Shih,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
[ Upstream commit 3c2999d13eeb222ae56631aeb7ca248090f2b210 ]
In the last error path in rtl_pci_probe(), the cleanup functions are
skipped due to a wrong goto label. Moreover, the successful call to
rtl_init_rfkill(), ieee80211_register_hw(), rtl_debug_add_one() have to
be reverted. Fix this issue by updating the labels and adding the
relevant cleanup functions to the last error path.
Fixes: 0c8173385e54 ("rtl8192ce: Add new driver")
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260723120118.145383-1-nihaal@cse.iitm.ac.in
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtlwifi/pci.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
index f0010336e78c1..8fb9604c3c533 100644
--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
+++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
@@ -2226,13 +2226,17 @@ int rtl_pci_probe(struct pci_dev *pdev,
rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
"%s: failed to register IRQ handler\n",
wiphy_name(hw->wiphy));
- goto fail3;
+ goto fail6;
}
rtlpci->irq_alloc = 1;
set_bit(RTL_STATUS_INTERFACE_START, &rtlpriv->status);
return 0;
+fail6:
+ rtl_deinit_rfkill(hw);
+ rtl_debug_remove_one(hw);
+ ieee80211_unregister_hw(hw);
fail5:
rtl_pci_deinit(hw);
fail4:
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0736/1376] bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (734 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0735/1376] wifi: rtlwifi: pci: fix error path in rtl_pci_probe() Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0737/1376] bus: mhi: host: Fix controller cleanup on EDL sysfs failure Greg Kroah-Hartman
` (262 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Williamson,
Manivannan Sadhasivam, Manivannan Sadhasivam, Jeff Hugo,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
[ Upstream commit 24f4423cbc89548def2b05ae86de6175086dbf94 ]
mhi_soc_reset() tries to reset the device by writing to the
MHI_SOC_RESET_REQ_OFFSET register. But it doesn't do a read-back to ensure
that the write gets flushed to the device before returning to the caller.
This may lead to the delay (if implemented) on the caller to be
insufficient, if the posted write doesn't reach the device before the
delay.
So add a read-back after writing to the MHI_SOC_RESET_REQ_OFFSET register.
Fixes: b5a8d233a588 ("bus: mhi: core: Add device hardware reset support")
Reported-by: Alex Williamson <alex@shazbot.org>
Closes: https://lore.kernel.org/linux-pci/20260622160822.09350246@shazbot.org
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
Link: https://patch.msgid.link/20260623145134.43976-1-manivannan.sadhasivam@oss.qualcomm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bus/mhi/host/main.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/bus/mhi/host/main.c b/drivers/bus/mhi/host/main.c
index 45ec1b585577d..846aee2a42a0b 100644
--- a/drivers/bus/mhi/host/main.c
+++ b/drivers/bus/mhi/host/main.c
@@ -170,6 +170,9 @@ EXPORT_SYMBOL_GPL(mhi_get_mhi_state);
void mhi_soc_reset(struct mhi_controller *mhi_cntrl)
{
+ int __maybe_unused ret;
+ u32 tmp;
+
if (mhi_cntrl->reset) {
mhi_cntrl->reset(mhi_cntrl);
return;
@@ -178,6 +181,9 @@ void mhi_soc_reset(struct mhi_controller *mhi_cntrl)
/* Generic MHI SoC reset */
mhi_write_reg(mhi_cntrl, mhi_cntrl->regs, MHI_SOC_RESET_REQ_OFFSET,
MHI_SOC_RESET_REQ);
+ /* Flush the posted write to the device (ignore return value) */
+ ret = mhi_read_reg(mhi_cntrl, mhi_cntrl->regs, MHI_SOC_RESET_REQ_OFFSET,
+ &tmp);
}
EXPORT_SYMBOL_GPL(mhi_soc_reset);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0737/1376] bus: mhi: host: Fix controller cleanup on EDL sysfs failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (735 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0736/1376] bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0738/1376] md/raid5: protect bitmap batch counters aka seq_flush/seq_write consistency Greg Kroah-Hartman
` (261 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuho Choi, Manivannan Sadhasivam,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <dbgh9129@gmail.com>
[ Upstream commit 0d5b9e66591d4e2a4376ac82c8cda889a29ba3ee ]
mhi_register_controller() adds the controller device before creating the
optional trigger_edl sysfs file. If sysfs_create_file() fails, the error
path only drops the device reference and leaves the device registered.
Hence, call device_del() in the error path before put_device().
Fixes: 17553ba8e19d ("bus: mhi: host: Add sysfs entry to force device to enter EDL")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bus/mhi/host/init.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/bus/mhi/host/init.c b/drivers/bus/mhi/host/init.c
index 223fc54c45b3e..9a917f14ab1b7 100644
--- a/drivers/bus/mhi/host/init.c
+++ b/drivers/bus/mhi/host/init.c
@@ -1042,7 +1042,7 @@ int mhi_register_controller(struct mhi_controller *mhi_cntrl,
if (mhi_cntrl->edl_trigger) {
ret = sysfs_create_file(&mhi_dev->dev.kobj, &dev_attr_trigger_edl.attr);
if (ret)
- goto err_release_dev;
+ goto err_del_dev;
}
mhi_cntrl->mhi_dev = mhi_dev;
@@ -1051,6 +1051,8 @@ int mhi_register_controller(struct mhi_controller *mhi_cntrl,
return 0;
+err_del_dev:
+ device_del(&mhi_dev->dev);
err_release_dev:
put_device(&mhi_dev->dev);
error_setup_irq:
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0738/1376] md/raid5: protect bitmap batch counters aka seq_flush/seq_write consistency
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (736 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0737/1376] bus: mhi: host: Fix controller cleanup on EDL sysfs failure Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0739/1376] md/raid5-ppl: fix use-after-free in ppl_do_flush() Greg Kroah-Hartman
` (260 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chen Cheng, Yu Kuai, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Cheng <chencheng@fnnas.com>
[ Upstream commit f565925810cb8bc799421485770e15d922ef766a ]
kcsan detect race :
- raid5d() closes the current bitmap batch by updating
conf->seq_flush under conf->device_lock.
- __add_stripe_bio() read conf->seq_flush without that
lock when assigning sh->bm_seq.
so, protect seq_flush/seq_write consistency for multiple CPUs by
READ_ONCE()/WRITE_ONCE() under the path without held device_lock.
re-explain the stripe batch sequence number update flow:
1. sh->bm_seq declare which batch number the stripe belongs to
when perform bitmap-related write.
==> bm_seq = seq_flush+1
2. stripe be handled,
* if sh->bm_seq - conf->seq_write > 0, means the
batch stripes **newer than** the last written
batch, it cannot proceed yet, queued on bitmap_list.
* otherwise , has already proceed.
3. raid5d() `++seq_flush` to closes the current batch, means
* no more stripes join that old batch
* just-closed batch ready to write-out to disk
4. raid5d() calls bitmap hooks unplug() or writeout, then,
`++seq_write` to the same as bm_seq.
- seq_flush - for producer, to close batches.
- seq_write - for consumer, the checkpoint number.
the report:
====================================
BUG: KCSAN: data-race in __add_stripe_bio / raid5d
write to 0xffff88ba5625d470 of 4 bytes by task 82401 on cpu 0:
raid5d+0x1d9/0xba0
[.....]
read to 0xffff88ba5625d470 of 4 bytes by task 82421 on cpu 8:
__add_stripe_bio+0x332/0x400
raid5_make_request+0x6ac/0x2930
md_handle_request+0x4a2/0xa40
md_submit_bio+0x109/0x1a0
__submit_bio+0x2ec/0x390
[.....]
Fixes: 7c13edc87510 ("md: incorporate new plugging into raid5.")
v1 -> v2:
- remove WRITE_ONCE(conf->seq_write) in held device_lock path.
- remove READ_ONCE(conf->seq_flush) in held device_lock path.
Signed-off-by: Chen Cheng <chencheng@fnnas.com>
Reviewed-by: Yu Kuai <yukuai@fygo.io>
Link: https://patch.msgid.link/20260622124649.1780233-1-chencheng@fnnas.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/raid5.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index b315d36b7f500..6e42366b15ca1 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -3545,7 +3545,7 @@ static void __add_stripe_bio(struct stripe_head *sh, struct bio *bi,
sh->dev[dd_idx].sector);
if (conf->mddev->bitmap && firstwrite && !sh->batch_head) {
- sh->bm_seq = conf->seq_flush+1;
+ sh->bm_seq = READ_ONCE(conf->seq_flush) + 1;
set_bit(STRIPE_BIT_DELAY, &sh->state);
}
}
@@ -5751,7 +5751,7 @@ static void make_discard_request(struct mddev *mddev, struct bio *bi)
}
spin_unlock_irq(&sh->stripe_lock);
if (conf->mddev->bitmap) {
- sh->bm_seq = conf->seq_flush + 1;
+ sh->bm_seq = READ_ONCE(conf->seq_flush) + 1;
set_bit(STRIPE_BIT_DELAY, &sh->state);
}
@@ -6788,11 +6788,13 @@ static void raid5d(struct md_thread *thread)
if (
!list_empty(&conf->bitmap_list)) {
/* Now is a good time to flush some bitmap updates */
- conf->seq_flush++;
+ int seq = conf->seq_flush + 1;
+
+ WRITE_ONCE(conf->seq_flush, seq);
spin_unlock_irq(&conf->device_lock);
mddev->bitmap_ops->unplug(mddev, true);
spin_lock_irq(&conf->device_lock);
- conf->seq_write = conf->seq_flush;
+ conf->seq_write = seq;
activate_bit_delay(conf, conf->temp_inactive_list);
}
raid5_activate_delayed(conf);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0739/1376] md/raid5-ppl: fix use-after-free in ppl_do_flush()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (737 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0738/1376] md/raid5: protect bitmap batch counters aka seq_flush/seq_write consistency Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0740/1376] md: ensure resync is prioritized over recovery Greg Kroah-Hartman
` (259 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Sajal Gupta, Yu Kuai,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sajal Gupta <sajal2005gupta@gmail.com>
[ Upstream commit 371f7a1b392edc8b7cf449cc7713179b588f2d0e ]
The loop in ppl_do_flush() continues iterating after calling
ppl_io_unit_finished(), touching io->pending_flushes and leading to a
use-after-free.
Add a break statement to stop the loop once io is freed.
Fixes: 1532d9e87e8b ("raid5-ppl: PPL support for disks with write-back cache enabled")
Reported-by: Dan Carpenter <error27@gmail.com>
Closes: https://lore.kernel.org/all/ajJF2wKYWRk4GGCK@stanley.mountain/
Signed-off-by: Sajal Gupta <sajal2005gupta@gmail.com>
Reviewed-by: Yu Kuai <yukuai@fygo.io>
Link: https://patch.msgid.link/20260622142146.56637-1-sajal2005gupta@gmail.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/raid5-ppl.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/md/raid5-ppl.c b/drivers/md/raid5-ppl.c
index a70cbec12ed01..c3cfdd66d8b0c 100644
--- a/drivers/md/raid5-ppl.c
+++ b/drivers/md/raid5-ppl.c
@@ -643,8 +643,10 @@ static void ppl_do_flush(struct ppl_io_unit *io)
log->disk_flush_bitmap = 0;
for (i = flushed_disks ; i < raid_disks; i++) {
- if (atomic_dec_and_test(&io->pending_flushes))
+ if (atomic_dec_and_test(&io->pending_flushes)) {
ppl_io_unit_finished(io);
+ break;
+ }
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0740/1376] md: ensure resync is prioritized over recovery
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (738 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0739/1376] md/raid5-ppl: fix use-after-free in ppl_do_flush() Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0741/1376] md: allow removing faulty rdev during resync Greg Kroah-Hartman
` (258 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Li Nan, Yu Kuai, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Nan <linan122@huawei.com>
[ Upstream commit 4b10a3bc67c1232f76aa1e04778ca26d6c0ddf7f ]
If a new disk is added during resync, the resync process is interrupted,
and recovery is triggered, causing the previous resync to be lost. In
reality, disk addition should not terminate resync, fix it.
Steps to reproduce the issue:
mdadm -CR /dev/md0 -l1 -n3 -x1 /dev/sd[abcd]
mdadm --fail /dev/md0 /dev/sdc
Fixes: 24dd469d728d ("[PATCH] md: allow a manual resync with md")
Signed-off-by: Li Nan <linan122@huawei.com>
Reviewed-by: Yu Kuai <yukuai3@huawei.com>
Link: https://lore.kernel.org/linux-raid/20250213131530.3698600-1-linan666@huaweicloud.com
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Stable-dep-of: a47431dfb353 ("md/raid5: protect lockless recovery_offset accesses during reshape")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/md.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 02bf5d37888b9..90fe53d5bd818 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -9488,6 +9488,13 @@ static bool md_choose_sync_action(struct mddev *mddev, int *spares)
return true;
}
+ /* Check if resync is in progress. */
+ if (mddev->recovery_cp < MaxSector) {
+ set_bit(MD_RECOVERY_SYNC, &mddev->recovery);
+ clear_bit(MD_RECOVERY_RECOVER, &mddev->recovery);
+ return true;
+ }
+
/*
* Remove any failed drives, then add spares if possible. Spares are
* also removed and re-added, to allow the personality to fail the
@@ -9504,13 +9511,6 @@ static bool md_choose_sync_action(struct mddev *mddev, int *spares)
return true;
}
- /* Check if recovery is in progress. */
- if (mddev->recovery_cp < MaxSector) {
- set_bit(MD_RECOVERY_SYNC, &mddev->recovery);
- clear_bit(MD_RECOVERY_RECOVER, &mddev->recovery);
- return true;
- }
-
/* Delay to choose resync/check/repair in md_do_sync(). */
if (test_bit(MD_RECOVERY_SYNC, &mddev->recovery))
return true;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0741/1376] md: allow removing faulty rdev during resync
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (739 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0740/1376] md: ensure resync is prioritized over recovery Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0742/1376] md: rename recovery_cp to resync_offset Greg Kroah-Hartman
` (257 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zheng Qixing, Li Nan, Yu Kuai,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Qixing <zhengqixing@huawei.com>
[ Upstream commit c0ffeb648000acdc932da7a9d33fd65e9263c54c ]
During RAID resync, faulty rdev cannot be removed and will result in
"Device or resource busy" error when attempting hot removal.
Reproduction steps:
mdadm -Cv /dev/md0 -l1 -n3 -e1.2 /dev/sd{b..d}
mdadm /dev/md0 -f /dev/sdb
mdadm /dev/md0 -r /dev/sdb
-> mdadm: hot remove failed for /dev/sdb: Device or resource busy
After commit 4b10a3bc67c1 ("md: ensure resync is prioritized over
recovery"), when a device becomes faulty during resync, the
md_choose_sync_action() function returns early without calling
remove_and_add_spares(), preventing faulty device removal.
This patch extracts a helper function remove_spares() to support
removing faulty devices during RAID resync operations.
Fixes: 4b10a3bc67c1 ("md: ensure resync is prioritized over recovery")
Signed-off-by: Zheng Qixing <zhengqixing@huawei.com>
Reviewed-by: Li Nan <linan122@huawei.com>
Link: https://lore.kernel.org/linux-raid/20250707075412.150301-1-zhengqixing@huaweicloud.com
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Stable-dep-of: a47431dfb353 ("md/raid5: protect lockless recovery_offset accesses during reshape")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/md.c | 24 +++++++++++++++++-------
1 file changed, 17 insertions(+), 7 deletions(-)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 90fe53d5bd818..a5ca93c0223a6 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -9424,17 +9424,11 @@ static bool md_spares_need_change(struct mddev *mddev)
return false;
}
-static int remove_and_add_spares(struct mddev *mddev,
- struct md_rdev *this)
+static int remove_spares(struct mddev *mddev, struct md_rdev *this)
{
struct md_rdev *rdev;
- int spares = 0;
int removed = 0;
- if (this && test_bit(MD_RECOVERY_RUNNING, &mddev->recovery))
- /* Mustn't remove devices when resync thread is running */
- return 0;
-
rdev_for_each(rdev, mddev) {
if ((this == NULL || rdev == this) && rdev_removeable(rdev) &&
!mddev->pers->hot_remove_disk(mddev, rdev)) {
@@ -9448,6 +9442,21 @@ static int remove_and_add_spares(struct mddev *mddev,
if (removed && mddev->kobj.sd)
sysfs_notify_dirent_safe(mddev->sysfs_degraded);
+ return removed;
+}
+
+static int remove_and_add_spares(struct mddev *mddev,
+ struct md_rdev *this)
+{
+ struct md_rdev *rdev;
+ int spares = 0;
+ int removed = 0;
+
+ if (this && test_bit(MD_RECOVERY_RUNNING, &mddev->recovery))
+ /* Mustn't remove devices when resync thread is running */
+ return 0;
+
+ removed = remove_spares(mddev, this);
if (this && removed)
goto no_add;
@@ -9490,6 +9499,7 @@ static bool md_choose_sync_action(struct mddev *mddev, int *spares)
/* Check if resync is in progress. */
if (mddev->recovery_cp < MaxSector) {
+ remove_spares(mddev, NULL);
set_bit(MD_RECOVERY_SYNC, &mddev->recovery);
clear_bit(MD_RECOVERY_RECOVER, &mddev->recovery);
return true;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0742/1376] md: rename recovery_cp to resync_offset
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (740 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0741/1376] md: allow removing faulty rdev during resync Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0743/1376] md: add a new recovery_flag MD_RECOVERY_LAZY_RECOVER Greg Kroah-Hartman
` (256 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Li Nan, Yu Kuai, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Nan <linan122@huawei.com>
[ Upstream commit 907a99c314a5a695e35acff78ac61f4ec950a6d3 ]
'recovery_cp' was used to represent the progress of sync, but its name
contains recovery, which can cause confusion. Replaces 'recovery_cp'
with 'resync_offset' for clarity.
Signed-off-by: Li Nan <linan122@huawei.com>
Link: https://lore.kernel.org/linux-raid/20250722033340.1933388-1-linan666@huaweicloud.com
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Stable-dep-of: a47431dfb353 ("md/raid5: protect lockless recovery_offset accesses during reshape")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-raid.c | 42 ++++++++++++++--------------
drivers/md/md-bitmap.c | 8 +++---
drivers/md/md-cluster.c | 16 +++++------
drivers/md/md.c | 50 +++++++++++++++++-----------------
drivers/md/md.h | 2 +-
drivers/md/raid0.c | 6 ++--
drivers/md/raid1-10.c | 2 +-
drivers/md/raid1.c | 10 +++----
drivers/md/raid10.c | 16 +++++------
drivers/md/raid5-ppl.c | 6 ++--
drivers/md/raid5.c | 30 ++++++++++----------
include/uapi/linux/raid/md_p.h | 2 +-
12 files changed, 95 insertions(+), 95 deletions(-)
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index b7f1cd81ab056..5078623690290 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -438,7 +438,7 @@ static bool rs_is_reshapable(struct raid_set *rs)
/* Return true, if raid set in @rs is recovering */
static bool rs_is_recovering(struct raid_set *rs)
{
- return rs->md.recovery_cp < rs->md.dev_sectors;
+ return rs->md.resync_offset < rs->md.dev_sectors;
}
/* Return true, if raid set in @rs is reshaping */
@@ -768,7 +768,7 @@ static struct raid_set *raid_set_alloc(struct dm_target *ti, struct raid_type *r
rs->md.layout = raid_type->algorithm;
rs->md.new_layout = rs->md.layout;
rs->md.delta_disks = 0;
- rs->md.recovery_cp = MaxSector;
+ rs->md.resync_offset = MaxSector;
for (i = 0; i < raid_devs; i++)
md_rdev_init(&rs->dev[i].rdev);
@@ -912,7 +912,7 @@ static int parse_dev_params(struct raid_set *rs, struct dm_arg_set *as)
rs->md.external = 0;
rs->md.persistent = 1;
rs->md.major_version = 2;
- } else if (rebuild && !rs->md.recovery_cp) {
+ } else if (rebuild && !rs->md.resync_offset) {
/*
* Without metadata, we will not be able to tell if the array
* is in-sync or not - we must assume it is not. Therefore,
@@ -1699,20 +1699,20 @@ static void rs_setup_recovery(struct raid_set *rs, sector_t dev_sectors)
{
/* raid0 does not recover */
if (rs_is_raid0(rs))
- rs->md.recovery_cp = MaxSector;
+ rs->md.resync_offset = MaxSector;
/*
* A raid6 set has to be recovered either
* completely or for the grown part to
* ensure proper parity and Q-Syndrome
*/
else if (rs_is_raid6(rs))
- rs->md.recovery_cp = dev_sectors;
+ rs->md.resync_offset = dev_sectors;
/*
* Other raid set types may skip recovery
* depending on the 'nosync' flag.
*/
else
- rs->md.recovery_cp = test_bit(__CTR_FLAG_NOSYNC, &rs->ctr_flags)
+ rs->md.resync_offset = test_bit(__CTR_FLAG_NOSYNC, &rs->ctr_flags)
? MaxSector : dev_sectors;
}
@@ -2147,7 +2147,7 @@ static void super_sync(struct mddev *mddev, struct md_rdev *rdev)
sb->events = cpu_to_le64(mddev->events);
sb->disk_recovery_offset = cpu_to_le64(rdev->recovery_offset);
- sb->array_resync_offset = cpu_to_le64(mddev->recovery_cp);
+ sb->array_resync_offset = cpu_to_le64(mddev->resync_offset);
sb->level = cpu_to_le32(mddev->level);
sb->layout = cpu_to_le32(mddev->layout);
@@ -2340,18 +2340,18 @@ static int super_init_validation(struct raid_set *rs, struct md_rdev *rdev)
}
if (!test_bit(__CTR_FLAG_NOSYNC, &rs->ctr_flags))
- mddev->recovery_cp = le64_to_cpu(sb->array_resync_offset);
+ mddev->resync_offset = le64_to_cpu(sb->array_resync_offset);
/*
* During load, we set FirstUse if a new superblock was written.
* There are two reasons we might not have a superblock:
* 1) The raid set is brand new - in which case, all of the
* devices must have their In_sync bit set. Also,
- * recovery_cp must be 0, unless forced.
+ * resync_offset must be 0, unless forced.
* 2) This is a new device being added to an old raid set
* and the new device needs to be rebuilt - in which
* case the In_sync bit will /not/ be set and
- * recovery_cp must be MaxSector.
+ * resync_offset must be MaxSector.
* 3) This is/are a new device(s) being added to an old
* raid set during takeover to a higher raid level
* to provide capacity for redundancy or during reshape
@@ -2396,8 +2396,8 @@ static int super_init_validation(struct raid_set *rs, struct md_rdev *rdev)
new_devs > 1 ? "s" : "");
return -EINVAL;
} else if (!test_bit(__CTR_FLAG_REBUILD, &rs->ctr_flags) && rs_is_recovering(rs)) {
- DMERR("'rebuild' specified while raid set is not in-sync (recovery_cp=%llu)",
- (unsigned long long) mddev->recovery_cp);
+ DMERR("'rebuild' specified while raid set is not in-sync (resync_offset=%llu)",
+ (unsigned long long) mddev->resync_offset);
return -EINVAL;
} else if (rs_is_reshaping(rs)) {
DMERR("'rebuild' specified while raid set is being reshaped (reshape_position=%llu)",
@@ -2702,11 +2702,11 @@ static int rs_adjust_data_offsets(struct raid_set *rs)
}
out:
/*
- * Raise recovery_cp in case data_offset != 0 to
+ * Raise resync_offset in case data_offset != 0 to
* avoid false recovery positives in the constructor.
*/
- if (rs->md.recovery_cp < rs->md.dev_sectors)
- rs->md.recovery_cp += rs->dev[0].rdev.data_offset;
+ if (rs->md.resync_offset < rs->md.dev_sectors)
+ rs->md.resync_offset += rs->dev[0].rdev.data_offset;
/* Adjust data offsets on all rdevs but on any raid4/5/6 journal device */
rdev_for_each(rdev, &rs->md) {
@@ -2761,7 +2761,7 @@ static int rs_setup_takeover(struct raid_set *rs)
}
clear_bit(MD_ARRAY_FIRST_USE, &mddev->flags);
- mddev->recovery_cp = MaxSector;
+ mddev->resync_offset = MaxSector;
while (d--) {
rdev = &rs->dev[d].rdev;
@@ -2769,7 +2769,7 @@ static int rs_setup_takeover(struct raid_set *rs)
if (test_bit(d, (void *) rs->rebuild_disks)) {
clear_bit(In_sync, &rdev->flags);
clear_bit(Faulty, &rdev->flags);
- mddev->recovery_cp = rdev->recovery_offset = 0;
+ mddev->resync_offset = rdev->recovery_offset = 0;
/* Bitmap has to be created when we do an "up" takeover */
set_bit(MD_ARRAY_FIRST_USE, &mddev->flags);
}
@@ -3227,7 +3227,7 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv)
if (r)
goto bad;
- rs_setup_recovery(rs, rs->md.recovery_cp < rs->md.dev_sectors ? rs->md.recovery_cp : rs->md.dev_sectors);
+ rs_setup_recovery(rs, rs->md.resync_offset < rs->md.dev_sectors ? rs->md.resync_offset : rs->md.dev_sectors);
} else {
/* This is no size change or it is shrinking, update size and record in superblocks */
r = rs_set_dev_and_array_sectors(rs, rs->ti->len, false);
@@ -3449,7 +3449,7 @@ static sector_t rs_get_progress(struct raid_set *rs, unsigned long recovery,
} else {
if (state == st_idle && !test_bit(MD_RECOVERY_INTR, &recovery))
- r = mddev->recovery_cp;
+ r = mddev->resync_offset;
else
r = mddev->curr_resync_completed;
@@ -4079,9 +4079,9 @@ static int raid_preresume(struct dm_target *ti)
}
/* Check for any resize/reshape on @rs and adjust/initiate */
- if (mddev->recovery_cp && mddev->recovery_cp < MaxSector) {
+ if (mddev->resync_offset && mddev->resync_offset < MaxSector) {
set_bit(MD_RECOVERY_REQUESTED, &mddev->recovery);
- mddev->resync_min = mddev->recovery_cp;
+ mddev->resync_min = mddev->resync_offset;
if (test_bit(RT_FLAG_RS_GROW, &rs->runtime_flags))
mddev->resync_max_sectors = mddev->dev_sectors;
}
diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c
index 21cdf48815f88..33b92b864f70c 100644
--- a/drivers/md/md-bitmap.c
+++ b/drivers/md/md-bitmap.c
@@ -1976,12 +1976,12 @@ static void bitmap_dirty_bits(struct mddev *mddev, unsigned long s,
md_bitmap_set_memory_bits(bitmap, sec, 1);
md_bitmap_file_set_bit(bitmap, sec);
- if (sec < bitmap->mddev->recovery_cp)
+ if (sec < bitmap->mddev->resync_offset)
/* We are asserting that the array is dirty,
- * so move the recovery_cp address back so
+ * so move the resync_offset address back so
* that it is obvious that it is dirty
*/
- bitmap->mddev->recovery_cp = sec;
+ bitmap->mddev->resync_offset = sec;
}
}
@@ -2247,7 +2247,7 @@ static int bitmap_load(struct mddev *mddev)
|| bitmap->events_cleared == mddev->events)
/* no need to keep dirty bits to optimise a
* re-add of a missing device */
- start = mddev->recovery_cp;
+ start = mddev->resync_offset;
mutex_lock(&mddev->bitmap_info.mutex);
err = md_bitmap_init_from_disk(bitmap, start);
diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c
index bf9ab478df2c0..7ee6edccd20a6 100644
--- a/drivers/md/md-cluster.c
+++ b/drivers/md/md-cluster.c
@@ -337,11 +337,11 @@ static void recover_bitmaps(struct md_thread *thread)
md_wakeup_thread(mddev->sync_thread);
if (hi > 0) {
- if (lo < mddev->recovery_cp)
- mddev->recovery_cp = lo;
+ if (lo < mddev->resync_offset)
+ mddev->resync_offset = lo;
/* wake up thread to continue resync in case resync
* is not finished */
- if (mddev->recovery_cp != MaxSector) {
+ if (mddev->resync_offset != MaxSector) {
/*
* clear the REMOTE flag since we will launch
* resync thread in current node.
@@ -868,9 +868,9 @@ static int gather_all_resync_info(struct mddev *mddev, int total_slots)
lockres_free(bm_lockres);
continue;
}
- if ((hi > 0) && (lo < mddev->recovery_cp)) {
+ if ((hi > 0) && (lo < mddev->resync_offset)) {
set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
- mddev->recovery_cp = lo;
+ mddev->resync_offset = lo;
md_check_recovery(mddev);
}
@@ -1032,7 +1032,7 @@ static int leave(struct mddev *mddev)
* Also, we should send BITMAP_NEEDS_SYNC message in
* case reshaping is interrupted.
*/
- if ((cinfo->slot_number > 0 && mddev->recovery_cp != MaxSector) ||
+ if ((cinfo->slot_number > 0 && mddev->resync_offset != MaxSector) ||
(mddev->reshape_position != MaxSector &&
test_bit(MD_CLOSING, &mddev->flags)))
resync_bitmap(mddev);
@@ -1610,8 +1610,8 @@ static int gather_bitmaps(struct md_rdev *rdev)
pr_warn("md-cluster: Could not gather bitmaps from slot %d", sn);
goto out;
}
- if ((hi > 0) && (lo < mddev->recovery_cp))
- mddev->recovery_cp = lo;
+ if ((hi > 0) && (lo < mddev->resync_offset))
+ mddev->resync_offset = lo;
}
out:
return err;
diff --git a/drivers/md/md.c b/drivers/md/md.c
index a5ca93c0223a6..b6b9168aa5bff 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1372,13 +1372,13 @@ static int super_90_validate(struct mddev *mddev, struct md_rdev *freshest, stru
mddev->layout = -1;
if (sb->state & (1<<MD_SB_CLEAN))
- mddev->recovery_cp = MaxSector;
+ mddev->resync_offset = MaxSector;
else {
if (sb->events_hi == sb->cp_events_hi &&
sb->events_lo == sb->cp_events_lo) {
- mddev->recovery_cp = sb->recovery_cp;
+ mddev->resync_offset = sb->resync_offset;
} else
- mddev->recovery_cp = 0;
+ mddev->resync_offset = 0;
}
memcpy(mddev->uuid+0, &sb->set_uuid0, 4);
@@ -1504,13 +1504,13 @@ static void super_90_sync(struct mddev *mddev, struct md_rdev *rdev)
mddev->minor_version = sb->minor_version;
if (mddev->in_sync)
{
- sb->recovery_cp = mddev->recovery_cp;
+ sb->resync_offset = mddev->resync_offset;
sb->cp_events_hi = (mddev->events>>32);
sb->cp_events_lo = (u32)mddev->events;
- if (mddev->recovery_cp == MaxSector)
+ if (mddev->resync_offset == MaxSector)
sb->state = (1<< MD_SB_CLEAN);
} else
- sb->recovery_cp = 0;
+ sb->resync_offset = 0;
sb->layout = mddev->layout;
sb->chunk_size = mddev->chunk_sectors << 9;
@@ -1865,7 +1865,7 @@ static int super_1_validate(struct mddev *mddev, struct md_rdev *freshest, struc
mddev->bitmap_info.default_space = (4096-1024) >> 9;
mddev->reshape_backwards = 0;
- mddev->recovery_cp = le64_to_cpu(sb->resync_offset);
+ mddev->resync_offset = le64_to_cpu(sb->resync_offset);
memcpy(mddev->uuid, sb->set_uuid, 16);
mddev->max_disks = (4096-256)/2;
@@ -2051,7 +2051,7 @@ static void super_1_sync(struct mddev *mddev, struct md_rdev *rdev)
sb->utime = cpu_to_le64((__u64)mddev->utime);
sb->events = cpu_to_le64(mddev->events);
if (mddev->in_sync)
- sb->resync_offset = cpu_to_le64(mddev->recovery_cp);
+ sb->resync_offset = cpu_to_le64(mddev->resync_offset);
else if (test_bit(MD_JOURNAL_CLEAN, &mddev->flags))
sb->resync_offset = cpu_to_le64(MaxSector);
else
@@ -2744,7 +2744,7 @@ void md_update_sb(struct mddev *mddev, int force_change)
/* If this is just a dirty<->clean transition, and the array is clean
* and 'events' is odd, we can roll back to the previous clean state */
if (nospares
- && (mddev->in_sync && mddev->recovery_cp == MaxSector)
+ && (mddev->in_sync && mddev->resync_offset == MaxSector)
&& mddev->can_decrease_events
&& mddev->events != 1) {
mddev->events--;
@@ -4281,9 +4281,9 @@ __ATTR(chunk_size, S_IRUGO|S_IWUSR, chunk_size_show, chunk_size_store);
static ssize_t
resync_start_show(struct mddev *mddev, char *page)
{
- if (mddev->recovery_cp == MaxSector)
+ if (mddev->resync_offset == MaxSector)
return sprintf(page, "none\n");
- return sprintf(page, "%llu\n", (unsigned long long)mddev->recovery_cp);
+ return sprintf(page, "%llu\n", (unsigned long long)mddev->resync_offset);
}
static ssize_t
@@ -4309,7 +4309,7 @@ resync_start_store(struct mddev *mddev, const char *buf, size_t len)
err = -EBUSY;
if (!err) {
- mddev->recovery_cp = n;
+ mddev->resync_offset = n;
if (mddev->pers)
set_bit(MD_SB_CHANGE_CLEAN, &mddev->sb_flags);
}
@@ -6375,7 +6375,7 @@ static void md_clean(struct mddev *mddev)
mddev->external_size = 0;
mddev->dev_sectors = 0;
mddev->raid_disks = 0;
- mddev->recovery_cp = 0;
+ mddev->resync_offset = 0;
mddev->resync_min = 0;
mddev->resync_max = MaxSector;
mddev->reshape_position = MaxSector;
@@ -7330,9 +7330,9 @@ int md_set_array_info(struct mddev *mddev, struct mdu_array_info_s *info)
* openned
*/
if (info->state & (1<<MD_SB_CLEAN))
- mddev->recovery_cp = MaxSector;
+ mddev->resync_offset = MaxSector;
else
- mddev->recovery_cp = 0;
+ mddev->resync_offset = 0;
mddev->persistent = ! info->not_persistent;
mddev->external = 0;
@@ -8244,7 +8244,7 @@ static int status_resync(struct seq_file *seq, struct mddev *mddev)
seq_printf(seq, "\tresync=REMOTE");
return 1;
}
- if (mddev->recovery_cp < MaxSector) {
+ if (mddev->resync_offset < MaxSector) {
seq_printf(seq, "\tresync=PENDING");
return 1;
}
@@ -8918,7 +8918,7 @@ static sector_t md_sync_position(struct mddev *mddev, enum sync_action action)
return mddev->resync_min;
case ACTION_RESYNC:
if (!mddev->bitmap)
- return mddev->recovery_cp;
+ return mddev->resync_offset;
return 0;
case ACTION_RESHAPE:
/*
@@ -9144,8 +9144,8 @@ void md_do_sync(struct md_thread *thread)
atomic_read(&mddev->recovery_active) == 0);
mddev->curr_resync_completed = j;
if (test_bit(MD_RECOVERY_SYNC, &mddev->recovery) &&
- j > mddev->recovery_cp)
- mddev->recovery_cp = j;
+ j > mddev->resync_offset)
+ mddev->resync_offset = j;
update_time = jiffies;
set_bit(MD_SB_CHANGE_CLEAN, &mddev->sb_flags);
sysfs_notify_dirent_safe(mddev->sysfs_completed);
@@ -9264,19 +9264,19 @@ void md_do_sync(struct md_thread *thread)
mddev->curr_resync > MD_RESYNC_ACTIVE) {
if (test_bit(MD_RECOVERY_SYNC, &mddev->recovery)) {
if (test_bit(MD_RECOVERY_INTR, &mddev->recovery)) {
- if (mddev->curr_resync >= mddev->recovery_cp) {
+ if (mddev->curr_resync >= mddev->resync_offset) {
pr_debug("md: checkpointing %s of %s.\n",
desc, mdname(mddev));
if (test_bit(MD_RECOVERY_ERROR,
&mddev->recovery))
- mddev->recovery_cp =
+ mddev->resync_offset =
mddev->curr_resync_completed;
else
- mddev->recovery_cp =
+ mddev->resync_offset =
mddev->curr_resync;
}
} else
- mddev->recovery_cp = MaxSector;
+ mddev->resync_offset = MaxSector;
} else {
if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery))
mddev->curr_resync = MaxSector;
@@ -9498,7 +9498,7 @@ static bool md_choose_sync_action(struct mddev *mddev, int *spares)
}
/* Check if resync is in progress. */
- if (mddev->recovery_cp < MaxSector) {
+ if (mddev->resync_offset < MaxSector) {
remove_spares(mddev, NULL);
set_bit(MD_RECOVERY_SYNC, &mddev->recovery);
clear_bit(MD_RECOVERY_RECOVER, &mddev->recovery);
@@ -9679,7 +9679,7 @@ void md_check_recovery(struct mddev *mddev)
test_bit(MD_RECOVERY_DONE, &mddev->recovery) ||
(mddev->external == 0 && mddev->safemode == 1) ||
(mddev->safemode == 2
- && !mddev->in_sync && mddev->recovery_cp == MaxSector)
+ && !mddev->in_sync && mddev->resync_offset == MaxSector)
))
return;
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 20857b8984625..c4554b89d4fe9 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -493,7 +493,7 @@ struct mddev {
atomic_t recovery_active; /* blocks scheduled, but not written */
wait_queue_head_t recovery_wait;
- sector_t recovery_cp;
+ sector_t resync_offset;
sector_t resync_min; /* user requested sync
* starts here */
sector_t resync_max; /* resync should pause
diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index db1ab214250f9..d02f5f0614663 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c
@@ -676,7 +676,7 @@ static void *raid0_takeover_raid45(struct mddev *mddev)
mddev->raid_disks--;
mddev->delta_disks = -1;
/* make sure it will be not marked as dirty */
- mddev->recovery_cp = MaxSector;
+ mddev->resync_offset = MaxSector;
mddev_clear_unsupported_flags(mddev, UNSUPPORTED_MDDEV_FLAGS);
create_strip_zones(mddev, &priv_conf);
@@ -719,7 +719,7 @@ static void *raid0_takeover_raid10(struct mddev *mddev)
mddev->raid_disks += mddev->delta_disks;
mddev->degraded = 0;
/* make sure it will be not marked as dirty */
- mddev->recovery_cp = MaxSector;
+ mddev->resync_offset = MaxSector;
mddev_clear_unsupported_flags(mddev, UNSUPPORTED_MDDEV_FLAGS);
create_strip_zones(mddev, &priv_conf);
@@ -762,7 +762,7 @@ static void *raid0_takeover_raid1(struct mddev *mddev)
mddev->delta_disks = 1 - mddev->raid_disks;
mddev->raid_disks = 1;
/* make sure it will be not marked as dirty */
- mddev->recovery_cp = MaxSector;
+ mddev->resync_offset = MaxSector;
mddev_clear_unsupported_flags(mddev, UNSUPPORTED_MDDEV_FLAGS);
create_strip_zones(mddev, &priv_conf);
diff --git a/drivers/md/raid1-10.c b/drivers/md/raid1-10.c
index f3750ceaa5829..41a559262210d 100644
--- a/drivers/md/raid1-10.c
+++ b/drivers/md/raid1-10.c
@@ -283,7 +283,7 @@ static inline int raid1_check_read_range(struct md_rdev *rdev,
static inline bool raid1_should_read_first(struct mddev *mddev,
sector_t this_sector, int len)
{
- if ((mddev->recovery_cp < this_sector + len))
+ if ((mddev->resync_offset < this_sector + len))
return true;
if (mddev_is_clustered(mddev) &&
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 4b18151cd8136..a6ee8d3c01cec 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -2815,7 +2815,7 @@ static sector_t raid1_sync_request(struct mddev *mddev, sector_t sector_nr,
}
if (mddev->bitmap == NULL &&
- mddev->recovery_cp == MaxSector &&
+ mddev->resync_offset == MaxSector &&
!test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery) &&
conf->fullsync == 0) {
*skipped = 1;
@@ -3277,9 +3277,9 @@ static int raid1_run(struct mddev *mddev)
}
if (conf->raid_disks - mddev->degraded == 1)
- mddev->recovery_cp = MaxSector;
+ mddev->resync_offset = MaxSector;
- if (mddev->recovery_cp != MaxSector)
+ if (mddev->resync_offset != MaxSector)
pr_info("md/raid1:%s: not clean -- starting background reconstruction\n",
mdname(mddev));
pr_info("md/raid1:%s: active with %d out of %d mirrors\n",
@@ -3340,8 +3340,8 @@ static int raid1_resize(struct mddev *mddev, sector_t sectors)
md_set_array_sectors(mddev, newsize);
if (sectors > mddev->dev_sectors &&
- mddev->recovery_cp > mddev->dev_sectors) {
- mddev->recovery_cp = mddev->dev_sectors;
+ mddev->resync_offset > mddev->dev_sectors) {
+ mddev->resync_offset = mddev->dev_sectors;
set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
}
mddev->dev_sectors = sectors;
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 68f9861fa57f4..e45008b01c41e 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -2115,7 +2115,7 @@ static int raid10_add_disk(struct mddev *mddev, struct md_rdev *rdev)
int last = conf->geo.raid_disks - 1;
struct raid10_info *p;
- if (mddev->recovery_cp < MaxSector)
+ if (mddev->resync_offset < MaxSector)
/* only hot-add to in-sync arrays, as recovery is
* very different from resync
*/
@@ -3192,7 +3192,7 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr,
* of a clean array, like RAID1 does.
*/
if (mddev->bitmap == NULL &&
- mddev->recovery_cp == MaxSector &&
+ mddev->resync_offset == MaxSector &&
mddev->reshape_position == MaxSector &&
!test_bit(MD_RECOVERY_SYNC, &mddev->recovery) &&
!test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery) &&
@@ -4154,7 +4154,7 @@ static int raid10_run(struct mddev *mddev)
disk->recovery_disabled = mddev->recovery_disabled - 1;
}
- if (mddev->recovery_cp != MaxSector)
+ if (mddev->resync_offset != MaxSector)
pr_notice("md/raid10:%s: not clean -- starting background reconstruction\n",
mdname(mddev));
pr_info("md/raid10:%s: active with %d out of %d devices\n",
@@ -4254,8 +4254,8 @@ static int raid10_resize(struct mddev *mddev, sector_t sectors)
md_set_array_sectors(mddev, size);
if (sectors > mddev->dev_sectors &&
- mddev->recovery_cp > oldsize) {
- mddev->recovery_cp = oldsize;
+ mddev->resync_offset > oldsize) {
+ mddev->resync_offset = oldsize;
set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
}
calc_sectors(conf, sectors);
@@ -4284,7 +4284,7 @@ static void *raid10_takeover_raid0(struct mddev *mddev, sector_t size, int devs)
mddev->delta_disks = mddev->raid_disks;
mddev->raid_disks *= 2;
/* make sure it will be not marked as dirty */
- mddev->recovery_cp = MaxSector;
+ mddev->resync_offset = MaxSector;
mddev->dev_sectors = size;
conf = setup_conf(mddev);
@@ -5098,8 +5098,8 @@ static void raid10_finish_reshape(struct mddev *mddev)
return;
if (mddev->delta_disks > 0) {
- if (mddev->recovery_cp > mddev->resync_max_sectors) {
- mddev->recovery_cp = mddev->resync_max_sectors;
+ if (mddev->resync_offset > mddev->resync_max_sectors) {
+ mddev->resync_offset = mddev->resync_max_sectors;
set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
}
mddev->resync_max_sectors = mddev->array_sectors;
diff --git a/drivers/md/raid5-ppl.c b/drivers/md/raid5-ppl.c
index c3cfdd66d8b0c..0c630cfbf3a01 100644
--- a/drivers/md/raid5-ppl.c
+++ b/drivers/md/raid5-ppl.c
@@ -1165,7 +1165,7 @@ static int ppl_load_distributed(struct ppl_log *log)
le64_to_cpu(pplhdr->generation));
/* attempt to recover from log if we are starting a dirty array */
- if (pplhdr && !mddev->pers && mddev->recovery_cp != MaxSector)
+ if (pplhdr && !mddev->pers && mddev->resync_offset != MaxSector)
ret = ppl_recover(log, pplhdr, pplhdr_offset);
/* write empty header if we are starting the array */
@@ -1424,14 +1424,14 @@ int ppl_init_log(struct r5conf *conf)
if (ret) {
goto err;
- } else if (!mddev->pers && mddev->recovery_cp == 0 &&
+ } else if (!mddev->pers && mddev->resync_offset == 0 &&
ppl_conf->recovered_entries > 0 &&
ppl_conf->mismatch_count == 0) {
/*
* If we are starting a dirty array and the recovery succeeds
* without any issues, set the array as clean.
*/
- mddev->recovery_cp = MaxSector;
+ mddev->resync_offset = MaxSector;
set_bit(MD_SB_CHANGE_CLEAN, &mddev->sb_flags);
} else if (mddev->pers && ppl_conf->mismatch_count > 0) {
/* no mismatch allowed when enabling PPL for a running array */
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 6e42366b15ca1..d658259691f89 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -3748,7 +3748,7 @@ static int want_replace(struct stripe_head *sh, int disk_idx)
&& !test_bit(Faulty, &rdev->flags)
&& !test_bit(In_sync, &rdev->flags)
&& (rdev->recovery_offset <= sh->sector
- || rdev->mddev->recovery_cp <= sh->sector))
+ || rdev->mddev->resync_offset <= sh->sector))
rv = 1;
return rv;
}
@@ -3840,7 +3840,7 @@ static int need_this_block(struct stripe_head *sh, struct stripe_head_state *s,
* is missing/faulty, then we need to read everything we can.
*/
if (!force_rcw &&
- sh->sector < sh->raid_conf->mddev->recovery_cp)
+ sh->sector < sh->raid_conf->mddev->resync_offset)
/* reconstruct-write isn't being forced */
return 0;
for (i = 0; i < s->failed && i < 2; i++) {
@@ -4105,7 +4105,7 @@ static int handle_stripe_dirtying(struct r5conf *conf,
int disks)
{
int rmw = 0, rcw = 0, i;
- sector_t recovery_cp = conf->mddev->recovery_cp;
+ sector_t resync_offset = conf->mddev->resync_offset;
/* Check whether resync is now happening or should start.
* If yes, then the array is dirty (after unclean shutdown or
@@ -4115,14 +4115,14 @@ static int handle_stripe_dirtying(struct r5conf *conf,
* generate correct data from the parity.
*/
if (conf->rmw_level == PARITY_DISABLE_RMW ||
- (recovery_cp < MaxSector && sh->sector >= recovery_cp &&
+ (resync_offset < MaxSector && sh->sector >= resync_offset &&
s->failed == 0)) {
/* Calculate the real rcw later - for now make it
* look like rcw is cheaper
*/
rcw = 1; rmw = 2;
- pr_debug("force RCW rmw_level=%u, recovery_cp=%llu sh->sector=%llu\n",
- conf->rmw_level, (unsigned long long)recovery_cp,
+ pr_debug("force RCW rmw_level=%u, resync_offset=%llu sh->sector=%llu\n",
+ conf->rmw_level, (unsigned long long)resync_offset,
(unsigned long long)sh->sector);
} else for (i = disks; i--; ) {
/* would I have to read this buffer for read_modify_write */
@@ -4779,14 +4779,14 @@ static void analyse_stripe(struct stripe_head *sh, struct stripe_head_state *s)
if (test_bit(STRIPE_SYNCING, &sh->state)) {
/* If there is a failed device being replaced,
* we must be recovering.
- * else if we are after recovery_cp, we must be syncing
+ * else if we are after resync_offset, we must be syncing
* else if MD_RECOVERY_REQUESTED is set, we also are syncing.
* else we can only be replacing
* sync and recovery both need to read all devices, and so
* use the same flag.
*/
if (do_recovery ||
- sh->sector >= conf->mddev->recovery_cp ||
+ sh->sector >= conf->mddev->resync_offset ||
test_bit(MD_RECOVERY_REQUESTED, &(conf->mddev->recovery)))
s->syncing = 1;
else
@@ -7811,7 +7811,7 @@ static int raid5_run(struct mddev *mddev)
int first = 1;
int ret = -EIO;
- if (mddev->recovery_cp != MaxSector)
+ if (mddev->resync_offset != MaxSector)
pr_notice("md/raid:%s: not clean -- starting background reconstruction\n",
mdname(mddev));
@@ -7952,7 +7952,7 @@ static int raid5_run(struct mddev *mddev)
mdname(mddev));
mddev->ro = 1;
set_disk_ro(mddev->gendisk, 1);
- } else if (mddev->recovery_cp == MaxSector)
+ } else if (mddev->resync_offset == MaxSector)
set_bit(MD_JOURNAL_CLEAN, &mddev->flags);
}
@@ -8019,7 +8019,7 @@ static int raid5_run(struct mddev *mddev)
mddev->resync_max_sectors = mddev->dev_sectors;
if (mddev->degraded > dirty_parity_disks &&
- mddev->recovery_cp != MaxSector) {
+ mddev->resync_offset != MaxSector) {
if (test_bit(MD_HAS_PPL, &mddev->flags))
pr_crit("md/raid:%s: starting dirty degraded array with PPL.\n",
mdname(mddev));
@@ -8360,8 +8360,8 @@ static int raid5_resize(struct mddev *mddev, sector_t sectors)
md_set_array_sectors(mddev, newsize);
if (sectors > mddev->dev_sectors &&
- mddev->recovery_cp > mddev->dev_sectors) {
- mddev->recovery_cp = mddev->dev_sectors;
+ mddev->resync_offset > mddev->dev_sectors) {
+ mddev->resync_offset = mddev->dev_sectors;
set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
}
mddev->dev_sectors = sectors;
@@ -8455,7 +8455,7 @@ static int raid5_start_reshape(struct mddev *mddev)
return -EINVAL;
/* raid5 can't handle concurrent reshape and recovery */
- if (mddev->recovery_cp < MaxSector)
+ if (mddev->resync_offset < MaxSector)
return -EBUSY;
for (i = 0; i < conf->raid_disks; i++)
if (conf->disks[i].replacement)
@@ -8680,7 +8680,7 @@ static void *raid45_takeover_raid0(struct mddev *mddev, int level)
mddev->raid_disks += 1;
mddev->delta_disks = 1;
/* make sure it will be not marked as dirty */
- mddev->recovery_cp = MaxSector;
+ mddev->resync_offset = MaxSector;
return setup_conf(mddev);
}
diff --git a/include/uapi/linux/raid/md_p.h b/include/uapi/linux/raid/md_p.h
index ff47b6f0ba0f5..b139462872775 100644
--- a/include/uapi/linux/raid/md_p.h
+++ b/include/uapi/linux/raid/md_p.h
@@ -173,7 +173,7 @@ typedef struct mdp_superblock_s {
#else
#error unspecified endianness
#endif
- __u32 recovery_cp; /* 11 recovery checkpoint sector count */
+ __u32 resync_offset; /* 11 resync checkpoint sector count */
/* There are only valid for minor_version > 90 */
__u64 reshape_position; /* 12,13 next address in array-space for reshape */
__u32 new_level; /* 14 new level we are reshaping to */
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0743/1376] md: add a new recovery_flag MD_RECOVERY_LAZY_RECOVER
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (741 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0742/1376] md: rename recovery_cp to resync_offset Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0744/1376] md/raid5: protect lockless recovery_offset accesses during reshape Greg Kroah-Hartman
` (255 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yu Kuai, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <yukuai3@huawei.com>
[ Upstream commit c951ccf0bf2df4f39b45dc77998dd71da7a85369 ]
This flag is used by llbitmap in later patches to skip raid456 initial
recover and delay building initial xor data to first write.
https: //lore.kernel.org/linux-raid/20250829080426.1441678-10-yukuai1@huaweicloud.com
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Stable-dep-of: a47431dfb353 ("md/raid5: protect lockless recovery_offset accesses during reshape")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/md.c | 47 +++++++++++++++++++++++++++++++++++++++++++++-
drivers/md/md.h | 2 ++
drivers/md/raid5.c | 19 +++++++++++++++----
3 files changed, 63 insertions(+), 5 deletions(-)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index b6b9168aa5bff..889711a24b1cb 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -8907,6 +8907,39 @@ static sector_t md_sync_max_sectors(struct mddev *mddev,
}
}
+/*
+ * If lazy recovery is requested and all rdevs are in sync, select the rdev with
+ * the higest index to perfore recovery to build initial xor data, this is the
+ * same as old bitmap.
+ */
+static bool mddev_select_lazy_recover_rdev(struct mddev *mddev)
+{
+ struct md_rdev *recover_rdev = NULL;
+ struct md_rdev *rdev;
+ bool ret = false;
+
+ rcu_read_lock();
+ rdev_for_each_rcu(rdev, mddev) {
+ if (rdev->raid_disk < 0)
+ continue;
+
+ if (test_bit(Faulty, &rdev->flags) ||
+ !test_bit(In_sync, &rdev->flags))
+ break;
+
+ if (!recover_rdev || recover_rdev->raid_disk < rdev->raid_disk)
+ recover_rdev = rdev;
+ }
+
+ if (recover_rdev) {
+ clear_bit(In_sync, &recover_rdev->flags);
+ ret = true;
+ }
+
+ rcu_read_unlock();
+ return ret;
+}
+
static sector_t md_sync_position(struct mddev *mddev, enum sync_action action)
{
sector_t start = 0;
@@ -8942,6 +8975,14 @@ static sector_t md_sync_position(struct mddev *mddev, enum sync_action action)
start = rdev->recovery_offset;
rcu_read_unlock();
+ /*
+ * If there are no spares, and raid456 lazy initial recover is
+ * requested.
+ */
+ if (test_bit(MD_RECOVERY_LAZY_RECOVER, &mddev->recovery) &&
+ start == MaxSector && mddev_select_lazy_recover_rdev(mddev))
+ start = 0;
+
/* If there is a bitmap, we need to make sure all
* writes that started before we added a spare
* complete before we start doing a recovery.
@@ -9494,6 +9535,7 @@ static bool md_choose_sync_action(struct mddev *mddev, int *spares)
set_bit(MD_RECOVERY_RESHAPE, &mddev->recovery);
clear_bit(MD_RECOVERY_RECOVER, &mddev->recovery);
+ clear_bit(MD_RECOVERY_LAZY_RECOVER, &mddev->recovery);
return true;
}
@@ -9502,6 +9544,7 @@ static bool md_choose_sync_action(struct mddev *mddev, int *spares)
remove_spares(mddev, NULL);
set_bit(MD_RECOVERY_SYNC, &mddev->recovery);
clear_bit(MD_RECOVERY_RECOVER, &mddev->recovery);
+ clear_bit(MD_RECOVERY_LAZY_RECOVER, &mddev->recovery);
return true;
}
@@ -9511,7 +9554,7 @@ static bool md_choose_sync_action(struct mddev *mddev, int *spares)
* re-add.
*/
*spares = remove_and_add_spares(mddev, NULL);
- if (*spares) {
+ if (*spares || test_bit(MD_RECOVERY_LAZY_RECOVER, &mddev->recovery)) {
clear_bit(MD_RECOVERY_SYNC, &mddev->recovery);
clear_bit(MD_RECOVERY_CHECK, &mddev->recovery);
clear_bit(MD_RECOVERY_REQUESTED, &mddev->recovery);
@@ -9724,6 +9767,7 @@ void md_check_recovery(struct mddev *mddev)
}
clear_bit(MD_RECOVERY_RECOVER, &mddev->recovery);
+ clear_bit(MD_RECOVERY_LAZY_RECOVER, &mddev->recovery);
clear_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
clear_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags);
@@ -9834,6 +9878,7 @@ void md_reap_sync_thread(struct mddev *mddev)
clear_bit(MD_RECOVERY_RESHAPE, &mddev->recovery);
clear_bit(MD_RECOVERY_REQUESTED, &mddev->recovery);
clear_bit(MD_RECOVERY_CHECK, &mddev->recovery);
+ clear_bit(MD_RECOVERY_LAZY_RECOVER, &mddev->recovery);
/*
* We call md_cluster_ops->update_size here because sync_size could
* be changed by md_update_sb, and MD_RECOVERY_RESHAPE is cleared,
diff --git a/drivers/md/md.h b/drivers/md/md.h
index c4554b89d4fe9..22a1ec3aa18d6 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -634,6 +634,8 @@ enum recovery_flags {
MD_RECOVERY_RESHAPE,
/* remote node is running resync thread */
MD_RESYNCING_REMOTE,
+ /* raid456 lazy initial recover */
+ MD_RECOVERY_LAZY_RECOVER,
};
enum md_ro_state {
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index d658259691f89..bcff3e9bcd749 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -4707,10 +4707,21 @@ static void analyse_stripe(struct stripe_head *sh, struct stripe_head_state *s)
}
} else if (test_bit(In_sync, &rdev->flags))
set_bit(R5_Insync, &dev->flags);
- else if (sh->sector + RAID5_STRIPE_SECTORS(conf) <= rdev->recovery_offset)
- /* in sync if before recovery_offset */
- set_bit(R5_Insync, &dev->flags);
- else if (test_bit(R5_UPTODATE, &dev->flags) &&
+ else if (sh->sector + RAID5_STRIPE_SECTORS(conf) <=
+ rdev->recovery_offset) {
+ /*
+ * in sync if:
+ * - normal IO, or
+ * - resync IO that is not lazy recovery
+ *
+ * For lazy recovery, we have to mark the rdev without
+ * In_sync as failed, to build initial xor data.
+ */
+ if (!test_bit(STRIPE_SYNCING, &sh->state) ||
+ !test_bit(MD_RECOVERY_LAZY_RECOVER,
+ &conf->mddev->recovery))
+ set_bit(R5_Insync, &dev->flags);
+ } else if (test_bit(R5_UPTODATE, &dev->flags) &&
test_bit(R5_Expanded, &dev->flags))
/* If we've reshaped into here, we assume it is Insync.
* We will shortly update recovery_offset to make
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0744/1376] md/raid5: protect lockless recovery_offset accesses during reshape
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (742 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0743/1376] md: add a new recovery_flag MD_RECOVERY_LAZY_RECOVER Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0745/1376] tools/nolibc/powerpc: mark ctr and xer as clobbered by system call Greg Kroah-Hartman
` (254 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chen Cheng, Yu Kuai, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Cheng <chencheng@fnnas.com>
[ Upstream commit a47431dfb3538a1485f65b68a0605a05307b5b2d ]
During reshape:
- reshape_request() advances rdev->recovery_offset for non-In_sync
devices locklessly.
- analyse_stripe() reads rdev->recovery_offset locklessly to decide:
a. use a replacement device to read ?
b. a device can already be treated as in-sync for the current
stripe ?
one possible scenario is:
CPU1 CPU2
reshape_request()
-> mddev->curr_resync_completed = sector_nr
-> if (!mddev->reshape_backwards)
-> rdev->recovery_offset = sector_nr
analyse_stripe(sh)
-> rdev = conf->disks[i].replacement
-> if (rdev->recovery_offset >=
sh->sector + stripe_sectors)
set_bit(R5_ReadRepl)
-> or
-> if (sh->sector + stripe_sectors <=
rdev->recovery_offset)
set_bit(R5_Insync)
And it could be:
- reading from a replacement before it is recovered far enough; or
- treating a not-yet-recovered device as in-sync for the current stripe.
Fixes: db0505d32066 ("md: be cautious about using ->curr_resync_completed for ->recovery_offset")
The race report:
==================================================================
BUG: KCSAN: data-race in ops_run_io / reshape_request
write to 0xffff8bdee168b270 of 8 bytes by task 1704 on cpu 10:
reshape_request+0x1292/0x17b0
raid5_sync_request+0x815/0xa00
md_do_sync.cold+0xf8d/0x1516
[......]
read to 0xffff8bdee168b270 of 8 bytes by task 1696 on cpu 9:
ops_run_io+0xc25/0x1960
handle_stripe+0x2273/0x4570
handle_active_stripes.isra.0+0x6e0/0xa50
raid5d+0x7d5/0xb90
[......]
value changed: 0x0000000000091a00 -> 0x0000000000091b00
==================================================================
Signed-off-by: Chen Cheng <chencheng@fnnas.com>
Reviewed-by: Yu Kuai <yukuai@fygo.io>
Link: https://patch.msgid.link/20260627102519.136940-1-chencheng@fnnas.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/raid5.c | 50 +++++++++++++++++++++++-----------------------
1 file changed, 25 insertions(+), 25 deletions(-)
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index bcff3e9bcd749..1daf043a5e524 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -3744,11 +3744,10 @@ static int want_replace(struct stripe_head *sh, int disk_idx)
int rv = 0;
rdev = sh->raid_conf->disks[disk_idx].replacement;
- if (rdev
- && !test_bit(Faulty, &rdev->flags)
- && !test_bit(In_sync, &rdev->flags)
- && (rdev->recovery_offset <= sh->sector
- || rdev->mddev->resync_offset <= sh->sector))
+ if (rdev && !test_bit(Faulty, &rdev->flags) &&
+ !test_bit(In_sync, &rdev->flags) &&
+ (READ_ONCE(rdev->recovery_offset) <= sh->sector ||
+ rdev->mddev->resync_offset <= sh->sector))
rv = 1;
return rv;
}
@@ -4665,7 +4664,8 @@ static void analyse_stripe(struct stripe_head *sh, struct stripe_head_state *s)
*/
rdev = conf->disks[i].replacement;
if (rdev && !test_bit(Faulty, &rdev->flags) &&
- rdev->recovery_offset >= sh->sector + RAID5_STRIPE_SECTORS(conf) &&
+ READ_ONCE(rdev->recovery_offset) >=
+ sh->sector + RAID5_STRIPE_SECTORS(conf) &&
!rdev_has_badblock(rdev, sh->sector,
RAID5_STRIPE_SECTORS(conf)))
set_bit(R5_ReadRepl, &dev->flags);
@@ -4708,7 +4708,7 @@ static void analyse_stripe(struct stripe_head *sh, struct stripe_head_state *s)
} else if (test_bit(In_sync, &rdev->flags))
set_bit(R5_Insync, &dev->flags);
else if (sh->sector + RAID5_STRIPE_SECTORS(conf) <=
- rdev->recovery_offset) {
+ READ_ONCE(rdev->recovery_offset)) {
/*
* in sync if:
* - normal IO, or
@@ -5441,13 +5441,13 @@ static int raid5_read_one_chunk(struct mddev *mddev, struct bio *raid_bio)
rdev = conf->disks[dd_idx].replacement;
if (!rdev || test_bit(Faulty, &rdev->flags) ||
- rdev->recovery_offset < end_sector) {
+ READ_ONCE(rdev->recovery_offset) < end_sector) {
rdev = conf->disks[dd_idx].rdev;
if (!rdev)
return 0;
if (test_bit(Faulty, &rdev->flags) ||
!(test_bit(In_sync, &rdev->flags) ||
- rdev->recovery_offset >= end_sector))
+ READ_ONCE(rdev->recovery_offset) >= end_sector))
return 0;
}
@@ -6376,8 +6376,8 @@ static sector_t reshape_request(struct mddev *mddev, sector_t sector_nr, int *sk
if (rdev->raid_disk >= 0 &&
!test_bit(Journal, &rdev->flags) &&
!test_bit(In_sync, &rdev->flags) &&
- rdev->recovery_offset < sector_nr)
- rdev->recovery_offset = sector_nr;
+ READ_ONCE(rdev->recovery_offset) < sector_nr)
+ WRITE_ONCE(rdev->recovery_offset, sector_nr);
conf->reshape_checkpoint = jiffies;
set_bit(MD_SB_CHANGE_DEVS, &mddev->sb_flags);
@@ -6485,8 +6485,8 @@ static sector_t reshape_request(struct mddev *mddev, sector_t sector_nr, int *sk
if (rdev->raid_disk >= 0 &&
!test_bit(Journal, &rdev->flags) &&
!test_bit(In_sync, &rdev->flags) &&
- rdev->recovery_offset < sector_nr)
- rdev->recovery_offset = sector_nr;
+ READ_ONCE(rdev->recovery_offset) < sector_nr)
+ WRITE_ONCE(rdev->recovery_offset, sector_nr);
conf->reshape_checkpoint = jiffies;
set_bit(MD_SB_CHANGE_DEVS, &mddev->sb_flags);
md_wakeup_thread(mddev->thread);
@@ -7996,9 +7996,9 @@ static int raid5_run(struct mddev *mddev)
/* Hack because v0.91 doesn't store recovery_offset properly. */
if (mddev->major_version == 0 &&
mddev->minor_version > 90)
- rdev->recovery_offset = reshape_offset;
+ WRITE_ONCE(rdev->recovery_offset, reshape_offset);
- if (rdev->recovery_offset < reshape_offset) {
+ if (READ_ONCE(rdev->recovery_offset) < reshape_offset) {
/* We need to check old and new layout */
if (!only_parity(rdev->raid_disk,
conf->algorithm,
@@ -8149,10 +8149,10 @@ static int raid5_spare_active(struct mddev *mddev)
for (i = 0; i < conf->raid_disks; i++) {
rdev = conf->disks[i].rdev;
replacement = conf->disks[i].replacement;
- if (replacement
- && replacement->recovery_offset == MaxSector
- && !test_bit(Faulty, &replacement->flags)
- && !test_and_set_bit(In_sync, &replacement->flags)) {
+ if (replacement &&
+ READ_ONCE(replacement->recovery_offset) == MaxSector &&
+ !test_bit(Faulty, &replacement->flags) &&
+ !test_and_set_bit(In_sync, &replacement->flags)) {
/* Replacement has just become active. */
if (!rdev
|| !test_and_clear_bit(In_sync, &rdev->flags))
@@ -8167,10 +8167,10 @@ static int raid5_spare_active(struct mddev *mddev)
rdev->sysfs_state);
}
sysfs_notify_dirent_safe(replacement->sysfs_state);
- } else if (rdev
- && rdev->recovery_offset == MaxSector
- && !test_bit(Faulty, &rdev->flags)
- && !test_and_set_bit(In_sync, &rdev->flags)) {
+ } else if (rdev &&
+ READ_ONCE(rdev->recovery_offset) == MaxSector &&
+ !test_bit(Faulty, &rdev->flags) &&
+ !test_and_set_bit(In_sync, &rdev->flags)) {
count++;
sysfs_notify_dirent_safe(rdev->sysfs_state);
}
@@ -8540,7 +8540,7 @@ static int raid5_start_reshape(struct mddev *mddev)
>= conf->previous_raid_disks)
set_bit(In_sync, &rdev->flags);
else
- rdev->recovery_offset = 0;
+ WRITE_ONCE(rdev->recovery_offset, 0);
/* Failure here is OK */
sysfs_link_rdev(mddev, rdev);
@@ -8592,7 +8592,7 @@ static void end_reshape(struct r5conf *conf)
if (rdev->raid_disk >= 0 &&
!test_bit(Journal, &rdev->flags) &&
!test_bit(In_sync, &rdev->flags))
- rdev->recovery_offset = MaxSector;
+ WRITE_ONCE(rdev->recovery_offset, MaxSector);
spin_unlock_irq(&conf->device_lock);
wake_up(&conf->wait_for_reshape);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0745/1376] tools/nolibc/powerpc: mark ctr and xer as clobbered by system call
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (743 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0744/1376] md/raid5: protect lockless recovery_offset accesses during reshape Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0746/1376] md: recheck spare changes before starting sync Greg Kroah-Hartman
` (253 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Weißschuh,
Thomas Weißschuh, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
[ Upstream commit b9fc5a1742b0c8fb7edf066cc17fa0b18b7be623 ]
The system call can clobber the ctr and xer registers.
Make sure the compiler takes this into account.
The missing clobbers only seem to be an issue with newer compilers.
Fixes: 0cb0675ec37e ("tools/nolibc: add support for powerpc")
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Link: https://patch.msgid.link/20260727-nolibc-powerpc-clobber-v1-1-e0911cc99ce1@linutronix.de
Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/include/nolibc/arch-powerpc.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/include/nolibc/arch-powerpc.h b/tools/include/nolibc/arch-powerpc.h
index ee2fdb8d601dc..f468b6750543a 100644
--- a/tools/include/nolibc/arch-powerpc.h
+++ b/tools/include/nolibc/arch-powerpc.h
@@ -23,7 +23,7 @@
*/
#define _NOLIBC_SYSCALL_CLOBBERLIST \
- "memory", "cr0", "r12", "r11", "r10", "r9"
+ "memory", "cr0", "ctr", "xer", "r12", "r11", "r10", "r9"
#define my_syscall0(num) \
({ \
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0746/1376] md: recheck spare changes before starting sync
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (744 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0745/1376] tools/nolibc/powerpc: mark ctr and xer as clobbered by system call Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0747/1376] selftests/zram: fix kernel_gte() for POSIX sh Greg Kroah-Hartman
` (252 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Abd-Alrhman Masalkhi,
Yu Kuai, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abd-Alrhman Masalkhi <abd.masalkhi@gmail.com>
[ Upstream commit c7d34d17ea43ebc86b45d439ebb435e11ca44bca ]
remove_spares() and remove_and_add_spares() modify the array's rdev
configuration. These operations are only safe after the array has been
suspended.
md_start_sync() checks whether spare configuration changes are needed
before taking reconfig_mutex. However, the rdev state can change before
the mutex is acquired, so the initial check can become stale. In that
case, md_choose_sync_action() may remove or replace rdevs while normal
I/O is still accessing them.
The race can occur as follows:
raid10d Worker Normal IO
____________ _______________________ ______________________
raid10_write_request()
wait_blocked_dev()
set Blocked
set Faulty
Skip Faulty rdev
rrdev->nr_pending++
.repl_bio = bio
removeable_rdev = false .
array not suspended .
lock mddev goto err_handle
lock mddev (wait)
.
update sb .
clear Blocked .
.
unlock mddev .
lock mddev (acquires)
remove_spares()
removeable_rdev = true
raid10_remove_disk()
rdev = replacement
replacement = NULL
rdev_dec_pending(NULL)
unlock mddev (NULL)->nr_pending--
In this case, rdev_dec_pending() is called with a NULL pointer,
resulting in a NULL pointer dereference when attempting to decrement
nr_pending.
Fix this by suspending the array when spare configuration changes are
needed, including for non-read-write arrays, and checking again after
taking reconfig_mutex. If the array was not already suspended and a
change is now needed, release the mutex, suspend the array, and
reacquire the mutex before continuing.
Fixes: bc08041b32ab ("md: suspend array in md_start_sync() if array need reconfiguration")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260628142420.1051027-1-abd.masalkhi@gmail.com?part=3
Signed-off-by: Abd-Alrhman Masalkhi <abd.masalkhi@gmail.com>
Reviewed-by: Yu Kuai <yukuai@fygo.io>
Link: https://patch.msgid.link/20260708112003.474537-1-abd.masalkhi@gmail.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/md.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 889711a24b1cb..3e683b9626df5 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -9583,13 +9583,25 @@ static void md_start_sync(struct work_struct *ws)
* If reshape is still in progress, spares won't be added or removed
* from conf until reshape is done.
*/
- if (mddev->reshape_position == MaxSector &&
+ if ((mddev->reshape_position == MaxSector || !md_is_rdwr(mddev)) &&
md_spares_need_change(mddev)) {
suspend = true;
mddev_suspend(mddev, false);
}
mddev_lock_nointr(mddev);
+
+ /*
+ * The spare configuration can change before reconfig_mutex is acquired.
+ * Recheck while holding the lock and suspend if needed.
+ */
+ if (!suspend && (mddev->reshape_position == MaxSector || !md_is_rdwr(mddev)) &&
+ md_spares_need_change(mddev)) {
+ mddev_unlock(mddev);
+ mddev_suspend_and_lock_nointr(mddev);
+ suspend = true;
+ }
+
if (!md_is_rdwr(mddev)) {
/*
* On a read-only array we can:
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0747/1376] selftests/zram: fix kernel_gte() for POSIX sh
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (745 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0746/1376] md: recheck spare changes before starting sync Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0748/1376] slab: simplify init_kmem_cache_nodes() error handling Greg Kroah-Hartman
` (251 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cheng-Han Wu, Shuah Khan,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cheng-Han Wu <hank20010209@gmail.com>
[ Upstream commit 649ba27dfac784427a01f9c95c09ecbcb88900d8 ]
Commit fc4eb486a59d ("selftests/zram: Skip max_comp_streams
interface on newer kernel") added kernel_gte() to zram_lib.sh.
The function uses the bash-specific [[ ... ]] conditional, but
zram selftests source this file while running under /bin/sh.
On systems where /bin/sh is dash, such as Debian, the following
test fails:
dash -c '
kernel_major=6; kernel_minor=1; major=6; minor=0
if [ $kernel_major -gt $major ]; then
echo ok
elif [[ $kernel_major -eq $major && $kernel_minor -ge $minor ]]; then
echo ok
fi'
with:
dash: 5: [[: not found
Use separate POSIX test expressions joined by && instead.
Fixes: fc4eb486a59d ("selftests/zram: Skip max_comp_streams interface on newer kernel")
Signed-off-by: Cheng-Han Wu <hank20010209@gmail.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/zram/zram_lib.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/testing/selftests/zram/zram_lib.sh b/tools/testing/selftests/zram/zram_lib.sh
index 21ec1966de76c..0d44d83888f9d 100755
--- a/tools/testing/selftests/zram/zram_lib.sh
+++ b/tools/testing/selftests/zram/zram_lib.sh
@@ -37,7 +37,7 @@ kernel_gte()
if [ $kernel_major -gt $major ]; then
return 0
- elif [[ $kernel_major -eq $major && $kernel_minor -ge $minor ]]; then
+ elif [ $kernel_major -eq $major ] && [ $kernel_minor -ge $minor ]; then
return 0
fi
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0748/1376] slab: simplify init_kmem_cache_nodes() error handling
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (746 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0747/1376] selftests/zram: fix kernel_gte() for POSIX sh Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0749/1376] slab: Make slub local_(try)lock more precise for LOCKDEP Greg Kroah-Hartman
` (250 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Harry Yoo, Suren Baghdasaryan,
Vlastimil Babka, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlastimil Babka <vbabka@suse.cz>
[ Upstream commit 9d4e6ab865c48c70e684b176d3ee1574d092626f ]
We don't need to call free_kmem_cache_nodes() immediately when failing
to allocate a kmem_cache_node, because when we return 0,
do_kmem_cache_create() calls __kmem_cache_release() which also performs
free_kmem_cache_nodes().
Reviewed-by: Harry Yoo <harry.yoo@oracle.com>
Reviewed-by: Suren Baghdasaryan <surenb@google.com>
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Stable-dep-of: 4c6eb712a91f ("wifi: ath12k: fix stride mismatch in mac_phy_caps_parse()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/slub.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/mm/slub.c b/mm/slub.c
index b61225c3503bf..68407f1177482 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -5323,10 +5323,8 @@ static int init_kmem_cache_nodes(struct kmem_cache *s)
n = kmem_cache_alloc_node(kmem_cache_node,
GFP_KERNEL, node);
- if (!n) {
- free_kmem_cache_nodes(s);
+ if (!n)
return 0;
- }
init_kmem_cache_node(n);
s->node[node] = n;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0749/1376] slab: Make slub local_(try)lock more precise for LOCKDEP
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (747 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0748/1376] slab: simplify init_kmem_cache_nodes() error handling Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0750/1376] slab: Reuse first bit for OBJEXTS_ALLOC_FAIL Greg Kroah-Hartman
` (249 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexei Starovoitov, Vlastimil Babka,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexei Starovoitov <ast@kernel.org>
[ Upstream commit 83382af9ddc3cb0ef43f67d049b461720ad785e6 ]
kmalloc_nolock() can be called from any context
the ___slab_alloc() can acquire local_trylock_t (which is rt_spin_lock
in PREEMPT_RT) and attempt to acquire a different local_trylock_t
while in the same task context.
The calling sequence might look like:
kmalloc() -> tracepoint -> bpf -> kmalloc_nolock()
or more precisely:
__lock_acquire+0x12ad/0x2590
lock_acquire+0x133/0x2d0
rt_spin_lock+0x6f/0x250
___slab_alloc+0xb7/0xec0
kmalloc_nolock_noprof+0x15a/0x430
my_debug_callback+0x20e/0x390 [testmod]
___slab_alloc+0x256/0xec0
__kmalloc_cache_noprof+0xd6/0x3b0
Make LOCKDEP understand that local_trylock_t-s protect
different kmem_caches. In order to do that add lock_class_key
for each kmem_cache and use that key in local_trylock_t.
This stack trace is possible on both PREEMPT_RT and !PREEMPT_RT,
but teach lockdep about it only for PREEMPT_RT, since
in !PREEMPT_RT the ___slab_alloc() code is using
local_trylock_irqsave() when lockdep is on.
Note, this patch applies this logic to local_lock_t
while the next one converts it to local_trylock_t.
Both are mapped to rt_spin_lock in PREEMPT_RT.
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Stable-dep-of: 4c6eb712a91f ("wifi: ath12k: fix stride mismatch in mac_phy_caps_parse()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/slab.h | 1 +
mm/slub.c | 20 ++++++++++++++++++++
2 files changed, 21 insertions(+)
diff --git a/mm/slab.h b/mm/slab.h
index 8e9fc3efc3fa4..1b58c2a771407 100644
--- a/mm/slab.h
+++ b/mm/slab.h
@@ -258,6 +258,7 @@ struct kmem_cache_order_objects {
struct kmem_cache {
#ifndef CONFIG_SLUB_TINY
struct kmem_cache_cpu __percpu *cpu_slab;
+ struct lock_class_key lock_key;
#endif
/* Used for retrieving partial slabs, etc. */
slab_flags_t flags;
diff --git a/mm/slub.c b/mm/slub.c
index 68407f1177482..f3868bad83dbb 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -3078,12 +3078,29 @@ static inline void note_cmpxchg_failure(const char *n,
static void init_kmem_cache_cpus(struct kmem_cache *s)
{
+#ifdef CONFIG_PREEMPT_RT
+ /*
+ * Register lockdep key for non-boot kmem caches to avoid
+ * WARN_ON_ONCE(static_obj(key))) in lockdep_register_key()
+ */
+ bool finegrain_lockdep = !init_section_contains(s, 1);
+#else
+ /*
+ * Don't bother with different lockdep classes for each
+ * kmem_cache, since we only use local_trylock_irqsave().
+ */
+ bool finegrain_lockdep = false;
+#endif
int cpu;
struct kmem_cache_cpu *c;
+ if (finegrain_lockdep)
+ lockdep_register_key(&s->lock_key);
for_each_possible_cpu(cpu) {
c = per_cpu_ptr(s->cpu_slab, cpu);
local_lock_init(&c->lock);
+ if (finegrain_lockdep)
+ lockdep_set_class(&c->lock, &s->lock_key);
c->tid = init_tid(cpu);
}
}
@@ -5304,6 +5321,9 @@ void __kmem_cache_release(struct kmem_cache *s)
{
cache_random_seq_destroy(s);
#ifndef CONFIG_SLUB_TINY
+#ifdef CONFIG_PREEMPT_RT
+ lockdep_unregister_key(&s->lock_key);
+#endif
free_percpu(s->cpu_slab);
#endif
free_kmem_cache_nodes(s);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0750/1376] slab: Reuse first bit for OBJEXTS_ALLOC_FAIL
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (748 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0749/1376] slab: Make slub local_(try)lock more precise for LOCKDEP Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0751/1376] wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() Greg Kroah-Hartman
` (248 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexei Starovoitov, Shakeel Butt,
Harry Yoo, Vlastimil Babka, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexei Starovoitov <ast@kernel.org>
[ Upstream commit 7612833192d56af86061de8ab51989b75daf5b0d ]
Since the combination of valid upper bits in slab->obj_exts with
OBJEXTS_ALLOC_FAIL bit can never happen,
use OBJEXTS_ALLOC_FAIL == (1ull << 0) as a magic sentinel
instead of (1ull << 2) to free up bit 2.
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
Reviewed-by: Harry Yoo <harry.yoo@oracle.com>
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Stable-dep-of: 4c6eb712a91f ("wifi: ath12k: fix stride mismatch in mac_phy_caps_parse()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/memcontrol.h | 10 ++++++++--
mm/slub.c | 2 +-
2 files changed, 9 insertions(+), 3 deletions(-)
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index e1b41554a5fb3..e4c24c94b9ef0 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -344,17 +344,23 @@ enum page_memcg_data_flags {
__NR_MEMCG_DATA_FLAGS = (1UL << 2),
};
+#define __OBJEXTS_ALLOC_FAIL MEMCG_DATA_OBJEXTS
#define __FIRST_OBJEXT_FLAG __NR_MEMCG_DATA_FLAGS
#else /* CONFIG_MEMCG */
+#define __OBJEXTS_ALLOC_FAIL (1UL << 0)
#define __FIRST_OBJEXT_FLAG (1UL << 0)
#endif /* CONFIG_MEMCG */
enum objext_flags {
- /* slabobj_ext vector failed to allocate */
- OBJEXTS_ALLOC_FAIL = __FIRST_OBJEXT_FLAG,
+ /*
+ * Use bit 0 with zero other bits to signal that slabobj_ext vector
+ * failed to allocate. The same bit 0 with valid upper bits means
+ * MEMCG_DATA_OBJEXTS.
+ */
+ OBJEXTS_ALLOC_FAIL = __OBJEXTS_ALLOC_FAIL,
/* the next bit after the last actual flag */
__NR_OBJEXTS_FLAGS = (__FIRST_OBJEXT_FLAG << 1),
};
diff --git a/mm/slub.c b/mm/slub.c
index f3868bad83dbb..620e31869c624 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -1958,7 +1958,7 @@ static inline void handle_failed_objexts_alloc(unsigned long obj_exts,
* objects with no tag reference. Mark all references in this
* vector as empty to avoid warnings later on.
*/
- if (obj_exts & OBJEXTS_ALLOC_FAIL) {
+ if (obj_exts == OBJEXTS_ALLOC_FAIL) {
unsigned int i;
for (i = 0; i < objects; i++)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0751/1376] wifi: ath12k: fix stride mismatch in mac_phy_caps_parse()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (749 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0750/1376] slab: Reuse first bit for OBJEXTS_ALLOC_FAIL Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0752/1376] wifi: ath11k: " Greg Kroah-Hartman
` (247 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baochen Qiang, Rameshkumar Sundaram,
Jeff Johnson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
[ Upstream commit 4c6eb712a91fa079be6f9f1419c96e0ad2227081 ]
Currently, in ath12k_wmi_mac_phy_caps_parse(), kzalloc() sizes the
mac_phy_caps buffer as tot_phy_id * len, where len is clamped to
min(firmware_len, sizeof(struct ath12k_wmi_mac_phy_caps_params)). The
subsequent memcpy() destination advances by sizeof(full struct) per slot
via C pointer arithmetic, not by the clamped len. When firmware sends
short TLVs, the second and later slots are written past the end of the
allocation.
The reader in ath12k_pull_mac_phy_cap_svc_ready_ext() also indexes the
buffer with full-struct pointer arithmetic, so the allocation must match
that stride.
Fix by using kzalloc_objs(), which derives the element size from the
pointer type, making allocation size and pointer stride provably
consistent regardless of what len the firmware provides.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3
Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Link: https://patch.msgid.link/20260728-mac_phy_caps_parse-stride-mismatch-v1-1-27a9c1a3fbd0@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/wmi.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c
index 111b0c91d4dee..598a69f9e6df0 100644
--- a/drivers/net/wireless/ath/ath12k/wmi.c
+++ b/drivers/net/wireless/ath/ath12k/wmi.c
@@ -4073,14 +4073,16 @@ static int ath12k_wmi_mac_phy_caps_parse(struct ath12k_base *soc,
if (svc_rdy_ext->n_mac_phy_caps >= svc_rdy_ext->tot_phy_id)
return -ENOBUFS;
- len = min_t(u16, len, sizeof(struct ath12k_wmi_mac_phy_caps_params));
if (!svc_rdy_ext->n_mac_phy_caps) {
- svc_rdy_ext->mac_phy_caps = kzalloc((svc_rdy_ext->tot_phy_id) * len,
- GFP_ATOMIC);
+ svc_rdy_ext->mac_phy_caps =
+ kzalloc_objs(*svc_rdy_ext->mac_phy_caps,
+ svc_rdy_ext->tot_phy_id,
+ GFP_ATOMIC);
if (!svc_rdy_ext->mac_phy_caps)
return -ENOMEM;
}
+ len = min_t(u16, len, sizeof(struct ath12k_wmi_mac_phy_caps_params));
memcpy(svc_rdy_ext->mac_phy_caps + svc_rdy_ext->n_mac_phy_caps, ptr, len);
svc_rdy_ext->n_mac_phy_caps++;
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0752/1376] wifi: ath11k: fix stride mismatch in mac_phy_caps_parse()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (750 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0751/1376] wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0753/1376] rcu: Mark accesses to ->rcu_urgent_qs and ->rcu_need_heavy_qs Greg Kroah-Hartman
` (246 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baochen Qiang, Rameshkumar Sundaram,
Jeff Johnson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
[ Upstream commit 7a246c72132eb943b5844ba79dad597b47429dba ]
Currently, in ath11k_wmi_tlv_mac_phy_caps_parse(), kcalloc() sizes the
mac_phy_caps buffer as tot_phy_id * len, where len is clamped to
min(firmware_len, sizeof(struct wmi_mac_phy_capabilities)). The subsequent
memcpy() destination advances by sizeof(full struct) per slot via C
pointer arithmetic, not by the clamped len. When firmware sends short
TLVs, the second and later slots are written past the end of the
allocation.
The reader in ath11k_pull_mac_phy_cap_svc_ready_ext() also indexes the
buffer with full-struct pointer arithmetic, so the allocation must match
that stride.
Fix by using kzalloc_objs(), which derives the element size from the
pointer type, making allocation size and pointer stride provably
consistent regardless of what len the firmware provides.
Compile tested only.
Fixes: 5b90fc760db5 ("ath11k: fix wmi service ready ext tlv parsing")
Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Link: https://patch.msgid.link/20260728-mac_phy_caps_parse-stride-mismatch-v1-2-27a9c1a3fbd0@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath11k/wmi.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c
index d0dbc1871ee7f..540faacee41d8 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.c
+++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -4756,14 +4756,16 @@ static int ath11k_wmi_tlv_mac_phy_caps_parse(struct ath11k_base *soc,
if (svc_rdy_ext->n_mac_phy_caps >= svc_rdy_ext->tot_phy_id)
return -ENOBUFS;
- len = min_t(u16, len, sizeof(struct wmi_mac_phy_capabilities));
if (!svc_rdy_ext->n_mac_phy_caps) {
- svc_rdy_ext->mac_phy_caps = kcalloc(svc_rdy_ext->tot_phy_id,
- len, GFP_ATOMIC);
+ svc_rdy_ext->mac_phy_caps =
+ kzalloc_objs(*svc_rdy_ext->mac_phy_caps,
+ svc_rdy_ext->tot_phy_id,
+ GFP_ATOMIC);
if (!svc_rdy_ext->mac_phy_caps)
return -ENOMEM;
}
+ len = min_t(u16, len, sizeof(struct wmi_mac_phy_capabilities));
memcpy(svc_rdy_ext->mac_phy_caps + svc_rdy_ext->n_mac_phy_caps, ptr, len);
svc_rdy_ext->n_mac_phy_caps++;
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0753/1376] rcu: Mark accesses to ->rcu_urgent_qs and ->rcu_need_heavy_qs
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (751 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0752/1376] wifi: ath11k: " Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0754/1376] arm64: dts: qcom: msm8998: Dont pull-up I2C pins by default in sleep Greg Kroah-Hartman
` (245 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Itai Handler, Paul E. McKenney,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Itai Handler <itai.handler@gmail.com>
[ Upstream commit 27d73e81195b395270117ff77c47be2ed9b09b12 ]
rcu_all_qs() and rcu_note_context_switch() read/clear the per-CPU
->rcu_urgent_qs and ->rcu_need_heavy_qs flags with plain raw_cpu_read()
and this_cpu_write(), while the RCU core clears them with WRITE_ONCE() in
rcu_disable_urgency_upon_qs(). KCSAN flags the resulting same-CPU race:
BUG: KCSAN: data-race in rcu_all_qs / rcu_disable_urgency_upon_qs
It is benign -- the flags are advisory and rcu_all_qs() re-reads
->rcu_urgent_qs with smp_load_acquire() before acting on it -- but these
are the last unmarked accesses to the two flags; every other access
already uses READ_ONCE()/WRITE_ONCE()/smp_*. Mark them to match. No
functional change.
Reproduced on a PREEMPT_NONE, CONFIG_KCSAN_INTERRUPT_WATCHER=y kernel with
a pthreads program whose threads (two per CPU) loop reading a large file:
for (;;) {
int fd = open("/proc/kallsyms", O_RDONLY);
while (read(fd, buf, sizeof(buf)) > 0)
;
close(fd);
}
The read()s drive cond_resched() -> rcu_all_qs() while the busy CPUs keep
the grace period urgent, so the RCU core clears the flags concurrently.
Fixes: 2dba13f0b6c2 ("rcu: Switch urgent quiescent-state requests to rcu_data structure")
Signed-off-by: Itai Handler <itai.handler@gmail.com>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/rcu/tree_plugin.h | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h
index 47a44f6dede0c..8708ca2609298 100644
--- a/kernel/rcu/tree_plugin.h
+++ b/kernel/rcu/tree_plugin.h
@@ -973,7 +973,7 @@ void rcu_all_qs(void)
{
unsigned long flags;
- if (!raw_cpu_read(rcu_data.rcu_urgent_qs))
+ if (!READ_ONCE(*raw_cpu_ptr(&rcu_data.rcu_urgent_qs)))
return;
preempt_disable(); // For CONFIG_PREEMPT_COUNT=y kernels
/* Load rcu_urgent_qs before other flags. */
@@ -981,8 +981,8 @@ void rcu_all_qs(void)
preempt_enable();
return;
}
- this_cpu_write(rcu_data.rcu_urgent_qs, false);
- if (unlikely(raw_cpu_read(rcu_data.rcu_need_heavy_qs))) {
+ WRITE_ONCE(*this_cpu_ptr(&rcu_data.rcu_urgent_qs), false);
+ if (unlikely(READ_ONCE(*this_cpu_ptr(&rcu_data.rcu_need_heavy_qs)))) {
local_irq_save(flags);
rcu_momentary_eqs();
local_irq_restore(flags);
@@ -1002,8 +1002,8 @@ void rcu_note_context_switch(bool preempt)
/* Load rcu_urgent_qs before other flags. */
if (!smp_load_acquire(this_cpu_ptr(&rcu_data.rcu_urgent_qs)))
goto out;
- this_cpu_write(rcu_data.rcu_urgent_qs, false);
- if (unlikely(raw_cpu_read(rcu_data.rcu_need_heavy_qs)))
+ WRITE_ONCE(*this_cpu_ptr(&rcu_data.rcu_urgent_qs), false);
+ if (unlikely(READ_ONCE(*this_cpu_ptr(&rcu_data.rcu_need_heavy_qs))))
rcu_momentary_eqs();
out:
rcu_tasks_qs(current, preempt);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0754/1376] arm64: dts: qcom: msm8998: Dont pull-up I2C pins by default in sleep
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (752 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 6.12 0753/1376] rcu: Mark accesses to ->rcu_urgent_qs and ->rcu_need_heavy_qs Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0755/1376] arm64: dts: qcom: sdm632-motorola-ocean: Fix LED default trigger property Greg Kroah-Hartman
` (244 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Bjorn Andersson,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
[ Upstream commit 58ce9a2b9099bb26aed55d4e350c32af94930532 ]
When the I2C controller is disabled, no communication is expected to
take place. Without traffic on the bus, the pull-up is unnecessary.
Both the vendor kernel for this platform and DTs of other SoCs in
upstream concur this logic. Change the default and clean up now-NOP
overrides.
Fixes: 0fee55fc0de7 ("arm64: dts: qcom: msm8998: Add I2C pinctrl and fix BLSP2_I2C naming")
Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260717-topic-june26_dts_fixes-v2-1-797cd46e5d9f@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../dts/qcom/msm8998-sony-xperia-yoshino.dtsi | 4 ----
.../boot/dts/qcom/msm8998-xiaomi-sagit.dts | 5 ----
arch/arm64/boot/dts/qcom/msm8998.dtsi | 24 +++++++++----------
3 files changed, 12 insertions(+), 21 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/msm8998-sony-xperia-yoshino.dtsi b/arch/arm64/boot/dts/qcom/msm8998-sony-xperia-yoshino.dtsi
index d8cc0d729e99c..0b6b71b5ec5d8 100644
--- a/arch/arm64/boot/dts/qcom/msm8998-sony-xperia-yoshino.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8998-sony-xperia-yoshino.dtsi
@@ -229,10 +229,6 @@ rmi4-f11@11 {
};
};
-&blsp1_i2c5_sleep {
- bias-disable;
-};
-
&blsp1_uart3 {
status = "okay";
diff --git a/arch/arm64/boot/dts/qcom/msm8998-xiaomi-sagit.dts b/arch/arm64/boot/dts/qcom/msm8998-xiaomi-sagit.dts
index 0cac06f25a77a..2ceeec827f8e2 100644
--- a/arch/arm64/boot/dts/qcom/msm8998-xiaomi-sagit.dts
+++ b/arch/arm64/boot/dts/qcom/msm8998-xiaomi-sagit.dts
@@ -217,11 +217,6 @@ rmi4-f1a@1a {
};
};
-&blsp1_i2c5_sleep {
- /delete-property/ bias-pull-up;
- bias-disable;
-};
-
&blsp1_uart3 {
status = "okay";
diff --git a/arch/arm64/boot/dts/qcom/msm8998.dtsi b/arch/arm64/boot/dts/qcom/msm8998.dtsi
index 9aa9c5cee355b..6524a182277db 100644
--- a/arch/arm64/boot/dts/qcom/msm8998.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8998.dtsi
@@ -1166,7 +1166,7 @@ blsp1_i2c1_sleep: blsp1-i2c1-sleep-state-state {
pins = "gpio2", "gpio3";
function = "blsp_i2c1";
drive-strength = <2>;
- bias-pull-up;
+ bias-disable;
};
blsp1_i2c2_default: blsp1-i2c2-default-state {
@@ -1180,7 +1180,7 @@ blsp1_i2c2_sleep: blsp1-i2c2-sleep-state-state {
pins = "gpio32", "gpio33";
function = "blsp_i2c2";
drive-strength = <2>;
- bias-pull-up;
+ bias-disable;
};
blsp1_i2c3_default: blsp1-i2c3-default-state {
@@ -1194,7 +1194,7 @@ blsp1_i2c3_sleep: blsp1-i2c3-sleep-state {
pins = "gpio47", "gpio48";
function = "blsp_i2c3";
drive-strength = <2>;
- bias-pull-up;
+ bias-disable;
};
blsp1_i2c4_default: blsp1-i2c4-default-state {
@@ -1208,7 +1208,7 @@ blsp1_i2c4_sleep: blsp1-i2c4-sleep-state {
pins = "gpio10", "gpio11";
function = "blsp_i2c4";
drive-strength = <2>;
- bias-pull-up;
+ bias-disable;
};
blsp1_i2c5_default: blsp1-i2c5-default-state {
@@ -1222,7 +1222,7 @@ blsp1_i2c5_sleep: blsp1-i2c5-sleep-state {
pins = "gpio87", "gpio88";
function = "blsp_i2c5";
drive-strength = <2>;
- bias-pull-up;
+ bias-disable;
};
blsp1_i2c6_default: blsp1-i2c6-default-state {
@@ -1236,7 +1236,7 @@ blsp1_i2c6_sleep: blsp1-i2c6-sleep-state {
pins = "gpio43", "gpio44";
function = "blsp_i2c6";
drive-strength = <2>;
- bias-pull-up;
+ bias-disable;
};
blsp1_spi_b_default: blsp1-spi-b-default-state {
@@ -1301,7 +1301,7 @@ blsp2_i2c1_sleep: blsp2-i2c1-sleep-state {
pins = "gpio55", "gpio56";
function = "blsp_i2c7";
drive-strength = <2>;
- bias-pull-up;
+ bias-disable;
};
blsp2_i2c2_default: blsp2-i2c2-default-state {
@@ -1315,7 +1315,7 @@ blsp2_i2c2_sleep: blsp2-i2c2-sleep-state {
pins = "gpio6", "gpio7";
function = "blsp_i2c8";
drive-strength = <2>;
- bias-pull-up;
+ bias-disable;
};
blsp2_i2c3_default: blsp2-i2c3-default-state {
@@ -1329,7 +1329,7 @@ blsp2_i2c3_sleep: blsp2-i2c3-sleep-state {
pins = "gpio51", "gpio52";
function = "blsp_i2c9";
drive-strength = <2>;
- bias-pull-up;
+ bias-disable;
};
blsp2_i2c4_default: blsp2-i2c4-default-state {
@@ -1343,7 +1343,7 @@ blsp2_i2c4_sleep: blsp2-i2c4-sleep-state {
pins = "gpio67", "gpio68";
function = "blsp_i2c10";
drive-strength = <2>;
- bias-pull-up;
+ bias-disable;
};
blsp2_i2c5_default: blsp2-i2c5-default-state {
@@ -1357,7 +1357,7 @@ blsp2_i2c5_sleep: blsp2-i2c5-sleep-state {
pins = "gpio60", "gpio61";
function = "blsp_i2c11";
drive-strength = <2>;
- bias-pull-up;
+ bias-disable;
};
blsp2_i2c6_default: blsp2-i2c6-default-state {
@@ -1371,7 +1371,7 @@ blsp2_i2c6_sleep: blsp2-i2c6-sleep-state {
pins = "gpio83", "gpio84";
function = "blsp_i2c12";
drive-strength = <2>;
- bias-pull-up;
+ bias-disable;
};
blsp2_spi1_default: blsp2-spi1-default-state {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0755/1376] arm64: dts: qcom: sdm632-motorola-ocean: Fix LED default trigger property
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (753 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0754/1376] arm64: dts: qcom: msm8998: Dont pull-up I2C pins by default in sleep Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0756/1376] arm64: dts: qcom: qcs404: Fix DTBS Check errors in usb controller nodes Greg Kroah-Hartman
` (243 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
[ Upstream commit c82ea31fb783d9ce4080eca1a7bb855f4648fc28 ]
The correct property name is "linux,default-trigger", not
"default-trigger". Fix it to avoid DT checker warnings and let the OSes
consume the intended information.
Fixes: 3176c4d6b9be ("arm64: dts: qcom: sdm632: Add device tree for Motorola G7 Power")
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260717-topic-june26_dts_fixes-v2-3-797cd46e5d9f@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sdm632-motorola-ocean.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/sdm632-motorola-ocean.dts b/arch/arm64/boot/dts/qcom/sdm632-motorola-ocean.dts
index 2f55db0c8ce35..9ea3e5e76bf9e 100644
--- a/arch/arm64/boot/dts/qcom/sdm632-motorola-ocean.dts
+++ b/arch/arm64/boot/dts/qcom/sdm632-motorola-ocean.dts
@@ -130,7 +130,7 @@ led-controller@36 {
led: led@1 {
reg = <1>;
- default-trigger = "backlight";
+ linux,default-trigger = "backlight";
function = LED_FUNCTION_BACKLIGHT;
led-sources = <0 1 2>;
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0756/1376] arm64: dts: qcom: qcs404: Fix DTBS Check errors in usb controller nodes
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (754 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0755/1376] arm64: dts: qcom: sdm632-motorola-ocean: Fix LED default trigger property Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0757/1376] clk: qcom: gcc-qcm2290: dont park QUP RCGs upon registration Greg Kroah-Hartman
` (242 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krishna Kurapati, Konrad Dybcio,
Dmitry Baryshkov, Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
[ Upstream commit 9812d0a3077489f67afaca84dcc7e01a440ee106 ]
The following errors pop up when DTBS check is done for qcs404 based
platforms:
arch/arm64/boot/dts/qcom/qcs404-evb-4000.dtb: usb@79b8800 (qcom,qcs404-
dwc3): interrupt-names:1: 'qusb2_phy' was expected
from schema $id: http://devicetree.org/schemas/usb/qcom,dwc3.yaml
arch/arm64/boot/dts/qcom/qcs404-evb-4000.dtb: usb@79b8800 (qcom,qcs404-
dwc3): interrupt-names:2: 'hs_phy_irq' was expected
from schema $id: http://devicetree.org/schemas/usb/qcom,dwc3.yaml
arch/arm64/boot/dts/qcom/qcs404-evb-4000.dtb: usb@7678800 (qcom,qcs404-
dwc3): interrupt-names:2: 'hs_phy_irq' was expected
from schema $id: http://devicetree.org/schemas/usb/qcom,dwc3.yaml
arch/arm64/boot/dts/qcom/qcs404-evb-4000.dtb: usb@7678800 (qcom,qcs404-
dwc3): interrupt-names:1: 'qusb2_phy' was expected
from schema $id: http://devicetree.org/schemas/usb/qcom,dwc3.yaml
Modify ordering of hs_phy and qusb2_phy interrupts to fix the errors.
Fixes: 927173bf8a0e ("arm64: dts: qcom: Add missing interrupts for qcs404/ipq5332")
Signed-off-by: Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260723-qcs404_dtbs_fix-v1-1-c9ca0dd69f23@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/qcs404.dtsi | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/qcs404.dtsi b/arch/arm64/boot/dts/qcom/qcs404.dtsi
index 81a161c0cc5a8..3ba456d73fb2a 100644
--- a/arch/arm64/boot/dts/qcom/qcs404.dtsi
+++ b/arch/arm64/boot/dts/qcom/qcs404.dtsi
@@ -677,11 +677,11 @@ usb3: usb@7678800 {
assigned-clock-rates = <19200000>, <200000000>;
interrupts = <GIC_SPI 25 IRQ_TYPE_LEVEL_HIGH>,
- <GIC_SPI 24 IRQ_TYPE_LEVEL_HIGH>,
- <GIC_SPI 319 IRQ_TYPE_LEVEL_HIGH>;
+ <GIC_SPI 319 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 24 IRQ_TYPE_LEVEL_HIGH>;
interrupt-names = "pwr_event",
- "hs_phy_irq",
- "qusb2_phy";
+ "qusb2_phy",
+ "hs_phy_irq";
status = "disabled";
@@ -714,11 +714,11 @@ usb2: usb@79b8800 {
assigned-clock-rates = <19200000>, <133333333>;
interrupts = <GIC_SPI 32 IRQ_TYPE_LEVEL_HIGH>,
- <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>,
- <GIC_SPI 318 IRQ_TYPE_LEVEL_HIGH>;
+ <GIC_SPI 318 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>;
interrupt-names = "pwr_event",
- "hs_phy_irq",
- "qusb2_phy";
+ "qusb2_phy",
+ "hs_phy_irq";
status = "disabled";
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0757/1376] clk: qcom: gcc-qcm2290: dont park QUP RCGs upon registration
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (755 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0756/1376] arm64: dts: qcom: qcs404: Fix DTBS Check errors in usb controller nodes Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0758/1376] arm64: dts: qcom: sc8280xp-crd: Fix the pin index for misc_3p3_reg_en Greg Kroah-Hartman
` (241 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
[ Upstream commit 9c4cee964e0ccc155e4ab8fa6cec88fffc262c63 ]
The gcc_qupv3_wrap0_s[0-5]_clk_src RCGs feed the QUP serial engines
(UART/I2C/SPI). Since shared RCGs are parked to XO at registration time,
binding the gcc-qcm2290 driver reprograms these clocks away from the
rate configured by the bootloader. For the UART used as the boot console
this drops early console output until the serial driver later
reconfigures the clock.
Switch the QUP wrap0 clock sources over to
clk_rcg2_shared_no_init_park_ops so their frequency is left unchanged at
registration time, keeping the bootloader-configured console working
across the gcc driver probe.
Fixes: 01a0a6cc8cfd ("clk: qcom: Park shared RCGs upon registration")
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260722-agatti-no-park-v1-1-31ae3a4774e5@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/gcc-qcm2290.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/clk/qcom/gcc-qcm2290.c b/drivers/clk/qcom/gcc-qcm2290.c
index 9a6703365e619..bbcbe847fd95a 100644
--- a/drivers/clk/qcom/gcc-qcm2290.c
+++ b/drivers/clk/qcom/gcc-qcm2290.c
@@ -1082,7 +1082,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s0_clk_src_init = {
.name = "gcc_qupv3_wrap0_s0_clk_src",
.parent_data = gcc_parents_1,
.num_parents = ARRAY_SIZE(gcc_parents_1),
- .ops = &clk_rcg2_shared_ops,
+ .ops = &clk_rcg2_shared_no_init_park_ops,
};
static struct clk_rcg2 gcc_qupv3_wrap0_s0_clk_src = {
@@ -1098,7 +1098,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s1_clk_src_init = {
.name = "gcc_qupv3_wrap0_s1_clk_src",
.parent_data = gcc_parents_1,
.num_parents = ARRAY_SIZE(gcc_parents_1),
- .ops = &clk_rcg2_shared_ops,
+ .ops = &clk_rcg2_shared_no_init_park_ops,
};
static struct clk_rcg2 gcc_qupv3_wrap0_s1_clk_src = {
@@ -1114,7 +1114,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s2_clk_src_init = {
.name = "gcc_qupv3_wrap0_s2_clk_src",
.parent_data = gcc_parents_1,
.num_parents = ARRAY_SIZE(gcc_parents_1),
- .ops = &clk_rcg2_shared_ops,
+ .ops = &clk_rcg2_shared_no_init_park_ops,
};
static struct clk_rcg2 gcc_qupv3_wrap0_s2_clk_src = {
@@ -1130,7 +1130,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s3_clk_src_init = {
.name = "gcc_qupv3_wrap0_s3_clk_src",
.parent_data = gcc_parents_1,
.num_parents = ARRAY_SIZE(gcc_parents_1),
- .ops = &clk_rcg2_shared_ops,
+ .ops = &clk_rcg2_shared_no_init_park_ops,
};
static struct clk_rcg2 gcc_qupv3_wrap0_s3_clk_src = {
@@ -1146,7 +1146,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s4_clk_src_init = {
.name = "gcc_qupv3_wrap0_s4_clk_src",
.parent_data = gcc_parents_1,
.num_parents = ARRAY_SIZE(gcc_parents_1),
- .ops = &clk_rcg2_shared_ops,
+ .ops = &clk_rcg2_shared_no_init_park_ops,
};
static struct clk_rcg2 gcc_qupv3_wrap0_s4_clk_src = {
@@ -1162,7 +1162,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s5_clk_src_init = {
.name = "gcc_qupv3_wrap0_s5_clk_src",
.parent_data = gcc_parents_1,
.num_parents = ARRAY_SIZE(gcc_parents_1),
- .ops = &clk_rcg2_shared_ops,
+ .ops = &clk_rcg2_shared_no_init_park_ops,
};
static struct clk_rcg2 gcc_qupv3_wrap0_s5_clk_src = {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0758/1376] arm64: dts: qcom: sc8280xp-crd: Fix the pin index for misc_3p3_reg_en
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (756 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0757/1376] clk: qcom: gcc-qcm2290: dont park QUP RCGs upon registration Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0759/1376] firmware: qcom_scm: Add API to get waitqueue IRQ info Greg Kroah-Hartman
` (240 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Dmitry Baryshkov,
Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
[ Upstream commit 0e05c183f3b97427f00d619132ba5984494f6886 ]
The correct pin is GPIO1. Fix it.
Fixes: ccd3517faf18 ("arm64: dts: qcom: sc8280xp: Add reference device")
Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260701-topic-8280crd_fixups-v1-2-3fe92ee9636b@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sc8280xp-crd.dts | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sc8280xp-crd.dts b/arch/arm64/boot/dts/qcom/sc8280xp-crd.dts
index 6020582b0a59d..36beb71d7d2f4 100644
--- a/arch/arm64/boot/dts/qcom/sc8280xp-crd.dts
+++ b/arch/arm64/boot/dts/qcom/sc8280xp-crd.dts
@@ -167,7 +167,7 @@ vreg_misc_3p3: regulator-misc-3p3 {
regulator-min-microvolt = <3300000>;
regulator-max-microvolt = <3300000>;
- gpio = <&pmc8280_1_gpios 2 GPIO_ACTIVE_HIGH>;
+ gpio = <&pmc8280_1_gpios 1 GPIO_ACTIVE_HIGH>;
enable-active-high;
pinctrl-names = "default";
@@ -759,7 +759,7 @@ edp_bl_reg_en: edp-bl-reg-en-state {
};
misc_3p3_reg_en: misc-3p3-reg-en-state {
- pins = "gpio2";
+ pins = "gpio1";
function = "normal";
};
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0759/1376] firmware: qcom_scm: Add API to get waitqueue IRQ info
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (757 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0758/1376] arm64: dts: qcom: sc8280xp-crd: Fix the pin index for misc_3p3_reg_en Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0760/1376] firmware: qcom_scm: Support multiple waitq contexts Greg Kroah-Hartman
` (239 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bartosz Golaszewski,
Unnathi Chalicheemala, Shivendra Pratap, Mukesh Ojha,
Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Unnathi Chalicheemala <unnathi.chalicheemala@oss.qualcomm.com>
[ Upstream commit da9e6b1a96b1eef47542ec46b67e3f4f883fed3b ]
Bootloader and firmware for SM8650 and older chipsets expect node
name as "qcom_scm", in order to patch the wait queue IRQ information.
However, DeviceTree uses node name "scm" and this mismatch prevents
firmware from correctly identifying waitqueue IRQ information. Waitqueue
IRQ is used for signaling between secure and non-secure worlds.
To resolve this, introduce qcom_scm_get_waitq_irq() that'll get the
hardware IRQ number to be used from firmware instead of relying on data
provided by devicetree, thereby bypassing the DeviceTree node name
mismatch.
This hardware IRQ number is converted to a Linux IRQ number using newly
qcom_scm_fill_irq_fwspec_params(). This Linux IRQ number is then
supplied to the threaded_irq call.
Reviewed-by: Bartosz Golaszewski <brgl@kernel.org>
Signed-off-by: Unnathi Chalicheemala <unnathi.chalicheemala@oss.qualcomm.com>
Signed-off-by: Shivendra Pratap <shivendra.pratap@oss.qualcomm.com>
Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20251217-multi_waitq_scm-v11-1-f21e50e792b8@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Stable-dep-of: 966d23c7e68e ("firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/qcom/qcom_scm.c | 62 +++++++++++++++++++++++++++++++-
drivers/firmware/qcom/qcom_scm.h | 1 +
2 files changed, 62 insertions(+), 1 deletion(-)
diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c
index 1da16bc79391c..5b2ef39a2e9e9 100644
--- a/drivers/firmware/qcom/qcom_scm.c
+++ b/drivers/firmware/qcom/qcom_scm.c
@@ -30,11 +30,18 @@
#include <linux/sizes.h>
#include <linux/types.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+
#include "qcom_scm.h"
#include "qcom_tzmem.h"
static u32 download_mode;
+#define GIC_SPI_BASE 32
+#define GIC_MAX_SPI 1019 // SPIs in GICv3 spec range from 32..1019
+#define GIC_ESPI_BASE 4096
+#define GIC_MAX_ESPI 5119 // ESPIs in GICv3 spec range from 4096..5119
+
struct qcom_scm {
struct device *dev;
struct clk *core_clk;
@@ -1847,6 +1854,56 @@ bool qcom_scm_is_available(void)
}
EXPORT_SYMBOL_GPL(qcom_scm_is_available);
+static int qcom_scm_fill_irq_fwspec_params(struct irq_fwspec *fwspec, u32 hwirq)
+{
+ if (hwirq >= GIC_SPI_BASE && hwirq <= GIC_MAX_SPI) {
+ fwspec->param[0] = GIC_SPI;
+ fwspec->param[1] = hwirq - GIC_SPI_BASE;
+ } else if (hwirq >= GIC_ESPI_BASE && hwirq <= GIC_MAX_ESPI) {
+ fwspec->param[0] = GIC_ESPI;
+ fwspec->param[1] = hwirq - GIC_ESPI_BASE;
+ } else {
+ WARN(1, "Unexpected hwirq: %d\n", hwirq);
+ return -ENXIO;
+ }
+
+ fwspec->param[2] = IRQ_TYPE_EDGE_RISING;
+ fwspec->param_count = 3;
+
+ return 0;
+}
+
+static int qcom_scm_get_waitq_irq(struct qcom_scm *scm)
+{
+ struct qcom_scm_desc desc = {
+ .svc = QCOM_SCM_SVC_WAITQ,
+ .cmd = QCOM_SCM_WAITQ_GET_INFO,
+ .owner = ARM_SMCCC_OWNER_SIP
+ };
+ struct device_node *parent_irq_node;
+ struct irq_fwspec fwspec;
+ struct qcom_scm_res res;
+ u32 hwirq;
+ int ret;
+
+ ret = qcom_scm_call_atomic(scm->dev, &desc, &res);
+ if (ret)
+ return ret;
+
+ hwirq = res.result[1] & GENMASK(15, 0);
+ ret = qcom_scm_fill_irq_fwspec_params(&fwspec, hwirq);
+ if (ret)
+ return ret;
+
+ parent_irq_node = of_irq_find_parent(scm->dev->of_node);
+ if (!parent_irq_node)
+ return -ENODEV;
+
+ fwspec.fwnode = of_fwnode_handle(parent_irq_node);
+
+ return irq_create_fwspec_mapping(&fwspec);
+}
+
static int qcom_scm_assert_valid_wq_ctx(u32 wq_ctx)
{
/* FW currently only supports a single wq_ctx (zero).
@@ -2003,7 +2060,10 @@ static int qcom_scm_probe(struct platform_device *pdev)
/* Paired with smp_load_acquire() in qcom_scm_is_available(). */
smp_store_release(&__scm, scm);
- irq = platform_get_irq_optional(pdev, 0);
+ irq = qcom_scm_get_waitq_irq(scm);
+ if (irq < 0)
+ irq = platform_get_irq_optional(pdev, 0);
+
if (irq < 0) {
if (irq != -ENXIO) {
ret = irq;
diff --git a/drivers/firmware/qcom/qcom_scm.h b/drivers/firmware/qcom/qcom_scm.h
index 685b8f59e7a64..ab0f88f5f7773 100644
--- a/drivers/firmware/qcom/qcom_scm.h
+++ b/drivers/firmware/qcom/qcom_scm.h
@@ -143,6 +143,7 @@ struct qcom_tzmem_pool *qcom_scm_get_tzmem_pool(void);
#define QCOM_SCM_SVC_WAITQ 0x24
#define QCOM_SCM_WAITQ_RESUME 0x02
#define QCOM_SCM_WAITQ_GET_WQ_CTX 0x03
+#define QCOM_SCM_WAITQ_GET_INFO 0x04
#define QCOM_SCM_SVC_GPU 0x28
#define QCOM_SCM_SVC_GPU_INIT_REGS 0x01
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0760/1376] firmware: qcom_scm: Support multiple waitq contexts
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (758 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0759/1376] firmware: qcom_scm: Add API to get waitqueue IRQ info Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0761/1376] firmware: qcom: scm: add trace events for the SMC call interface Greg Kroah-Hartman
` (238 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bartosz Golaszewski,
Unnathi Chalicheemala, Shivendra Pratap, Mukesh Ojha,
Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Unnathi Chalicheemala <unnathi.chalicheemala@oss.qualcomm.com>
[ Upstream commit ccd207ec848e768da41465352a0f52081eec6bb1 ]
Currently, only a single waitqueue context exists in the driver.
Multi-waitqueue mechanism is added in firmware to support the case,
when multiple VMs make SMC calls or single VM making multiple calls on
same CPU. Enhance the driver to support multiple waitqueue when
support is present in the firmware.
When VMs make a SMC call, firmware allocates a waitqueue context,
assuming the SMC call to be a blocking call. The SMC calls that cannot
acquire resources, while execution in firmware, are returned to sleep
in the calling VM. When the resource becomes available in the
firmware, the VM gets notified to wake the sleeping thread and resume
SMC call. The current qcom_scm driver supports single waitqueue as the
old firmwares support only single waitqueue with waitqueue id zero.
Multi-waitqueue mechanism is added in firmware starting SM8650 to
support the case when multiple VMs make SMC calls or single VM making
multiple calls on same CPU. To enable this support in qcom_scm driver,
add support for handling multiple waitqueues. For instance, SM8650
firmware can allocate two such waitq contexts, so the driver needs to
implement two waitqueue contexts. For a generalized approach, the
number of supported waitqueues can be queried from the firmware using
a SMC call.
Introduce qcom_scm_query_waitq_count to get the number of waitqueue
contexts supported by the firmware and allocate “N” unique waitqueue
contexts with a dynamic sized array where each unique wq_ctx is
associated with a struct completion variable for easy lookup. Older
targets which support only a single waitqueue, may return an error for
qcom_scm_query_waitq_count, set the wq_cnt to one for such failures.
Reviewed-by: Bartosz Golaszewski <brgl@kernel.org>
Signed-off-by: Unnathi Chalicheemala <unnathi.chalicheemala@oss.qualcomm.com>
Signed-off-by: Shivendra Pratap <shivendra.pratap@oss.qualcomm.com>
Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20251217-multi_waitq_scm-v11-2-f21e50e792b8@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Stable-dep-of: 966d23c7e68e ("firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/qcom/qcom_scm.c | 72 ++++++++++++++++++++++----------
1 file changed, 50 insertions(+), 22 deletions(-)
diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c
index 5b2ef39a2e9e9..7f56ab78ac159 100644
--- a/drivers/firmware/qcom/qcom_scm.c
+++ b/drivers/firmware/qcom/qcom_scm.c
@@ -48,7 +48,7 @@ struct qcom_scm {
struct clk *iface_clk;
struct clk *bus_clk;
struct icc_path *path;
- struct completion waitq_comp;
+ struct completion *waitq_comps;
struct reset_controller_dev reset;
/* control access to the interconnect path */
@@ -58,6 +58,7 @@ struct qcom_scm {
u64 dload_mode_addr;
struct qcom_tzmem_pool *mempool;
+ unsigned int wq_cnt;
};
struct qcom_scm_current_perm_info {
@@ -137,6 +138,8 @@ static const u8 qcom_scm_cpu_warm_bits[QCOM_SCM_BOOT_MAX_CPUS] = {
#define QCOM_DLOAD_MINIDUMP 2
#define QCOM_DLOAD_BOTHDUMP 3
+#define QCOM_SCM_DEFAULT_WAITQ_COUNT 1
+
static const char * const qcom_scm_convention_names[] = {
[SMC_CONVENTION_UNKNOWN] = "unknown",
[SMC_CONVENTION_ARM_32] = "smc arm 32",
@@ -1873,6 +1876,23 @@ static int qcom_scm_fill_irq_fwspec_params(struct irq_fwspec *fwspec, u32 hwirq)
return 0;
}
+static int qcom_scm_query_waitq_count(struct qcom_scm *scm)
+{
+ struct qcom_scm_desc desc = {
+ .svc = QCOM_SCM_SVC_WAITQ,
+ .cmd = QCOM_SCM_WAITQ_GET_INFO,
+ .owner = ARM_SMCCC_OWNER_SIP
+ };
+ struct qcom_scm_res res;
+ int ret;
+
+ ret = qcom_scm_call_atomic(scm->dev, &desc, &res);
+ if (ret)
+ return ret;
+
+ return res.result[0] & GENMASK(7, 0);
+}
+
static int qcom_scm_get_waitq_irq(struct qcom_scm *scm)
{
struct qcom_scm_desc desc = {
@@ -1904,42 +1924,40 @@ static int qcom_scm_get_waitq_irq(struct qcom_scm *scm)
return irq_create_fwspec_mapping(&fwspec);
}
-static int qcom_scm_assert_valid_wq_ctx(u32 wq_ctx)
+static struct completion *qcom_scm_get_completion(u32 wq_ctx)
{
- /* FW currently only supports a single wq_ctx (zero).
- * TODO: Update this logic to include dynamic allocation and lookup of
- * completion structs when FW supports more wq_ctx values.
- */
- if (wq_ctx != 0) {
- dev_err(__scm->dev, "Firmware unexpectedly passed non-zero wq_ctx\n");
- return -EINVAL;
- }
+ struct completion *wq;
- return 0;
+ if (WARN_ON_ONCE(wq_ctx >= __scm->wq_cnt))
+ return ERR_PTR(-EINVAL);
+
+ wq = &__scm->waitq_comps[wq_ctx];
+
+ return wq;
}
int qcom_scm_wait_for_wq_completion(u32 wq_ctx)
{
- int ret;
+ struct completion *wq;
- ret = qcom_scm_assert_valid_wq_ctx(wq_ctx);
- if (ret)
- return ret;
+ wq = qcom_scm_get_completion(wq_ctx);
+ if (IS_ERR(wq))
+ return PTR_ERR(wq);
- wait_for_completion(&__scm->waitq_comp);
+ wait_for_completion(wq);
return 0;
}
static int qcom_scm_waitq_wakeup(unsigned int wq_ctx)
{
- int ret;
+ struct completion *wq;
- ret = qcom_scm_assert_valid_wq_ctx(wq_ctx);
- if (ret)
- return ret;
+ wq = qcom_scm_get_completion(wq_ctx);
+ if (IS_ERR(wq))
+ return PTR_ERR(wq);
- complete(&__scm->waitq_comp);
+ complete(wq);
return 0;
}
@@ -2015,6 +2033,7 @@ static int qcom_scm_probe(struct platform_device *pdev)
struct qcom_tzmem_pool_config pool_config;
struct qcom_scm *scm;
int irq, ret;
+ int i;
scm = devm_kzalloc(&pdev->dev, sizeof(*scm), GFP_KERNEL);
if (!scm)
@@ -2025,7 +2044,6 @@ static int qcom_scm_probe(struct platform_device *pdev)
if (ret < 0)
return ret;
- init_completion(&scm->waitq_comp);
mutex_init(&scm->scm_bw_lock);
scm->path = devm_of_icc_get(&pdev->dev, NULL);
@@ -2060,6 +2078,16 @@ static int qcom_scm_probe(struct platform_device *pdev)
/* Paired with smp_load_acquire() in qcom_scm_is_available(). */
smp_store_release(&__scm, scm);
+ ret = qcom_scm_query_waitq_count(scm);
+ scm->wq_cnt = ret < 0 ? QCOM_SCM_DEFAULT_WAITQ_COUNT : ret;
+ scm->waitq_comps = devm_kcalloc(&pdev->dev, scm->wq_cnt, sizeof(*scm->waitq_comps),
+ GFP_KERNEL);
+ if (!scm->waitq_comps)
+ return -ENOMEM;
+
+ for (i = 0; i < scm->wq_cnt; i++)
+ init_completion(&scm->waitq_comps[i]);
+
irq = qcom_scm_get_waitq_irq(scm);
if (irq < 0)
irq = platform_get_irq_optional(pdev, 0);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0761/1376] firmware: qcom: scm: add trace events for the SMC call interface
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (759 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0760/1376] firmware: qcom_scm: Support multiple waitq contexts Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0762/1376] firmware: qcom: scm: instrument SMC call path with tracepoints Greg Kroah-Hartman
` (237 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Yuvaraj Ranganathan,
Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuvaraj Ranganathan <yuvaraj.ranganathan@oss.qualcomm.com>
[ Upstream commit f6bb2daa4584229af155c2488b83151999315293 ]
The SCM SMC call path is opaque at runtime. Stalls caused by firmware
congestion, QCOM_SCM_WAITQ_SLEEP/RESUME cycles, and EBUSY retry loops
are invisible without recompiling the kernel with temporary printk
statements or attaching a hardware debugger.
Add five TRACE_EVENTs covering the complete lifecycle of an SCM call:
scm_smc_request
Emit before each arm_smccc_smc_quirk() invocation. Records the
SMC function ID, decoded service and command identifiers, argument
count, and up to six register arguments in hex and decimal. Because
the caller loops on QCOM_SCM_INTERRUPTED, this event fires once per
physical SMC instruction including inte
scm_smc_done
Emit after the outer __scm_smc_do() returns, pairing each
request with its final outcome. Records the SMC function ID, the
kernel error code returned to the caller, and the four firmware
result registers a0-a3.
scm_waitq_sleep
Emit when the firmware returns QCOM_SCM_WAITQ_SLEEP. Records
the wait-queue context and the SMC call context handles required
to issue the matching WAITQ_RESUME.
scm_waitq_resume
Emit just before constructing and sending the WAITQ_RESUME
follow-up call. Records the SMC call context handle being resumed.
scm_waitq_get_wq_ctx
Emit after a successful WAITQ_GET_WQ_CTX fast-call. Records
the returned wait-queue context, flags, and more_pending indicator.
These events let ftrace and perf reconstruct the full sequence of
firmware interactions, measure per-call and end-to-end latency, and
attribute waitqueue stalls to specific service/command pairs without
modifying driver source.
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Yuvaraj Ranganathan <yuvaraj.ranganathan@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260522-scm-tracepoints-v2-1-e27cdbe0c585@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Stable-dep-of: 966d23c7e68e ("firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/qcom/qcom_scm_trace.h | 143 +++++++++++++++++++++++++
1 file changed, 143 insertions(+)
create mode 100644 drivers/firmware/qcom/qcom_scm_trace.h
diff --git a/drivers/firmware/qcom/qcom_scm_trace.h b/drivers/firmware/qcom/qcom_scm_trace.h
new file mode 100644
index 0000000000000..6c911124fc56b
--- /dev/null
+++ b/drivers/firmware/qcom/qcom_scm_trace.h
@@ -0,0 +1,143 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+ */
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM qcom_scm
+
+#if !defined(_TRACE_SCM_SMC_INTERFACE_H) || defined(TRACE_HEADER_MULTI_READ)
+
+#define _TRACE_SCM_SMC_INTERFACE_H
+
+#include <linux/tracepoint.h>
+
+TRACE_EVENT(scm_smc_request,
+
+ TP_PROTO(unsigned long a0, const struct arm_smccc_args *smc),
+
+ TP_ARGS(a0, smc),
+
+ TP_STRUCT__entry(
+ __field(u64, smc_id)
+ __field(u8, svc_id)
+ __field(u8, cmd_id)
+ __field(u8, args_cnt)
+ __dynamic_array(unsigned long, args,
+ min_t(u8, (smc->args[1] & 0xF), (u8)6))
+ ),
+
+ TP_fast_assign(
+ __entry->smc_id = a0;
+ __entry->svc_id = (smc->args[0] >> 8) & 0xFF;
+ __entry->cmd_id = smc->args[0] & 0xFF;
+ u8 n = min_t(u8, (smc->args[1] & 0xF), (u8)6);
+
+ __entry->args_cnt = n;
+
+ unsigned long *dst = __get_dynamic_array(args);
+
+ for (int i = 0; i < n; i++)
+ dst[i] = smc->args[2 + i];
+ ),
+
+ TP_printk("smc_id:0x%08llx svc_id:0x%02x cmd_id:0x%02x args_cnt:%u args:%s",
+ __entry->smc_id, __entry->svc_id, __entry->cmd_id, __entry->args_cnt,
+ __print_dynamic_array(args, sizeof(unsigned long)))
+);
+
+TRACE_EVENT(scm_waitq_sleep,
+
+ TP_PROTO(u32 wq_ctx, u32 smc_ctx),
+
+ TP_ARGS(wq_ctx, smc_ctx),
+
+ TP_STRUCT__entry(
+ __field(u32, wq_ctx)
+ __field(u32, smc_call_ctx)
+ ),
+
+ TP_fast_assign(
+ __entry->wq_ctx = wq_ctx;
+ __entry->smc_call_ctx = smc_ctx;
+ ),
+
+ TP_printk("wq_ctx:%u, smc_call_ctx:%u", __entry->wq_ctx, __entry->smc_call_ctx)
+);
+
+TRACE_EVENT(scm_waitq_resume,
+
+ TP_PROTO(u32 smc_ctx),
+
+ TP_ARGS(smc_ctx),
+
+ TP_STRUCT__entry(
+ __field(u32, smc_call_ctx)
+ ),
+
+ TP_fast_assign(
+ __entry->smc_call_ctx = smc_ctx;
+ ),
+
+ TP_printk("smc_call_ctx:%u", __entry->smc_call_ctx)
+);
+
+TRACE_EVENT(scm_waitq_get_wq_ctx,
+
+ TP_PROTO(u32 wq_ctx, u32 flags, u32 pending),
+
+ TP_ARGS(wq_ctx, flags, pending),
+
+ TP_STRUCT__entry(
+ __field(u32, wq_ctx)
+ __field(u32, flags)
+ __field(u32, more_pending)
+ ),
+
+ TP_fast_assign(
+ __entry->wq_ctx = wq_ctx;
+ __entry->flags = flags;
+ __entry->more_pending = pending;
+ ),
+
+ TP_printk("wq_ctx:%u, flags:%u, more_pending:%u",
+ __entry->wq_ctx, __entry->flags, __entry->more_pending)
+);
+
+TRACE_EVENT(scm_smc_done,
+
+ TP_PROTO(int ret, u64 smc_id, struct arm_smccc_res *smc_res),
+
+ TP_ARGS(ret, smc_id, smc_res),
+
+ TP_STRUCT__entry(
+ __field(int, ret)
+ __field(u64, smc_id)
+ __field(unsigned long, res)
+ __field(unsigned long, res0)
+ __field(unsigned long, res1)
+ __field(unsigned long, res2)
+ ),
+
+ TP_fast_assign(
+ __entry->ret = ret;
+ __entry->smc_id = smc_id;
+ __entry->res = smc_res->a0;
+ __entry->res0 = smc_res->a1;
+ __entry->res1 = smc_res->a2;
+ __entry->res2 = smc_res->a3;
+ ),
+
+ TP_printk("smc_id:0x%08llx, ret:%d res_to_callee:0x%lx res0:0x%lx res1:0x%lx res2:0x%lx",
+ __entry->smc_id, __entry->ret, __entry->res,
+ __entry->res0, __entry->res1, __entry->res2)
+);
+
+#endif /* _TRACE_SCM_SMC_INTERFACE_H */
+
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH .
+#define TRACE_INCLUDE_FILE qcom_scm_trace
+
+#include <trace/define_trace.h>
+
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0762/1376] firmware: qcom: scm: instrument SMC call path with tracepoints
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (760 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0761/1376] firmware: qcom: scm: add trace events for the SMC call interface Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0763/1376] firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published Greg Kroah-Hartman
` (236 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Yuvaraj Ranganathan,
Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuvaraj Ranganathan <yuvaraj.ranganathan@oss.qualcomm.com>
[ Upstream commit 41329e72363c02facfeae063ef304aa7ced68c3b ]
Wire the five tracepoints defined in qcom_scm_trace.h into the SMC
execution path by including the header with CREATE_TRACE_POINTS.
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Yuvaraj Ranganathan <yuvaraj.ranganathan@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260522-scm-tracepoints-v2-2-e27cdbe0c585@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Stable-dep-of: 966d23c7e68e ("firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/qcom/Makefile | 1 +
drivers/firmware/qcom/qcom_scm-smc.c | 10 ++++++++++
2 files changed, 11 insertions(+)
diff --git a/drivers/firmware/qcom/Makefile b/drivers/firmware/qcom/Makefile
index 0be40a1abc13c..b679d3fc2c267 100644
--- a/drivers/firmware/qcom/Makefile
+++ b/drivers/firmware/qcom/Makefile
@@ -5,6 +5,7 @@
obj-$(CONFIG_QCOM_SCM) += qcom-scm.o
qcom-scm-objs += qcom_scm.o qcom_scm-smc.o qcom_scm-legacy.o
+CFLAGS_qcom_scm-smc.o := -I$(src)
obj-$(CONFIG_QCOM_TZMEM) += qcom_tzmem.o
obj-$(CONFIG_QCOM_QSEECOM) += qcom_qseecom.o
obj-$(CONFIG_QCOM_QSEECOM_UEFISECAPP) += qcom_qseecom_uefisecapp.o
diff --git a/drivers/firmware/qcom/qcom_scm-smc.c b/drivers/firmware/qcom/qcom_scm-smc.c
index 3f10b23ec941b..56fe0d4f0c623 100644
--- a/drivers/firmware/qcom/qcom_scm-smc.c
+++ b/drivers/firmware/qcom/qcom_scm-smc.c
@@ -24,6 +24,9 @@ struct arm_smccc_args {
unsigned long args[8];
};
+#define CREATE_TRACE_POINTS
+#include "qcom_scm_trace.h"
+
static DEFINE_MUTEX(qcom_scm_lock);
#define QCOM_SCM_EBUSY_WAIT_MS 30
@@ -44,6 +47,7 @@ static void __scm_smc_do_quirk(const struct arm_smccc_args *smc,
quirk.state.a6 = 0;
do {
+ trace_scm_smc_request(a0, smc);
arm_smccc_smc_quirk(a0, smc->args[1], smc->args[2],
smc->args[3], smc->args[4], smc->args[5],
quirk.state.a6, smc->args[7], res, &quirk);
@@ -83,6 +87,7 @@ int scm_get_wq_ctx(u32 *wq_ctx, u32 *flags, u32 *more_pending)
if (ret)
return ret;
+ trace_scm_waitq_get_wq_ctx(get_wq_res.a1, get_wq_res.a2, get_wq_res.a3);
*wq_ctx = get_wq_res.a1;
*flags = get_wq_res.a2;
*more_pending = get_wq_res.a3;
@@ -105,10 +110,12 @@ static int __scm_smc_do_quirk_handle_waitq(struct device *dev, struct arm_smccc_
wq_ctx = res->a1;
smc_call_ctx = res->a2;
+ trace_scm_waitq_sleep(wq_ctx, smc_call_ctx);
ret = qcom_scm_wait_for_wq_completion(wq_ctx);
if (ret)
return ret;
+ trace_scm_waitq_resume(smc_call_ctx);
fill_wq_resume_args(&resume, smc_call_ctx);
smc = &resume;
}
@@ -200,6 +207,9 @@ int __scm_smc_call(struct device *dev, const struct qcom_scm_desc *desc,
}
ret = __scm_smc_do(dev, &smc, &smc_res, atomic);
+
+ trace_scm_smc_done(ret, smc.args[0], &smc_res);
+
if (ret)
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0763/1376] firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (761 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0762/1376] firmware: qcom: scm: instrument SMC call path with tracepoints Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0764/1376] firmware: qcom: scm: Fix tzmem state on probe retry Greg Kroah-Hartman
` (235 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bartosz Golaszewski, Konrad Dybcio,
Mukesh Ojha, Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
[ Upstream commit 966d23c7e68ea32679275a7e3d2383181002c868 ]
In qcom_scm_probe(), devm_request_threaded_irq() is called before
smp_store_release(&__scm, scm). Two paths can dereference __scm before
it is published, both causing a NULL pointer dereference.
The IRQ handler receives scm via its data argument but passes only wq_ctx
to qcom_scm_waitq_wakeup() and qcom_scm_get_completion(), which then
dereference __scm directly. Thread scm through both functions so the IRQ
handler path never touches __scm.
Non-atomic SMC calls made during probe (e.g. from qcom_tzmem_init via
qcom_scm_shm_bridge_enable) can return WAITQ_SLEEP, causing
qcom_scm_wait_for_wq_completion() to run before __scm is published and
dereference it. Add platform_set_drvdata(pdev, scm) early in probe and
change qcom_scm_wait_for_wq_completion() to take the device pointer and
use dev_get_drvdata() to reach scm, removing any dependency on __scm.
Fixes: 6bf325992236 ("firmware: qcom: scm: Add wait-queue handling logic")
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260724094939.613844-2-mukesh.ojha@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/qcom/qcom_scm-smc.c | 2 +-
drivers/firmware/qcom/qcom_scm.c | 22 ++++++++++------------
drivers/firmware/qcom/qcom_scm.h | 2 +-
3 files changed, 12 insertions(+), 14 deletions(-)
diff --git a/drivers/firmware/qcom/qcom_scm-smc.c b/drivers/firmware/qcom/qcom_scm-smc.c
index 56fe0d4f0c623..59cd6cfa75e17 100644
--- a/drivers/firmware/qcom/qcom_scm-smc.c
+++ b/drivers/firmware/qcom/qcom_scm-smc.c
@@ -111,7 +111,7 @@ static int __scm_smc_do_quirk_handle_waitq(struct device *dev, struct arm_smccc_
smc_call_ctx = res->a2;
trace_scm_waitq_sleep(wq_ctx, smc_call_ctx);
- ret = qcom_scm_wait_for_wq_completion(wq_ctx);
+ ret = qcom_scm_wait_for_wq_completion(dev, wq_ctx);
if (ret)
return ret;
diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c
index 7f56ab78ac159..afbf0ad80c858 100644
--- a/drivers/firmware/qcom/qcom_scm.c
+++ b/drivers/firmware/qcom/qcom_scm.c
@@ -1924,23 +1924,20 @@ static int qcom_scm_get_waitq_irq(struct qcom_scm *scm)
return irq_create_fwspec_mapping(&fwspec);
}
-static struct completion *qcom_scm_get_completion(u32 wq_ctx)
+static struct completion *qcom_scm_get_completion(struct qcom_scm *scm, u32 wq_ctx)
{
- struct completion *wq;
-
- if (WARN_ON_ONCE(wq_ctx >= __scm->wq_cnt))
+ if (WARN_ON_ONCE(wq_ctx >= scm->wq_cnt))
return ERR_PTR(-EINVAL);
- wq = &__scm->waitq_comps[wq_ctx];
-
- return wq;
+ return &scm->waitq_comps[wq_ctx];
}
-int qcom_scm_wait_for_wq_completion(u32 wq_ctx)
+int qcom_scm_wait_for_wq_completion(struct device *dev, u32 wq_ctx)
{
+ struct qcom_scm *scm = dev_get_drvdata(dev);
struct completion *wq;
- wq = qcom_scm_get_completion(wq_ctx);
+ wq = qcom_scm_get_completion(scm, wq_ctx);
if (IS_ERR(wq))
return PTR_ERR(wq);
@@ -1949,11 +1946,11 @@ int qcom_scm_wait_for_wq_completion(u32 wq_ctx)
return 0;
}
-static int qcom_scm_waitq_wakeup(unsigned int wq_ctx)
+static int qcom_scm_waitq_wakeup(struct qcom_scm *scm, unsigned int wq_ctx)
{
struct completion *wq;
- wq = qcom_scm_get_completion(wq_ctx);
+ wq = qcom_scm_get_completion(scm, wq_ctx);
if (IS_ERR(wq))
return PTR_ERR(wq);
@@ -1980,7 +1977,7 @@ static irqreturn_t qcom_scm_irq_handler(int irq, void *data)
goto out;
}
- ret = qcom_scm_waitq_wakeup(wq_ctx);
+ ret = qcom_scm_waitq_wakeup(scm, wq_ctx);
if (ret)
goto out;
} while (more_pending);
@@ -2040,6 +2037,7 @@ static int qcom_scm_probe(struct platform_device *pdev)
return -ENOMEM;
scm->dev = &pdev->dev;
+ platform_set_drvdata(pdev, scm);
ret = qcom_scm_find_dload_address(&pdev->dev, &scm->dload_mode_addr);
if (ret < 0)
return ret;
diff --git a/drivers/firmware/qcom/qcom_scm.h b/drivers/firmware/qcom/qcom_scm.h
index ab0f88f5f7773..3a072b861d7fd 100644
--- a/drivers/firmware/qcom/qcom_scm.h
+++ b/drivers/firmware/qcom/qcom_scm.h
@@ -63,7 +63,7 @@ struct qcom_scm_res {
u64 result[MAX_QCOM_SCM_RETS];
};
-int qcom_scm_wait_for_wq_completion(u32 wq_ctx);
+int qcom_scm_wait_for_wq_completion(struct device *dev, u32 wq_ctx);
int scm_get_wq_ctx(u32 *wq_ctx, u32 *flags, u32 *more_pending);
#define SCM_SMC_FNID(s, c) ((((s) & 0xFF) << 8) | ((c) & 0xFF))
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0764/1376] firmware: qcom: scm: Fix tzmem state on probe retry
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (762 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0763/1376] firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0765/1376] arm64: dts: qcom: sm8250-xiaomi-elish: correct the board ID Greg Kroah-Hartman
` (234 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bartosz Golaszewski, Konrad Dybcio,
Mukesh Ojha, Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
[ Upstream commit 9941fe8a04f3d258e07eb5899db3027252a4190f ]
qcom_tzmem_enable() returns -EBUSY if called a second time, but this
causes probe retries to fail permanently if a later step in
qcom_scm_probe() defers after qcom_tzmem_enable() has already succeeded.
Use DO_ONCE() to ensure qcom_tzmem_init() runs exactly once across all
calls in a thread-safe manner. qcom_tzmem_dev is set on every call since
probe retries use the same device pointer. The result of the first
initialisation is cached and returned to every subsequent caller.
Fixes: 40289e35ca52 ("firmware: qcom: scm: enable the TZ mem allocator")
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260724094939.613844-4-mukesh.ojha@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/qcom/qcom_tzmem.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/drivers/firmware/qcom/qcom_tzmem.c b/drivers/firmware/qcom/qcom_tzmem.c
index f8fef622e48fe..91f1efd83d712 100644
--- a/drivers/firmware/qcom/qcom_tzmem.c
+++ b/drivers/firmware/qcom/qcom_tzmem.c
@@ -15,6 +15,7 @@
#include <linux/kernel.h>
#include <linux/list.h>
#include <linux/mm.h>
+#include <linux/once.h>
#include <linux/radix-tree.h>
#include <linux/slab.h>
#include <linux/spinlock.h>
@@ -465,14 +466,18 @@ phys_addr_t qcom_tzmem_to_phys(void *vaddr)
}
EXPORT_SYMBOL_GPL(qcom_tzmem_to_phys);
+static void qcom_tzmem_do_init(int *result)
+{
+ *result = qcom_tzmem_init();
+}
+
int qcom_tzmem_enable(struct device *dev)
{
- if (qcom_tzmem_dev)
- return -EBUSY;
+ static int result;
qcom_tzmem_dev = dev;
-
- return qcom_tzmem_init();
+ DO_ONCE(qcom_tzmem_do_init, &result);
+ return result;
}
EXPORT_SYMBOL_GPL(qcom_tzmem_enable);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0765/1376] arm64: dts: qcom: sm8250-xiaomi-elish: correct the board ID
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (763 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0764/1376] firmware: qcom: scm: Fix tzmem state on probe retry Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0766/1376] arm64: dts: qcom: sc8180x: Fix the PCIe iommu-map entries Greg Kroah-Hartman
` (233 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dawid Wróbel, Konrad Dybcio,
Dmitry Baryshkov, Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dawid Wróbel <me@dawidwrobel.com>
[ Upstream commit 299731d4fbeaaa141ce2e8226ca00cb30d6ab647 ]
elish declares the same qcom,msm-id and qcom,board-id pair as
sm8250-sony-xperia-edo.dtsi, so a bootloader choosing between appended
device trees cannot tell the two boards apart.
0x10008 is Sony's value. The downstream device tree for this board,
elish-sm8250-overlay.dts, uses qcom,board-id = <47 0>, i.e. platform
type 0x2f.
Fixes: a41b617530bf ("arm64: dts: qcom: sm8250: Add device tree for Xiaomi Mi Pad 5 Pro")
Signed-off-by: Dawid Wróbel <me@dawidwrobel.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260730-elish-board-id-v1-1-92f99e9722ec@dawidwrobel.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sm8250-xiaomi-elish-common.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/sm8250-xiaomi-elish-common.dtsi b/arch/arm64/boot/dts/qcom/sm8250-xiaomi-elish-common.dtsi
index 3596dd328c31d..00e90080d2125 100644
--- a/arch/arm64/boot/dts/qcom/sm8250-xiaomi-elish-common.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8250-xiaomi-elish-common.dtsi
@@ -28,7 +28,7 @@ / {
/* required for bootloader to select correct board */
qcom,msm-id = <QCOM_ID_SM8250 0x20001>; /* SM8250 v2.1 */
- qcom,board-id = <0x10008 0>;
+ qcom,board-id = <0x2f 0>;
chosen {
#address-cells = <2>;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0766/1376] arm64: dts: qcom: sc8180x: Fix the PCIe iommu-map entries
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (764 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0765/1376] arm64: dts: qcom: sm8250-xiaomi-elish: correct the board ID Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0767/1376] arm64: dts: qcom: sdm845: " Greg Kroah-Hartman
` (232 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manivannan Sadhasivam, Konrad Dybcio,
Dmitry Baryshkov, Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
[ Upstream commit a4548204821a56c23cd711cfad2a637ca055ff47 ]
The IOMMU provider apps_smmu uses '#iommu-cells = <2>', but the PCIe
iommu-map entries specify only one cell for the SID, omitting the SID
mask. This went unnoticed until the OF core started warning with commit
ccb2fd725d41 ("of: Respect #{iommu,msi}-cells in maps"):
iommu-map has 1-cell entries targeting 2-cell #iommu-cells, treating as 1-cell output
So fix the entries to match the provider's '#iommu-cells' property.
Fixes: d20b6c84f56a ("arm64: dts: qcom: sc8180x: Add PCIe instances")
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260730-iommu-map-fix-v1-4-83405d37ba41@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sc8180x.dtsi | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sc8180x.dtsi b/arch/arm64/boot/dts/qcom/sc8180x.dtsi
index 4715e26fc2647..d3aed296e32cc 100644
--- a/arch/arm64/boot/dts/qcom/sc8180x.dtsi
+++ b/arch/arm64/boot/dts/qcom/sc8180x.dtsi
@@ -1761,8 +1761,8 @@ pcie0: pcie@1c00000 {
assigned-clocks = <&gcc GCC_PCIE_0_AUX_CLK>;
assigned-clock-rates = <19200000>;
- iommu-map = <0x0 &apps_smmu 0x1d80 0x1>,
- <0x100 &apps_smmu 0x1d81 0x1>;
+ iommu-map = <0x0 &apps_smmu 0x1d80 0x0 0x1>,
+ <0x100 &apps_smmu 0x1d81 0x0 0x1>;
resets = <&gcc GCC_PCIE_0_BCR>;
reset-names = "pci";
@@ -1882,8 +1882,8 @@ pcie3: pcie@1c08000 {
assigned-clocks = <&gcc GCC_PCIE_3_AUX_CLK>;
assigned-clock-rates = <19200000>;
- iommu-map = <0x0 &apps_smmu 0x1e00 0x1>,
- <0x100 &apps_smmu 0x1e01 0x1>;
+ iommu-map = <0x0 &apps_smmu 0x1e00 0x0 0x1>,
+ <0x100 &apps_smmu 0x1e01 0x0 0x1>;
resets = <&gcc GCC_PCIE_3_BCR>;
reset-names = "pci";
@@ -2004,8 +2004,8 @@ pcie1: pcie@1c10000 {
assigned-clocks = <&gcc GCC_PCIE_1_AUX_CLK>;
assigned-clock-rates = <19200000>;
- iommu-map = <0x0 &apps_smmu 0x1c80 0x1>,
- <0x100 &apps_smmu 0x1c81 0x1>;
+ iommu-map = <0x0 &apps_smmu 0x1c80 0x0 0x1>,
+ <0x100 &apps_smmu 0x1c81 0x0 0x1>;
resets = <&gcc GCC_PCIE_1_BCR>;
reset-names = "pci";
@@ -2126,8 +2126,8 @@ pcie2: pcie@1c18000 {
assigned-clocks = <&gcc GCC_PCIE_2_AUX_CLK>;
assigned-clock-rates = <19200000>;
- iommu-map = <0x0 &apps_smmu 0x1d00 0x1>,
- <0x100 &apps_smmu 0x1d01 0x1>;
+ iommu-map = <0x0 &apps_smmu 0x1d00 0x0 0x1>,
+ <0x100 &apps_smmu 0x1d01 0x0 0x1>;
resets = <&gcc GCC_PCIE_2_BCR>;
reset-names = "pci";
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0767/1376] arm64: dts: qcom: sdm845: Fix the PCIe iommu-map entries
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (765 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0766/1376] arm64: dts: qcom: sc8180x: Fix the PCIe iommu-map entries Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0768/1376] arm64: dts: qcom: sm8150: " Greg Kroah-Hartman
` (231 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manivannan Sadhasivam, Konrad Dybcio,
Dmitry Baryshkov, Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
[ Upstream commit deaea7e982bc353c8d3c406774970f16ed901adb ]
The IOMMU provider apps_smmu uses '#iommu-cells = <2>', but the PCIe
iommu-map entries specify only one cell for the SID, omitting the SID
mask. This went unnoticed until the OF core started warning with commit
ccb2fd725d41 ("of: Respect #{iommu,msi}-cells in maps"):
iommu-map has 1-cell entries targeting 2-cell #iommu-cells, treating as 1-cell output
So fix the entries to match the provider's '#iommu-cells' property.
Fixes: 5c538e09cb19 ("arm64: dts: qcom: sdm845: Add first PCIe controller and PHY")
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260730-iommu-map-fix-v1-5-83405d37ba41@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sdm845.dtsi | 64 ++++++++++++++--------------
1 file changed, 32 insertions(+), 32 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi
index 54956ae1f6745..0653bccf50491 100644
--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi
@@ -2350,22 +2350,22 @@ pcie0: pcie@1c00000 {
"slave_q2a",
"tbu";
- iommu-map = <0x0 &apps_smmu 0x1c10 0x1>,
- <0x100 &apps_smmu 0x1c11 0x1>,
- <0x200 &apps_smmu 0x1c12 0x1>,
- <0x300 &apps_smmu 0x1c13 0x1>,
- <0x400 &apps_smmu 0x1c14 0x1>,
- <0x500 &apps_smmu 0x1c15 0x1>,
- <0x600 &apps_smmu 0x1c16 0x1>,
- <0x700 &apps_smmu 0x1c17 0x1>,
- <0x800 &apps_smmu 0x1c18 0x1>,
- <0x900 &apps_smmu 0x1c19 0x1>,
- <0xa00 &apps_smmu 0x1c1a 0x1>,
- <0xb00 &apps_smmu 0x1c1b 0x1>,
- <0xc00 &apps_smmu 0x1c1c 0x1>,
- <0xd00 &apps_smmu 0x1c1d 0x1>,
- <0xe00 &apps_smmu 0x1c1e 0x1>,
- <0xf00 &apps_smmu 0x1c1f 0x1>;
+ iommu-map = <0x0 &apps_smmu 0x1c10 0x0 0x1>,
+ <0x100 &apps_smmu 0x1c11 0x0 0x1>,
+ <0x200 &apps_smmu 0x1c12 0x0 0x1>,
+ <0x300 &apps_smmu 0x1c13 0x0 0x1>,
+ <0x400 &apps_smmu 0x1c14 0x0 0x1>,
+ <0x500 &apps_smmu 0x1c15 0x0 0x1>,
+ <0x600 &apps_smmu 0x1c16 0x0 0x1>,
+ <0x700 &apps_smmu 0x1c17 0x0 0x1>,
+ <0x800 &apps_smmu 0x1c18 0x0 0x1>,
+ <0x900 &apps_smmu 0x1c19 0x0 0x1>,
+ <0xa00 &apps_smmu 0x1c1a 0x0 0x1>,
+ <0xb00 &apps_smmu 0x1c1b 0x0 0x1>,
+ <0xc00 &apps_smmu 0x1c1c 0x0 0x1>,
+ <0xd00 &apps_smmu 0x1c1d 0x0 0x1>,
+ <0xe00 &apps_smmu 0x1c1e 0x0 0x1>,
+ <0xf00 &apps_smmu 0x1c1f 0x0 0x1>;
resets = <&gcc GCC_PCIE_0_BCR>;
reset-names = "pci";
@@ -2464,22 +2464,22 @@ pcie1: pcie@1c08000 {
assigned-clocks = <&gcc GCC_PCIE_1_AUX_CLK>;
assigned-clock-rates = <19200000>;
- iommu-map = <0x0 &apps_smmu 0x1c00 0x1>,
- <0x100 &apps_smmu 0x1c01 0x1>,
- <0x200 &apps_smmu 0x1c02 0x1>,
- <0x300 &apps_smmu 0x1c03 0x1>,
- <0x400 &apps_smmu 0x1c04 0x1>,
- <0x500 &apps_smmu 0x1c05 0x1>,
- <0x600 &apps_smmu 0x1c06 0x1>,
- <0x700 &apps_smmu 0x1c07 0x1>,
- <0x800 &apps_smmu 0x1c08 0x1>,
- <0x900 &apps_smmu 0x1c09 0x1>,
- <0xa00 &apps_smmu 0x1c0a 0x1>,
- <0xb00 &apps_smmu 0x1c0b 0x1>,
- <0xc00 &apps_smmu 0x1c0c 0x1>,
- <0xd00 &apps_smmu 0x1c0d 0x1>,
- <0xe00 &apps_smmu 0x1c0e 0x1>,
- <0xf00 &apps_smmu 0x1c0f 0x1>;
+ iommu-map = <0x0 &apps_smmu 0x1c00 0x0 0x1>,
+ <0x100 &apps_smmu 0x1c01 0x0 0x1>,
+ <0x200 &apps_smmu 0x1c02 0x0 0x1>,
+ <0x300 &apps_smmu 0x1c03 0x0 0x1>,
+ <0x400 &apps_smmu 0x1c04 0x0 0x1>,
+ <0x500 &apps_smmu 0x1c05 0x0 0x1>,
+ <0x600 &apps_smmu 0x1c06 0x0 0x1>,
+ <0x700 &apps_smmu 0x1c07 0x0 0x1>,
+ <0x800 &apps_smmu 0x1c08 0x0 0x1>,
+ <0x900 &apps_smmu 0x1c09 0x0 0x1>,
+ <0xa00 &apps_smmu 0x1c0a 0x0 0x1>,
+ <0xb00 &apps_smmu 0x1c0b 0x0 0x1>,
+ <0xc00 &apps_smmu 0x1c0c 0x0 0x1>,
+ <0xd00 &apps_smmu 0x1c0d 0x0 0x1>,
+ <0xe00 &apps_smmu 0x1c0e 0x0 0x1>,
+ <0xf00 &apps_smmu 0x1c0f 0x0 0x1>;
resets = <&gcc GCC_PCIE_1_BCR>;
reset-names = "pci";
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0768/1376] arm64: dts: qcom: sm8150: Fix the PCIe iommu-map entries
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (766 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0767/1376] arm64: dts: qcom: sdm845: " Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0769/1376] arm64: dts: qcom: sm8250: " Greg Kroah-Hartman
` (230 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manivannan Sadhasivam, Konrad Dybcio,
Dmitry Baryshkov, Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
[ Upstream commit d2e56fb42e3d10d7e711063cdc00523ddb31d544 ]
The IOMMU provider apps_smmu uses '#iommu-cells = <2>', but the PCIe
iommu-map entries specify only one cell for the SID, omitting the SID
mask. This went unnoticed until the OF core started warning with commit
ccb2fd725d41 ("of: Respect #{iommu,msi}-cells in maps"):
iommu-map has 1-cell entries targeting 2-cell #iommu-cells, treating as 1-cell output
So fix the entries to match the provider's '#iommu-cells' property.
Fixes: a1c86c680533 ("arm64: dts: qcom: sm8150: Add PCIe nodes")
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260730-iommu-map-fix-v1-6-83405d37ba41@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sm8150.dtsi | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sm8150.dtsi b/arch/arm64/boot/dts/qcom/sm8150.dtsi
index 0aeceffd872c0..e06f7782b551c 100644
--- a/arch/arm64/boot/dts/qcom/sm8150.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8150.dtsi
@@ -1885,8 +1885,8 @@ pcie0: pcie@1c00000 {
"tbu",
"ref";
- iommu-map = <0x0 &apps_smmu 0x1d80 0x1>,
- <0x100 &apps_smmu 0x1d81 0x1>;
+ iommu-map = <0x0 &apps_smmu 0x1d80 0x0 0x1>,
+ <0x100 &apps_smmu 0x1d81 0x0 0x1>;
resets = <&gcc GCC_PCIE_0_BCR>;
reset-names = "pci";
@@ -2005,8 +2005,8 @@ pcie1: pcie@1c08000 {
assigned-clocks = <&gcc GCC_PCIE_1_AUX_CLK>;
assigned-clock-rates = <19200000>;
- iommu-map = <0x0 &apps_smmu 0x1e00 0x1>,
- <0x100 &apps_smmu 0x1e01 0x1>;
+ iommu-map = <0x0 &apps_smmu 0x1e00 0x0 0x1>,
+ <0x100 &apps_smmu 0x1e01 0x0 0x1>;
resets = <&gcc GCC_PCIE_1_BCR>;
reset-names = "pci";
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0769/1376] arm64: dts: qcom: sm8250: Fix the PCIe iommu-map entries
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (767 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0768/1376] arm64: dts: qcom: sm8150: " Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0770/1376] arm64: dts: qcom: sm8350: " Greg Kroah-Hartman
` (229 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manivannan Sadhasivam, Konrad Dybcio,
Dmitry Baryshkov, Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
[ Upstream commit c41749e9554d4e03e7074f5d1e46140bc4ac77bd ]
The IOMMU provider apps_smmu uses '#iommu-cells = <2>', but the PCIe
iommu-map entries specify only one cell for the SID, omitting the SID
mask. This went unnoticed until the OF core started warning with commit
ccb2fd725d41 ("of: Respect #{iommu,msi}-cells in maps"):
iommu-map has 1-cell entries targeting 2-cell #iommu-cells, treating as 1-cell output
So fix the entries to match the provider's '#iommu-cells' property.
Fixes: e53bdfc00977 ("arm64: dts: qcom: sm8250: Add PCIe support")
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260730-iommu-map-fix-v1-7-83405d37ba41@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sm8250.dtsi | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi
index d6607c38eb35c..f1851cbcd48b9 100644
--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi
@@ -2187,8 +2187,8 @@ pcie0: pcie@1c00000 {
"tbu",
"ddrss_sf_tbu";
- iommu-map = <0x0 &apps_smmu 0x1c00 0x1>,
- <0x100 &apps_smmu 0x1c01 0x1>;
+ iommu-map = <0x0 &apps_smmu 0x1c00 0x0 0x1>,
+ <0x100 &apps_smmu 0x1c01 0x0 0x1>;
resets = <&gcc GCC_PCIE_0_BCR>;
reset-names = "pci";
@@ -2312,8 +2312,8 @@ pcie1: pcie@1c08000 {
assigned-clocks = <&gcc GCC_PCIE_1_AUX_CLK>;
assigned-clock-rates = <19200000>;
- iommu-map = <0x0 &apps_smmu 0x1c80 0x1>,
- <0x100 &apps_smmu 0x1c81 0x1>;
+ iommu-map = <0x0 &apps_smmu 0x1c80 0x0 0x1>,
+ <0x100 &apps_smmu 0x1c81 0x0 0x1>;
resets = <&gcc GCC_PCIE_1_BCR>;
reset-names = "pci";
@@ -2437,8 +2437,8 @@ pcie2: pcie@1c10000 {
assigned-clocks = <&gcc GCC_PCIE_2_AUX_CLK>;
assigned-clock-rates = <19200000>;
- iommu-map = <0x0 &apps_smmu 0x1d00 0x1>,
- <0x100 &apps_smmu 0x1d01 0x1>;
+ iommu-map = <0x0 &apps_smmu 0x1d00 0x0 0x1>,
+ <0x100 &apps_smmu 0x1d01 0x0 0x1>;
resets = <&gcc GCC_PCIE_2_BCR>;
reset-names = "pci";
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0770/1376] arm64: dts: qcom: sm8350: Fix the PCIe iommu-map entries
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (768 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0769/1376] arm64: dts: qcom: sm8250: " Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0771/1376] arm64: dts: qcom: sm8450: " Greg Kroah-Hartman
` (228 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manivannan Sadhasivam, Konrad Dybcio,
Dmitry Baryshkov, Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
[ Upstream commit 80337ea3a154230621c0b4e3c831f5d81712ba18 ]
The IOMMU provider apps_smmu uses '#iommu-cells = <2>', but the PCIe
iommu-map entries specify only one cell for the SID, omitting the SID
mask. This went unnoticed until the OF core started warning with commit
ccb2fd725d41 ("of: Respect #{iommu,msi}-cells in maps"):
iommu-map has 1-cell entries targeting 2-cell #iommu-cells, treating as 1-cell output
So fix the entries to match the provider's '#iommu-cells' property.
Fixes: 6daee40678a0 ("arm64: dts: qcom: sm8350: add PCIe devices")
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260730-iommu-map-fix-v1-8-83405d37ba41@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sm8350.dtsi | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi
index 1870ec4176daa..6f175791de90d 100644
--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi
@@ -1571,8 +1571,8 @@ pcie0: pcie@1c00000 {
"aggre1",
"aggre0";
- iommu-map = <0x0 &apps_smmu 0x1c00 0x1>,
- <0x100 &apps_smmu 0x1c01 0x1>;
+ iommu-map = <0x0 &apps_smmu 0x1c00 0x0 0x1>,
+ <0x100 &apps_smmu 0x1c01 0x0 0x1>;
resets = <&gcc GCC_PCIE_0_BCR>;
reset-names = "pci";
@@ -1678,8 +1678,8 @@ pcie1: pcie@1c08000 {
"ddrss_sf_tbu",
"aggre1";
- iommu-map = <0x0 &apps_smmu 0x1c80 0x1>,
- <0x100 &apps_smmu 0x1c81 0x1>;
+ iommu-map = <0x0 &apps_smmu 0x1c80 0x0 0x1>,
+ <0x100 &apps_smmu 0x1c81 0x0 0x1>;
resets = <&gcc GCC_PCIE_1_BCR>;
reset-names = "pci";
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0771/1376] arm64: dts: qcom: sm8450: Fix the PCIe iommu-map entries
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (769 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0770/1376] arm64: dts: qcom: sm8350: " Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0772/1376] arm64: dts: qcom: sm8550: " Greg Kroah-Hartman
` (227 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manivannan Sadhasivam, Konrad Dybcio,
Dmitry Baryshkov, Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
[ Upstream commit 9b10e56647fa8f7ab62c7e45ebf4b168f7befa7f ]
The IOMMU provider apps_smmu uses '#iommu-cells = <2>', but the PCIe
iommu-map entries specify only one cell for the SID, omitting the SID
mask. This went unnoticed until the OF core started warning with commit
ccb2fd725d41 ("of: Respect #{iommu,msi}-cells in maps"):
iommu-map has 1-cell entries targeting 2-cell #iommu-cells, treating as 1-cell output
So fix the entries to match the provider's '#iommu-cells' property.
Fixes: 7b09b1b47335 ("arm64: dts: qcom: sm8450: add PCIe0 RC device")
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260730-iommu-map-fix-v1-9-83405d37ba41@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sm8450.dtsi | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sm8450.dtsi b/arch/arm64/boot/dts/qcom/sm8450.dtsi
index 59172db1e3d9e..521b12a56e55d 100644
--- a/arch/arm64/boot/dts/qcom/sm8450.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi
@@ -1834,8 +1834,8 @@ &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
"aggre0",
"aggre1";
- iommu-map = <0x0 &apps_smmu 0x1c00 0x1>,
- <0x100 &apps_smmu 0x1c01 0x1>;
+ iommu-map = <0x0 &apps_smmu 0x1c00 0x0 0x1>,
+ <0x100 &apps_smmu 0x1c01 0x0 0x1>;
resets = <&gcc GCC_PCIE_0_BCR>;
reset-names = "pci";
@@ -1994,8 +1994,8 @@ &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
"ddrss_sf_tbu",
"aggre1";
- iommu-map = <0x0 &apps_smmu 0x1c80 0x1>,
- <0x100 &apps_smmu 0x1c81 0x1>;
+ iommu-map = <0x0 &apps_smmu 0x1c80 0x0 0x1>,
+ <0x100 &apps_smmu 0x1c81 0x0 0x1>;
resets = <&gcc GCC_PCIE_1_BCR>;
reset-names = "pci";
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0772/1376] arm64: dts: qcom: sm8550: Fix the PCIe iommu-map entries
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (770 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0771/1376] arm64: dts: qcom: sm8450: " Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0773/1376] arm64: dts: qcom: sm8650: add OPP table support to PCIe Greg Kroah-Hartman
` (226 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manivannan Sadhasivam,
Neil Armstrong, Konrad Dybcio, Dmitry Baryshkov, Bjorn Andersson,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
[ Upstream commit 16d98ee918d63018eaa6cc260791b71319aa4faa ]
The IOMMU provider apps_smmu uses '#iommu-cells = <2>', but the PCIe
iommu-map entries specify only one cell for the SID, omitting the SID
mask. This went unnoticed until the OF core started warning with commit
ccb2fd725d41 ("of: Respect #{iommu,msi}-cells in maps"):
iommu-map has 1-cell entries targeting 2-cell #iommu-cells, treating as 1-cell output
So fix the entries to match the provider's '#iommu-cells' property.
Fixes: 7d1158c984d3 ("arm64: dts: qcom: sm8550: Add PCIe PHYs and controllers nodes")
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260730-iommu-map-fix-v1-10-83405d37ba41@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sm8550.dtsi | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sm8550.dtsi b/arch/arm64/boot/dts/qcom/sm8550.dtsi
index 38b15db0676ce..7f06bea09d0ac 100644
--- a/arch/arm64/boot/dts/qcom/sm8550.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8550.dtsi
@@ -1771,8 +1771,8 @@ pcie0: pcie@1c00000 {
msi-map = <0x0 &gic_its 0x1400 0x1>,
<0x100 &gic_its 0x1401 0x1>;
- iommu-map = <0x0 &apps_smmu 0x1400 0x1>,
- <0x100 &apps_smmu 0x1401 0x1>;
+ iommu-map = <0x0 &apps_smmu 0x1400 0x0 0x1>,
+ <0x100 &apps_smmu 0x1401 0x0 0x1>;
resets = <&gcc GCC_PCIE_0_BCR>;
reset-names = "pci";
@@ -1892,8 +1892,8 @@ pcie1: pcie@1c08000 {
msi-map = <0x0 &gic_its 0x1480 0x1>,
<0x100 &gic_its 0x1481 0x1>;
- iommu-map = <0x0 &apps_smmu 0x1480 0x1>,
- <0x100 &apps_smmu 0x1481 0x1>;
+ iommu-map = <0x0 &apps_smmu 0x1480 0x0 0x1>,
+ <0x100 &apps_smmu 0x1481 0x0 0x1>;
resets = <&gcc GCC_PCIE_1_BCR>,
<&gcc GCC_PCIE_1_LINK_DOWN_BCR>;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0773/1376] arm64: dts: qcom: sm8650: add OPP table support to PCIe
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (771 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0772/1376] arm64: dts: qcom: sm8550: " Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0774/1376] arm64: dts: qcom: sm8650: Fix the PCIe iommu-map entries Greg Kroah-Hartman
` (225 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neil Armstrong <neil.armstrong@linaro.org>
[ Upstream commit 5cddecc3d1dce1e20bb64364cb6cd5d8edf376b3 ]
The PCIe bus interconnect path can be scaled depending on the
PCIe link established, add the OPP table with all the possible
link speeds and the associated power domain level.
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250115-topic-sm8x50-upstream-dt-icc-update-v1-8-eaa8b10e2af7@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Stable-dep-of: 8ccba7b44609 ("arm64: dts: qcom: sm8650: Fix the PCIe iommu-map entries")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sm8650.dtsi | 89 ++++++++++++++++++++++++++++
1 file changed, 89 insertions(+)
diff --git a/arch/arm64/boot/dts/qcom/sm8650.dtsi b/arch/arm64/boot/dts/qcom/sm8650.dtsi
index b4d9900e17763..51bfb220b6c2e 100644
--- a/arch/arm64/boot/dts/qcom/sm8650.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8650.dtsi
@@ -2279,6 +2279,8 @@ &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
power-domains = <&gcc PCIE_0_GDSC>;
+ operating-points-v2 = <&pcie0_opp_table>;
+
iommu-map = <0 &apps_smmu 0x1400 0x1>,
<0x100 &apps_smmu 0x1401 0x1>;
@@ -2309,6 +2311,45 @@ &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
status = "disabled";
+ pcie0_opp_table: opp-table {
+ compatible = "operating-points-v2";
+
+ /* GEN 1 x1 */
+ opp-2500000 {
+ opp-hz = /bits/ 64 <2500000>;
+ required-opps = <&rpmhpd_opp_low_svs>;
+ opp-peak-kBps = <250000 1>;
+ };
+
+ /* GEN 1 x2 and GEN 2 x1 */
+ opp-5000000 {
+ opp-hz = /bits/ 64 <5000000>;
+ required-opps = <&rpmhpd_opp_low_svs>;
+ opp-peak-kBps = <500000 1>;
+ };
+
+ /* GEN 2 x2 */
+ opp-10000000 {
+ opp-hz = /bits/ 64 <10000000>;
+ required-opps = <&rpmhpd_opp_low_svs>;
+ opp-peak-kBps = <1000000 1>;
+ };
+
+ /* GEN 3 x1 */
+ opp-8000000 {
+ opp-hz = /bits/ 64 <8000000>;
+ required-opps = <&rpmhpd_opp_nom>;
+ opp-peak-kBps = <984500 1>;
+ };
+
+ /* GEN 3 x2 */
+ opp-16000000 {
+ opp-hz = /bits/ 64 <16000000>;
+ required-opps = <&rpmhpd_opp_nom>;
+ opp-peak-kBps = <1969000 1>;
+ };
+ };
+
pcieport0: pcie@0 {
device_type = "pci";
reg = <0x0 0x0 0x0 0x0 0x0>;
@@ -2416,6 +2457,8 @@ &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
power-domains = <&gcc PCIE_1_GDSC>;
+ operating-points-v2 = <&pcie1_opp_table>;
+
iommu-map = <0 &apps_smmu 0x1480 0x1>,
<0x100 &apps_smmu 0x1481 0x1>;
@@ -2446,6 +2489,52 @@ &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
status = "disabled";
+ pcie1_opp_table: opp-table {
+ compatible = "operating-points-v2";
+
+ /* GEN 1 x1 */
+ opp-2500000 {
+ opp-hz = /bits/ 64 <2500000>;
+ required-opps = <&rpmhpd_opp_low_svs>;
+ opp-peak-kBps = <250000 1>;
+ };
+
+ /* GEN 1 x2 and GEN 2 x1 */
+ opp-5000000 {
+ opp-hz = /bits/ 64 <5000000>;
+ required-opps = <&rpmhpd_opp_low_svs>;
+ opp-peak-kBps = <500000 1>;
+ };
+
+ /* GEN 2 x2 */
+ opp-10000000 {
+ opp-hz = /bits/ 64 <10000000>;
+ required-opps = <&rpmhpd_opp_low_svs>;
+ opp-peak-kBps = <1000000 1>;
+ };
+
+ /* GEN 3 x1 */
+ opp-8000000 {
+ opp-hz = /bits/ 64 <8000000>;
+ required-opps = <&rpmhpd_opp_nom>;
+ opp-peak-kBps = <984500 1>;
+ };
+
+ /* GEN 3 x2 and GEN 4 x1 */
+ opp-16000000 {
+ opp-hz = /bits/ 64 <16000000>;
+ required-opps = <&rpmhpd_opp_nom>;
+ opp-peak-kBps = <1969000 1>;
+ };
+
+ /* GEN 4 x2 */
+ opp-32000000 {
+ opp-hz = /bits/ 64 <32000000>;
+ required-opps = <&rpmhpd_opp_nom>;
+ opp-peak-kBps = <3938000 1>;
+ };
+ };
+
pcie@0 {
device_type = "pci";
reg = <0x0 0x0 0x0 0x0 0x0>;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0774/1376] arm64: dts: qcom: sm8650: Fix the PCIe iommu-map entries
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (772 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0773/1376] arm64: dts: qcom: sm8650: add OPP table support to PCIe Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0775/1376] power: supply: isp1704_charger: cancel work on remove Greg Kroah-Hartman
` (224 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manivannan Sadhasivam,
Neil Armstrong, Konrad Dybcio, Dmitry Baryshkov, Bjorn Andersson,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
[ Upstream commit 8ccba7b44609d58db088447a771f6f30cfa8739e ]
The IOMMU provider apps_smmu uses '#iommu-cells = <2>', but the PCIe
iommu-map entries specify only one cell for the SID, omitting the SID
mask. This went unnoticed until the OF core started warning with commit
ccb2fd725d41 ("of: Respect #{iommu,msi}-cells in maps"):
iommu-map has 1-cell entries targeting 2-cell #iommu-cells, treating as 1-cell output
So fix the entries to match the provider's '#iommu-cells' property.
Fixes: 10e024671295 ("arm64: dts: qcom: sm8650: add interconnect dependent device nodes")
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260730-iommu-map-fix-v1-11-83405d37ba41@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sm8650.dtsi | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sm8650.dtsi b/arch/arm64/boot/dts/qcom/sm8650.dtsi
index 51bfb220b6c2e..d28dfbf57e634 100644
--- a/arch/arm64/boot/dts/qcom/sm8650.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8650.dtsi
@@ -2281,8 +2281,8 @@ &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
operating-points-v2 = <&pcie0_opp_table>;
- iommu-map = <0 &apps_smmu 0x1400 0x1>,
- <0x100 &apps_smmu 0x1401 0x1>;
+ iommu-map = <0 &apps_smmu 0x1400 0x0 0x1>,
+ <0x100 &apps_smmu 0x1401 0x0 0x1>;
interrupt-map = <0 0 0 1 &intc 0 0 0 149 IRQ_TYPE_LEVEL_HIGH>,
<0 0 0 2 &intc 0 0 0 150 IRQ_TYPE_LEVEL_HIGH>,
@@ -2459,8 +2459,8 @@ &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
operating-points-v2 = <&pcie1_opp_table>;
- iommu-map = <0 &apps_smmu 0x1480 0x1>,
- <0x100 &apps_smmu 0x1481 0x1>;
+ iommu-map = <0 &apps_smmu 0x1480 0x0 0x1>,
+ <0x100 &apps_smmu 0x1481 0x0 0x1>;
interrupt-map = <0 0 0 1 &intc 0 0 0 434 IRQ_TYPE_LEVEL_HIGH>,
<0 0 0 2 &intc 0 0 0 435 IRQ_TYPE_LEVEL_HIGH>,
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0775/1376] power: supply: isp1704_charger: cancel work on remove
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (773 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0774/1376] arm64: dts: qcom: sm8650: Fix the PCIe iommu-map entries Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0776/1376] power: supply: sc2731_charger: " Greg Kroah-Hartman
` (223 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hongyan Xu, Sebastian Reichel,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongyan Xu <getshell@seu.edu.cn>
[ Upstream commit 60c5b8a9ef4dbc5d69bbc1a960fe55826cb3b643 ]
The USB notifier and initial VBUS detection can schedule isp->work. The
remove path unregisters the notifier and power supply, but does not wait
for queued or running work before tearing down the power supply state.
Cancel the work after unregistering the notifier. Do this before
unregistering the power supply.
This issue was found by a static analysis tool.
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
Link: https://patch.msgid.link/20260728123423.781-5-getshell@seu.edu.cn
Fixes: ec46475f3e31 ("power_supply: Add isp1704 charger detection driver")
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/isp1704_charger.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/power/supply/isp1704_charger.c b/drivers/power/supply/isp1704_charger.c
index 860d8614c98fd..71008c5d9d7f5 100644
--- a/drivers/power/supply/isp1704_charger.c
+++ b/drivers/power/supply/isp1704_charger.c
@@ -482,6 +482,7 @@ static void isp1704_charger_remove(struct platform_device *pdev)
struct isp1704_charger *isp = platform_get_drvdata(pdev);
usb_unregister_notifier(isp->phy, &isp->nb);
+ cancel_work_sync(&isp->work);
power_supply_unregister(isp->psy);
isp1704_charger_set_power(isp, 0);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0776/1376] power: supply: sc2731_charger: cancel work on remove
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (774 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0775/1376] power: supply: isp1704_charger: cancel work on remove Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0777/1376] bpf: Fix potential UAF in bpf_netns_link_update_prog Greg Kroah-Hartman
` (222 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baolin Wang, Hongyan Xu,
Sebastian Reichel, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongyan Xu <getshell@seu.edu.cn>
[ Upstream commit dfc859bb8d332c525872f1a44028137724fa1998 ]
The USB notifier and initial charger detection can schedule info->work.
The remove path unregisters the notifier, but does not cancel queued or
running work before the devm-allocated driver data is released.
Set the platform drvdata used by remove, then cancel the work after
unregistering the notifier.
This issue was found by a static analysis tool.
Fixes: 8ac1091ed18b ("power: supply: sc2731_charger: Add one work to charge/discharge")
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
Link: https://patch.msgid.link/5d48b827687168cb1b1bfe85f17945566b42829d.1785321763.git.getshell@seu.edu.cn
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/sc2731_charger.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/power/supply/sc2731_charger.c b/drivers/power/supply/sc2731_charger.c
index b3d8b1ca97da7..0b3153eed8c41 100644
--- a/drivers/power/supply/sc2731_charger.c
+++ b/drivers/power/supply/sc2731_charger.c
@@ -466,6 +466,7 @@ static int sc2731_charger_probe(struct platform_device *pdev)
mutex_init(&info->lock);
info->dev = &pdev->dev;
INIT_WORK(&info->work, sc2731_charger_work);
+ platform_set_drvdata(pdev, info);
info->regmap = dev_get_regmap(pdev->dev.parent, NULL);
if (!info->regmap) {
@@ -516,6 +517,7 @@ static void sc2731_charger_remove(struct platform_device *pdev)
struct sc2731_charger_info *info = platform_get_drvdata(pdev);
usb_unregister_notifier(info->usb_phy, &info->usb_notify);
+ cancel_work_sync(&info->work);
}
static const struct of_device_id sc2731_charger_of_match[] = {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0777/1376] bpf: Fix potential UAF in bpf_netns_link_update_prog
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (775 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0776/1376] power: supply: sc2731_charger: " Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0778/1376] bpf: Fix potential UAF when reading bpf link info Greg Kroah-Hartman
` (221 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Pu Lehui, Andrii Nakryiko,
Amery Hung, Emil Tsalapatis, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pu Lehui <pulehui@huawei.com>
[ Upstream commit 5c5997836381010fc5907b36bc17d3b19407e933 ]
In bpf_netns_link_update_prog, the checks for old_prog and prog type
are currently performed locklessly before acquiring netns_bpf_mutex.
This creates a race condition that can lead to a UAF issue.
If two threads concurrently execute BPF_LINK_UPDATE on the same netns
link, the following execution path can trigger a UAF:
CPU0 CPU1
bpf_netns_link_update_prog
if (old_prog && old_prog != link->prog)
return -EPERM;
bpf_netns_link_update_prog
if (old_prog && old_prog != link->prog)
...
old_prog = xchg(&link->prog, new_prog);
bpf_prog_put(old_prog);
if (new_prog->type != link->prog->type) <-- trigger UAF
Fix this by moving the old_prog and prog->type checks inside the
netns_bpf_mutex critical section. Meanwhile, use guard() to simplify
lock management and avoid all the goto jumping.
Fixes: 7f045a49fee0 ("bpf: Add link-based BPF program attachment to network namespace")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Pu Lehui <pulehui@huawei.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Reviewed-by: Amery Hung <ameryhung@gmail.com>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Link: https://lore.kernel.org/bpf/f87b53c0-8f00-45a6-82db-8242fa9b143f@huaweicloud.com [0]
Link: https://lore.kernel.org/bpf/20260728023259.2813482-1-pulehui@huaweicloud.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/net_namespace.c | 17 ++++++-----------
1 file changed, 6 insertions(+), 11 deletions(-)
diff --git a/kernel/bpf/net_namespace.c b/kernel/bpf/net_namespace.c
index 868cc2c438997..a1d14bcb67c57 100644
--- a/kernel/bpf/net_namespace.c
+++ b/kernel/bpf/net_namespace.c
@@ -172,33 +172,28 @@ static int bpf_netns_link_update_prog(struct bpf_link *link,
struct net *net;
int idx, ret;
+ guard(mutex)(&netns_bpf_mutex);
+
if (old_prog && old_prog != link->prog)
return -EPERM;
if (new_prog->type != link->prog->type)
return -EINVAL;
- mutex_lock(&netns_bpf_mutex);
-
net = net_link->net;
- if (!net || !check_net(net)) {
+ if (!net || !check_net(net))
/* Link auto-detached or netns dying */
- ret = -ENOLINK;
- goto out_unlock;
- }
+ return -ENOLINK;
run_array = rcu_dereference_protected(net->bpf.run_array[type],
lockdep_is_held(&netns_bpf_mutex));
idx = link_index(net, type, net_link);
ret = bpf_prog_array_update_at(run_array, idx, new_prog);
if (ret)
- goto out_unlock;
+ return ret;
old_prog = xchg(&link->prog, new_prog);
bpf_prog_put(old_prog);
-
-out_unlock:
- mutex_unlock(&netns_bpf_mutex);
- return ret;
+ return 0;
}
static int bpf_netns_link_fill_info(const struct bpf_link *link,
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0778/1376] bpf: Fix potential UAF when reading bpf link info
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (776 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0777/1376] bpf: Fix potential UAF in bpf_netns_link_update_prog Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0779/1376] lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone Greg Kroah-Hartman
` (220 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Pu Lehui, Andrii Nakryiko,
Emil Tsalapatis, Amery Hung, Leon Hwang, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pu Lehui <pulehui@huawei.com>
[ Upstream commit 863f3ddd0b8ac65abfb50d3be0869268ac0e277b ]
In bpf_link_show_fdinfo and bpf_link_get_info_by_fd, link->prog is
accessed without holding any locks. If the prog is concurrently replaced
via bpf_link_update, the old prog can be freed, leading to a potential
UAF issue.
Fix this by accessing link->prog under RCU protection to safely fetch
the pointer and guarantee its lifetime while reading its fields.
Fixes: 0c991ebc8c69 ("bpf: Implement bpf_prog replacement for an active bpf_cgroup_link")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Pu Lehui <pulehui@huawei.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Reviewed-by: Amery Hung <ameryhung@gmail.com>
Acked-by: Leon Hwang <leon.hwang@linux.dev>
Link: https://lore.kernel.org/bpf/f87b53c0-8f00-45a6-82db-8242fa9b143f@huaweicloud.com [0]
Link: https://lore.kernel.org/bpf/20260728025457.2814876-1-pulehui@huaweicloud.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/syscall.c | 21 +++++++++++++++++----
1 file changed, 17 insertions(+), 4 deletions(-)
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 3bdfac9b4418a..fc41d87263aac 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -3091,9 +3091,10 @@ static const char *bpf_link_type_strs[] = {
static void bpf_link_show_fdinfo(struct seq_file *m, struct file *filp)
{
const struct bpf_link *link = filp->private_data;
- const struct bpf_prog *prog = link->prog;
+ const struct bpf_prog *prog;
enum bpf_link_type type = link->type;
char prog_tag[sizeof(prog->tag) * 2 + 1] = { };
+ u32 prog_id = 0;
if (type < ARRAY_SIZE(bpf_link_type_strs) && bpf_link_type_strs[type]) {
seq_printf(m, "link_type:\t%s\n", bpf_link_type_strs[type]);
@@ -3103,13 +3104,20 @@ static void bpf_link_show_fdinfo(struct seq_file *m, struct file *filp)
}
seq_printf(m, "link_id:\t%u\n", link->id);
+ rcu_read_lock();
+ prog = READ_ONCE(link->prog);
if (prog) {
bin2hex(prog_tag, prog->tag, sizeof(prog->tag));
+ prog_id = prog->aux->id;
+ }
+ rcu_read_unlock();
+
+ if (prog) {
seq_printf(m,
"prog_tag:\t%s\n"
"prog_id:\t%u\n",
prog_tag,
- prog->aux->id);
+ prog_id);
}
if (link->ops->show_fdinfo)
link->ops->show_fdinfo(link, m);
@@ -4917,6 +4925,7 @@ static int bpf_link_get_info_by_fd(struct file *file,
{
struct bpf_link_info __user *uinfo = u64_to_user_ptr(attr->info.info);
struct bpf_link_info info;
+ const struct bpf_prog *prog;
u32 info_len = attr->info.info_len;
int err;
@@ -4931,8 +4940,12 @@ static int bpf_link_get_info_by_fd(struct file *file,
info.type = link->type;
info.id = link->id;
- if (link->prog)
- info.prog_id = link->prog->aux->id;
+
+ rcu_read_lock();
+ prog = READ_ONCE(link->prog);
+ if (prog)
+ info.prog_id = prog->aux->id;
+ rcu_read_unlock();
if (link->ops->fill_link_info) {
err = link->ops->fill_link_info(link, &info);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0779/1376] lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (777 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0778/1376] bpf: Fix potential UAF when reading bpf link info Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0780/1376] clk: qcom: gpucc-qcm2290: Park RCGs clk source at XO during disable Greg Kroah-Hartman
` (219 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stanislav Kinsburskii,
Jason Gunthorpe, Leon Romanovsky, Ralph Campbell, Andrew Morton,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com>
[ Upstream commit 6a8024511ddf4877435c34fb3d6028aa8e590649 ]
dmirror_fault() is called from the dmirror_read() and dmirror_write()
retry loops after dmirror_do_read() or dmirror_do_write() finds a missing
device page table entry.
If the mirrored mm has already exited, mmget_not_zero() fails. The
current code returns 0 in that case, which tells the caller that faulting
succeeded even though no page was faulted and no device page table entry
was installed. The caller then retries the same address, hits -ENOENT
again, and can loop forever without making progress.
Return -EFAULT instead, so the ioctl fails when the mirrored mm is no
longer faultable.
Link: https://lore.kernel.org/178294308408.327222.3319445682023999403.stgit@skinsburskii
Fixes: b2ef9f5a5cb37 ("mm/hmm/test: add selftest driver for HMM")
Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Ralph Campbell <rcampbell@nvidia.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/test_hmm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/test_hmm.c b/lib/test_hmm.c
index 850d23469ef78..62d4872232951 100644
--- a/lib/test_hmm.c
+++ b/lib/test_hmm.c
@@ -391,7 +391,7 @@ static int dmirror_fault(struct dmirror *dmirror, unsigned long start,
/* Since the mm is for the mirrored process, get a reference first. */
if (!mmget_not_zero(mm))
- return 0;
+ return -EFAULT;
for (addr = start; addr < end; addr = range.end) {
range.start = addr;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0780/1376] clk: qcom: gpucc-qcm2290: Park RCGs clk source at XO during disable
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (778 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0779/1376] lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0781/1376] clk: qcom: Return expected ENOMEM error on dynamic allocation failure Greg Kroah-Hartman
` (218 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Konrad Dybcio,
Imran Shaik, Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Imran Shaik <imran.shaik@oss.qualcomm.com>
[ Upstream commit ab46b5fb668b8b9b848a8f036fc4c06ce86b7e3b ]
The RCG's clk src has to be parked at XO while disabling as per hardware
team's recommendation, hence use clk_rcg2_shared_ops to achieve the same.
Fixes: 8cab033628b1 ("clk: qcom: Add QCM2290 GPU clock controller driver")
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Imran Shaik <imran.shaik@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260718-shikra-dispcc-gpucc-v6-11-62703e05ef0f@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/gpucc-qcm2290.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clk/qcom/gpucc-qcm2290.c b/drivers/clk/qcom/gpucc-qcm2290.c
index dc369dff882e6..3ccab8f3b4e0f 100644
--- a/drivers/clk/qcom/gpucc-qcm2290.c
+++ b/drivers/clk/qcom/gpucc-qcm2290.c
@@ -144,7 +144,7 @@ static struct clk_rcg2 gpu_cc_gx_gfx3d_clk_src = {
.parent_data = gpu_cc_parent_data_1,
.num_parents = ARRAY_SIZE(gpu_cc_parent_data_1),
.flags = CLK_SET_RATE_PARENT,
- .ops = &clk_rcg2_ops,
+ .ops = &clk_rcg2_shared_ops,
},
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0781/1376] clk: qcom: Return expected ENOMEM error on dynamic allocation failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (779 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0780/1376] clk: qcom: gpucc-qcm2290: Park RCGs clk source at XO during disable Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0782/1376] md/bitmap: resume array on backlog_store() error path Greg Kroah-Hartman
` (217 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladimir Zapolskiy, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <vz@kernel.org>
[ Upstream commit 22d9257f08913b6eec3e8ece4d13d9c41f14428b ]
If a dynamic memory allocation fails, the returned error code in clock
controller driver probe functions on a few legacy platforms should be
set to -ENOMEM instead of -EINVAL.
Fixes: ee15faffef11 ("clk: qcom: common: Add API to register board clocks backwards compatibly")
Signed-off-by: Vladimir Zapolskiy <vz@kernel.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260629162127.3910603-1-vz@kernel.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/common.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/clk/qcom/common.c b/drivers/clk/qcom/common.c
index e1a83ec481509..8061d0bf590ae 100644
--- a/drivers/clk/qcom/common.c
+++ b/drivers/clk/qcom/common.c
@@ -165,7 +165,7 @@ static int _qcom_cc_register_board_clk(struct device *dev, const char *path,
if (!node) {
fixed = devm_kzalloc(dev, sizeof(*fixed), GFP_KERNEL);
if (!fixed)
- return -EINVAL;
+ return -ENOMEM;
fixed->fixed_rate = rate;
fixed->hw.init = &init_data;
@@ -182,7 +182,7 @@ static int _qcom_cc_register_board_clk(struct device *dev, const char *path,
if (add_factor) {
factor = devm_kzalloc(dev, sizeof(*factor), GFP_KERNEL);
if (!factor)
- return -EINVAL;
+ return -ENOMEM;
factor->mult = factor->div = 1;
factor->hw.init = &init_data;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0782/1376] md/bitmap: resume array on backlog_store() error path
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (780 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0781/1376] clk: qcom: Return expected ENOMEM error on dynamic allocation failure Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0783/1376] md: remove unused mddev argument from export_rdev Greg Kroah-Hartman
` (216 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chen Cheng, Yu Kuai, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Cheng <chencheng@fnnas.com>
[ Upstream commit 2911cd0a0f4366a7e06832bc5f0a7fdcc138e4dc ]
backlog_store() suspends the array before checking whether a write-mostly
device exists. If no such device exists, the error path only unlocks
reconfig_mutex and leaves the array suspended, blocking subsequent I/O.
Use mddev_unlock_and_resume() to release both states.
Fixes: 58226942ad3d ("md: use new apis to suspend array before mddev_create/destroy_serial_pool")
Signed-off-by: Chen Cheng <chencheng@fnnas.com>
Reviewed-by: Yu Kuai <yukuai@fygo.io>
Link: https://patch.msgid.link/20260718034236.4119093-1-chencheng@fnnas.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/md-bitmap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c
index 33b92b864f70c..67f1b716e2936 100644
--- a/drivers/md/md-bitmap.c
+++ b/drivers/md/md-bitmap.c
@@ -2816,7 +2816,7 @@ backlog_store(struct mddev *mddev, const char *buf, size_t len)
if (!has_write_mostly) {
pr_warn_ratelimited("%s: can't set backlog, no write mostly device available\n",
mdname(mddev));
- mddev_unlock(mddev);
+ mddev_unlock_and_resume(mddev);
return -EINVAL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0783/1376] md: remove unused mddev argument from export_rdev
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (781 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0782/1376] md/bitmap: resume array on backlog_store() error path Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0784/1376] md: skip redundant raid_disks update when value is unchanged Greg Kroah-Hartman
` (215 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chen Cheng, Paul Menzel, Yu Kuai,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Cheng <chencheng@fnnas.com>
[ Upstream commit 6f507eb2bb5491327fe634dc23558d4ca5d710b8 ]
The mddev argument in export_rdev() is never used. Remove it to
simplify callers.
Signed-off-by: Chen Cheng <chencheng@fnnas.com>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Link: https://lore.kernel.org/linux-raid/20260304111417.20777-1-chencheng@fnnas.com/
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Stable-dep-of: bace2010dd7a ("md: scope memalloc_noio to allocation critical sections")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/md.c | 28 ++++++++++++++--------------
1 file changed, 14 insertions(+), 14 deletions(-)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 3e683b9626df5..47b5415cd5a3b 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -105,7 +105,7 @@ struct workqueue_struct *md_bitmap_wq;
static int remove_and_add_spares(struct mddev *mddev,
struct md_rdev *this);
static void mddev_detach(struct mddev *mddev);
-static void export_rdev(struct md_rdev *rdev, struct mddev *mddev);
+static void export_rdev(struct md_rdev *rdev);
static void md_wakeup_thread_directly(struct md_thread __rcu **thread);
/*
@@ -865,7 +865,7 @@ void mddev_unlock(struct mddev *mddev)
list_for_each_entry_safe(rdev, tmp, &delete, same_set) {
list_del_init(&rdev->same_set);
kobject_del(&rdev->kobj);
- export_rdev(rdev, mddev);
+ export_rdev(rdev);
}
}
EXPORT_SYMBOL_GPL(mddev_unlock);
@@ -2498,7 +2498,7 @@ void md_autodetect_dev(dev_t dev);
/* just for claiming the bdev */
static struct md_rdev claim_rdev;
-static void export_rdev(struct md_rdev *rdev, struct mddev *mddev)
+static void export_rdev(struct md_rdev *rdev)
{
pr_debug("md: export_rdev(%pg)\n", rdev->bdev);
md_rdev_clear(rdev);
@@ -4637,7 +4637,7 @@ new_dev_store(struct mddev *mddev, const char *buf, size_t len)
err = bind_rdev_to_array(rdev, mddev);
out:
if (err)
- export_rdev(rdev, mddev);
+ export_rdev(rdev);
mddev_unlock_and_resume(mddev);
if (!err)
md_new_event();
@@ -6718,7 +6718,7 @@ static void autorun_devices(int part)
rdev_for_each_list(rdev, tmp, &candidates) {
list_del_init(&rdev->same_set);
if (bind_rdev_to_array(rdev, mddev))
- export_rdev(rdev, mddev);
+ export_rdev(rdev);
}
autorun_array(mddev);
mddev_unlock_and_resume(mddev);
@@ -6728,7 +6728,7 @@ static void autorun_devices(int part)
*/
rdev_for_each_list(rdev, tmp, &candidates) {
list_del_init(&rdev->same_set);
- export_rdev(rdev, mddev);
+ export_rdev(rdev);
}
mddev_put(mddev);
}
@@ -6916,13 +6916,13 @@ int md_add_new_disk(struct mddev *mddev, struct mdu_disk_info_s *info)
pr_warn("md: %pg has different UUID to %pg\n",
rdev->bdev,
rdev0->bdev);
- export_rdev(rdev, mddev);
+ export_rdev(rdev);
return -EINVAL;
}
}
err = bind_rdev_to_array(rdev, mddev);
if (err)
- export_rdev(rdev, mddev);
+ export_rdev(rdev);
return err;
}
@@ -6965,7 +6965,7 @@ int md_add_new_disk(struct mddev *mddev, struct mdu_disk_info_s *info)
/* This was a hot-add request, but events doesn't
* match, so reject it.
*/
- export_rdev(rdev, mddev);
+ export_rdev(rdev);
return -EINVAL;
}
@@ -6991,7 +6991,7 @@ int md_add_new_disk(struct mddev *mddev, struct mdu_disk_info_s *info)
}
}
if (has_journal || mddev->bitmap) {
- export_rdev(rdev, mddev);
+ export_rdev(rdev);
return -EBUSY;
}
set_bit(Journal, &rdev->flags);
@@ -7006,7 +7006,7 @@ int md_add_new_disk(struct mddev *mddev, struct mdu_disk_info_s *info)
/* --add initiated by this node */
err = md_cluster_ops->add_new_disk(mddev, rdev);
if (err) {
- export_rdev(rdev, mddev);
+ export_rdev(rdev);
return err;
}
}
@@ -7016,7 +7016,7 @@ int md_add_new_disk(struct mddev *mddev, struct mdu_disk_info_s *info)
err = bind_rdev_to_array(rdev, mddev);
if (err)
- export_rdev(rdev, mddev);
+ export_rdev(rdev);
if (mddev_is_clustered(mddev)) {
if (info->state & (1 << MD_DISK_CANDIDATE)) {
@@ -7079,7 +7079,7 @@ int md_add_new_disk(struct mddev *mddev, struct mdu_disk_info_s *info)
err = bind_rdev_to_array(rdev, mddev);
if (err) {
- export_rdev(rdev, mddev);
+ export_rdev(rdev);
return err;
}
}
@@ -7192,7 +7192,7 @@ static int hot_add_disk(struct mddev *mddev, dev_t dev)
return 0;
abort_export:
- export_rdev(rdev, mddev);
+ export_rdev(rdev);
return err;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0784/1376] md: skip redundant raid_disks update when value is unchanged
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (782 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0783/1376] md: remove unused mddev argument from export_rdev Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0785/1376] md: scope memalloc_noio to allocation critical sections Greg Kroah-Hartman
` (214 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abd-Alrhman Masalkhi, Yu Kuai,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abd-Alrhman Masalkhi <abd.masalkhi@gmail.com>
[ Upstream commit abaf4783822851678632e5cea98aa5aead99852f ]
Calling update_raid_disks() with the same value as the current one
can trigger unnecessary work. For example, RAID1 will reallocate
resources such as the mempool for r1bio.
Signed-off-by: Abd-Alrhman Masalkhi <abd.masalkhi@gmail.com>
Link: https://patch.msgid.link/20260428130524.448063-1-abd.masalkhi@gmail.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Stable-dep-of: bace2010dd7a ("md: scope memalloc_noio to allocation critical sections")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/md.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 47b5415cd5a3b..27d8b973c89b1 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -4196,9 +4196,10 @@ raid_disks_store(struct mddev *mddev, const char *buf, size_t len)
err = mddev_suspend_and_lock(mddev);
if (err)
return err;
- if (mddev->pers)
- err = update_raid_disks(mddev, n);
- else if (mddev->reshape_position != MaxSector) {
+ if (mddev->pers) {
+ if (n != mddev->raid_disks)
+ err = update_raid_disks(mddev, n);
+ } else if (mddev->reshape_position != MaxSector) {
struct md_rdev *rdev;
int olddisks = mddev->raid_disks - mddev->delta_disks;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0785/1376] md: scope memalloc_noio to allocation critical sections
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (783 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0784/1376] md: skip redundant raid_disks update when value is unchanged Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0786/1376] iommu/dma: Check atomic pool allocation result directly Greg Kroah-Hartman
` (213 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chen Cheng, Yu Kuai, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Cheng <chencheng@fnnas.com>
[ Upstream commit bace2010dd7ac07bc980575afb135c406730a7fe ]
Storing a memalloc_noio_save() token in mddev->noio_flags lets one task
save the token and another task restore it. With concurrent suspend sysfs
writes, task A can enter PF_MEMALLOC_NOIO, return to userspace still in
that scope, and later task B can restore A's saved token.
Avoid tying the token lifetime to mddev. Keep mddev_suspend() and
mddev_resume() only responsible for array suspension, and enter
PF_MEMALLOC_NOIO only in the MD paths that allocate memory after the array
has been suspended. Restore the token before resuming the array.
A reproducer repeatedly writes suspend_lo and suspend_hi from concurrent
workers and checks each worker's /proc/self/stat flags before and after the
sysfs write.
Link: https://github.com/chencheng-fnnas/reproducer/blob/main/repro-md-noio-token-leak.sh
Fixes: 78f57ef9d50a ("md: use memalloc scope APIs in mddev_suspend()/mddev_resume()")
Signed-off-by: Chen Cheng <chencheng@fnnas.com>
Reviewed-by: Yu Kuai <yukuai@fygo.io>
Link: https://patch.msgid.link/20260718084218.417895-1-chencheng@fnnas.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/md-bitmap.c | 3 +++
drivers/md/md.c | 53 ++++++++++++++++++++++++++++--------------
drivers/md/md.h | 1 -
drivers/md/raid5.c | 14 +++++++----
4 files changed, 48 insertions(+), 23 deletions(-)
diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c
index 67f1b716e2936..b0bd83ba237d7 100644
--- a/drivers/md/md-bitmap.c
+++ b/drivers/md/md-bitmap.c
@@ -2612,10 +2612,12 @@ static ssize_t
location_store(struct mddev *mddev, const char *buf, size_t len)
{
int rv;
+ unsigned int noio_flags;
rv = mddev_suspend_and_lock(mddev);
if (rv)
return rv;
+ noio_flags = memalloc_noio_save();
if (mddev->pers) {
if (mddev->recovery || mddev->sync_thread) {
@@ -2689,6 +2691,7 @@ location_store(struct mddev *mddev, const char *buf, size_t len)
}
rv = 0;
out:
+ memalloc_noio_restore(noio_flags);
mddev_unlock_and_resume(mddev);
if (rv)
return rv;
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 27d8b973c89b1..9ad6835a3c143 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -226,23 +226,21 @@ static int rdev_need_serial(struct md_rdev *rdev)
void mddev_create_serial_pool(struct mddev *mddev, struct md_rdev *rdev)
{
int ret = 0;
+ unsigned int noio_flags;
if (rdev && !rdev_need_serial(rdev) &&
!test_bit(CollisionCheck, &rdev->flags))
return;
+ noio_flags = memalloc_noio_save();
if (!rdev)
ret = rdevs_init_serial(mddev);
else
ret = rdev_init_serial(rdev);
if (ret)
- return;
+ goto out;
if (mddev->serial_info_pool == NULL) {
- /*
- * already in memalloc noio context by
- * mddev_suspend()
- */
mddev->serial_info_pool =
mempool_create_kmalloc_pool(NR_SERIAL_INFOS,
sizeof(struct serial_info));
@@ -251,6 +249,8 @@ void mddev_create_serial_pool(struct mddev *mddev, struct md_rdev *rdev)
pr_err("can't alloc memory pool for serialization\n");
}
}
+out:
+ memalloc_noio_restore(noio_flags);
}
/*
@@ -500,9 +500,6 @@ int mddev_suspend(struct mddev *mddev, bool interruptible)
*/
WRITE_ONCE(mddev->suspended, mddev->suspended + 1);
- /* restrict memory reclaim I/O during raid array is suspend */
- mddev->noio_flag = memalloc_noio_save();
-
mutex_unlock(&mddev->suspend_mutex);
return 0;
}
@@ -519,9 +516,6 @@ static void __mddev_resume(struct mddev *mddev, bool recovery_needed)
return;
}
- /* entred the memalloc scope from mddev_suspend() */
- memalloc_noio_restore(mddev->noio_flag);
-
percpu_ref_resurrect(&mddev->active_io);
wake_up(&mddev->sb_wait);
@@ -3898,6 +3892,7 @@ level_store(struct mddev *mddev, const char *buf, size_t len)
char clevel[16];
ssize_t rv;
size_t slen = len;
+ unsigned int noio_flags;
struct md_personality *pers, *oldpers;
long level;
void *priv, *oldpriv;
@@ -3909,6 +3904,7 @@ level_store(struct mddev *mddev, const char *buf, size_t len)
rv = mddev_suspend_and_lock(mddev);
if (rv)
return rv;
+ noio_flags = memalloc_noio_save();
if (mddev->pers == NULL) {
memcpy(mddev->clevel, buf, slen);
@@ -4088,6 +4084,7 @@ level_store(struct mddev *mddev, const char *buf, size_t len)
md_new_event();
rv = len;
out_unlock:
+ memalloc_noio_restore(noio_flags);
mddev_unlock_and_resume(mddev);
return rv;
}
@@ -4187,6 +4184,7 @@ static ssize_t
raid_disks_store(struct mddev *mddev, const char *buf, size_t len)
{
unsigned int n;
+ unsigned int noio_flags;
int err;
err = kstrtouint(buf, 10, &n);
@@ -4196,6 +4194,7 @@ raid_disks_store(struct mddev *mddev, const char *buf, size_t len)
err = mddev_suspend_and_lock(mddev);
if (err)
return err;
+ noio_flags = memalloc_noio_save();
if (mddev->pers) {
if (n != mddev->raid_disks)
err = update_raid_disks(mddev, n);
@@ -4219,6 +4218,7 @@ raid_disks_store(struct mddev *mddev, const char *buf, size_t len)
} else
mddev->raid_disks = n;
out_unlock:
+ memalloc_noio_restore(noio_flags);
mddev_unlock_and_resume(mddev);
return err ? err : len;
}
@@ -4599,6 +4599,7 @@ new_dev_store(struct mddev *mddev, const char *buf, size_t len)
int minor;
dev_t dev;
struct md_rdev *rdev;
+ unsigned int noio_flags;
int err;
if (!*buf || *e != ':' || !e[1] || e[1] == '\n')
@@ -4614,6 +4615,7 @@ new_dev_store(struct mddev *mddev, const char *buf, size_t len)
err = mddev_suspend_and_lock(mddev);
if (err)
return err;
+ noio_flags = memalloc_noio_save();
if (mddev->persistent) {
rdev = md_import_device(dev, mddev->major_version,
mddev->minor_version);
@@ -4632,6 +4634,7 @@ new_dev_store(struct mddev *mddev, const char *buf, size_t len)
rdev = md_import_device(dev, -1, -1);
if (IS_ERR(rdev)) {
+ memalloc_noio_restore(noio_flags);
mddev_unlock_and_resume(mddev);
return PTR_ERR(rdev);
}
@@ -4639,6 +4642,7 @@ new_dev_store(struct mddev *mddev, const char *buf, size_t len)
out:
if (err)
export_rdev(rdev);
+ memalloc_noio_restore(noio_flags);
mddev_unlock_and_resume(mddev);
if (!err)
md_new_event();
@@ -7709,8 +7713,10 @@ static int md_ioctl(struct block_device *bdev, blk_mode_t mode,
unsigned int cmd, unsigned long arg)
{
int err = 0;
+ unsigned int noio_flags = 0;
void __user *argp = (void __user *)arg;
struct mddev *mddev = NULL;
+ bool suspend;
err = md_ioctl_valid(cmd);
if (err)
@@ -7760,13 +7766,15 @@ static int md_ioctl(struct block_device *bdev, blk_mode_t mode,
if (!md_is_rdwr(mddev))
flush_work(&mddev->sync_work);
- err = md_ioctl_need_suspend(cmd) ? mddev_suspend_and_lock(mddev) :
- mddev_lock(mddev);
+ suspend = md_ioctl_need_suspend(cmd);
+ err = suspend ? mddev_suspend_and_lock(mddev) : mddev_lock(mddev);
if (err) {
pr_debug("md: ioctl lock interrupted, reason %d, cmd %d\n",
err, cmd);
goto out;
}
+ if (suspend)
+ noio_flags = memalloc_noio_save();
if (cmd == SET_ARRAY_INFO) {
err = __md_set_array_info(mddev, argp);
@@ -7891,8 +7899,12 @@ static int md_ioctl(struct block_device *bdev, blk_mode_t mode,
err != -EINVAL)
mddev->hold_active = 0;
- md_ioctl_need_suspend(cmd) ? mddev_unlock_and_resume(mddev) :
- mddev_unlock(mddev);
+ if (suspend) {
+ memalloc_noio_restore(noio_flags);
+ mddev_unlock_and_resume(mddev);
+ } else {
+ mddev_unlock(mddev);
+ }
out:
if (cmd == STOP_ARRAY_RO || (err && cmd == STOP_ARRAY))
@@ -9578,6 +9590,7 @@ static void md_start_sync(struct work_struct *ws)
struct mddev *mddev = container_of(ws, struct mddev, sync_work);
int spares = 0;
bool suspend = false;
+ unsigned int noio_flags = 0;
char *name;
/*
@@ -9588,6 +9601,7 @@ static void md_start_sync(struct work_struct *ws)
md_spares_need_change(mddev)) {
suspend = true;
mddev_suspend(mddev, false);
+ noio_flags = memalloc_noio_save();
}
mddev_lock_nointr(mddev);
@@ -9601,6 +9615,7 @@ static void md_start_sync(struct work_struct *ws)
mddev_unlock(mddev);
mddev_suspend_and_lock_nointr(mddev);
suspend = true;
+ noio_flags = memalloc_noio_save();
}
if (!md_is_rdwr(mddev)) {
@@ -9646,8 +9661,10 @@ static void md_start_sync(struct work_struct *ws)
* https://bugzilla.kernel.org/show_bug.cgi?id=218200
* Therefore, use __mddev_resume(mddev, false).
*/
- if (suspend)
+ if (suspend) {
+ memalloc_noio_restore(noio_flags);
__mddev_resume(mddev, false);
+ }
md_wakeup_thread(mddev->sync_thread);
sysfs_notify_dirent_safe(mddev->sysfs_action);
md_new_event();
@@ -9666,8 +9683,10 @@ static void md_start_sync(struct work_struct *ws)
* https://bugzilla.kernel.org/show_bug.cgi?id=218200
* Therefore, use __mddev_resume(mddev, false).
*/
- if (suspend)
+ if (suspend) {
+ memalloc_noio_restore(noio_flags);
__mddev_resume(mddev, false);
+ }
wake_up(&resync_wait);
if (test_and_clear_bit(MD_RECOVERY_RECOVER, &mddev->recovery) &&
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 22a1ec3aa18d6..9a44676102f20 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -577,7 +577,6 @@ struct mddev {
void (*sync_super)(struct mddev *mddev, struct md_rdev *rdev);
struct md_cluster_info *cluster_info;
unsigned int good_device_nr; /* good device num within cluster raid */
- unsigned int noio_flag; /* for memalloc scope API */
/*
* Temporarily store rdev that will be finally removed when
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 1daf043a5e524..78f3f2d4d1dcb 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -2460,11 +2460,6 @@ static int scribble_alloc(struct raid5_percpu *percpu,
sizeof(unsigned int) * (num + 2);
void *scribble;
- /*
- * If here is in raid array suspend context, it is in memalloc noio
- * context as well, there is no potential recursive memory reclaim
- * I/Os with the GFP_KERNEL flag.
- */
scribble = kvmalloc_array(cnt, obj_size, GFP_KERNEL);
if (!scribble)
return -ENOMEM;
@@ -2479,6 +2474,7 @@ static int scribble_alloc(struct raid5_percpu *percpu,
static int resize_chunks(struct r5conf *conf, int new_disks, int new_sectors)
{
unsigned long cpu;
+ unsigned int noio_flags;
int err = 0;
/* Never shrink. */
@@ -2487,6 +2483,7 @@ static int resize_chunks(struct r5conf *conf, int new_disks, int new_sectors)
return 0;
raid5_quiesce(conf->mddev, true);
+ noio_flags = memalloc_noio_save();
cpus_read_lock();
for_each_present_cpu(cpu) {
@@ -2500,6 +2497,7 @@ static int resize_chunks(struct r5conf *conf, int new_disks, int new_sectors)
}
cpus_read_unlock();
+ memalloc_noio_restore(noio_flags);
raid5_quiesce(conf->mddev, false);
if (!err) {
@@ -6990,6 +6988,7 @@ raid5_store_stripe_size(struct mddev *mddev, const char *page, size_t len)
{
struct r5conf *conf;
unsigned long new;
+ unsigned int noio_flags = 0;
int err;
int size;
@@ -7030,6 +7029,7 @@ raid5_store_stripe_size(struct mddev *mddev, const char *page, size_t len)
goto out_unlock;
}
+ noio_flags = memalloc_noio_save();
mutex_lock(&conf->cache_size_mutex);
size = conf->max_nr_stripes;
@@ -7046,6 +7046,7 @@ raid5_store_stripe_size(struct mddev *mddev, const char *page, size_t len)
mutex_unlock(&conf->cache_size_mutex);
out_unlock:
+ memalloc_noio_restore(noio_flags);
mddev_unlock_and_resume(mddev);
return err ?: len;
}
@@ -8912,6 +8913,7 @@ static void *raid6_takeover(struct mddev *mddev)
static int raid5_change_consistency_policy(struct mddev *mddev, const char *buf)
{
struct r5conf *conf;
+ unsigned int noio_flags;
int err;
err = mddev_suspend_and_lock(mddev);
@@ -8923,6 +8925,7 @@ static int raid5_change_consistency_policy(struct mddev *mddev, const char *buf)
return -ENODEV;
}
+ noio_flags = memalloc_noio_save();
if (strncmp(buf, "ppl", 3) == 0) {
/* ppl only works with RAID 5 */
if (!raid5_has_ppl(conf) && conf->level == 5) {
@@ -8962,6 +8965,7 @@ static int raid5_change_consistency_policy(struct mddev *mddev, const char *buf)
if (!err)
md_update_sb(mddev, 1);
+ memalloc_noio_restore(noio_flags);
mddev_unlock_and_resume(mddev);
return err;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0786/1376] iommu/dma: Check atomic pool allocation result directly
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (784 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0785/1376] md: scope memalloc_noio to allocation critical sections Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0787/1376] swiotlb: Preserve allocation virtual address for dynamic pools Greg Kroah-Hartman
` (212 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jason Gunthorpe, Michael Kelley,
Mostafa Saleh, Petr Tesarik, Aneesh Kumar K.V (Arm),
Marek Szyprowski, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aneesh Kumar K.V (Arm) <aneesh.kumar@kernel.org>
[ Upstream commit af95a0ebc0a0db0762be75f51eadf770bad01aaa ]
The non-blocking, non-coherent allocation path uses dma_alloc_from_pool(),
which returns the allocated page and fills cpu_addr only on success.
Do not rely on cpu_addr to detect allocation failure in this path. Check
the returned page directly before using it for the IOMMU mapping.
Fixes: 9420139f516d ("dma-pool: fix coherent pool allocations for IOMMU mappings")
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Tested-by: Michael Kelley <mhklinux@outlook.com>
Tested-by: Mostafa Saleh <smostafa@google.com>
Reviewed-by: Petr Tesarik <ptesarik@suse.com>
Signed-off-by: Aneesh Kumar K.V (Arm) <aneesh.kumar@kernel.org>
Link: https://lore.kernel.org/r/20260717180442.110954-4-aneesh.kumar@kernel.org
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/dma-iommu.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
index 0f0caf59023c7..059463664b418 100644
--- a/drivers/iommu/dma-iommu.c
+++ b/drivers/iommu/dma-iommu.c
@@ -1648,13 +1648,16 @@ void *iommu_dma_alloc(struct device *dev, size_t size, dma_addr_t *handle,
}
if (IS_ENABLED(CONFIG_DMA_DIRECT_REMAP) &&
- !gfpflags_allow_blocking(gfp) && !coherent)
+ !gfpflags_allow_blocking(gfp) && !coherent) {
page = dma_alloc_from_pool(dev, PAGE_ALIGN(size), &cpu_addr,
- gfp, NULL);
- else
+ gfp, NULL);
+ if (!page)
+ return NULL;
+ } else {
cpu_addr = iommu_dma_alloc_pages(dev, size, &page, gfp, attrs);
- if (!cpu_addr)
- return NULL;
+ if (!cpu_addr)
+ return NULL;
+ }
*handle = __iommu_dma_map(dev, page_to_phys(page), size, ioprot,
dev->coherent_dma_mask);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0787/1376] swiotlb: Preserve allocation virtual address for dynamic pools
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (785 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0786/1376] iommu/dma: Check atomic pool allocation result directly Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0788/1376] i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices Greg Kroah-Hartman
` (211 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jason Gunthorpe, Michael Kelley,
Mostafa Saleh, Petr Tesarik, Aneesh Kumar K.V (Arm),
Marek Szyprowski, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aneesh Kumar K.V (Arm) <aneesh.kumar@kernel.org>
[ Upstream commit 57d29044d0f29a76c6ec0c112c8c7371d5608dc7 ]
swiotlb_alloc_tlb() can allocate from the DMA atomic pool when a decrypted
pool is needed from atomic context. With CONFIG_DMA_DIRECT_REMAP, the
atomic pool is backed by remapped virtual addresses, which are not the same
as the direct-map addresses returned by phys_to_virt().
swiotlb_init_io_tlb_pool() currently reconstructs the pool virtual address
from the physical start address. For atomic-pool backed allocations this
stores the wrong address in pool->vaddr. Later, swiotlb_free_tlb() passes
that address to dma_free_from_pool(), which will fail to recognize the
chunk
Pass the virtual address returned by the allocation path into
swiotlb_init_io_tlb_pool(), and store that address in pool->vaddr. This
keeps the pool free path using the same virtual address as the allocator.
Fixes: 79636caad361 ("swiotlb: if swiotlb is full, fall back to a transient memory pool")
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Tested-by: Michael Kelley <mhklinux@outlook.com>
Tested-by: Mostafa Saleh <smostafa@google.com>
Reviewed-by: Petr Tesarik <ptesarik@suse.com>
Signed-off-by: Aneesh Kumar K.V (Arm) <aneesh.kumar@kernel.org>
Reviewed-by: Mostafa Saleh <smostafa@google.com>
Link: https://lore.kernel.org/r/20260717180442.110954-6-aneesh.kumar@kernel.org
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/dma/swiotlb.c | 31 +++++++++++++++++++------------
1 file changed, 19 insertions(+), 12 deletions(-)
diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
index e2445b3af7468..ffb7b021e2fb9 100644
--- a/kernel/dma/swiotlb.c
+++ b/kernel/dma/swiotlb.c
@@ -268,9 +268,9 @@ void __init swiotlb_update_mem_attributes(void)
}
static void swiotlb_init_io_tlb_pool(struct io_tlb_pool *mem, phys_addr_t start,
- unsigned long nslabs, bool late_alloc, unsigned int nareas)
+ void *vaddr, unsigned long nslabs, bool late_alloc,
+ unsigned int nareas)
{
- void *vaddr = phys_to_virt(start);
unsigned long bytes = nslabs << IO_TLB_SHIFT, i;
mem->nslabs = nslabs;
@@ -411,7 +411,7 @@ void __init swiotlb_init_remap(bool addressing_limit, unsigned int flags,
return;
}
- swiotlb_init_io_tlb_pool(mem, __pa(tlb), nslabs, false, nareas);
+ swiotlb_init_io_tlb_pool(mem, __pa(tlb), tlb, nslabs, false, nareas);
add_mem_pool(&io_tlb_default_mem, mem);
if (flags & SWIOTLB_VERBOSE)
@@ -509,7 +509,7 @@ int swiotlb_init_late(size_t size, gfp_t gfp_mask,
set_memory_decrypted((unsigned long)vstart,
(nslabs << IO_TLB_SHIFT) >> PAGE_SHIFT);
- swiotlb_init_io_tlb_pool(mem, virt_to_phys(vstart), nslabs, true,
+ swiotlb_init_io_tlb_pool(mem, virt_to_phys(vstart), vstart, nslabs, true,
nareas);
add_mem_pool(&io_tlb_default_mem, mem);
@@ -607,25 +607,26 @@ static struct page *alloc_dma_pages(gfp_t gfp, size_t bytes, u64 phys_limit)
* @bytes: Size of the buffer.
* @phys_limit: Maximum allowed physical address of the buffer.
* @gfp: GFP flags for the allocation.
+ * @vaddr: Receives the virtual address for the allocated buffer.
*
* Return: Allocated pages, or %NULL on allocation failure.
*/
static struct page *swiotlb_alloc_tlb(struct device *dev, size_t bytes,
- u64 phys_limit, gfp_t gfp)
+ u64 phys_limit, gfp_t gfp, void **vaddr)
{
struct page *page;
+ *vaddr = NULL;
+
/*
* Allocate from the atomic pools if memory is encrypted and
* the allocation is atomic, because decrypting may block.
*/
if (!gfpflags_allow_blocking(gfp) && dev && force_dma_unencrypted(dev)) {
- void *vaddr;
-
if (!IS_ENABLED(CONFIG_DMA_COHERENT_POOL))
return NULL;
- return dma_alloc_from_pool(dev, bytes, &vaddr, gfp,
+ return dma_alloc_from_pool(dev, bytes, vaddr, gfp,
dma_coherent_ok);
}
@@ -647,6 +648,8 @@ static struct page *swiotlb_alloc_tlb(struct device *dev, size_t bytes,
return NULL;
}
+ if (page)
+ *vaddr = phys_to_virt(page_to_phys(page));
return page;
}
@@ -687,6 +690,7 @@ static struct io_tlb_pool *swiotlb_alloc_pool(struct device *dev,
{
struct io_tlb_pool *pool;
unsigned int slot_order;
+ void *tlb_vaddr;
struct page *tlb;
size_t pool_size;
size_t tlb_size;
@@ -703,7 +707,8 @@ static struct io_tlb_pool *swiotlb_alloc_pool(struct device *dev,
pool->areas = (void *)pool + sizeof(*pool);
tlb_size = nslabs << IO_TLB_SHIFT;
- while (!(tlb = swiotlb_alloc_tlb(dev, tlb_size, phys_limit, gfp))) {
+ while (!(tlb = swiotlb_alloc_tlb(dev, tlb_size, phys_limit, gfp,
+ &tlb_vaddr))) {
if (nslabs <= minslabs)
goto error_tlb;
nslabs = ALIGN(nslabs >> 1, IO_TLB_SEGSIZE);
@@ -717,11 +722,12 @@ static struct io_tlb_pool *swiotlb_alloc_pool(struct device *dev,
if (!pool->slots)
goto error_slots;
- swiotlb_init_io_tlb_pool(pool, page_to_phys(tlb), nslabs, true, nareas);
+ swiotlb_init_io_tlb_pool(pool, page_to_phys(tlb), tlb_vaddr, nslabs,
+ true, nareas);
return pool;
error_slots:
- swiotlb_free_tlb(page_address(tlb), tlb_size);
+ swiotlb_free_tlb(tlb_vaddr, tlb_size);
error_tlb:
kfree(pool);
error:
@@ -1849,7 +1855,8 @@ static int rmem_swiotlb_device_init(struct reserved_mem *rmem,
set_memory_decrypted((unsigned long)phys_to_virt(rmem->base),
rmem->size >> PAGE_SHIFT);
- swiotlb_init_io_tlb_pool(pool, rmem->base, nslabs,
+ swiotlb_init_io_tlb_pool(pool, rmem->base, phys_to_virt(rmem->base),
+ nslabs,
false, nareas);
mem->force_bounce = true;
mem->for_alloc = true;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0788/1376] i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (786 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0787/1376] swiotlb: Preserve allocation virtual address for dynamic pools Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0789/1376] i3c: master: Fix device_register() error path Greg Kroah-Hartman
` (210 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jakub Kicinski, Frank Li,
Alexandre Belloni, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <kuba@kernel.org>
[ Upstream commit 038cf48b3170af26a70bf2dee4f8c3ac910f5176 ]
On an empty bus ENTDAA assigns nothing, so cmd->rx_len (the count
of addresses left unassigned) equals master->maxdevs.
The GENMASK() index master->maxdevs - cmd->rx_len - 1 then becomes -1,
which trips up UBSAN. This happens every time on boot on a Gigabyte/AMD
server:
UBSAN: shift-out-of-bounds in drivers/i3c/master/dw-i3c-master.c:905:12
shift exponent 64 is too large for 64-bit type 'long unsigned int'
CPU: 7 UID: 0 PID: 963 Comm: (udev-worker) Not tainted 7.0.11-200.fc44.x86_64 #1 PREEMPT(lazy)
Hardware name: Giga Computing E163-Z34-AAH1-000/MZ33-DC1-000, BIOS R32_F45 04/01/2026
Call Trace:
<TASK>
dump_stack_lvl+0x5d/0x80
ubsan_epilogue+0x5/0x2b
__ubsan_handle_shift_out_of_bounds.cold+0xd7/0x1ab
dw_i3c_master_daa.cold+0x1b/0x96 [dw_i3c_master]
i3c_master_do_daa_ext.part.0+0x3e/0xf0 [i3c]
Skip the mask when no new device was assigned.
Fixes: 1dd728f5d4d4 ("i3c: master: Add driver for Synopsys DesignWare IP")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260630172904.2662160-1-kuba@kernel.org
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i3c/master/dw-i3c-master.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/i3c/master/dw-i3c-master.c b/drivers/i3c/master/dw-i3c-master.c
index a60eb86bddba8..c68637ddd05e9 100644
--- a/drivers/i3c/master/dw-i3c-master.c
+++ b/drivers/i3c/master/dw-i3c-master.c
@@ -889,7 +889,15 @@ static int dw_i3c_master_daa(struct i3c_master_controller *m)
if (!wait_for_completion_timeout(&xfer->comp, XFER_TIMEOUT))
dw_i3c_master_dequeue_xfer(master, xfer);
- newdevs = GENMASK(master->maxdevs - cmd->rx_len - 1, 0);
+ /*
+ * cmd->rx_len holds the number of addresses ENTDAA left unassigned.
+ * On an empty bus rx_len == maxdevs, so avoid GENMASK(-1, 0).
+ */
+ if (cmd->rx_len >= master->maxdevs)
+ newdevs = 0;
+ else
+ newdevs = GENMASK(master->maxdevs - cmd->rx_len - 1, 0);
+
newdevs &= ~olddevs;
for (pos = 0; pos < master->maxdevs; pos++) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0789/1376] i3c: master: Fix device_register() error path
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (787 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0788/1376] i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0790/1376] md: merge mddev has_superblock into mddev_flags Greg Kroah-Hartman
` (209 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Adrian Hunter, Frank Li,
Alexandre Belloni, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <adrian.hunter@intel.com>
[ Upstream commit 74be657d98a8d684c0475f3cbd450ef2a30ffc73 ]
When device_register() fails in i3c_master_register_new_i3c_devs(),
put_device() is called to drop the reference taken by
device_register(). That drops the last reference, so the device's
release callback i3c_device_release() runs and frees the i3c_device.
Two problems follow from that:
i3c_device_release() does WARN_ON(i3cdev->desc), so it warns because
desc->dev->desc still points back at the descriptor. Clear it before
calling put_device().
After put_device() frees the i3c_device, desc->dev is left pointing at
freed memory, so clear desc->dev as well. That prevents, for example,
i3c_master_unregister_i3c_devs() seeing desc->dev as non-NULL and
dereferencing it.
Reported-by: sashiko-bot@kernel.org
Link: https://lore.kernel.org/linux-i3c/20260701203053.8F3971F000E9@smtp.kernel.org/
Fixes: cab63f6488761 ("i3c: Fix potential refcount leak in i3c_master_register_new_i3c_devs")
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260702183644.60827-1-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i3c/master.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
index 6eec1e6fb139f..48a91eac5ae51 100644
--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@@ -1689,7 +1689,9 @@ i3c_master_register_new_i3c_devs(struct i3c_master_controller *master)
if (ret) {
dev_err(&master->dev,
"Failed to add I3C device (err = %d)\n", ret);
+ desc->dev->desc = NULL;
put_device(&desc->dev->dev);
+ desc->dev = NULL;
}
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0790/1376] md: merge mddev has_superblock into mddev_flags
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (788 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0789/1376] i3c: master: Fix device_register() error path Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0791/1376] md: merge mddev faillast_dev " Greg Kroah-Hartman
` (208 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yu Kuai, Li Nan, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <yukuai@fnnas.com>
[ Upstream commit fba4a980403d2f489bc680dbff7d7d2514e669f9 ]
There is not need to use a separate field in struct mddev, there are no
functional changes.
Link: https://lore.kernel.org/linux-raid/20260114171241.3043364-3-yukuai@fnnas.com
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
Reviewed-by: Li Nan <linan122@huawei.com>
Stable-dep-of: 140234b2380f ("md/raid1: create serial pool adding rdev to array with serialize_policy=1")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/md.c | 6 +++---
drivers/md/md.h | 3 ++-
2 files changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 9ad6835a3c143..6d0ab9a471316 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -6063,7 +6063,7 @@ int md_run(struct mddev *mddev)
* the only valid external interface is through the md
* device.
*/
- mddev->has_superblocks = false;
+ clear_bit(MD_HAS_SUPERBLOCK, &mddev->flags);
rdev_for_each(rdev, mddev) {
if (test_bit(Faulty, &rdev->flags))
continue;
@@ -6076,7 +6076,7 @@ int md_run(struct mddev *mddev)
}
if (rdev->sb_page)
- mddev->has_superblocks = true;
+ set_bit(MD_HAS_SUPERBLOCK, &mddev->flags);
/* perform some consistency tests on the device.
* We don't want the data to overlap the metadata,
@@ -8722,7 +8722,7 @@ void md_write_start(struct mddev *mddev, struct bio *bi)
rcu_read_unlock();
if (did_change)
sysfs_notify_dirent_safe(mddev->sysfs_state);
- if (!mddev->has_superblocks)
+ if (!test_bit(MD_HAS_SUPERBLOCK, &mddev->flags))
return;
wait_event(mddev->sb_wait,
!test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags));
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 9a44676102f20..e5b37aafc0591 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -312,6 +312,7 @@ struct md_cluster_info;
* array is ready yet.
* @MD_BROKEN: This is used to stop writes and mark array as failed.
* @MD_DELETED: This device is being deleted
+ * @MD_HAS_SUPERBLOCK: There is persistence sb in member disks.
*
* change UNSUPPORTED_MDDEV_FLAGS for each array type if new flag is added
*/
@@ -327,6 +328,7 @@ enum mddev_flags {
MD_NOT_READY,
MD_BROKEN,
MD_DELETED,
+ MD_HAS_SUPERBLOCK,
};
enum mddev_sb_flags {
@@ -587,7 +589,6 @@ struct mddev {
/* The sequence number for sync thread */
atomic_t sync_seq;
- bool has_superblocks:1;
bool fail_last_dev:1;
bool serialize_policy:1;
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0791/1376] md: merge mddev faillast_dev into mddev_flags
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (789 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0790/1376] md: merge mddev has_superblock into mddev_flags Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0792/1376] md: merge mddev serialize_policy " Greg Kroah-Hartman
` (207 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yu Kuai, Li Nan, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <yukuai@fnnas.com>
[ Upstream commit 4f6d2e648cbe963b328cb8815290676da3866434 ]
There is not need to use a separate field in struct mddev, there are no
functional changes.
Link: https://lore.kernel.org/linux-raid/20260114171241.3043364-4-yukuai@fnnas.com
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
Reviewed-by: Li Nan <linan122@huawei.com>
Stable-dep-of: 140234b2380f ("md/raid1: create serial pool adding rdev to array with serialize_policy=1")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/md.c | 10 ++++++----
drivers/md/md.h | 3 ++-
drivers/md/raid0.c | 3 ++-
drivers/md/raid1.c | 4 ++--
drivers/md/raid10.c | 4 ++--
drivers/md/raid5.c | 5 ++++-
6 files changed, 18 insertions(+), 11 deletions(-)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 6d0ab9a471316..dc168f45cfb02 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -5582,11 +5582,11 @@ __ATTR(consistency_policy, S_IRUGO | S_IWUSR, consistency_policy_show,
static ssize_t fail_last_dev_show(struct mddev *mddev, char *page)
{
- return sprintf(page, "%d\n", mddev->fail_last_dev);
+ return sprintf(page, "%d\n", test_bit(MD_FAILLAST_DEV, &mddev->flags));
}
/*
- * Setting fail_last_dev to true to allow last device to be forcibly removed
+ * Setting MD_FAILLAST_DEV to allow last device to be forcibly removed
* from RAID1/RAID10.
*/
static ssize_t
@@ -5599,8 +5599,10 @@ fail_last_dev_store(struct mddev *mddev, const char *buf, size_t len)
if (ret)
return ret;
- if (value != mddev->fail_last_dev)
- mddev->fail_last_dev = value;
+ if (value)
+ set_bit(MD_FAILLAST_DEV, &mddev->flags);
+ else
+ clear_bit(MD_FAILLAST_DEV, &mddev->flags);
return len;
}
diff --git a/drivers/md/md.h b/drivers/md/md.h
index e5b37aafc0591..4a410683a788e 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -313,6 +313,7 @@ struct md_cluster_info;
* @MD_BROKEN: This is used to stop writes and mark array as failed.
* @MD_DELETED: This device is being deleted
* @MD_HAS_SUPERBLOCK: There is persistence sb in member disks.
+ * @MD_FAILLAST_DEV: Allow last rdev to be removed.
*
* change UNSUPPORTED_MDDEV_FLAGS for each array type if new flag is added
*/
@@ -329,6 +330,7 @@ enum mddev_flags {
MD_BROKEN,
MD_DELETED,
MD_HAS_SUPERBLOCK,
+ MD_FAILLAST_DEV,
};
enum mddev_sb_flags {
@@ -589,7 +591,6 @@ struct mddev {
/* The sequence number for sync thread */
atomic_t sync_seq;
- bool fail_last_dev:1;
bool serialize_policy:1;
};
diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index d02f5f0614663..b88ad9c2423c0 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c
@@ -27,7 +27,8 @@ module_param(default_layout, int, 0644);
(1L << MD_JOURNAL_CLEAN) | \
(1L << MD_FAILFAST_SUPPORTED) |\
(1L << MD_HAS_PPL) | \
- (1L << MD_HAS_MULTIPLE_PPLS))
+ (1L << MD_HAS_MULTIPLE_PPLS) | \
+ (1L << MD_FAILLAST_DEV))
/*
* inform the user of the raid configuration
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index a6ee8d3c01cec..7bb28732a2e8f 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1741,7 +1741,7 @@ static void raid1_status(struct seq_file *seq, struct mddev *mddev)
* - &mddev->degraded is bumped.
*
* @rdev is marked as &Faulty excluding case when array is failed and
- * &mddev->fail_last_dev is off.
+ * MD_FAILLAST_DEV is not set.
*/
static void raid1_error(struct mddev *mddev, struct md_rdev *rdev)
{
@@ -1754,7 +1754,7 @@ static void raid1_error(struct mddev *mddev, struct md_rdev *rdev)
(conf->raid_disks - mddev->degraded) == 1) {
set_bit(MD_BROKEN, &mddev->flags);
- if (!mddev->fail_last_dev) {
+ if (!test_bit(MD_FAILLAST_DEV, &mddev->flags)) {
conf->recovery_disabled = mddev->recovery_disabled;
spin_unlock_irqrestore(&conf->device_lock, flags);
return;
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index e45008b01c41e..06189fa95490b 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1994,7 +1994,7 @@ static int enough(struct r10conf *conf, int ignore)
* - &mddev->degraded is bumped.
*
* @rdev is marked as &Faulty excluding case when array is failed and
- * &mddev->fail_last_dev is off.
+ * MD_FAILLAST_DEV is not set.
*/
static void raid10_error(struct mddev *mddev, struct md_rdev *rdev)
{
@@ -2006,7 +2006,7 @@ static void raid10_error(struct mddev *mddev, struct md_rdev *rdev)
if (test_bit(In_sync, &rdev->flags) && !enough(conf, rdev->raid_disk)) {
set_bit(MD_BROKEN, &mddev->flags);
- if (!mddev->fail_last_dev) {
+ if (!test_bit(MD_FAILLAST_DEV, &mddev->flags)) {
spin_unlock_irqrestore(&conf->device_lock, flags);
return;
}
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 78f3f2d4d1dcb..d631ab8be69b4 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -56,7 +56,10 @@
#include "md-bitmap.h"
#include "raid5-log.h"
-#define UNSUPPORTED_MDDEV_FLAGS (1L << MD_FAILFAST_SUPPORTED)
+#define UNSUPPORTED_MDDEV_FLAGS \
+ ((1L << MD_FAILFAST_SUPPORTED) | \
+ (1L << MD_FAILLAST_DEV))
+
#define cpu_to_group(cpu) cpu_to_node(cpu)
#define ANY_GROUP NUMA_NO_NODE
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0792/1376] md: merge mddev serialize_policy into mddev_flags
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (790 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0791/1376] md: merge mddev faillast_dev " Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0793/1376] md/raid1: create serial pool adding rdev to array with serialize_policy=1 Greg Kroah-Hartman
` (206 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yu Kuai, Li Nan, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <yukuai@fnnas.com>
[ Upstream commit 10787568cc1f3f80afc510b2728751989dfa0ae6 ]
There is not need to use a separate field in struct mddev, there are no
functional changes.
Link: https://lore.kernel.org/linux-raid/20260114171241.3043364-5-yukuai@fnnas.com
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
Reviewed-by: Li Nan <linan122@huawei.com>
Stable-dep-of: 140234b2380f ("md/raid1: create serial pool adding rdev to array with serialize_policy=1")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/md-bitmap.c | 4 ++--
drivers/md/md.c | 20 ++++++++++++--------
drivers/md/md.h | 4 ++--
drivers/md/raid0.c | 3 ++-
drivers/md/raid1.c | 4 ++--
drivers/md/raid5.c | 3 ++-
6 files changed, 22 insertions(+), 16 deletions(-)
diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c
index b0bd83ba237d7..61271053e8ba0 100644
--- a/drivers/md/md-bitmap.c
+++ b/drivers/md/md-bitmap.c
@@ -2097,7 +2097,7 @@ static void bitmap_destroy(struct mddev *mddev)
return;
bitmap_wait_behind_writes(mddev);
- if (!mddev->serialize_policy)
+ if (!test_bit(MD_SERIALIZE_POLICY, &mddev->flags))
mddev_destroy_serial_pool(mddev, NULL);
mutex_lock(&mddev->bitmap_info.mutex);
@@ -2826,7 +2826,7 @@ backlog_store(struct mddev *mddev, const char *buf, size_t len)
mddev->bitmap_info.max_write_behind = backlog;
if (!backlog && mddev->serial_info_pool) {
/* serial_info_pool is not needed if backlog is zero */
- if (!mddev->serialize_policy)
+ if (!test_bit(MD_SERIALIZE_POLICY, &mddev->flags))
mddev_destroy_serial_pool(mddev, NULL);
} else if (backlog && !mddev->serial_info_pool) {
/* serial_info_pool is needed since backlog is not zero */
diff --git a/drivers/md/md.c b/drivers/md/md.c
index dc168f45cfb02..1f3322dfc1220 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -270,7 +270,8 @@ void mddev_destroy_serial_pool(struct mddev *mddev, struct md_rdev *rdev)
rdev_for_each(temp, mddev) {
if (!rdev) {
- if (!mddev->serialize_policy ||
+ if (!test_bit(MD_SERIALIZE_POLICY,
+ &mddev->flags) ||
!rdev_need_serial(temp))
rdev_uninit_serial(temp);
else
@@ -5615,11 +5616,12 @@ static ssize_t serialize_policy_show(struct mddev *mddev, char *page)
if (mddev->pers == NULL || (mddev->pers->level != 1))
return sprintf(page, "n/a\n");
else
- return sprintf(page, "%d\n", mddev->serialize_policy);
+ return sprintf(page, "%d\n",
+ test_bit(MD_SERIALIZE_POLICY, &mddev->flags));
}
/*
- * Setting serialize_policy to true to enforce write IO is not reordered
+ * Setting MD_SERIALIZE_POLICY enforce write IO is not reordered
* for raid1.
*/
static ssize_t
@@ -5632,7 +5634,7 @@ serialize_policy_store(struct mddev *mddev, const char *buf, size_t len)
if (err)
return err;
- if (value == mddev->serialize_policy)
+ if (value == test_bit(MD_SERIALIZE_POLICY, &mddev->flags))
return len;
err = mddev_suspend_and_lock(mddev);
@@ -5644,11 +5646,13 @@ serialize_policy_store(struct mddev *mddev, const char *buf, size_t len)
goto unlock;
}
- if (value)
+ if (value) {
mddev_create_serial_pool(mddev, NULL);
- else
+ set_bit(MD_SERIALIZE_POLICY, &mddev->flags);
+ } else {
mddev_destroy_serial_pool(mddev, NULL);
- mddev->serialize_policy = value;
+ clear_bit(MD_SERIALIZE_POLICY, &mddev->flags);
+ }
unlock:
mddev_unlock_and_resume(mddev);
return err ?: len;
@@ -6453,7 +6457,7 @@ static void __md_stop_writes(struct mddev *mddev)
md_update_sb(mddev, 1);
}
/* disable policy to guarantee rdevs free resources for serialization */
- mddev->serialize_policy = 0;
+ clear_bit(MD_SERIALIZE_POLICY, &mddev->flags);
mddev_destroy_serial_pool(mddev, NULL);
}
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 4a410683a788e..bd5d95b1bac74 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -314,6 +314,7 @@ struct md_cluster_info;
* @MD_DELETED: This device is being deleted
* @MD_HAS_SUPERBLOCK: There is persistence sb in member disks.
* @MD_FAILLAST_DEV: Allow last rdev to be removed.
+ * @MD_SERIALIZE_POLICY: Enforce write IO is not reordered, just used by raid1.
*
* change UNSUPPORTED_MDDEV_FLAGS for each array type if new flag is added
*/
@@ -331,6 +332,7 @@ enum mddev_flags {
MD_DELETED,
MD_HAS_SUPERBLOCK,
MD_FAILLAST_DEV,
+ MD_SERIALIZE_POLICY,
};
enum mddev_sb_flags {
@@ -590,8 +592,6 @@ struct mddev {
/* The sequence number for sync thread */
atomic_t sync_seq;
-
- bool serialize_policy:1;
};
enum recovery_flags {
diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index b88ad9c2423c0..efff5c4629c19 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c
@@ -28,7 +28,8 @@ module_param(default_layout, int, 0644);
(1L << MD_FAILFAST_SUPPORTED) |\
(1L << MD_HAS_PPL) | \
(1L << MD_HAS_MULTIPLE_PPLS) | \
- (1L << MD_FAILLAST_DEV))
+ (1L << MD_FAILLAST_DEV) | \
+ (1L << MD_SERIALIZE_POLICY))
/*
* inform the user of the raid configuration
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 7bb28732a2e8f..c6ad1f97cdace 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -542,7 +542,7 @@ static void raid1_end_write_request(struct bio *bio)
call_bio_endio(r1_bio);
}
}
- } else if (rdev->mddev->serialize_policy)
+ } else if (test_bit(MD_SERIALIZE_POLICY, &rdev->mddev->flags))
remove_serial(rdev, lo, hi);
if (r1_bio->bios[mirror] == NULL)
rdev_dec_pending(rdev, conf->mddev);
@@ -1637,7 +1637,7 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio,
mbio = bio_alloc_clone(rdev->bdev, bio, GFP_NOIO,
&mddev->bio_set);
- if (mddev->serialize_policy)
+ if (test_bit(MD_SERIALIZE_POLICY, &mddev->flags))
wait_for_serialization(rdev, r1_bio);
}
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index d631ab8be69b4..ef1a1a8507792 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -58,7 +58,8 @@
#define UNSUPPORTED_MDDEV_FLAGS \
((1L << MD_FAILFAST_SUPPORTED) | \
- (1L << MD_FAILLAST_DEV))
+ (1L << MD_FAILLAST_DEV) | \
+ (1L << MD_SERIALIZE_POLICY))
#define cpu_to_group(cpu) cpu_to_node(cpu)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0793/1376] md/raid1: create serial pool adding rdev to array with serialize_policy=1
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (791 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0792/1376] md: merge mddev serialize_policy " Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0794/1376] locking/lockdep: Fix NULL pointer dereference in __lock_set_class() Greg Kroah-Hartman
` (205 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Martin Wilck, Mykola Marzhan,
Yu Kuai, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Wilck <mwilck@suse.com>
[ Upstream commit 140234b2380ffb8ffb0cfc46fee0e822f43adef7 ]
The following bug has been observed with kernel 7.1.3 after adding a new
rdev to an existing RAID1 array with serialize_policy enabled:
Oops: 0002 [#1]
CPU: 0 UID: 0 PID: 19639 Comm: ext4lazyinit Not tainted 7.1.3-1-default
RIP: _raw_spin_lock_irqsave+0x27/0x50
CR2: 0000000000004960
Call Trace:
wait_for_serialization+0xb9/0x260 [raid1]
raid1_make_request+0x762/0xaff [raid1]
md_handle_request+0x1c9/0x2e0 [md_mod]
The raid1.c code calls wait_for_serialization() if the MD_SERIALIZE_POLICY
is set, and wait_for_serialization assumes that rdev->serial is
initialized. Normally this will be the case for arrays that have
the serialize_policy sysfs attribute set to 1.
But when a new rdev is added to an existing array in bind_rdev_to_array(),
the condition at mddev_create_serial_pool() causes creation of rdev->serial
to be skipped. Fix it.
Fixes: 69b00b5bb235 ("md: introduce a new struct for IO serialization")
Signed-off-by: Martin Wilck <mwilck@suse.com>
Reviewed-by: Mykola Marzhan <mykola@meshstor.io>
Link: https://patch.msgid.link/20260723112741.1206836-1-mwilck@suse.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/md.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 1f3322dfc1220..dedd8a583f7e6 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -228,7 +228,8 @@ void mddev_create_serial_pool(struct mddev *mddev, struct md_rdev *rdev)
int ret = 0;
unsigned int noio_flags;
- if (rdev && !rdev_need_serial(rdev) &&
+ if (!test_bit(MD_SERIALIZE_POLICY, &mddev->flags) &&
+ rdev && !rdev_need_serial(rdev) &&
!test_bit(CollisionCheck, &rdev->flags))
return;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0794/1376] locking/lockdep: Fix NULL pointer dereference in __lock_set_class()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (792 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0793/1376] md/raid1: create serial pool adding rdev to array with serialize_policy=1 Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0795/1376] powerpc/crash: Fix possible memory leak in update_crash_elfcorehdr() Greg Kroah-Hartman
` (204 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Naveen Kumar Chaudhary,
Peter Zijlstra (Intel), Waiman Long, Dmitry Ilvokhin, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naveen Kumar Chaudhary <naveen.osdev@gmail.com>
[ Upstream commit 7577e00b9ab506202b9f1a33de3cc8cc6413a4db ]
register_lock_class() can return NULL when the lock class pool is
exhausted, graph_lock() fails, or key validation fails. However,
__lock_set_class() uses the return value directly in pointer arithmetic
without a NULL check:
class = register_lock_class(lock, subclass, 0);
hlock->class_idx = class - lock_classes;
If class is NULL, this computes a wild offset that corrupts
hlock->class_idx. The subsequent reacquire_held_locks() call will
invoke hlock_class() with this corrupted index, leading to a NULL or
out-of-bounds pointer dereference.
Add the missing NULL check, consistent with how __lock_acquire() already
handles this case at the same call site.
Fixes: 64aa348edc61 ("lockdep: lock_set_subclass - reset a held lock's subclass")
Signed-off-by: Naveen Kumar Chaudhary <naveen.osdev@gmail.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Waiman Long <longman@redhat.com>
Reviewed-by: Dmitry Ilvokhin <d@ilvokhin.com>
Link: https://patch.msgid.link/h2kfw43n4527x6mgi2lwpz2rieqnfzgictpv4wr5nyfjkc47co@2r5vz4uz44db
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/locking/lockdep.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
index 53c76dc71f3f5..1422a04f950d0 100644
--- a/kernel/locking/lockdep.c
+++ b/kernel/locking/lockdep.c
@@ -5402,6 +5402,8 @@ __lock_set_class(struct lockdep_map *lock, const char *name,
lock->wait_type_outer,
lock->lock_type);
class = register_lock_class(lock, subclass, 0);
+ if (!class)
+ return 0;
hlock->class_idx = class - lock_classes;
curr->lockdep_depth = i;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0795/1376] powerpc/crash: Fix possible memory leak in update_crash_elfcorehdr()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (793 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0794/1376] locking/lockdep: Fix NULL pointer dereference in __lock_set_class() Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0796/1376] misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() Greg Kroah-Hartman
` (203 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sourabh Jain, Jinjie Ruan,
Madhavan Srinivasan, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <ruanjinjie@huawei.com>
[ Upstream commit 4cc4b586007fbbf8edba4f1d0849e9a06b0cf6c3 ]
In get_crash_memory_ranges(), if crash_exclude_mem_range() failed
after realloc_mem_ranges() has successfully allocated the cmem
memory, it just returns an error but leaves cmem pointing to
the allocated memory, nor is it freed in the caller
update_crash_elfcorehdr(), which cause a memory leak, goto out
to free the cmem.
Fixes: 849599b702ef ("powerpc/crash: add crash memory hotplug support")
Reviewed-by: Sourabh Jain <sourabhjain@linux.ibm.com>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260729012948.2797865-2-ruanjinjie@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/kexec/crash.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/kexec/crash.c b/arch/powerpc/kexec/crash.c
index e6539f213b3d1..a520f851c3a6b 100644
--- a/arch/powerpc/kexec/crash.c
+++ b/arch/powerpc/kexec/crash.c
@@ -502,7 +502,7 @@ static void update_crash_elfcorehdr(struct kimage *image, struct memory_notify *
ret = get_crash_memory_ranges(&cmem);
if (ret) {
pr_err("Failed to get crash mem range\n");
- return;
+ goto out;
}
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0796/1376] misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (794 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0795/1376] powerpc/crash: Fix possible memory leak in update_crash_elfcorehdr() Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0797/1376] misc: sgi-gru: remove interrupt-context page-table walks Greg Kroah-Hartman
` (202 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Vishnu Dasa,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
[ Upstream commit 210854a96ef18b09b45a2a59ff14ca06dfe5ad4d ]
The memory allocated for struct vmci_subscription (sub) is not freed
in the error path when have_new_id is false. Fix that by adding a
kfree() call, and moving the read of sub->id to a point before freeing.
Fixes: 1d990201f9bb ("VMCI: event handling implementation.")
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Acked-by: Vishnu Dasa <vishnu.dasa@broadcom.com>
Link: https://patch.msgid.link/20260722101215.76680-1-nihaal@cse.iitm.ac.in
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/misc/vmw_vmci/vmci_event.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/misc/vmw_vmci/vmci_event.c b/drivers/misc/vmw_vmci/vmci_event.c
index 9a41ab65378de..89ab9f05b88c5 100644
--- a/drivers/misc/vmw_vmci/vmci_event.c
+++ b/drivers/misc/vmw_vmci/vmci_event.c
@@ -179,16 +179,16 @@ int vmci_event_subscribe(u32 event,
}
}
+ *new_subscription_id = sub->id;
if (have_new_id) {
list_add_rcu(&sub->node, &subscriber_array[event]);
retval = VMCI_SUCCESS;
} else {
+ kfree(sub);
retval = VMCI_ERROR_NO_RESOURCES;
}
mutex_unlock(&subscriber_mutex);
-
- *new_subscription_id = sub->id;
return retval;
}
EXPORT_SYMBOL_GPL(vmci_event_subscribe);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0797/1376] misc: sgi-gru: remove interrupt-context page-table walks
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (795 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0796/1376] misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0798/1376] fanotify: report full event length for FIONREAD Greg Kroah-Hartman
` (201 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Muhammad Usama Anjum, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Usama Anjum <usama.anjum@arm.com>
[ Upstream commit 928a8e9f523df845fc496bcb9811013b67aabec5 ]
The GRU TLB miss handler walks a process's page tables without holding
page-table locks or a reference to the mapped page. It also uses a kernel
page-table accessor on user page tables and supports only PMD-level large
mappings on x86-64.
Remove the direct walker. Send interrupt faults directly to user polling
mode so the existing call-OS fallback retries them in process context.
Remove the mmap-lock failure statistic that can no longer be incremented.
Fixes: 142586409c8b ("GRU Driver: page faults & exceptions")
Signed-off-by: Muhammad Usama Anjum <usama.anjum@arm.com>
Link: https://patch.msgid.link/20260730111316.3672672-2-usama.anjum@arm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/misc/sgi-gru/grufault.c | 101 ++++---------------------------
drivers/misc/sgi-gru/gruprocfs.c | 1 -
drivers/misc/sgi-gru/grutables.h | 1 -
3 files changed, 12 insertions(+), 91 deletions(-)
diff --git a/drivers/misc/sgi-gru/grufault.c b/drivers/misc/sgi-gru/grufault.c
index 3557d78ee47a2..5a87c12f444a3 100644
--- a/drivers/misc/sgi-gru/grufault.c
+++ b/drivers/misc/sgi-gru/grufault.c
@@ -166,13 +166,8 @@ static void get_clear_fault_map(struct gru_state *gru,
}
/*
- * Atomic (interrupt context) & non-atomic (user context) functions to
- * convert a vaddr into a physical address. The size of the page
- * is returned in pageshift.
- * returns:
- * 0 - successful
- * < 0 - error code
- * 1 - (atomic only) try again in non-atomic context
+ * Convert a user virtual address to a physical address in process context.
+ * The size of the page is returned in pageshift.
*/
static int non_atomic_pte_lookup(struct vm_area_struct *vma,
unsigned long vaddr, int write,
@@ -192,87 +187,25 @@ static int non_atomic_pte_lookup(struct vm_area_struct *vma,
return 0;
}
-/*
- * atomic_pte_lookup
- *
- * Convert a user virtual address to a physical address
- * Only supports Intel large pages (2MB only) on x86_64.
- * ZZZ - hugepage support is incomplete
- *
- * NOTE: mmap_lock is already held on entry to this function. This
- * guarantees existence of the page tables.
- */
-static int atomic_pte_lookup(struct vm_area_struct *vma, unsigned long vaddr,
- int write, unsigned long *paddr, int *pageshift)
-{
- pgd_t *pgdp;
- p4d_t *p4dp;
- pud_t *pudp;
- pmd_t *pmdp;
- pte_t pte;
-
- pgdp = pgd_offset(vma->vm_mm, vaddr);
- if (unlikely(pgd_none(*pgdp)))
- goto err;
-
- p4dp = p4d_offset(pgdp, vaddr);
- if (unlikely(p4d_none(*p4dp)))
- goto err;
-
- pudp = pud_offset(p4dp, vaddr);
- if (unlikely(pud_none(*pudp)))
- goto err;
-
- pmdp = pmd_offset(pudp, vaddr);
- if (unlikely(pmd_none(*pmdp)))
- goto err;
-#ifdef CONFIG_X86_64
- if (unlikely(pmd_leaf(*pmdp)))
- pte = ptep_get((pte_t *)pmdp);
- else
-#endif
- pte = *pte_offset_kernel(pmdp, vaddr);
-
- if (unlikely(!pte_present(pte) ||
- (write && (!pte_write(pte) || !pte_dirty(pte)))))
- return 1;
-
- *paddr = pte_pfn(pte) << PAGE_SHIFT;
-#ifdef CONFIG_HUGETLB_PAGE
- *pageshift = is_vm_hugetlb_page(vma) ? HPAGE_SHIFT : PAGE_SHIFT;
-#else
- *pageshift = PAGE_SHIFT;
-#endif
- return 0;
-
-err:
- return 1;
-}
-
static int gru_vtop(struct gru_thread_state *gts, unsigned long vaddr,
int write, int atomic, unsigned long *gpa, int *pageshift)
{
struct mm_struct *mm = gts->ts_mm;
struct vm_area_struct *vma;
unsigned long paddr;
- int ret, ps;
+ int ps;
vma = find_vma(mm, vaddr);
if (!vma)
goto inval;
- /*
- * Atomic lookup is faster & usually works even if called in non-atomic
- * context.
- */
- rmb(); /* Must/check ms_range_active before loading PTEs */
- ret = atomic_pte_lookup(vma, vaddr, write, &paddr, &ps);
- if (ret) {
- if (atomic)
- goto upm;
- if (non_atomic_pte_lookup(vma, vaddr, write, &paddr, &ps))
- goto inval;
- }
+ if (atomic)
+ goto upm;
+
+ /* Order the caller's ms_range_active check before loading PTEs. */
+ rmb();
+ if (non_atomic_pte_lookup(vma, vaddr, write, &paddr, &ps))
+ goto inval;
if (is_gru_paddr(paddr))
goto inval;
paddr = paddr & ~((1UL << ps) - 1);
@@ -569,19 +502,9 @@ static irqreturn_t gru_intr(int chiplet, int blade)
continue;
}
- /*
- * This is running in interrupt context. Trylock the mmap_lock.
- * If it fails, retry the fault in user context.
- */
+ /* Address translation may sleep, so retry the fault in user context. */
gts->ustats.fmm_tlbmiss++;
- if (!gts->ts_force_cch_reload &&
- mmap_read_trylock(gts->ts_mm)) {
- gru_try_dropin(gru, gts, tfh, NULL);
- mmap_read_unlock(gts->ts_mm);
- } else {
- tfh_user_polling_mode(tfh);
- STAT(intr_mm_lock_failed);
- }
+ tfh_user_polling_mode(tfh);
}
return IRQ_HANDLED;
}
diff --git a/drivers/misc/sgi-gru/gruprocfs.c b/drivers/misc/sgi-gru/gruprocfs.c
index 97b8b38ab47df..b8139c27bc7f8 100644
--- a/drivers/misc/sgi-gru/gruprocfs.c
+++ b/drivers/misc/sgi-gru/gruprocfs.c
@@ -54,7 +54,6 @@ static int statistics_show(struct seq_file *s, void *p)
printstat(s, intr_cbr);
printstat(s, intr_tfh);
printstat(s, intr_spurious);
- printstat(s, intr_mm_lock_failed);
printstat(s, call_os);
printstat(s, call_os_wait_queue);
printstat(s, user_flush_tlb);
diff --git a/drivers/misc/sgi-gru/grutables.h b/drivers/misc/sgi-gru/grutables.h
index 640daf1994df7..3348552925c61 100644
--- a/drivers/misc/sgi-gru/grutables.h
+++ b/drivers/misc/sgi-gru/grutables.h
@@ -182,7 +182,6 @@ struct gru_stats_s {
atomic_long_t intr_cbr;
atomic_long_t intr_tfh;
atomic_long_t intr_spurious;
- atomic_long_t intr_mm_lock_failed;
atomic_long_t call_os;
atomic_long_t call_os_wait_queue;
atomic_long_t user_flush_tlb;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0798/1376] fanotify: report full event length for FIONREAD
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (796 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0797/1376] misc: sgi-gru: remove interrupt-context page-table walks Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0799/1376] wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length Greg Kroah-Hartman
` (200 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yichong Chen, Jan Kara, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yichong Chen <chenyichong@uniontech.com>
[ Upstream commit 68615158c12de36220446dfea5cfdf9ba6c19690 ]
fanotify_ioctl(FIONREAD) reports the number of bytes available to read
from the event queue. It currently accounts only FAN_EVENT_METADATA_LEN
for each queued event.
That underestimates events that carry additional information records, such
as FAN_REPORT_DFID_NAME events. A userspace program that uses FIONREAD to
size its read buffer can receive a length that is smaller than the next
event. Reading with that buffer then fails with -EINVAL, while a larger
buffer succeeds and reports a larger metadata.event_len.
Use fanotify_event_len() when summing queued events so FIONREAD includes
all info records.
Fixes: 5e469c830fdb ("fanotify: copy event fid info to user")
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Link: https://patch.msgid.link/20260731021827.602479-1-chenyichong@uniontech.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/notify/fanotify/fanotify_user.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index 93472a48ceb3c..c62eb37cfb24d 100644
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -970,11 +970,13 @@ static long fanotify_ioctl(struct file *file, unsigned int cmd, unsigned long ar
{
struct fsnotify_group *group;
struct fsnotify_event *fsn_event;
+ unsigned int info_mode;
void __user *p;
int ret = -ENOTTY;
size_t send_len = 0;
group = file->private_data;
+ info_mode = FAN_GROUP_FLAG(group, FANOTIFY_INFO_MODES);
p = (void __user *) arg;
@@ -982,7 +984,8 @@ static long fanotify_ioctl(struct file *file, unsigned int cmd, unsigned long ar
case FIONREAD:
spin_lock(&group->notification_lock);
list_for_each_entry(fsn_event, &group->notification_list, list)
- send_len += FAN_EVENT_METADATA_LEN;
+ send_len += fanotify_event_len(info_mode,
+ FANOTIFY_E(fsn_event));
spin_unlock(&group->notification_lock);
ret = put_user(send_len, (int __user *) p);
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0799/1376] wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (797 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0798/1376] fanotify: report full event length for FIONREAD Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0800/1376] wifi: mt76: mt7921: validate CLC firmware records Greg Kroah-Hartman
` (199 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Devin Wittmayer, Felix Fietkau,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Devin Wittmayer <lucid_duck@justthetip.ca>
[ Upstream commit 81497634d9f872fd3e8b03aada55574afff6f174 ]
The MPDU length in the rx descriptor comes from the hardware. In
monitor mode with the fcsfail filter enabled, the hardware passes up
corrupted frames, and a corrupted frame can report a length larger
than the received buffer. The bounds check correctly discards such
frames, but its WARN_ON_ONCE wrapper means any over-the-air garbage
frame taints the kernel, and panics it on the first such frame when
panic_on_warn is set.
Drop the WARN and discard the frame silently, matching what
commit c2d4c8723dbf ("mt76x2: remove some harmless WARN_ONs in tx
status and rx path") did for the neighboring rx and tx status paths.
Observed immediately on rx with an MT7612U in fcsfail monitor mode
on a busy channel.
Fixes: 7bc04215a66b ("mt76: add driver code for MT76x2e")
Signed-off-by: Devin Wittmayer <lucid_duck@justthetip.ca>
Link: https://patch.msgid.link/20260613002544.27750-2-lucid_duck@justthetip.ca
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt76x02_mac.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c b/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
index d5db6ffd6d365..338f5b46c6511 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
@@ -850,7 +850,7 @@ int mt76x02_mac_process_rx(struct mt76x02_dev *dev, struct sk_buff *skb,
}
}
- if (WARN_ON_ONCE(len > skb->len))
+ if (len > skb->len)
return -EINVAL;
if (pskb_trim(skb, len))
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0800/1376] wifi: mt76: mt7921: validate CLC firmware records
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (798 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0799/1376] wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0801/1376] wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 Greg Kroah-Hartman
` (198 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Laxman Acharya Padhya, Felix Fietkau,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
[ Upstream commit 9417c5818a0146980c2608fda94c908e604eb033 ]
The CLC region is supplied by firmware, but the loader trusts the
region count and each record length. A malformed image can make the
region table pointer precede the firmware buffer, make the record loop
fail to advance, or index phy->clc past its end. Validate the table and
record bounds before dereferencing or copying.
Fixes: 23bdc5d8cadf ("wifi: mt76: mt7921: introduce Country Location Control support")
Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
Link: https://patch.msgid.link/CAMyXUJmh=WfwC4_KHupNxYR5e2Gy5QhBDL5TSG6XEW-XLa+X4Q@mail.gmail.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/wireless/mediatek/mt76/mt7921/mcu.c | 28 ++++++++++++++++---
1 file changed, 24 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
index 46b3b8d91cd84..141167cf79b5d 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
@@ -412,7 +412,8 @@ static int mt7921_load_clc(struct mt792x_dev *dev, const char *fw_name)
struct mt76_dev *mdev = &dev->mt76;
struct mt792x_phy *phy = &dev->phy;
const struct firmware *fw;
- int ret, i, len, offset = 0;
+ size_t clc_len, fw_data_len, len, offset = 0;
+ int ret, i;
u8 *clc_base = NULL, hw_encap = 0;
dev->phy.clc_chan_conf = 0xff;
@@ -438,13 +439,21 @@ static int mt7921_load_clc(struct mt792x_dev *dev, const char *fw_name)
}
hdr = (const void *)(fw->data + fw->size - sizeof(*hdr));
+ if (hdr->n_region > (fw->size - sizeof(*hdr)) / sizeof(*region)) {
+ dev_err(mdev->dev, "Invalid firmware region table\n");
+ ret = -EINVAL;
+ goto out;
+ }
+ fw_data_len = fw->size - sizeof(*hdr) -
+ hdr->n_region * sizeof(*region);
+
for (i = 0; i < hdr->n_region; i++) {
region = (const void *)((const u8 *)hdr -
(hdr->n_region - i) * sizeof(*region));
len = le32_to_cpu(region->len);
/* check if we have valid buffer size */
- if (offset + len > fw->size) {
+ if (len > fw_data_len - offset) {
dev_err(mdev->dev, "Invalid firmware region\n");
ret = -EINVAL;
goto out;
@@ -461,8 +470,19 @@ static int mt7921_load_clc(struct mt792x_dev *dev, const char *fw_name)
if (!clc_base)
goto out;
- for (offset = 0; offset < len; offset += le32_to_cpu(clc->len)) {
+ for (offset = 0; offset < len; offset += clc_len) {
+ if (len - offset < sizeof(*clc)) {
+ ret = -EINVAL;
+ goto out;
+ }
+
clc = (const struct mt7921_clc *)(clc_base + offset);
+ clc_len = le32_to_cpu(clc->len);
+ if (clc_len < sizeof(*clc) || clc_len > len - offset ||
+ clc->idx >= ARRAY_SIZE(phy->clc)) {
+ ret = -EINVAL;
+ goto out;
+ }
/* do not init buf again if chip reset triggered */
if (phy->clc[clc->idx])
@@ -474,7 +494,7 @@ static int mt7921_load_clc(struct mt792x_dev *dev, const char *fw_name)
continue;
phy->clc[clc->idx] = devm_kmemdup(mdev->dev, clc,
- le32_to_cpu(clc->len),
+ clc_len,
GFP_KERNEL);
if (!phy->clc[clc->idx]) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0801/1376] wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (799 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0800/1376] wifi: mt76: mt7921: validate CLC firmware records Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0802/1376] wifi: mt76: add init_wiphy callback Greg Kroah-Hartman
` (197 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benjamin Larsson, Zhi-Jun You,
Felix Fietkau, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhi-Jun You <hujy652@gmail.com>
[ Upstream commit bade0d238b60c29dafcc7da17501fa489495d6ae ]
Current implementation assumes that the hardware supports DBDC or single
band and binds to band0.
This causes net_fill_forward_path to select the wrong queue for non-DBDC
mt7986 because it binds to band1 and getting the following in dmesg:
ieee80211 phy2: WA: --> drop by reaseon:1, msdu id = 0xc002 but failed!
mtk_wed1: error status=00000002
ieee80211 phy2: WA: txblk
10324e00
len = 128
DW0 : 10 00 00 00
DW1 : 00 00 00 00
DW2 : 00 00 00 00
DW3 : 72 0f 94 68
DW4 : 00 00 00 00
DW5 : ff 03 00 00
DW6 : 00 00 3c 40
DW7 : 00 17 dd 14
DW8 : 79 6f 00 00
DW9 : 02 c0 00 00
DW10 : 58 c5 34 10
DW11 : 00 00 00 00
DW12 : 00 06 3e 00
DW13 : 00 00 00 80
DW14 : 10 8c 00 00
DW15 : 00 00 00 00
DW16 : 00 00 00 00
DW17 : 00 00 00 00
DW18 : 00 00 00 00
DW19 : 00 00 00 00
DW20 : 00 00 00 00
DW21 : 00 00 00 00
DW22 : 00 00 00 00
DW23 : 00 00 00 00
DW24 : 00 00 00 00
DW25 : 00 00 00 00
DW26 : 00 00 00 00
DW27 : 00 00 00 00
DW28 : 00 00 00 00
DW29 : 00 00 00 00
DW30 : 00 00 00 00
DW31 : 00 00 00 00
Fix it by using phy->mt76->band_idx for queue which works for both
non-DBDC and DBDC devices.
Fixes: f68d67623dec ("mt76: mt7915: add Wireless Ethernet Dispatch support")
Suggested-by: Benjamin Larsson <benjamin.larsson@genexis.eu>
Signed-off-by: Zhi-Jun You <hujy652@gmail.com>
Link: https://patch.msgid.link/20260715152113.553-2-hujy652@gmail.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7915/main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/main.c b/drivers/net/wireless/mediatek/mt76/mt7915/main.c
index f49dcdde3f2c6..9b0fde73b8945 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/main.c
@@ -1676,7 +1676,7 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
path->mtk_wdma.wdma_idx = wed->wdma_idx;
path->mtk_wdma.bss = mvif->mt76.idx;
path->mtk_wdma.wcid = is_mt7915(&dev->mt76) ? msta->wcid.idx : 0x3ff;
- path->mtk_wdma.queue = phy != &dev->phy;
+ path->mtk_wdma.queue = phy->mt76->band_idx;
ctx->dev = NULL;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0802/1376] wifi: mt76: add init_wiphy callback
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (800 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0801/1376] wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0803/1376] wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete Greg Kroah-Hartman
` (196 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stella Liu, Jeremy Yu, Sean Wang,
Felix Fietkau, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Wang <sean.wang@mediatek.com>
[ Upstream commit 4ee3d2a5f2cd5b6d0ba0d997913c1b763ef4d5c5 ]
Add an optional callback for drivers to finalize wiphy state after mt76
has initialized the supported bands and before registration.
Co-developed-by: Stella Liu <yu-ching.liu@mediatek.com>
Signed-off-by: Stella Liu <yu-ching.liu@mediatek.com>
Co-developed-by: Jeremy Yu <chengwei.yu@mediatek.com>
Signed-off-by: Jeremy Yu <chengwei.yu@mediatek.com>
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
Link: https://patch.msgid.link/20260625001834.475094-7-sean.wang@kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Stable-dep-of: 217f9e7bb025 ("wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mac80211.c | 7 +++++++
drivers/net/wireless/mediatek/mt76/mt76.h | 3 +++
2 files changed, 10 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
index e538bb36a7309..e1856664ca5d1 100644
--- a/drivers/net/wireless/mediatek/mt76/mac80211.c
+++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
@@ -644,6 +644,7 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
dev = hw->priv;
dev->hw = hw;
dev->dev = pdev;
+ dev->init_wiphy = NULL;
dev->drv = drv_ops;
dev->dma_dev = pdev;
@@ -740,6 +741,12 @@ int mt76_register_device(struct mt76_dev *dev, bool vht,
mt76_check_sband(&dev->phy, &phy->sband_5g, NL80211_BAND_5GHZ);
mt76_check_sband(&dev->phy, &phy->sband_6g, NL80211_BAND_6GHZ);
+ if (dev->init_wiphy) {
+ ret = dev->init_wiphy(dev);
+ if (ret)
+ return ret;
+ }
+
if (IS_ENABLED(CONFIG_MT76_LEDS)) {
ret = mt76_led_init(phy);
if (ret)
diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h
index e7ebae0584f55..daa78f52c15ea 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76.h
@@ -845,6 +845,9 @@ struct mt76_dev {
const struct mt76_bus_ops *bus;
const struct mt76_driver_ops *drv;
const struct mt76_mcu_ops *mcu_ops;
+
+ /* Optional callback to finalize wiphy state before registration. */
+ int (*init_wiphy)(struct mt76_dev *dev);
struct device *dev;
struct device *dma_dev;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0803/1376] wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (801 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0802/1376] wifi: mt76: add init_wiphy callback Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0804/1376] wifi: mt76: mt7925: fix msg len mismatch between driver and firmware Greg Kroah-Hartman
` (195 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Eason Lai, Felix Fietkau,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eason Lai <Eason.Lai@mediatek.com>
[ Upstream commit 217f9e7bb02558759be9d9ecfe532e9708741c50 ]
A use-after-free issue occurs in mt76_rx_poll_complete due to a race
condition. The STA has already been removed, but the rx_status still
had a pointer to the wcid in the STA.
Set the links' wcid pointers to be NULL for a MLD in
mt7925_sta_pre_rcu_remove()
BUG: KASAN: invalid-access in mt76_rx_poll_complete+0x280/0x470
Call trace:
dump_backtrace+0xec/0x128
show_stack+0x18/0x28
dump_stack_lvl+0x40/0xc8
print_report+0x1b8/0x710
kasan_report+0xe0/0x144
do_bad_area+0x120/0x260
do_tag_check_fault+0x20/0x34
do_mem_abort+0x54/0xa8
el1_abort+0x3c/0x5c
el1h_64_sync_handler+0x40/0xcc
el1h_64_sync+0x7c/0x80
mt76_rx_poll_complete+0x280/0x470
mt76_dma_rx_poll+0x114/0x51c
mt792x_poll_rx+0x60/0xf8
napi_threaded_poll_loop+0xe0/0x450
napi_threaded_poll+0x80/0x9c
kthread+0x11c/0x158
ret_from_fork+0x10/0x20
Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
Signed-off-by: Eason Lai <Eason.Lai@mediatek.com>
Link: https://patch.msgid.link/20260701010654.956863-1-eason.lai@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/wireless/mediatek/mt76/mt7925/main.c | 36 ++++++++++++++++++-
1 file changed, 35 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/main.c b/drivers/net/wireless/mediatek/mt76/mt7925/main.c
index 1dbc6d22b0666..626e68905ffa0 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/main.c
@@ -2165,6 +2165,40 @@ static void mt7925_unassign_vif_chanctx(struct ieee80211_hw *hw,
mutex_unlock(&dev->mt76.mutex);
}
+static void mt7925_sta_pre_rcu_remove(struct ieee80211_hw *hw,
+ struct ieee80211_vif *vif,
+ struct ieee80211_sta *sta)
+{
+ struct mt76_phy *phy = hw->priv;
+ struct mt76_dev *dev = phy->dev;
+ struct mt76_wcid *wcid = (struct mt76_wcid *)sta->drv_priv;
+
+ mutex_lock(&dev->mutex);
+ spin_lock_bh(&dev->status_lock);
+
+ if (ieee80211_vif_is_mld(vif)) {
+ struct mt792x_sta *msta = (struct mt792x_sta *)sta->drv_priv;
+ struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
+ unsigned long valid = mvif->valid_links;
+ struct mt792x_link_sta *mlink;
+ unsigned int link_id;
+
+ for_each_set_bit(link_id, &valid, IEEE80211_MLD_MAX_NUM_LINKS) {
+ mlink = mt792x_sta_to_link(msta, link_id);
+ if (!mlink || !mlink->wcid.sta)
+ continue;
+ if (mlink->wcid.idx < ARRAY_SIZE(dev->wcid))
+ rcu_assign_pointer(dev->wcid[mlink->wcid.idx],
+ NULL);
+ }
+ } else {
+ rcu_assign_pointer(dev->wcid[wcid->idx], NULL);
+ }
+
+ spin_unlock_bh(&dev->status_lock);
+ mutex_unlock(&dev->mutex);
+}
+
const struct ieee80211_ops mt7925_ops = {
.tx = mt792x_tx,
.start = mt7925_start,
@@ -2177,7 +2211,7 @@ const struct ieee80211_ops mt7925_ops = {
.start_ap = mt7925_start_ap,
.stop_ap = mt7925_stop_ap,
.sta_state = mt76_sta_state,
- .sta_pre_rcu_remove = mt76_sta_pre_rcu_remove,
+ .sta_pre_rcu_remove = mt7925_sta_pre_rcu_remove,
.set_key = mt7925_set_key,
.sta_set_decap_offload = mt7925_sta_set_decap_offload,
#if IS_ENABLED(CONFIG_IPV6)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0804/1376] wifi: mt76: mt7925: fix msg len mismatch between driver and firmware
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (802 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0803/1376] wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0805/1376] wifi: mt76: mt792x: Fix memory leak in SDIO TX path Greg Kroah-Hartman
` (194 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jared.Huang, Felix Fietkau,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jared.Huang <jared.huang@mediatek.com>
[ Upstream commit 9ddb7487aa7cccb6e1880b4151ab5895109eb8d6 ]
The mt7925_tx_power_limit_tlv struct begins with a 4-byte rsv[] field
that acts as a UNI command header prefix. The firmware dispatcher did
not use the 4-byte rsv[] and will only check the payloads after the
4-byte rsv[] As a result, the total message length minus the 4-byte
prefix. Fix this by setting len to msg_len - 4.
Fixes: ccb186326bb6 ("wifi: mt76: mt7925: fix incorrect length field in txpower command")
Signed-off-by: Jared.Huang <jared.huang@mediatek.com>
Link: https://patch.msgid.link/20260617071320.1808499-1-jb.tsai@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
index 910775a2c39fe..ac241c2dfb980 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
@@ -3602,7 +3602,7 @@ mt7925_mcu_rate_txpower_band(struct mt76_phy *phy,
memcpy(tx_power_tlv->alpha2, dev->alpha2, sizeof(dev->alpha2));
tx_power_tlv->n_chan = num_ch;
tx_power_tlv->tag = cpu_to_le16(0x1);
- tx_power_tlv->len = cpu_to_le16(msg_len);
+ tx_power_tlv->len = cpu_to_le16(msg_len - 4);
switch (band) {
case NL80211_BAND_2GHZ:
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0805/1376] wifi: mt76: mt792x: Fix memory leak in SDIO TX path
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (803 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0804/1376] wifi: mt76: mt7925: fix msg len mismatch between driver and firmware Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0806/1376] wifi: mt76: mt7996: fix capability of EHT-MCS 15 in MRU Greg Kroah-Hartman
` (193 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Eason Lai, Felix Fietkau,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eason Lai <Eason.Lai@mediatek.com>
[ Upstream commit 808f2767d4217a5b96f674288573b9b89d432eed ]
When tx_prepare_skb() returns an error in the SDIO TX path, the
skb is not freed, leading to a memory leak. This can occur when
zero-length frames (such as WNM NULL frames) are dropped to prevent
potential hardware TX hangs.
Fix this by properly releasing the skb with ieee80211_tx_status_ext()
when tx_prepare_skb() fails.
Fixes: b747fa343817 ("mt76: mt7915: drop zero-length packet to avoid Tx hang")
Signed-off-by: Eason Lai <Eason.Lai@mediatek.com>
Link: https://patch.msgid.link/20260703005945.2244533-1-eason.lai@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/sdio.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/sdio.c b/drivers/net/wireless/mediatek/mt76/sdio.c
index 8e9576747052d..e4c3dcc34f68a 100644
--- a/drivers/net/wireless/mediatek/mt76/sdio.c
+++ b/drivers/net/wireless/mediatek/mt76/sdio.c
@@ -519,6 +519,10 @@ mt76s_tx_queue_skb(struct mt76_phy *phy, struct mt76_queue *q,
enum mt76_txq_id qid, struct sk_buff *skb,
struct mt76_wcid *wcid, struct ieee80211_sta *sta)
{
+ struct ieee80211_tx_status status = {
+ .sta = sta,
+ };
+
struct mt76_tx_info tx_info = {
.skb = skb,
};
@@ -531,8 +535,13 @@ mt76s_tx_queue_skb(struct mt76_phy *phy, struct mt76_queue *q,
skb->prev = skb->next = NULL;
err = dev->drv->tx_prepare_skb(dev, NULL, qid, wcid, sta, &tx_info);
- if (err < 0)
+ if (err < 0) {
+ status.skb = tx_info.skb;
+ spin_lock_bh(&dev->rx_lock);
+ ieee80211_tx_status_ext(dev->hw, &status);
+ spin_unlock_bh(&dev->rx_lock);
return err;
+ }
q->entry[q->head].skb = tx_info.skb;
q->entry[q->head].buf_sz = len;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0806/1376] wifi: mt76: mt7996: fix capability of EHT-MCS 15 in MRU
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (804 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0805/1376] wifi: mt76: mt792x: Fix memory leak in SDIO TX path Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0807/1376] wifi: mt76: fix non-AQL packet accounting for MLO stations Greg Kroah-Hartman
` (192 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Shayne Chen, Felix Fietkau,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shayne Chen <shayne.chen@mediatek.com>
[ Upstream commit 29e889c4ada83c69d10a3937f5ae2934306e2e3d ]
According to the definition in IEEE Std 802.11be-2024, Table 9-417r:
- If 80 MHz is not supported, bit 1-3 are set to 0.
- If 160 MHz is not supported, bit 2-3 are set to 0.
- If 320 MHz is not supported, bit 3 is set to 0.
Fixes: 348533eb968d ("wifi: mt76: mt7996: add EHT capability init")
Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
Link: https://patch.msgid.link/20260313062150.3165433-2-shayne.chen@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7996/init.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
index fc2d46b10b720..d3d63f07d7b05 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
@@ -1181,7 +1181,6 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band,
struct ieee80211_sta_eht_cap *eht_cap = &data->eht_cap;
struct ieee80211_eht_cap_elem_fixed *eht_cap_elem = &eht_cap->eht_cap_elem;
struct ieee80211_eht_mcs_nss_supp *eht_nss = &eht_cap->eht_mcs_nss_supp;
- enum nl80211_chan_width width = phy->mt76->chandef.width;
int nss = hweight8(phy->mt76->antenna_mask);
int sts = hweight16(phy->mt76->chainmask);
u8 val;
@@ -1250,11 +1249,16 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band,
u8_encode_bits(u8_get_bits(1, GENMASK(1, 0)),
IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK);
- val = width == NL80211_CHAN_WIDTH_320 ? 0xf :
- width == NL80211_CHAN_WIDTH_160 ? 0x7 :
- width == NL80211_CHAN_WIDTH_80 ? 0x3 : 0x1;
- eht_cap_elem->phy_cap_info[6] =
- u8_encode_bits(val, IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK);
+ eht_cap_elem->phy_cap_info[6] = IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK;
+ if (band != NL80211_BAND_6GHZ) {
+ eht_cap_elem->phy_cap_info[6] &=
+ ~IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_320MHZ;
+
+ if (band != NL80211_BAND_5GHZ)
+ eht_cap_elem->phy_cap_info[6] &=
+ ~(IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_160MHZ |
+ IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_80MHZ);
+ }
val = u8_encode_bits(nss, IEEE80211_EHT_MCS_NSS_RX) |
u8_encode_bits(nss, IEEE80211_EHT_MCS_NSS_TX);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0807/1376] wifi: mt76: fix non-AQL packet accounting for MLO stations
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (805 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0806/1376] wifi: mt76: mt7996: fix capability of EHT-MCS 15 in MRU Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0808/1376] wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[] Greg Kroah-Hartman
` (191 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael-CY Lee, Felix Fietkau,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael-CY Lee <michael-cy.lee@mediatek.com>
[ Upstream commit 8ae659743ba936b22ecb4620815887728e2820d6 ]
__mt76_tx_queue_skb() overrides the wcid passed by the driver with
sta->drv_priv, so the wcid might incorrectly be changed after TX,
causing wcid->non_aql_packets to be counted on the wrong wcid. For
example, on the AP side, if a station's setup link is the 5G link and
the station uses 2G to transmit a frame, the value of non_aql_packets
is increased on the 5G wcid but decreased on the 2G wcid. Once the
inflated counter exceeds MT_MAX_NON_AQL_PKT, the TX scheduler
permanently refuses to service the station.
Drop the reassignment and account on the wcid used for transmission.
This also records the actual wcid in the queue entry.
Fixes: e1378e5228aa ("mt76: rely on AQL for burst size limits on tx queueing")
Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
Link: https://patch.msgid.link/20260722082610.2699628-4-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/tx.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/tx.c b/drivers/net/wireless/mediatek/mt76/tx.c
index 634b6dacd1e0d..1184357d933d2 100644
--- a/drivers/net/wireless/mediatek/mt76/tx.c
+++ b/drivers/net/wireless/mediatek/mt76/tx.c
@@ -313,10 +313,6 @@ __mt76_tx_queue_skb(struct mt76_phy *phy, int qid, struct sk_buff *skb,
if (idx < 0 || !sta)
return idx;
- wcid = (struct mt76_wcid *)sta->drv_priv;
- if (!wcid->sta)
- return idx;
-
q->entry[idx].wcid = wcid->idx;
if (!non_aql)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0808/1376] wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[]
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (806 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0807/1376] wifi: mt76: fix non-AQL packet accounting for MLO stations Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0809/1376] wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset Greg Kroah-Hartman
` (190 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Felix Fietkau, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@nbd.name>
[ Upstream commit 2243778a5fae8329ab5f18e7adcd7e03b911a1b7 ]
band_idx comes from a 2-bit descriptor field (0-3) and was used directly
to index dev->mt76.phys[] (size __MT_MAX_BAND == 3) and dereference the
result. A corrupt or reserved descriptor value could index out of bounds
or hit a NULL phy on parts with fewer bands. Reject invalid band indices,
mirroring mt7996_rx_get_wcid().
Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Link: https://patch.msgid.link/20260722082610.2699628-6-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
index 54bbc871c0bdc..116050a987a61 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
@@ -454,7 +454,13 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
memset(status, 0, sizeof(*status));
band_idx = FIELD_GET(MT_RXD1_NORMAL_BAND_IDX, rxd1);
+ if (!mt7996_band_valid(dev, band_idx))
+ return -EINVAL;
+
mphy = dev->mt76.phys[band_idx];
+ if (!mphy)
+ return -EINVAL;
+
phy = mphy->priv;
status->phy_idx = mphy->band_idx;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0809/1376] wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (807 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0808/1376] wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[] Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0810/1376] wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear Greg Kroah-Hartman
` (189 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Felix Fietkau, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@nbd.name>
[ Upstream commit 6469ae71e7e5d0132c934972f628f346ad0379cd ]
mt7996_mac_full_reset() called wake_up(&dev->mt76.mcu.wait) without first
setting MT76_MCU_RESET. The MCU response wait condition only checks the
response queue and that bit, so the wake-up released nobody: a thread
blocked in an MCU command against the dead firmware (typically holding
dev->mt76.mutex) stayed asleep until its multi-second timeout, stalling
recovery. Set the bit before the wake-up, as mt7915 does.
Fixes: 27015b6fbcca ("wifi: mt76: mt7996: enable full system reset support")
Link: https://patch.msgid.link/20260722082610.2699628-7-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
index 116050a987a61..24e0346ea3d88 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
@@ -1798,6 +1798,7 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
phy3 = mt7996_phy3(dev);
dev->recovery.hw_full_reset = true;
+ set_bit(MT76_MCU_RESET, &dev->mphy.state);
wake_up(&dev->mt76.mcu.wait);
ieee80211_stop_queues(mt76_hw(dev));
if (phy2)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0810/1376] wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (808 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0809/1376] wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0811/1376] wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss Greg Kroah-Hartman
` (188 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Felix Fietkau, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@nbd.name>
[ Upstream commit 6486e11a6e2f679597af2d5bb48c3b07a2b2a7ba ]
mt7915_remove_interface() cleared the wcid mask bit with no lock held and
before clearing the RCU wcid pointer. The mask is a non-atomic RMW shared
with the allocators, which all run under dev->mt76.mutex; on DBDC the two
wiphys share one mt76_dev, so this raced add_interface/sta_add on the
other band and could leak or double-hand-out a wcid. Clearing the bit
before the RCU pointer also let a concurrent allocation reuse the index
and publish its wcid, which the subsequent NULL assignment then wiped.
Move the clear into the existing mutex section, after the RCU pointer is
cleared.
Fixes: f3049b88b2b3 ("wifi: mt76: mt7915: allocate vif wcid in the same range as stations")
Link: https://patch.msgid.link/20260722082610.2699628-8-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7915/main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/main.c b/drivers/net/wireless/mediatek/mt76/mt7915/main.c
index 9b0fde73b8945..4875f51472ed8 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/main.c
@@ -296,7 +296,6 @@ static void mt7915_remove_interface(struct ieee80211_hw *hw,
mt7915_mcu_add_bss_info(phy, vif, false);
mt7915_mcu_add_sta(dev, vif, NULL, CONN_STATE_DISCONNECT, false);
- mt76_wcid_mask_clear(dev->mt76.wcid_mask, mvif->sta.wcid.idx);
mutex_lock(&dev->mt76.mutex);
mt76_testmode_reset(phy->mt76, true);
@@ -312,6 +311,7 @@ static void mt7915_remove_interface(struct ieee80211_hw *hw,
mutex_lock(&dev->mt76.mutex);
dev->mt76.vif_mask &= ~BIT_ULL(mvif->mt76.idx);
phy->omac_mask &= ~BIT_ULL(mvif->mt76.omac_idx);
+ mt76_wcid_mask_clear(dev->mt76.wcid_mask, mvif->sta.wcid.idx);
mutex_unlock(&dev->mt76.mutex);
spin_lock_bh(&dev->mt76.sta_poll_lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0811/1376] wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (809 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0810/1376] wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0812/1376] wifi: mt76: mt7996: dont report a zero TX bitrate Greg Kroah-Hartman
` (187 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Felix Fietkau, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@nbd.name>
[ Upstream commit 4a2f4be532e3ea4e2b536e411793a05aaa51af25 ]
If a peer's VHT/HE MCS map has no supported spatial stream (all fields
0x3), the loop exits with nss == 0 and the function returned (u8)-1 (255),
which was then written into the firmware sta_rec_bf beamforming fields.
Clamp the result to 0.
Fixes: 89029a85482c ("mt76: mt7915: add Tx beamformer support")
Link: https://patch.msgid.link/20260722082610.2699628-9-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
index 32e9c0960657a..dcebe55c9010e 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
@@ -51,7 +51,7 @@ mt7915_mcu_get_sta_nss(u16 mcs_map)
break;
}
- return nss - 1;
+ return nss ? nss - 1 : 0;
}
static void
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0812/1376] wifi: mt76: mt7996: dont report a zero TX bitrate
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (810 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0811/1376] wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0813/1376] wifi: mt76: mt7915: write RX header translation bit to the correct register Greg Kroah-Hartman
` (186 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Felix Fietkau, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@nbd.name>
[ Upstream commit d4d92ccded678c92c390003926097ddbb6516bc7 ]
mt7996_sta_statistics() set NL80211_STA_INFO_TX_BITRATE unconditionally
after the block that already sets it, so a station with no rate info yet
was reported to userspace with a valid-but-zero TX rate. Drop the
redundant unconditional assignments; the in-block ones are sufficient.
Fixes: b34f346b917e ("wifi: mt76: mt7996: drop return in mt7996_sta_statistics")
Link: https://patch.msgid.link/20260722082610.2699628-10-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7996/main.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
index 4d11083b86c09..bdb5e82d9f4e7 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
@@ -1014,8 +1014,6 @@ static void mt7996_sta_statistics(struct ieee80211_hw *hw,
sinfo->txrate.flags = txrate->flags;
sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
}
- sinfo->txrate.flags = txrate->flags;
- sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
sinfo->tx_failed = msta->wcid.stats.tx_failed;
sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0813/1376] wifi: mt76: mt7915: write RX header translation bit to the correct register
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (811 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0812/1376] wifi: mt76: mt7996: dont report a zero TX bitrate Greg Kroah-Hartman
@ 2026-09-12 6:53 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0814/1376] wifi: mt76: fix stranded frames in mt76_txq_schedule_pending Greg Kroah-Hartman
` (185 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:53 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Felix Fietkau, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@nbd.name>
[ Upstream commit 236145737480c4c0c515e09061d0d5f77cf52d3f ]
MT_MDP_DCR0_RX_HDR_TRANS_EN is a field of MT_MDP_DCR0, but monitor-mode
handling applied it to the per-band MT_DMA_DCR0 register instead. As a
result RX header translation was never disabled in the MDP when entering
monitor mode, and an undocumented bit of MT_DMA_DCR0 was toggled. Target
MT_MDP_DCR0, matching the mt7996 driver.
Fixes: b2491018587a ("wifi: mt76: mt7915: fix monitor mode issues")
Link: https://patch.msgid.link/20260722082610.2699628-11-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7915/main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/main.c b/drivers/net/wireless/mediatek/mt76/mt7915/main.c
index 4875f51472ed8..529926c287bce 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/main.c
@@ -490,7 +490,7 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
mt76_rmw_field(dev, MT_DMA_DCR0(band), MT_DMA_DCR0_RXD_G5_EN,
enabled);
- mt76_rmw_field(dev, MT_DMA_DCR0(band), MT_MDP_DCR0_RX_HDR_TRANS_EN,
+ mt76_rmw_field(dev, MT_MDP_DCR0, MT_MDP_DCR0_RX_HDR_TRANS_EN,
!dev->monitor_mask);
mt76_testmode_reset(phy->mt76, true);
mt76_wr(dev, MT_WF_RFCR(band), rxfilter);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0814/1376] wifi: mt76: fix stranded frames in mt76_txq_schedule_pending
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (812 preceding siblings ...)
2026-09-12 6:53 ` [PATCH 6.12 0813/1376] wifi: mt76: mt7915: write RX header translation bit to the correct register Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0815/1376] wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie Greg Kroah-Hartman
` (184 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Felix Fietkau, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@nbd.name>
[ Upstream commit 422dd2db28ae27c35a586acd9ad482f30000c090 ]
A wcid is added to phy->tx_list whenever either tx_pending or
tx_offchannel becomes non-empty, but the requeue check after a partial
schedule required BOTH queues to be non-empty. When
mt76_txq_schedule_pending_wcid() returns -1 (queue stopped or
MT76_RESET) it leaves frames in tx_pending while tx_offchannel is empty,
so the wcid is dropped from every scheduling list and its frames stall
until the next mt76_tx() for that wcid or wcid cleanup. This strands
EAPOL/mgmt/nullfunc frames under momentary queue-full or across
scan/channel-switch, causing association and 4-way-handshake timeouts.
Requeue when either queue still holds frames, matching the enqueue
condition.
Fixes: 0b3be9d1d34e ("wifi: mt76: add separate tx scheduling queue for off-channel tx")
Link: https://patch.msgid.link/20260722082610.2699628-14-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/tx.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/tx.c b/drivers/net/wireless/mediatek/mt76/tx.c
index 1184357d933d2..1a5acb2bcfb3e 100644
--- a/drivers/net/wireless/mediatek/mt76/tx.c
+++ b/drivers/net/wireless/mediatek/mt76/tx.c
@@ -664,8 +664,8 @@ static void mt76_txq_schedule_pending(struct mt76_phy *phy)
ret = mt76_txq_schedule_pending_wcid(phy, wcid, &wcid->tx_pending);
spin_lock(&phy->tx_lock);
- if (!skb_queue_empty(&wcid->tx_pending) &&
- !skb_queue_empty(&wcid->tx_offchannel) &&
+ if ((!skb_queue_empty(&wcid->tx_pending) ||
+ !skb_queue_empty(&wcid->tx_offchannel)) &&
list_empty(&wcid->tx_list))
list_add_tail(&wcid->tx_list, &phy->tx_list);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0815/1376] wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (813 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0814/1376] wifi: mt76: fix stranded frames in mt76_txq_schedule_pending Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0816/1376] wifi: mt76: check txfree done event on the WED hw path Greg Kroah-Hartman
` (183 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Felix Fietkau, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@nbd.name>
[ Upstream commit dd59a6126a8f1bd52bf6bd057bf0c8307f76a74b ]
The clock enable path for the second adie sets MT_ADIE_SLP_CTRL_CK0(1)
but polled the busy bit of MT_ADIE_SLP_CTRL_CK0(0), so dual-adie
bring-up could proceed before the adie1 clock was stable.
Fixes: 99ad32a4ca3a ("mt76: mt7915: add support for MT7986")
Link: https://patch.msgid.link/20260722082610.2699628-18-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7915/soc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/soc.c b/drivers/net/wireless/mediatek/mt76/mt7915/soc.c
index 90a6f61d10892..c0372f693cd49 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/soc.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/soc.c
@@ -913,7 +913,7 @@ static void mt7986_wmac_clock_enable(struct mt7915_dev *dev, u32 adie_type)
read_poll_timeout(mt76_rr, cur, !(cur & MT_SLP_CTRL_BSY_MASK),
USEC_PER_MSEC, 50 * USEC_PER_MSEC, false,
- dev, MT_ADIE_SLP_CTRL_CK0(0));
+ dev, MT_ADIE_SLP_CTRL_CK0(1));
}
mt76_wmac_spi_unlock(dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0816/1376] wifi: mt76: check txfree done event on the WED hw path
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (814 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0815/1376] wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0817/1376] wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config Greg Kroah-Hartman
` (182 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rex Lu, Shayne Chen, Felix Fietkau,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rex Lu <rex.lu@mediatek.com>
[ Upstream commit 3310e71a74b176d3613dfb42b6bc630d99e90cbb ]
Check the txfree done event DW1 bit 15 when WED is enabled, to avoid
the driver reading a txfree done event before WED has finished reading
it. No need to check this flag on WED v2, otherwise SER will occur.
The bit position was previously defined as MT_DMA_CTL_BURST, which is
unused; rename it to match its function on the txfree ring.
Fixes: 83eafc9251d6 ("wifi: mt76: mt7996: add wed tx support")
Signed-off-by: Rex Lu <rex.lu@mediatek.com>
Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
Link: https://patch.msgid.link/20260722082610.2699628-2-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/dma.c | 9 +++++++++
drivers/net/wireless/mediatek/mt76/dma.h | 2 +-
2 files changed, 10 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
index 8940f8bb7bb50..7989edea8bc09 100644
--- a/drivers/net/wireless/mediatek/mt76/dma.c
+++ b/drivers/net/wireless/mediatek/mt76/dma.c
@@ -490,6 +490,15 @@ mt76_dma_dequeue(struct mt76_dev *dev, struct mt76_queue *q, bool flush,
q->desc[idx].ctrl |= cpu_to_le32(MT_DMA_CTL_DMA_DONE);
else if (!(q->desc[idx].ctrl & cpu_to_le32(MT_DMA_CTL_DMA_DONE)))
return NULL;
+#ifdef CONFIG_NET_MEDIATEK_SOC_WED
+ /* on WED v3 the M_DONE bit signals that WED is done reading
+ * the txfree descriptor; WED v2 does not set it
+ */
+ else if (dev->mmio.wed.version > 2 &&
+ mt76_queue_is_wed_tx_free(q) &&
+ !(q->desc[idx].ctrl & cpu_to_le32(MT_DMA_CTL_M_DONE)))
+ return NULL;
+#endif
}
q->tail = (q->tail + 1) % q->ndesc;
diff --git a/drivers/net/wireless/mediatek/mt76/dma.h b/drivers/net/wireless/mediatek/mt76/dma.h
index e3ddc7a837579..2e20d855f3ecf 100644
--- a/drivers/net/wireless/mediatek/mt76/dma.h
+++ b/drivers/net/wireless/mediatek/mt76/dma.h
@@ -11,7 +11,7 @@
#define MT_DMA_CTL_SD_LEN1 GENMASK(13, 0)
#define MT_DMA_CTL_LAST_SEC1 BIT(14)
-#define MT_DMA_CTL_BURST BIT(15)
+#define MT_DMA_CTL_M_DONE BIT(15)
#define MT_DMA_CTL_SD_LEN0 GENMASK(29, 16)
#define MT_DMA_CTL_LAST_SEC0 BIT(30)
#define MT_DMA_CTL_DMA_DONE BIT(31)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0817/1376] wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (815 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0816/1376] wifi: mt76: check txfree done event on the WED hw path Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0818/1376] wifi: mt76: mt7915: unwind state on add_interface failure Greg Kroah-Hartman
` (181 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Felix Fietkau, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@nbd.name>
[ Upstream commit 44af52467e72094351a362bf69effd52f1d9c186 ]
The response TLV loop advanced by tlv->len without a minimum, so a
theoretical firmware response containing a zero-length TLV could spin
forever, hanging the CPU during device probe.
The u32 payload was also read without bounds checking.
Reject a short fixed field, stop on a TLV whose length underruns the
header or overruns the skb.
Fixes: 5d33053be609 ("wifi: mt76: mt7996: add variants support")
Link: https://patch.msgid.link/20260724124813.3961474-2-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
index a5693efee74b8..e3f5b2b2e3674 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -3651,21 +3651,31 @@ int mt7996_mcu_get_chip_config(struct mt7996_dev *dev, u32 *cap)
return ret;
/* fixed field */
+ if (skb->len < 4) {
+ dev_kfree_skb(skb);
+ return -EINVAL;
+ }
skb_pull(skb, 4);
buf = skb->data;
- while (buf - skb->data < skb->len) {
+ while (buf - skb->data + sizeof(struct tlv) <= skb->len) {
struct tlv *tlv = (struct tlv *)buf;
+ u16 tlv_len = le16_to_cpu(tlv->len);
+
+ if (tlv_len < sizeof(*tlv) ||
+ tlv_len > skb->len - (buf - skb->data))
+ break;
switch (le16_to_cpu(tlv->tag)) {
case UNI_EVENT_CHIP_CONFIG_EFUSE_VERSION:
- *cap = le32_to_cpu(*(__le32 *)(buf + sizeof(*tlv)));
+ if (tlv_len >= sizeof(*tlv) + sizeof(__le32))
+ *cap = le32_to_cpu(*(__le32 *)(buf + sizeof(*tlv)));
break;
default:
break;
}
- buf += le16_to_cpu(tlv->len);
+ buf += tlv_len;
}
dev_kfree_skb(skb);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0818/1376] wifi: mt76: mt7915: unwind state on add_interface failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (816 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0817/1376] wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0819/1376] wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV Greg Kroah-Hartman
` (180 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Felix Fietkau, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@nbd.name>
[ Upstream commit 2fb6480c52f611338e1b0abe5e6219be1fc9ab75 ]
When mt76_wcid_alloc() fails, mt7915_add_interface() returned without
clearing the vif_mask/omac_mask bits it had already set, without removing
the firmware dev info added earlier, and without clearing a monitor_vif
pointer to the vif mac80211 is about to free. mac80211 does not call
remove_interface() for a failed add, so the indices and firmware dev
entry leaked permanently and testmode could dereference the stale
monitor_vif. Add a proper error unwind.
Fixes: b619e01380ee ("mt76: fix MBSS index condition in DBDC mode")
Link: https://patch.msgid.link/20260724124813.3961474-4-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7915/main.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/main.c b/drivers/net/wireless/mediatek/mt76/mt7915/main.c
index 529926c287bce..b065a8938dd5d 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/main.c
@@ -248,7 +248,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
idx = mt76_wcid_alloc(dev->mt76.wcid_mask, mt7915_wtbl_size(dev));
if (idx < 0) {
ret = -ENOSPC;
- goto out;
+ goto err;
}
INIT_LIST_HEAD(&mvif->sta.rc_list);
@@ -279,7 +279,17 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
mt7915_mcu_add_sta(dev, vif, NULL, CONN_STATE_PORT_SECURE, true);
rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid);
+ mutex_unlock(&dev->mt76.mutex);
+
+ return 0;
+
+err:
+ dev->mt76.vif_mask &= ~BIT_ULL(mvif->mt76.idx);
+ phy->omac_mask &= ~BIT_ULL(mvif->mt76.omac_idx);
+ mt7915_mcu_add_dev_info(phy, vif, false);
out:
+ if (phy->monitor_vif == vif)
+ phy->monitor_vif = NULL;
mutex_unlock(&dev->mt76.mutex);
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0819/1376] wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (817 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0818/1376] wifi: mt76: mt7915: unwind state on add_interface failure Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0820/1376] wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields Greg Kroah-Hartman
` (179 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Felix Fietkau, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@nbd.name>
[ Upstream commit 50c66bab321140c49aa2ed779a3ec9d2f085b458 ]
When a CSA countdown is active, mt7996_mcu_beacon_cntdwn() emits two
bss_bcn_cntdwn_tlv entries (the CSA countdown and the CCA-abort BCC), but
MT7996_BEACON_UPDATE_SIZE only reserved one. With MBSSID enabled and a
near-maximum beacon template the extra 8 bytes could push the offload
command past MT7996_MAX_BSS_OFFLOAD_SIZE and trigger skb_over_panic().
Reserve room for both countdown TLVs.
Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Link: https://patch.msgid.link/20260724124813.3961474-8-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7996/mcu.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
index ded2fe7210680..ce01f540972bf 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
@@ -804,7 +804,7 @@ enum {
#define MT7996_BEACON_UPDATE_SIZE (sizeof(struct bss_req_hdr) + \
sizeof(struct bss_bcn_content_tlv) + \
4 + MT_TXD_SIZE + \
- sizeof(struct bss_bcn_cntdwn_tlv) + \
+ sizeof(struct bss_bcn_cntdwn_tlv) * 2 + \
sizeof(struct bss_bcn_mbss_tlv))
#define MT7996_MAX_BSS_OFFLOAD_SIZE (MT7996_MAX_BEACON_SIZE + \
MT7996_BEACON_UPDATE_SIZE)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0820/1376] wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (818 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0819/1376] wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0821/1376] wifi: mt76: only consume the WO drop bit on WED v2 devices Greg Kroah-Hartman
` (178 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Felix Fietkau, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@nbd.name>
[ Upstream commit 04280d0a56be4264720e7b205daaa332c715e5ec ]
train_up_high_thres, train_up_rule_rssi and low_traffic_thres were
declared as host-native short in a firmware-facing TLV and assigned
host-order constants, so on a big-endian host the firmware received
byte-swapped rate-adaptation thresholds. Declare them __le16 and convert
with cpu_to_le16().
Fixes: e57b7901469f ("mt76: add mac80211 driver for MT7915 PCIe-based chipsets")
Link: https://patch.msgid.link/20260724124813.3961474-12-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 6 +++---
drivers/net/wireless/mediatek/mt76/mt7915/mcu.h | 6 +++---
2 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
index dcebe55c9010e..276cbc7693fef 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
@@ -532,9 +532,9 @@ mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
ra->rx_streams = max_nss;
ra->algo = 4;
ra->train_up_rule = 2;
- ra->train_up_high_thres = 110;
- ra->train_up_rule_rssi = -70;
- ra->low_traffic_thres = 2;
+ ra->train_up_high_thres = cpu_to_le16(110);
+ ra->train_up_rule_rssi = cpu_to_le16(-70);
+ ra->low_traffic_thres = cpu_to_le16(2);
ra->phy_cap = cpu_to_le32(0xfdf);
ra->interval = cpu_to_le32(500);
ra->fast_interval = cpu_to_le32(100);
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.h b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.h
index b7e26c2409444..9e57a369a423f 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.h
@@ -318,9 +318,9 @@ struct bss_info_ra {
u8 antenna_idx;
u8 train_up_rule;
u8 rsv[3];
- unsigned short train_up_high_thres;
- short train_up_rule_rssi;
- unsigned short low_traffic_thres;
+ __le16 train_up_high_thres;
+ __le16 train_up_rule_rssi;
+ __le16 low_traffic_thres;
__le16 max_phyrate;
__le32 phy_cap;
__le32 interval;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0821/1376] wifi: mt76: only consume the WO drop bit on WED v2 devices
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (819 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0820/1376] wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0822/1376] ACPI: processor: idle: Optimize ACPI idle driver registration Greg Kroah-Hartman
` (177 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Felix Fietkau, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@nbd.name>
[ Upstream commit 1df54335590bb025c3bd706a9ba9c6e73a1d3000 ]
The RX path is handled by the WO MCU only on WED v2 hardware. On WED
v3 the same buf1 bit does not carry drop information, so evaluating it
there causes spurious RX drops.
Fixes: e4d2b8bcac11 ("wifi: mt76: drop the incorrect scatter and gather frame")
Link: https://patch.msgid.link/20260724124813.3961474-14-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/dma.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
index 7989edea8bc09..e02741c5892e6 100644
--- a/drivers/net/wireless/mediatek/mt76/dma.c
+++ b/drivers/net/wireless/mediatek/mt76/dma.c
@@ -459,8 +459,13 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
t->ptr = NULL;
mt76_put_rxwi(dev, t);
- if (drop)
+#ifdef CONFIG_NET_MEDIATEK_SOC_WED
+ /* the WO MCU owns the RX path only on WED v2, on newer
+ * versions this buf1 bit carries no drop information
+ */
+ if (drop && dev->mmio.wed.version == 2)
*drop |= !!(buf1 & MT_DMA_CTL_WO_DROP);
+#endif
} else {
dma_sync_single_for_cpu(dev->dma_dev, e->dma_addr[0],
SKB_WITH_OVERHEAD(q->buf_size),
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0822/1376] ACPI: processor: idle: Optimize ACPI idle driver registration
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (820 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0821/1376] wifi: mt76: only consume the WO drop bit on WED v2 devices Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0823/1376] ACPI: processor: Unregister cpufreq notifier on init failure Greg Kroah-Hartman
` (176 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Huisong Li, Rafael J. Wysocki,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huisong Li <lihuisong@huawei.com>
[ Upstream commit 7a8c994cbb2db3c5335cee35fd486557f5aaf7e1 ]
Currently, the ACPI idle driver is registered from within a CPU
hotplug callback. Although this didn't cause any functional issues,
this is questionable and confusing. And it is better to register
the cpuidle driver when all of the CPUs have been brought up.
So add a new function to initialize acpi_idle_driver based on the
power management information of an available CPU and register cpuidle
driver in acpi_processor_driver_init().
Signed-off-by: Huisong Li <lihuisong@huawei.com>
Link: https://patch.msgid.link/20250728070612.1260859-3-lihuisong@huawei.com
[ rjw: Added missing inline modifiers ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
This commit has four changes under the commit 7a8c994cbb2d (ACPI:
processor: idle: Optimize ACPI idle driver registration):
1) move acpi_processor_register_idle_driver() ahead of the
driver_register().
2) add acpi_processor_cstate_first_run_checks() before calling
acpi_processor_get_power_info().
3) squash the commit 9d68320b2bca (ACPI: processor: idle: Fix
function defined but not used warning) into this change.
4) use for_each_possible_cpu(cpu) to scan all possible cpus.
[ rjw: New comment edits, changelog tweak ]
Stable-dep-of: 06f32dd67e6b ("ACPI: processor: Unregister cpufreq notifier on init failure")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/processor_driver.c | 10 ++++-
drivers/acpi/processor_idle.c | 66 +++++++++++++++++++++------------
include/acpi/processor.h | 2 +
3 files changed, 54 insertions(+), 24 deletions(-)
diff --git a/drivers/acpi/processor_driver.c b/drivers/acpi/processor_driver.c
index 3b281bc1e73c3..93970583157df 100644
--- a/drivers/acpi/processor_driver.c
+++ b/drivers/acpi/processor_driver.c
@@ -259,9 +259,11 @@ static int __init acpi_processor_driver_init(void)
acpi_processor_ignore_ppc_init();
}
+ acpi_processor_register_idle_driver();
+
result = driver_register(&acpi_processor_driver);
if (result < 0)
- return result;
+ goto unregister_idle_drv;
result = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN,
"acpi/cpu-drv:online",
@@ -280,8 +282,13 @@ static int __init acpi_processor_driver_init(void)
*/
acpi_processor_init_invariance_cppc();
return 0;
+
err:
driver_unregister(&acpi_processor_driver);
+
+unregister_idle_drv:
+ acpi_processor_unregister_idle_driver();
+
return result;
}
@@ -299,6 +306,7 @@ static void __exit acpi_processor_driver_exit(void)
cpuhp_remove_state_nocalls(hp_online);
cpuhp_remove_state_nocalls(CPUHP_ACPI_CPUDRV_DEAD);
driver_unregister(&acpi_processor_driver);
+ acpi_processor_unregister_idle_driver();
}
module_init(acpi_processor_driver_init);
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 6ecf784cf6b5c..17ba203294028 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -1379,7 +1379,49 @@ int acpi_processor_power_state_has_changed(struct acpi_processor *pr)
return 0;
}
-static int acpi_processor_registered;
+void acpi_processor_register_idle_driver(void)
+{
+ struct acpi_processor *pr;
+ int ret = -ENODEV;
+ int cpu;
+
+ /*
+ * ACPI idle driver is used by all possible CPUs.
+ * Use the processor power info of one in them to set up idle states.
+ * Note that the existing idle handler will be used on platforms that
+ * only support C1.
+ */
+ for_each_possible_cpu(cpu) {
+ pr = per_cpu(processors, cpu);
+ if (!pr)
+ continue;
+
+ acpi_processor_cstate_first_run_checks();
+ ret = acpi_processor_get_power_info(pr);
+ if (!ret) {
+ pr->flags.power_setup_done = 1;
+ acpi_processor_setup_cpuidle_states(pr);
+ break;
+ }
+ }
+
+ if (ret) {
+ pr_debug("No ACPI power information from any CPUs.\n");
+ return;
+ }
+
+ ret = cpuidle_register_driver(&acpi_idle_driver);
+ if (ret) {
+ pr_debug("register %s failed.\n", acpi_idle_driver.name);
+ return;
+ }
+ pr_debug("%s registered with cpuidle.\n", acpi_idle_driver.name);
+}
+
+void acpi_processor_unregister_idle_driver(void)
+{
+ cpuidle_unregister_driver(&acpi_idle_driver);
+}
int acpi_processor_power_init(struct acpi_processor *pr)
{
@@ -1394,22 +1436,7 @@ int acpi_processor_power_init(struct acpi_processor *pr)
if (!acpi_processor_get_power_info(pr))
pr->flags.power_setup_done = 1;
- /*
- * Install the idle handler if processor power management is supported.
- * Note that we use previously set idle handler will be used on
- * platforms that only support C1.
- */
if (pr->flags.power) {
- /* Register acpi_idle_driver if not already registered */
- if (!acpi_processor_registered) {
- acpi_processor_setup_cpuidle_states(pr);
- retval = cpuidle_register_driver(&acpi_idle_driver);
- if (retval)
- return retval;
- pr_debug("%s registered with cpuidle\n",
- acpi_idle_driver.name);
- }
-
dev = kzalloc(sizeof(*dev), GFP_KERNEL);
if (!dev)
return -ENOMEM;
@@ -1422,14 +1449,11 @@ int acpi_processor_power_init(struct acpi_processor *pr)
*/
retval = cpuidle_register_device(dev);
if (retval) {
- if (acpi_processor_registered == 0)
- cpuidle_unregister_driver(&acpi_idle_driver);
per_cpu(acpi_cpuidle_device, pr->id) = NULL;
kfree(dev);
return retval;
}
- acpi_processor_registered++;
}
return 0;
}
@@ -1443,10 +1467,6 @@ int acpi_processor_power_exit(struct acpi_processor *pr)
if (pr->flags.power) {
cpuidle_unregister_device(dev);
- acpi_processor_registered--;
- if (acpi_processor_registered == 0)
- cpuidle_unregister_driver(&acpi_idle_driver);
-
kfree(dev);
}
diff --git a/include/acpi/processor.h b/include/acpi/processor.h
index a17e97e634a68..960ce42386cc7 100644
--- a/include/acpi/processor.h
+++ b/include/acpi/processor.h
@@ -418,6 +418,8 @@ int acpi_processor_power_init(struct acpi_processor *pr);
int acpi_processor_power_exit(struct acpi_processor *pr);
int acpi_processor_power_state_has_changed(struct acpi_processor *pr);
int acpi_processor_hotplug(struct acpi_processor *pr);
+void acpi_processor_register_idle_driver(void);
+void acpi_processor_unregister_idle_driver(void);
#else
static inline int acpi_processor_power_init(struct acpi_processor *pr)
{
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0823/1376] ACPI: processor: Unregister cpufreq notifier on init failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (821 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0822/1376] ACPI: processor: idle: Optimize ACPI idle driver registration Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0824/1376] perf: arm_spe: Make wakeup range check overflow safe Greg Kroah-Hartman
` (175 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Can Peng, Rafael J. Wysocki,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Can Peng <pengcan@kylinos.cn>
[ Upstream commit 06f32dd67e6b23a05bef0d8183c5335af91c0c3b ]
acpi_processor_driver_init() registers the cpufreq policy notifier before
registering the ACPI processor driver and setting up CPU hotplug state.
If driver_register() or cpuhp_setup_state() fails, the error path only
unregisters the ACPI processor driver and the idle driver. The cpufreq
notifier remains registered even though initialization failed.
Mirror the module exit path on the init failure path and unregister the
cpufreq notifier when it has been registered.
Fixes: c0e0421a60bf ("ACPI: processor: Reorder acpi_processor_driver_init()")
Signed-off-by: Can Peng <pengcan@kylinos.cn>
Link: https://patch.msgid.link/20260729023605.197367-1-pengcan@kylinos.cn
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/processor_driver.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/acpi/processor_driver.c b/drivers/acpi/processor_driver.c
index 93970583157df..d6d9c57dd555f 100644
--- a/drivers/acpi/processor_driver.c
+++ b/drivers/acpi/processor_driver.c
@@ -289,6 +289,12 @@ static int __init acpi_processor_driver_init(void)
unregister_idle_drv:
acpi_processor_unregister_idle_driver();
+ if (acpi_processor_cpufreq_init) {
+ cpufreq_unregister_notifier(&acpi_processor_notifier_block,
+ CPUFREQ_POLICY_NOTIFIER);
+ acpi_processor_cpufreq_init = false;
+ }
+
return result;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0824/1376] perf: arm_spe: Make wakeup range check overflow safe
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (822 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0823/1376] ACPI: processor: Unregister cpufreq notifier on init failure Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0825/1376] drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) Greg Kroah-Hartman
` (174 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Leo Yan, Will Deacon, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <leo.yan@arm.com>
[ Upstream commit fcc5eaea2d234162dfb8258372dd897bc2a1b862 ]
The current code checks whether the wakeup point is in the current
writable range by comparing it with handle->head + handle->size.
The perf AUX head is a monotonically increasing index, so that addition
can overflow when head is close to ULONG_MAX. In that case, a wakeup
point which is still inside the free space range can be missed.
Use unsigned subtraction to compare the distance from head to wakeup
against the handle->size. This can dismiss the issue when addition
overflow.
This is unlikely to happen in practice, but the change makes the
watermark check logically correct.
Fixes: d5d9696b0380 ("drivers/perf: Add support for ARMv8.2 Statistical Profiling Extension")
Signed-off-by: Leo Yan <leo.yan@arm.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/perf/arm_spe_pmu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c
index 2fce871a1882d..5902ca3f057a1 100644
--- a/drivers/perf/arm_spe_pmu.c
+++ b/drivers/perf/arm_spe_pmu.c
@@ -467,7 +467,7 @@ static u64 __arm_spe_pmu_next_off(struct perf_output_handle *handle)
* the page boundary following it. Keep the tail boundary if
* that's lower.
*/
- if (handle->wakeup < (handle->head + handle->size) && head <= wakeup)
+ if ((handle->wakeup - handle->head) < handle->size && head <= wakeup)
limit = min(limit, round_up(wakeup, PAGE_SIZE));
if (limit > head)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0825/1376] drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0)
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (823 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0824/1376] perf: arm_spe: Make wakeup range check overflow safe Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0826/1376] drm/msm/dsi: Drop dev_pm_opp_set_rate(0) Greg Kroah-Hartman
` (173 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Dmitry Baryshkov,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
[ Upstream commit 811c38907eab0f66c22c5e5708e6f8eab14d76fa ]
dev_pm_opp_set_rate(0) removes the vote specified in required-opps but
does not actually park the clock, making it run without the necessary
power backing. Prevent that from happening when
_dpu_core_perf_get_core_clk_rate() returns 0.
Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support")
Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/742779/
Link: https://lore.kernel.org/r/20260728-topic-dpu_power-v1-1-e7783b859a70@oss.qualcomm.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c
index 260accc151d4b..d29df73c02c5f 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c
@@ -383,6 +383,10 @@ int dpu_core_perf_crtc_update(struct drm_crtc *crtc,
trace_dpu_core_perf_update_clk(kms->dev, !crtc->enabled, clk_rate);
+ /* If we're going offline, PM callbacks will disable the clocks instead */
+ if (!clk_rate)
+ return 0;
+
clk_rate = min(clk_rate, kms->perf.max_core_clk_rate);
ret = dev_pm_opp_set_rate(&kms->pdev->dev, clk_rate);
if (ret) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0826/1376] drm/msm/dsi: Drop dev_pm_opp_set_rate(0)
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (824 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0825/1376] drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0827/1376] wifi: ath11k: fix leak in ath11k_service_ready_ext_event() Greg Kroah-Hartman
` (172 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Dmitry Baryshkov,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
[ Upstream commit 06b7ba206561619bb34116f49e0ef26b867ce3aa ]
dev_pm_opp_set_rate(0) removes the vote specified in required-opps but
does not actually park the clock, making it run without the necessary
power backing. Drop the explicit call to it.
Every call site of ops->link_clk_disable() is followed by
pm_runtime_put(), so the power vote will be rescinded if deemed safe.
Fixes: 32d3e0feccfe ("drm/msm: dsi: Use OPP API to set clk/perf state")
Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/742783/
Link: https://lore.kernel.org/r/20260728-topic-dpu_power-v1-3-e7783b859a70@oss.qualcomm.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/dsi/dsi_host.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
index ab97de31af5ff..77173183509f1 100644
--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
+++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
@@ -499,8 +499,6 @@ int dsi_link_clk_enable_v2(struct msm_dsi_host *msm_host)
void dsi_link_clk_disable_6g(struct msm_dsi_host *msm_host)
{
- /* Drop the performance state vote */
- dev_pm_opp_set_rate(&msm_host->pdev->dev, 0);
clk_disable_unprepare(msm_host->esc_clk);
clk_disable_unprepare(msm_host->pixel_clk);
clk_disable_unprepare(msm_host->byte_intf_clk);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0827/1376] wifi: ath11k: fix leak in ath11k_service_ready_ext_event()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (825 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0826/1376] drm/msm/dsi: Drop dev_pm_opp_set_rate(0) Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0828/1376] regulator: core: use system_freezable_wq for init complete work Greg Kroah-Hartman
` (171 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rameshkumar Sundaram, Baochen Qiang,
Jeff Johnson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
[ Upstream commit 0293be2212d319d59589082461abf2a9b626cd1c ]
Currently, during ath11k_service_ready_ext_event() processing,
svc_rdy_ext.mac_phy_caps can be allocated during TLV parsing. This is a
temporary allocation that is freed on the success path, but not on the
error path. If parsing succeeds far enough to allocate mac_phy_caps and
then fails on a later TLV, the allocation leaks. So free the allocation
on the error path.
Compile tested only.
Fixes: 5b90fc760db5 ("ath11k: fix wmi service ready ext tlv parsing")
Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260727-ath11k_service_ready_ext_event-memleak-v1-1-e8373d27bdd1@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath11k/wmi.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c
index 540faacee41d8..a184a7e3452c0 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.c
+++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -5077,6 +5077,7 @@ static int ath11k_service_ready_ext_event(struct ath11k_base *ab,
return 0;
err:
+ kfree(svc_rdy_ext.mac_phy_caps);
ath11k_wmi_free_dbring_caps(ab);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0828/1376] regulator: core: use system_freezable_wq for init complete work
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (826 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0827/1376] wifi: ath11k: fix leak in ath11k_service_ready_ext_event() Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0829/1376] perf machine: Fix NULL parent dereference in fork event processing Greg Kroah-Hartman
` (170 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joy Zou, Frank Li, Mark Brown,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joy Zou <joy.zou@oss.nxp.com>
[ Upstream commit 03eab318cedd6ae34ecd34533cd986edf5237164 ]
schedule_delayed_work() uses system_wq, which is non-freezable, allowing
regulator_init_complete_work to run concurrently with system suspend. This
work fires ~30s after boot to disable unused regulators via I2C. When it
races with PM suspend, the I2C adapter may already be suspended, triggering
a -ESHUTDOWN warning in __i2c_transfer():
WARNING: ... at __i2c_transfer+0x36c/0x3c8
Call trace:
__i2c_transfer
i2c_transfer
regmap_i2c_write
_regmap_update_bits
regulator_disable_regmap
_regulator_do_disable
regulator_late_cleanup
regulator_init_complete_work_function
process_one_work
Switch to system_freezable_wq so the work is frozen before any device
is suspended, eliminating the race.
Fixes: 55576cf18537 ("regulator: Defer init completion for a while after late_initcall")
Signed-off-by: Joy Zou <joy.zou@oss.nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260731-b4-regulator-pf01-v2-1-a406c8737fdb@oss.nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/core.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 264c8ab434f07..6c571edfaab97 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -27,6 +27,7 @@
#include <linux/regulator/driver.h>
#include <linux/regulator/machine.h>
#include <linux/module.h>
+#include <linux/workqueue.h>
#define CREATE_TRACE_POINTS
#include <trace/events/regulator.h>
@@ -6467,8 +6468,9 @@ static int __init regulator_init_complete(void)
* we'd only do this on systems that need it, and a kernel
* command line option might be useful.
*/
- schedule_delayed_work(®ulator_init_complete_work,
- msecs_to_jiffies(30000));
+ queue_delayed_work(system_freezable_wq,
+ ®ulator_init_complete_work,
+ msecs_to_jiffies(30000));
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0829/1376] perf machine: Fix NULL parent dereference in fork event processing
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (827 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0828/1376] regulator: core: use system_freezable_wq for init complete work Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0830/1376] perf machine: Guard against NULL strlist in machines__findnew() Greg Kroah-Hartman
` (169 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Adrian Hunter,
Arnaldo Carvalho de Melo, Namhyung Kim, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 73ac546bd6ba8ed4dc8d7a90fcb9bb8236de1568 ]
machine__process_fork_event() calls machine__findnew_thread() for the
parent thread, which can return NULL on allocation failure. The code
then dereferences parent via thread__pid(parent) without a NULL check
when validating whether the parent PID matches. The later NULL check
at thread__fork() does not prevent this earlier dereference.
Add a NULL guard before accessing the parent thread.
Fixes: 5cb73340d92a ("perf tools: Make fork event processing more resilient")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/machine.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index 20fd742984e3c..8341737172279 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -1843,7 +1843,8 @@ int machine__process_fork_event(struct machine *machine, union perf_event *event
* (fork) event that would have removed the thread was lost. Assume the
* latter case and continue on as best we can.
*/
- if (thread__pid(parent) != (pid_t)event->fork.ppid) {
+ if (parent != NULL &&
+ thread__pid(parent) != (pid_t)event->fork.ppid) {
dump_printf("removing erroneous parent thread %d/%d\n",
thread__pid(parent), thread__tid(parent));
machine__remove_thread(machine, parent);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0830/1376] perf machine: Guard against NULL strlist in machines__findnew()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (828 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0829/1376] perf machine: Fix NULL parent dereference in fork event processing Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0831/1376] perf machine: Use snprintf() for guestmount path construction Greg Kroah-Hartman
` (168 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, David Ahern,
Arnaldo Carvalho de Melo, Namhyung Kim, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit e27b96d0a34e1dc87affecf221a99fee8f6c5afc ]
The static 'seen' strlist caches guestmount paths that have already
been reported as inaccessible, to avoid repeating the error message.
If strlist__new() fails (OOM), 'seen' stays NULL and the next call
dereferences it via strlist__has_entry() and strlist__add().
Guard both calls so that on allocation failure the error message is
still printed (just not deduplicated) instead of crashing.
Fixes: c80c3c269011 ("perf kvm: Limit repetitive guestmount message to once per directory")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: David Ahern <dsahern@gmail.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/machine.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index 8341737172279..9bd5dd9ddc81c 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -296,9 +296,10 @@ struct machine *machines__findnew(struct machines *machines, pid_t pid)
if (!seen)
seen = strlist__new(NULL, NULL);
- if (!strlist__has_entry(seen, path)) {
+ if (!seen || !strlist__has_entry(seen, path)) {
pr_err("Can't access file %s\n", path);
- strlist__add(seen, path);
+ if (seen)
+ strlist__add(seen, path);
}
machine = NULL;
goto out;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0831/1376] perf machine: Use snprintf() for guestmount path construction
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (829 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0830/1376] perf machine: Guard against NULL strlist in machines__findnew() Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0832/1376] perf machine: Check snprintf truncation in machines__findnew() Greg Kroah-Hartman
` (167 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Zhang, Yanmin,
Arnaldo Carvalho de Melo, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit fe63d3bca288c5bb983304efd5fc3a5ff3183403 ]
machines__findnew() and machines__create_guest_kernel_maps() use
sprintf() to build paths by prepending symbol_conf.guestmount.
Both write into PATH_MAX stack buffers, but guestmount comes from
user configuration and is not length-checked. A guestmount path
at or near PATH_MAX causes a stack buffer overflow.
Switch to snprintf() with sizeof() to prevent overflow. The
subsequent access()/fopen() calls will fail on a truncated path.
Fixes: a1645ce12adb6c9c ("perf: 'perf kvm' tool for monitoring guest performance from host")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Zhang, Yanmin <yanmin_zhang@linux.intel.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Stable-dep-of: cc6abe0012bf ("perf machine: Check snprintf truncation in machines__findnew()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/machine.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index 9bd5dd9ddc81c..03fd3dcd4c986 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -289,7 +289,7 @@ struct machine *machines__findnew(struct machines *machines, pid_t pid)
if ((pid != HOST_KERNEL_ID) &&
(pid != DEFAULT_GUEST_KERNEL_ID) &&
(symbol_conf.guestmount)) {
- sprintf(path, "%s/%d", symbol_conf.guestmount, pid);
+ snprintf(path, sizeof(path), "%s/%d", symbol_conf.guestmount, pid);
if (access(path, R_OK)) {
static struct strlist *seen;
@@ -1215,9 +1215,9 @@ int machines__create_guest_kernel_maps(struct machines *machines)
namelist[i]->d_name);
continue;
}
- sprintf(path, "%s/%s/proc/kallsyms",
- symbol_conf.guestmount,
- namelist[i]->d_name);
+ snprintf(path, sizeof(path), "%s/%s/proc/kallsyms",
+ symbol_conf.guestmount,
+ namelist[i]->d_name);
ret = access(path, R_OK);
if (ret) {
pr_debug("Can't access file %s\n", path);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0832/1376] perf machine: Check snprintf truncation in machines__findnew()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (830 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0831/1376] perf machine: Use snprintf() for guestmount path construction Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0833/1376] perf machine: Dont abort guest map creation on first inaccessible dir Greg Kroah-Hartman
` (166 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Zhang, Yanmin,
Arnaldo Carvalho de Melo, Namhyung Kim, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit cc6abe0012bf8c04af8275266f8ed7c55ba4a5fb ]
The guestmount path is built with snprintf() into a PATH_MAX buffer
without checking the return value. If symbol_conf.guestmount is long
enough to cause truncation, the truncated path could match a different
directory, causing the wrong guest to be associated with the pid.
Check for truncation and bail out early.
Fixes: a1645ce12adb ("perf: 'perf kvm' tool for monitoring guest performance from host")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Zhang, Yanmin <yanmin_zhang@linux.intel.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/machine.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index 03fd3dcd4c986..ea89e7499032a 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -289,7 +289,12 @@ struct machine *machines__findnew(struct machines *machines, pid_t pid)
if ((pid != HOST_KERNEL_ID) &&
(pid != DEFAULT_GUEST_KERNEL_ID) &&
(symbol_conf.guestmount)) {
- snprintf(path, sizeof(path), "%s/%d", symbol_conf.guestmount, pid);
+ if (snprintf(path, sizeof(path), "%s/%d",
+ symbol_conf.guestmount, pid) >= (int)sizeof(path)) {
+ pr_err("Guest path too long for pid %d\n", pid);
+ machine = NULL;
+ goto out;
+ }
if (access(path, R_OK)) {
static struct strlist *seen;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0833/1376] perf machine: Dont abort guest map creation on first inaccessible dir
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (831 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0832/1376] perf machine: Check snprintf truncation in machines__findnew() Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0834/1376] perf machine: Reset errno before strtol in guest kernel map creation Greg Kroah-Hartman
` (165 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Zhang, Yanmin,
Arnaldo Carvalho de Melo, Namhyung Kim, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit b687e1a418fb819ef83c362d84c216a6a841e3b0 ]
machines__create_guest_kernel_maps() jumps to the failure label when one
guest directory's kallsyms file fails access(), skipping all remaining
valid guest directories. An inaccessible directory is not fatal — other
guests may still be reachable.
Replace 'goto failure' with 'continue' so the loop processes all
directories, and remove the now-unreferenced failure label.
Fixes: a1645ce12adb ("perf: 'perf kvm' tool for monitoring guest performance from host")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Zhang, Yanmin <yanmin_zhang@linux.intel.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/machine.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index ea89e7499032a..073ab47bd5678 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -1223,14 +1223,12 @@ int machines__create_guest_kernel_maps(struct machines *machines)
snprintf(path, sizeof(path), "%s/%s/proc/kallsyms",
symbol_conf.guestmount,
namelist[i]->d_name);
- ret = access(path, R_OK);
- if (ret) {
+ if (access(path, R_OK)) {
pr_debug("Can't access file %s\n", path);
- goto failure;
+ continue;
}
machines__create_kernel_maps(machines, pid);
}
-failure:
free(namelist);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0834/1376] perf machine: Reset errno before strtol in guest kernel map creation
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (832 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0833/1376] perf machine: Dont abort guest map creation on first inaccessible dir Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0835/1376] perf machine: Free scandir entries " Greg Kroah-Hartman
` (164 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Zhang, Yanmin,
Arnaldo Carvalho de Melo, Namhyung Kim, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 29ec46e43f6ca7d6a6651db724d4ffd820f46e8b ]
machines__create_guest_kernel_maps() checks errno == ERANGE after
strtol() to detect overflow, but does not clear errno first. A stale
ERANGE from an earlier library call (e.g. scandir internals) causes
valid numeric directory names to be incorrectly skipped.
Set errno = 0 before strtol() so only the current conversion can
trigger the ERANGE check.
Fixes: a1645ce12adb ("perf: 'perf kvm' tool for monitoring guest performance from host")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Zhang, Yanmin <yanmin_zhang@linux.intel.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/machine.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index 073ab47bd5678..1cef434b3c8dc 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -1212,6 +1212,7 @@ int machines__create_guest_kernel_maps(struct machines *machines)
/* Filter out . and .. */
continue;
}
+ errno = 0;
pid = (pid_t)strtol(namelist[i]->d_name, &endp, 10);
if ((*endp != '\0') ||
(endp == namelist[i]->d_name) ||
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0835/1376] perf machine: Free scandir entries in guest kernel map creation
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (833 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0834/1376] perf machine: Reset errno before strtol in guest kernel map creation Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0836/1376] perf machine: Check snprintf truncation for guest kallsyms path Greg Kroah-Hartman
` (163 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Zhang, Yanmin,
Arnaldo Carvalho de Melo, Namhyung Kim, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit f53bf58dcd11e1cb088d3b91a035fef77062094b ]
machines__create_guest_kernel_maps() calls scandir() which allocates
both the namelist array and each individual dirent entry. The code
frees the namelist array but not the individual entries, leaking memory
proportional to the number of directories under guestmount.
Free each namelist[i] after it is no longer needed.
Fixes: a1645ce12adb ("perf: 'perf kvm' tool for monitoring guest performance from host")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Zhang, Yanmin <yanmin_zhang@linux.intel.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/machine.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index 1cef434b3c8dc..a958184d3bb38 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -1210,6 +1210,7 @@ int machines__create_guest_kernel_maps(struct machines *machines)
for (i = 0; i < items; i++) {
if (!isdigit(namelist[i]->d_name[0])) {
/* Filter out . and .. */
+ free(namelist[i]);
continue;
}
errno = 0;
@@ -1219,6 +1220,7 @@ int machines__create_guest_kernel_maps(struct machines *machines)
(errno == ERANGE)) {
pr_debug("invalid directory (%s). Skipping.\n",
namelist[i]->d_name);
+ free(namelist[i]);
continue;
}
snprintf(path, sizeof(path), "%s/%s/proc/kallsyms",
@@ -1226,9 +1228,11 @@ int machines__create_guest_kernel_maps(struct machines *machines)
namelist[i]->d_name);
if (access(path, R_OK)) {
pr_debug("Can't access file %s\n", path);
+ free(namelist[i]);
continue;
}
machines__create_kernel_maps(machines, pid);
+ free(namelist[i]);
}
free(namelist);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0836/1376] perf machine: Check snprintf truncation for guest kallsyms path
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (834 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0835/1376] perf machine: Free scandir entries " Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0837/1376] bpf, x86: Fix trampoline stack size for 128-bit arguments Greg Kroah-Hartman
` (162 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Zhang, Yanmin,
Arnaldo Carvalho de Melo, Namhyung Kim, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit d04ef71492fad7230d474efe33d05f4c0563d409 ]
machines__create_guest_kernel_maps() builds the guest kallsyms path
with snprintf() without checking the return value. A truncated path
could pass the access() check if a prefix directory happens to contain
a file named "kallsyms", leading to the wrong file being used for
symbol resolution.
Check for truncation and skip the directory.
Fixes: a1645ce12adb ("perf: 'perf kvm' tool for monitoring guest performance from host")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Zhang, Yanmin <yanmin_zhang@linux.intel.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/machine.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index a958184d3bb38..77050eff8fcb5 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -1223,9 +1223,14 @@ int machines__create_guest_kernel_maps(struct machines *machines)
free(namelist[i]);
continue;
}
- snprintf(path, sizeof(path), "%s/%s/proc/kallsyms",
- symbol_conf.guestmount,
- namelist[i]->d_name);
+ if (snprintf(path, sizeof(path), "%s/%s/proc/kallsyms",
+ symbol_conf.guestmount,
+ namelist[i]->d_name) >= (int)sizeof(path)) {
+ pr_debug("Guest kallsyms path too long for %s. Skipping.\n",
+ namelist[i]->d_name);
+ free(namelist[i]);
+ continue;
+ }
if (access(path, R_OK)) {
pr_debug("Can't access file %s\n", path);
free(namelist[i]);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0837/1376] bpf, x86: Fix trampoline stack size for 128-bit arguments
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (835 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0836/1376] perf machine: Check snprintf truncation for guest kallsyms path Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0838/1376] wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement Greg Kroah-Hartman
` (161 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yonghong Song, Leon Hwang,
Kumar Kartikeya Dwivedi, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonghong Song <yonghong.song@linux.dev>
[ Upstream commit 814cba835ef648e0c5eb79505c96c0493b29eea6 ]
btf_distill_func_proto() accepts a function argument up to 16 bytes, so a
128-bit scalar such as __int128 reaches the x86 trampoline with
arg_size == 16. But the current implementation assumes an __int128
argument only needs one register, so the register save area is
under-allocated and save_args() overwrites adjacent stack slots.
Compute the register count from arg_size for all arguments to fix it.
Fixes: a9c5ad31fbdc ("bpf: x86: Support in-register struct arguments in trampoline programs")
Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
Acked-by: Leon Hwang <leon.hwang@linux.dev>
Link: https://lore.kernel.org/bpf/20260729050204.2586457-1-yonghong.song@linux.dev
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/net/bpf_jit_comp.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index 5e1518218f1de..ca882b8d70734 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -2948,11 +2948,8 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *rw_im
WARN_ON_ONCE((flags & BPF_TRAMP_F_INDIRECT) &&
(flags & ~(BPF_TRAMP_F_INDIRECT | BPF_TRAMP_F_RET_FENTRY_RET)));
- /* extra registers for struct arguments */
- for (i = 0; i < m->nr_args; i++) {
- if (m->arg_flags[i] & BTF_FMODEL_STRUCT_ARG)
- nr_regs += (m->arg_size[i] + 7) / 8 - 1;
- }
+ for (i = 0; i < m->nr_args; i++)
+ nr_regs += (m->arg_size[i] + 7) / 8 - 1;
/* x86-64 supports up to MAX_BPF_FUNC_ARGS arguments. 1-6
* are passed through regs, the remains are through stack.
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0838/1376] wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (836 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0837/1376] bpf, x86: Fix trampoline stack size for 128-bit arguments Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0839/1376] wifi: mt76: mt7915: fix double hif2 init on the non-WED path Greg Kroah-Hartman
` (160 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Felix Fietkau, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@nbd.name>
[ Upstream commit 16a04441eab0dcd4d7126a6f66b370adbf28f96d ]
The flow is added to dev->twt_list before sending the agreement to the
firmware, but the error path leaves it linked while flowid_mask is
never set. The flow slot can then be reused and memset while still on
the list, corrupting twt_list, and station removal leaves a dangling
entry behind that mt7915_mac_twt_sched_list_add() later walks.
Fixes: 3782b69d03e7 ("mt76: mt7915: introduce mt7915_mac_add_twt_setup routine")
Link: https://patch.msgid.link/20260724124813.3961474-17-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
index b058a38a88cf2..bd8bd74f0336d 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
@@ -2371,8 +2371,10 @@ void mt7915_mac_add_twt_setup(struct ieee80211_hw *hw,
}
flow->tsf = le64_to_cpu(twt_agrt->twt);
- if (mt7915_mcu_twt_agrt_update(dev, msta->vif, flow, MCU_TWT_AGRT_ADD))
+ if (mt7915_mcu_twt_agrt_update(dev, msta->vif, flow, MCU_TWT_AGRT_ADD)) {
+ list_del(&flow->list);
goto unlock;
+ }
setup_cmd = TWT_SETUP_CMD_ACCEPT;
dev->twt.table_mask |= BIT(table_id);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0839/1376] wifi: mt76: mt7915: fix double hif2 init on the non-WED path
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (837 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0838/1376] wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0840/1376] wifi: mt76: mt7915: fix ext PHY use-after-free on register error path Greg Kroah-Hartman
` (159 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Felix Fietkau, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@nbd.name>
[ Upstream commit 3ae8ad277e2819a281b0e36b55633c8515c16ce7 ]
mt7915_pci_init_hif2() was called unconditionally and again inside the
WED-inactive branch. The helper increments the global hif_idx, writes the
PCIe RECOG_ID register and takes a get_device() reference via
mt7915_pci_get_hif2(), while removal only drops one reference. On non-WED
dual-hif hardware this double-incremented hif_idx, wrote RECOG_ID twice and
leaked a device reference. Only the call inside the WED-inactive branch is
correct; drop the unconditional one. hif2 is already initialised to NULL.
Fixes: cacdd67812c6 ("mt76: mt7915: add mt7915_mmio_probe() as a common probing function")
Link: https://patch.msgid.link/20260727150434.1778520-2-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7915/pci.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/pci.c b/drivers/net/wireless/mediatek/mt76/mt7915/pci.c
index 07b0a5766eab7..5a0c9eeb2c4e2 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/pci.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/pci.c
@@ -135,7 +135,6 @@ static int mt7915_pci_probe(struct pci_dev *pdev,
mdev = &dev->mt76;
mt7915_wfsys_reset(dev);
- hif2 = mt7915_pci_init_hif2(pdev);
ret = mt7915_mmio_wed_init(dev, pdev, true, &irq);
if (ret < 0)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0840/1376] wifi: mt76: mt7915: fix ext PHY use-after-free on register error path
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (838 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0839/1376] wifi: mt76: mt7915: fix double hif2 init on the non-WED path Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0841/1376] wifi: mt76: mt7915: release hif2 reference on probe IRQ failure Greg Kroah-Hartman
` (158 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Felix Fietkau, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@nbd.name>
[ Upstream commit 15b960014f24dce5388d4a2e7274e6490cb3c421 ]
After mt7915_register_ext_phy() succeeded, a failure of the main PHY
mt7915_init_debugfs() or mt7915_coredump_register() unwound through
free_phy2, which called ieee80211_free_hw() on the ext PHY hw while it
was still registered with mac80211, since mt76_unregister_device() only
unregisters the main hw. Unregister the ext PHY (thermal + phy + hw)
first and skip the redundant free.
Fixes: 7b8e1ae886e4 ("mt76: mt7915: rework hardware/phy initialization")
Link: https://patch.msgid.link/20260727150434.1778520-3-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7915/init.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/init.c b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
index b2220ff7d6758..96871012bed3b 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
@@ -1253,14 +1253,19 @@ int mt7915_register_device(struct mt7915_dev *dev)
ret = mt7915_init_debugfs(&dev->phy);
if (ret)
- goto unreg_thermal;
+ goto unreg_ext_phy;
ret = mt7915_coredump_register(dev);
if (ret)
- goto unreg_thermal;
+ goto unreg_ext_phy;
return 0;
+unreg_ext_phy:
+ if (phy2) {
+ mt7915_unregister_ext_phy(dev);
+ phy2 = NULL;
+ }
unreg_thermal:
mt7915_unregister_thermal(&dev->phy);
unreg_dev:
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0841/1376] wifi: mt76: mt7915: release hif2 reference on probe IRQ failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (839 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0840/1376] wifi: mt76: mt7915: fix ext PHY use-after-free on register error path Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0842/1376] wifi: mt76: mt7996: fix reg addr remap when addr is 0 Greg Kroah-Hartman
` (157 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Felix Fietkau, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@nbd.name>
[ Upstream commit 8370aebd26a9dfa2e0de665e3ab504c0e97ee730 ]
The hif2 reference obtained by mt7915_pci_init_hif2() is only released on
error paths that key off dev->hif2, which is not assigned until after the
IRQ setup. If pci_alloc_irq_vectors() or the primary devm_request_irq()
fails, the reference leaks. Drop it explicitly on those paths via
mt7915_put_hif2().
Fixes: f68d67623dec ("mt76: mt7915: add Wireless Ethernet Dispatch support")
Link: https://patch.msgid.link/20260727150434.1778520-4-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7915/pci.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/pci.c b/drivers/net/wireless/mediatek/mt76/mt7915/pci.c
index 5a0c9eeb2c4e2..c24f1b12f064f 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/pci.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/pci.c
@@ -144,16 +144,20 @@ static int mt7915_pci_probe(struct pci_dev *pdev,
hif2 = mt7915_pci_init_hif2(pdev);
ret = pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_ALL_TYPES);
- if (ret < 0)
+ if (ret < 0) {
+ mt7915_put_hif2(hif2);
goto free_device;
+ }
irq = pdev->irq;
}
ret = devm_request_irq(mdev->dev, irq, mt7915_irq_handler,
IRQF_SHARED, KBUILD_MODNAME, dev);
- if (ret)
+ if (ret) {
+ mt7915_put_hif2(hif2);
goto free_wed_or_irq_vector;
+ }
/* master switch of PCIe tnterrupt enable */
mt76_wr(dev, MT_PCIE_MAC_INT_ENABLE, 0xff);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0842/1376] wifi: mt76: mt7996: fix reg addr remap when addr is 0
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (840 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0841/1376] wifi: mt76: mt7915: release hif2 reference on probe IRQ failure Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0843/1376] wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1 Greg Kroah-Hartman
` (156 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, StanleyYP Wang, Felix Fietkau,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
[ Upstream commit eb906eeff2d1e84b628dc210dada325269c71383 ]
When addr is less than the hardcoded threshold in __mt7996_reg_addr,
it indicates that remapping is unnecessary.
Currently, the flow remaps address 0x0 to MT_HIF_REMAP_BASE_L2,
which is incorrect.
To address this, modify __mt7996_reg_addr to return INVALID_REG_ADDR
if the address is not below the hardcoded value or is not present in
the mt7996_reg_map array.
Additionally, update the remap condition to check if addr is equal to
INVALID_REG_ADDR.
Fixes: 3687854d3e7e ("wifi: mt76: mt7996: add locking for accessing mapped registers")
Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
Link: https://patch.msgid.link/20260727150434.1778520-5-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7996/mmio.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c b/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c
index bffee73b780cb..01d4b54a1acc6 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c
@@ -17,6 +17,8 @@
static bool wed_enable;
module_param(wed_enable, bool, 0644);
+#define INVALID_REG_ADDR 0xffffffff
+
static const struct __base mt7996_reg_base[] = {
[WF_AGG_BASE] = { { 0x820e2000, 0x820f2000, 0x830e2000 } },
[WF_ARB_BASE] = { { 0x820e3000, 0x820f3000, 0x830e3000 } },
@@ -183,7 +185,7 @@ static u32 __mt7996_reg_addr(struct mt7996_dev *dev, u32 addr)
return dev->reg.map[i].mapped + ofs;
}
- return 0;
+ return INVALID_REG_ADDR;
}
static u32 __mt7996_reg_remap_addr(struct mt7996_dev *dev, u32 addr)
@@ -212,7 +214,7 @@ void mt7996_memcpy_fromio(struct mt7996_dev *dev, void *buf, u32 offset,
{
u32 addr = __mt7996_reg_addr(dev, offset);
- if (addr) {
+ if (addr != INVALID_REG_ADDR) {
memcpy_fromio(buf, dev->mt76.mmio.regs + addr, len);
return;
}
@@ -228,7 +230,7 @@ static u32 mt7996_rr(struct mt76_dev *mdev, u32 offset)
struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
u32 addr = __mt7996_reg_addr(dev, offset), val;
- if (addr)
+ if (addr != INVALID_REG_ADDR)
return dev->bus_ops->rr(mdev, addr);
spin_lock_bh(&dev->reg_lock);
@@ -243,7 +245,7 @@ static void mt7996_wr(struct mt76_dev *mdev, u32 offset, u32 val)
struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
u32 addr = __mt7996_reg_addr(dev, offset);
- if (addr) {
+ if (addr != INVALID_REG_ADDR) {
dev->bus_ops->wr(mdev, addr, val);
return;
}
@@ -258,7 +260,7 @@ static u32 mt7996_rmw(struct mt76_dev *mdev, u32 offset, u32 mask, u32 val)
struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
u32 addr = __mt7996_reg_addr(dev, offset);
- if (addr)
+ if (addr != INVALID_REG_ADDR)
return dev->bus_ops->rmw(mdev, addr, mask, val);
spin_lock_bh(&dev->reg_lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0843/1376] wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (841 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0842/1376] wifi: mt76: mt7996: fix reg addr remap when addr is 0 Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0844/1376] wifi: mt76: mt7915: report RX chain signal for all RX paths Greg Kroah-Hartman
` (155 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Felix Fietkau, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@nbd.name>
[ Upstream commit ea891799eccc9e43ebba0dc157d4b197ad6c1a0e ]
On single-adie mt7986 the only phy is bound to band 1, but its chainmask
is stored unshifted, because dev->chainshift is still zero while the
eeprom is parsed for the main phy. mt7915_set_antenna() on the other
hand shifts by chainshift * band_idx, so the representation of the
chainmask changed as soon as the antenna configuration was touched.
Until then, mt7915_mcu_set_chan_info() passed rx_path = 0 to the
firmware, since shifting the unshifted mask down clears all bits.
Keep the unshifted form for that case and add helpers for the band local
chainmask, so that only the band 1 phy of a dbdc device uses the shifted
form.
Fixes: 3eb50cc90534 ("wifi: mt76: mt7915: rely on band_idx of mt76_phy")
Link: https://patch.msgid.link/20260727150434.1778520-8-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/wireless/mediatek/mt76/mt7915/eeprom.c | 2 +-
.../net/wireless/mediatek/mt76/mt7915/main.c | 6 +++---
.../net/wireless/mediatek/mt76/mt7915/mcu.c | 2 +-
.../net/wireless/mediatek/mt76/mt7915/mt7915.h | 18 ++++++++++++++++++
.../wireless/mediatek/mt76/mt7915/testmode.c | 5 +----
5 files changed, 24 insertions(+), 9 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c
index b038568e0be91..93956d4020414 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c
@@ -257,7 +257,7 @@ void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
nss = min_t(u8, min_t(u8, nss_max, nss), path);
mphy->chainmask = BIT(path) - 1;
- if (band)
+ if (band && dev->dbdc_support)
mphy->chainmask <<= dev->chainshift;
mphy->antenna_mask = BIT(nss) - 1;
dev->chainmask |= mphy->chainmask;
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/main.c b/drivers/net/wireless/mediatek/mt76/mt7915/main.c
index b065a8938dd5d..0e3ca0eb9f082 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/main.c
@@ -1072,7 +1072,7 @@ mt7915_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
struct mt7915_dev *dev = mt7915_hw_dev(hw);
struct mt7915_phy *phy = mt7915_hw_phy(hw);
int max_nss = hweight8(hw->wiphy->available_antennas_tx);
- u8 chainshift = dev->chainshift;
+ u8 shift = mt7915_band_chainshift(phy);
u8 band = phy->mt76->band_idx;
if (!tx_ant || tx_ant != rx_ant || ffs(tx_ant) > max_nss)
@@ -1085,9 +1085,9 @@ mt7915_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
/* handle a variant of mt7916/mt7981 which has 3T3R but nss2 on 5 GHz band */
if ((is_mt7916(&dev->mt76) || is_mt7981(&dev->mt76)) &&
band && hweight8(tx_ant) == max_nss)
- phy->mt76->chainmask = (dev->chainmask >> chainshift) << chainshift;
+ phy->mt76->chainmask = (dev->chainmask >> shift) << shift;
else
- phy->mt76->chainmask = tx_ant << (chainshift * band);
+ phy->mt76->chainmask = tx_ant << shift;
mt76_set_stream_caps(phy->mt76, true);
mt7915_set_stream_vht_txbf_caps(phy);
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
index 276cbc7693fef..343866dfc112b 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
@@ -2758,7 +2758,7 @@ int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
.center_ch = ieee80211_frequency_to_channel(freq1),
.bw = mt76_connac_chan_bw(chandef),
.tx_path_num = hweight16(phy->mt76->chainmask),
- .rx_path = phy->mt76->chainmask >> (dev->chainshift * band),
+ .rx_path = mt7915_band_chainmask(phy),
.band_idx = band,
.channel_band = ch_band[chandef->chan->band],
};
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h b/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h
index f49d6b2f81e42..623b3077ed6f6 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h
@@ -383,6 +383,24 @@ mt7915_ext_phy(struct mt7915_dev *dev)
return phy->priv;
}
+/* without dbdc, the chainmask is stored unshifted, even if the phy is
+ * bound to band 1
+ */
+static inline u8 mt7915_band_chainshift(struct mt7915_phy *phy)
+{
+ struct mt7915_dev *dev = phy->dev;
+
+ if (!dev->dbdc_support)
+ return 0;
+
+ return phy->mt76->band_idx * dev->chainshift;
+}
+
+static inline u16 mt7915_band_chainmask(struct mt7915_phy *phy)
+{
+ return phy->mt76->chainmask >> mt7915_band_chainshift(phy);
+}
+
static inline u32 mt7915_check_adie(struct mt7915_dev *dev, bool sku)
{
u32 mask = sku ? MT_CONNINFRA_SKU_MASK : MT_ADIE_TYPE_MASK;
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/testmode.c b/drivers/net/wireless/mediatek/mt76/mt7915/testmode.c
index d534fff5c952b..2a9e5d9ff101c 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/testmode.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/testmode.c
@@ -694,9 +694,7 @@ mt7915_tm_set_params(struct mt76_phy *mphy, struct nlattr **tb,
{
struct mt76_testmode_data *td = &mphy->test;
struct mt7915_phy *phy = mphy->priv;
- struct mt7915_dev *dev = phy->dev;
- u32 chainmask = mphy->chainmask, changed = 0;
- bool ext_phy = phy != &dev->phy;
+ u32 chainmask = mt7915_band_chainmask(phy), changed = 0;
int i;
BUILD_BUG_ON(NUM_TM_CHANGED >= 32);
@@ -705,7 +703,6 @@ mt7915_tm_set_params(struct mt76_phy *mphy, struct nlattr **tb,
td->state == MT76_TM_STATE_OFF)
return 0;
- chainmask = ext_phy ? chainmask >> dev->chainshift : chainmask;
if (td->tx_antenna_mask > chainmask)
return -EINVAL;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0844/1376] wifi: mt76: mt7915: report RX chain signal for all RX paths
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (842 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0843/1376] wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1 Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0845/1376] wifi: mt76: mt7925: advertise EHT 320MHz capabilities for 6GHz band Greg Kroah-Hartman
` (154 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Felix Fietkau, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@nbd.name>
[ Upstream commit b53c44fe65792608f58028c7b0953e610ad652ee ]
status->chains was set from the antenna mask, which is derived from the
number of spatial streams, while the chain_signal array is filled from
all RCPI fields. On boards where the number of RX paths exceeds the
stream count, e.g. the 3T3R mt7916/mt7981 variant with 2 streams on the
5 GHz band, the RSSI of the extra chains was never reported.
Use the band local RX path chainmask instead.
Fixes: e57b7901469f ("mt76: add mac80211 driver for MT7915 PCIe-based chipsets")
Link: https://patch.msgid.link/20260727150434.1778520-9-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
index bd8bd74f0336d..f165e61ed28f7 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
@@ -444,7 +444,7 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
if (v0 & MT_PRXV_HT_AD_CODE)
status->enc_flags |= RX_ENC_FLAG_LDPC;
- status->chains = mphy->antenna_mask;
+ status->chains = mt7915_band_chainmask(phy);
status->chain_signal[0] = to_rssi(MT_PRXV_RCPI0, v1);
status->chain_signal[1] = to_rssi(MT_PRXV_RCPI1, v1);
status->chain_signal[2] = to_rssi(MT_PRXV_RCPI2, v1);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0845/1376] wifi: mt76: mt7925: advertise EHT 320MHz capabilities for 6GHz band
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (843 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0844/1376] wifi: mt76: mt7915: report RX chain signal for all RX paths Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0846/1376] wifi: mt76: mt7925: Fix EHT Beamformee SS subfields to meet 802.11be minimum Greg Kroah-Hartman
` (153 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marcin FM, Cristian-Florin Radoi,
George Salukvadze, Evgeny Kapusta, Samu Toljamo, Ariel Rosenfeld,
Chapuis Dario, Thibaut François, 张旭涵,
Sean Wang, Javier Tia, Felix Fietkau, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Tia <floss@jetm.me>
[ Upstream commit 77833c57a33450c0409e4b90d7721d255ea23a9e ]
mt7925_init_eht_caps() only populates EHT MCS/NSS maps for BW <= 80
and BW = 160, but never sets BW = 320. This means iw phy shows no
320MHz MCS map entries even though the hardware supports 320MHz
operation in the 6GHz band.
Add the missing 320MHz capability bits for 6GHz:
- PHY_CAP0: IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ
- PHY_CAP1: beamformee SS for 320MHz
- PHY_CAP2: sounding dimensions for 320MHz
- PHY_CAP6: MCS15 support for 320MHz width
- MCS/NSS: populate bw._320 maps for 6GHz band
Introduce is_320mhz_supported() to gate 320MHz on MT7927 only, since
MT7925 does not support 320MHz operation.
Tested-by: Marcin FM <marcin@lgic.pl>
Tested-by: Cristian-Florin Radoi <radoi.chris@gmail.com>
Tested-by: George Salukvadze <giosal90@gmail.com>
Tested-by: Evgeny Kapusta <3193631@gmail.com>
Tested-by: Samu Toljamo <samu.toljamo@gmail.com>
Tested-by: Ariel Rosenfeld <ariel.rosenfeld.750@gmail.com>
Tested-by: Chapuis Dario <chapuisdario4@gmail.com>
Tested-by: Thibaut François <tibo@humeurlibre.fr>
Tested-by: 张旭涵 <Loong.0x00@gmail.com>
Reviewed-by: Sean Wang <sean.wang@mediatek.com>
Signed-off-by: Javier Tia <floss@jetm.me>
Link: https://patch.msgid.link/20260425195011.790265-6-sean.wang@kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Stable-dep-of: 404c4e564f6b ("wifi: mt76: mt7925: Fix EHT Beamformee SS subfields to meet 802.11be minimum")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/wireless/mediatek/mt76/mt76_connac.h | 5 +++++
.../net/wireless/mediatek/mt76/mt7925/main.c | 22 ++++++++++++++++++-
2 files changed, 26 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac.h b/drivers/net/wireless/mediatek/mt76/mt76_connac.h
index 445d0f0ab7795..deb3c27ddc317 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76_connac.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76_connac.h
@@ -177,6 +177,11 @@ static inline bool is_mt7925(struct mt76_dev *dev)
return mt76_chip(dev) == 0x7925;
}
+static inline bool is_320mhz_supported(struct mt76_dev *dev)
+{
+ return mt76_chip(dev) == 0x7927;
+}
+
static inline bool is_mt7920(struct mt76_dev *dev)
{
return mt76_chip(dev) == 0x7920;
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/main.c b/drivers/net/wireless/mediatek/mt76/mt7925/main.c
index 626e68905ffa0..c219460549679 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/main.c
@@ -178,6 +178,10 @@ mt7925_init_eht_caps(struct mt792x_phy *phy, enum nl80211_band band,
IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE;
+ if (band == NL80211_BAND_6GHZ && is_320mhz_supported(&phy->dev->mt76))
+ eht_cap_elem->phy_cap_info[0] |=
+ IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ;
+
eht_cap_elem->phy_cap_info[0] |=
u8_encode_bits(u8_get_bits(sts - 1, BIT(0)),
IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK);
@@ -188,10 +192,20 @@ mt7925_init_eht_caps(struct mt792x_phy *phy, enum nl80211_band band,
u8_encode_bits(sts - 1,
IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK);
+ if (band == NL80211_BAND_6GHZ && is_320mhz_supported(&phy->dev->mt76))
+ eht_cap_elem->phy_cap_info[1] |=
+ u8_encode_bits(sts - 1,
+ IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK);
+
eht_cap_elem->phy_cap_info[2] =
u8_encode_bits(sts - 1, IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK) |
u8_encode_bits(sts - 1, IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK);
+ if (band == NL80211_BAND_6GHZ && is_320mhz_supported(&phy->dev->mt76))
+ eht_cap_elem->phy_cap_info[2] |=
+ u8_encode_bits(sts - 1,
+ IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_320MHZ_MASK);
+
eht_cap_elem->phy_cap_info[3] =
IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
@@ -212,7 +226,8 @@ mt7925_init_eht_caps(struct mt792x_phy *phy, enum nl80211_band band,
u8_encode_bits(u8_get_bits(0x11, GENMASK(1, 0)),
IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK);
- val = width == NL80211_CHAN_WIDTH_160 ? 0x7 :
+ val = width == NL80211_CHAN_WIDTH_320 ? 0xf :
+ width == NL80211_CHAN_WIDTH_160 ? 0x7 :
width == NL80211_CHAN_WIDTH_80 ? 0x3 : 0x1;
eht_cap_elem->phy_cap_info[6] =
u8_encode_bits(u8_get_bits(0x11, GENMASK(4, 2)),
@@ -234,6 +249,11 @@ mt7925_init_eht_caps(struct mt792x_phy *phy, enum nl80211_band band,
eht_nss->bw._160.rx_tx_mcs9_max_nss = val;
eht_nss->bw._160.rx_tx_mcs11_max_nss = val;
eht_nss->bw._160.rx_tx_mcs13_max_nss = val;
+ if (band == NL80211_BAND_6GHZ && is_320mhz_supported(&phy->dev->mt76)) {
+ eht_nss->bw._320.rx_tx_mcs9_max_nss = val;
+ eht_nss->bw._320.rx_tx_mcs11_max_nss = val;
+ eht_nss->bw._320.rx_tx_mcs13_max_nss = val;
+ }
}
int mt7925_init_mlo_caps(struct mt792x_phy *phy)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0846/1376] wifi: mt76: mt7925: Fix EHT Beamformee SS subfields to meet 802.11be minimum
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (844 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0845/1376] wifi: mt76: mt7925: advertise EHT 320MHz capabilities for 6GHz band Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0847/1376] wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump Greg Kroah-Hartman
` (152 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, shengwei.lu, Felix Fietkau,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: shengwei.lu <shengwei.lu@mediatek.com>
[ Upstream commit 404c4e564f6b1eeffd10bf2b2d3b86620f5794c3 ]
Per IEEE 802.11be, the Beamformee SS <= 80/160/320 MHz 3-bit subfields
in the EHT PHY Capabilities are encoded as (Nss - 1) and are required
to be >= 3 (i.e. at least 4 SS receive capability) whenever SU
Beamformee is advertised.
MT7925 is a 2x2 STA (sts = 2), so directly filling (sts - 1) = 1
violates the spec minimum. Clamp the encoded value to 3 when sts <= 3,
otherwise use (sts - 1). This is applied consistently to the
BEAMFORMEE_SS <= 80 MHz (split across phy_cap_info[0]/[1]), <= 160 MHz
and <= 320 MHz (6 GHz only) subfields.
Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
Signed-off-by: shengwei.lu <shengwei.lu@mediatek.com>
Link: https://patch.msgid.link/20260723031108.2017653-1-jb.tsai@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7925/main.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/main.c b/drivers/net/wireless/mediatek/mt76/mt7925/main.c
index c219460549679..bcc5ce829169f 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/main.c
@@ -182,19 +182,21 @@ mt7925_init_eht_caps(struct mt792x_phy *phy, enum nl80211_band band,
eht_cap_elem->phy_cap_info[0] |=
IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ;
+ val = (sts > 3) ? sts - 1 : 3;
+
eht_cap_elem->phy_cap_info[0] |=
- u8_encode_bits(u8_get_bits(sts - 1, BIT(0)),
+ u8_encode_bits(u8_get_bits(val, BIT(0)),
IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK);
eht_cap_elem->phy_cap_info[1] =
- u8_encode_bits(u8_get_bits(sts - 1, GENMASK(2, 1)),
+ u8_encode_bits(u8_get_bits(val, GENMASK(2, 1)),
IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK) |
- u8_encode_bits(sts - 1,
+ u8_encode_bits(val,
IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK);
if (band == NL80211_BAND_6GHZ && is_320mhz_supported(&phy->dev->mt76))
eht_cap_elem->phy_cap_info[1] |=
- u8_encode_bits(sts - 1,
+ u8_encode_bits(val,
IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK);
eht_cap_elem->phy_cap_info[2] =
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0847/1376] wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (845 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0846/1376] wifi: mt76: mt7925: Fix EHT Beamformee SS subfields to meet 802.11be minimum Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0848/1376] iommu/arm-smmu-v3: Convert to use atomic poll timeout Greg Kroah-Hartman
` (151 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linghui Wu, Rameshkumar Sundaram,
Baochen Qiang, Jeff Johnson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linghui Wu <linghui.wu@oss.qualcomm.com>
[ Upstream commit 4f25071afe9218aaae1c63fbf75e229aa6405319 ]
On WCN3990/SNOC the MSA region is mapped with devm_memremap(MEMREMAP_WT).
On arm64 such a mapping is not Normal-cacheable, so unaligned accesses to
it are not permitted. ath10k_msa_dump_memory() copies the region with a
plain memcpy(), whose optimized __pi_memcpy_generic implementation issues
wide/unaligned loads. This triggers an alignment fault (FSC=0x21) Oops in
ath10k_snoc_fw_crashed_dump() while collecting the devcoredump:
Unable to handle kernel paging request ... FSC=0x21: alignment fault
pc : __pi_memcpy_generic
lr : ath10k_snoc_fw_crashed_dump [ath10k_snoc]
The Oops both leaves the firmware RAM dump buffer zeroed (no dump is
captured) and crashes the kernel, which in turn breaks modem SSR
recovery.
Use memcpy_fromio(), which only performs accesses that are valid for such
a device-memory mapping. The generic memcpy_fromio() implementation aligns
the source before issuing word-sized reads and stores the destination with
put_unaligned(), so it is also safe for the coherent DMA allocation used on
the non-reserved-memory path. ath11k and ath12k use the same pattern
when copying target memory into crash dumps, so call it unconditionally
here too.
The MEMREMAP_WT pointer is a plain void *, so an explicit __iomem cast is
needed; use __force to keep sparse happy.
Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.3.3.7.c5-00107-QCAHLSWMTPL-1
Fixes: 3f14b73c3843 ("ath10k: Enable MSA region dump support for WCN3990")
Signed-off-by: Linghui Wu <linghui.wu@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260727072629.2297208-1-linghui.wu@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath10k/snoc.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/ath10k/snoc.c b/drivers/net/wireless/ath/ath10k/snoc.c
index 59f7ccb33fde3..ad215de068e1c 100644
--- a/drivers/net/wireless/ath/ath10k/snoc.c
+++ b/drivers/net/wireless/ath/ath10k/snoc.c
@@ -5,6 +5,7 @@
#include <linux/bits.h>
#include <linux/clk.h>
+#include <linux/io.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/of.h>
@@ -1455,11 +1456,15 @@ static void ath10k_msa_dump_memory(struct ath10k *ar,
hdr->length = cpu_to_le32(ar->msa.mem_size);
if (current_region->len < ar->msa.mem_size) {
- memcpy(buf, ar->msa.vaddr, current_region->len);
+ memcpy_fromio(buf,
+ (const void __iomem __force *)ar->msa.vaddr,
+ current_region->len);
ath10k_warn(ar, "msa dump length is less than msa size %x, %x\n",
current_region->len, ar->msa.mem_size);
} else {
- memcpy(buf, ar->msa.vaddr, ar->msa.mem_size);
+ memcpy_fromio(buf,
+ (const void __iomem __force *)ar->msa.vaddr,
+ ar->msa.mem_size);
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0848/1376] iommu/arm-smmu-v3: Convert to use atomic poll timeout
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (846 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0847/1376] wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0849/1376] perf/cxlpmu: Fix 64-bit write to 32-bit HDM filter register Greg Kroah-Hartman
` (150 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Pranjal Shrivastava,
Will Deacon, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pranjal Shrivastava <praan@google.com>
[ Upstream commit eced8058c82a3a81ae480a6546e2da32100dddfa ]
The arm_smmu_write_reg_sync() helper is currently implemented using
readl_relaxed_poll_timeout() (that relies on usleep_range() internally)
which becomes a critical issue when used in the gerror irq handler.
If the SMMU hits a gerror and enters Service Failure Mode
(GERROR_SFM_ERR), the gerror handler calls arm_smmu_device_disable() in
hard-irq context. This becomes a problem as arm_smmu_device_disable()
inevitably calls arm_smmu_write_reg_sync() which might attempt to sleep
inside a hard-irq context.
Fix this by converting the arm_smmu_write_reg_sync to use the
readl_relaxed_poll_timeout_atomic() polling helper.
(Discovered while running Sashiko locally on another patch series).
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: 48ec83bcbcf5 ("iommu/arm-smmu: Add initial driver support for ARM SMMUv3 devices")
Signed-off-by: Pranjal Shrivastava <praan@google.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
index 0a8a6cf1f0330..28331d9118b63 100644
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
@@ -3774,8 +3774,9 @@ static int arm_smmu_write_reg_sync(struct arm_smmu_device *smmu, u32 val,
u32 reg;
writel_relaxed(val, smmu->base + reg_off);
- return readl_relaxed_poll_timeout(smmu->base + ack_off, reg, reg == val,
- 1, ARM_SMMU_POLL_TIMEOUT_US);
+ return readl_relaxed_poll_timeout_atomic(smmu->base + ack_off, reg,
+ reg == val, 1,
+ ARM_SMMU_POLL_TIMEOUT_US);
}
/* GBPA is "special" */
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0849/1376] perf/cxlpmu: Fix 64-bit write to 32-bit HDM filter register
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (847 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0848/1376] iommu/arm-smmu-v3: Convert to use atomic poll timeout Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0850/1376] wifi: mac80211: send TWT teardown to peer after setup TX failure Greg Kroah-Hartman
` (149 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Davidlohr Bueso, Richard Cheng,
Dave Jiang, Will Deacon, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Davidlohr Bueso <dave@stgolabs.net>
[ Upstream commit ea434e8fd3a539e9c53285b10d3c7e539e228591 ]
The HDM decoder filter configuration register is 32 bits wide, but the
driver programs it with a 64-bit writeq(). The filter value never
exceeds 32 bits, so the upper half of the write is always zero and
lands in the adjacent Filter ID 1 (Channel/Rank/Bank) configuration
register at offset+4.
Fixes: 5d7107c72796 ("perf: CXL Performance Monitoring Unit driver")
Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
Reviewed-by: Richard Cheng <icheng@nvidia.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/perf/cxl_pmu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/perf/cxl_pmu.c b/drivers/perf/cxl_pmu.c
index 24244096f5141..ce97062a66190 100644
--- a/drivers/perf/cxl_pmu.c
+++ b/drivers/perf/cxl_pmu.c
@@ -632,7 +632,7 @@ static void cxl_pmu_event_start(struct perf_event *event, int flags)
cfg = cxl_pmu_config2_get_hdm_decoder(event);
else
cfg = GENMASK(31, 0); /* No filtering if 0xFFFF_FFFF */
- writeq(cfg, base + CXL_PMU_FILTER_CFG_REG(hwc->idx, 0));
+ writel(cfg, base + CXL_PMU_FILTER_CFG_REG(hwc->idx, 0));
}
cfg = readq(base + CXL_PMU_COUNTER_CFG_REG(hwc->idx));
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0850/1376] wifi: mac80211: send TWT teardown to peer after setup TX failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (848 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0849/1376] perf/cxlpmu: Fix 64-bit write to 32-bit HDM filter register Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0851/1376] wifi: zd1211rw: reject secondary interfaces to prevent conflicts Greg Kroah-Hartman
` (148 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhao Li, Johannes Berg, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Li <enderaoelyther@gmail.com>
[ Upstream commit a28fcce6ee74be8a4526e6cfa16dc7786d62a784 ]
When an AP's TWT Setup response is not acknowledged,
ieee80211_s1g_tx_twt_setup_fail() asks the driver to tear down the local
agreement and sends a TWT teardown action as the peer notification. It
uses the response SA as the destination, but
ieee80211_s1g_send_twt_setup() built that response with SA set to the
AP's address. The teardown is therefore queued with DA, SA and BSSID all
set to the AP address and never reaches the station.
The in-tree driver callbacks update local hardware state and emit no
action frame. The station receives no notification that mac80211 asked
the driver to remove the agreement and can keep following the TWT
schedule, leaving the peers' power-save state desynchronized.
Address the teardown to the response DA, the station to which the failed
response was sent. This also matches the station lookup the transmit
status path already performs on the same frame.
Fixes: f5a4c24e689f ("mac80211: introduce individual TWT support in AP mode")
Assisted-by: Codex:gpt-5.6-sol
Assisted-by: Kimi:K3
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
Link: https://patch.msgid.link/20260729173607.13340-1-enderaoelyther@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/s1g.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/mac80211/s1g.c b/net/mac80211/s1g.c
index 2a23e431cbb5a..657f281adf10a 100644
--- a/net/mac80211/s1g.c
+++ b/net/mac80211/s1g.c
@@ -147,7 +147,7 @@ ieee80211_s1g_tx_twt_setup_fail(struct ieee80211_sub_if_data *sdata,
drv_twt_teardown_request(sdata->local, sdata, &sta->sta, flowid);
- ieee80211_s1g_send_twt_teardown(sdata, mgmt->sa, sdata->vif.addr,
+ ieee80211_s1g_send_twt_teardown(sdata, mgmt->da, sdata->vif.addr,
flowid);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0851/1376] wifi: zd1211rw: reject secondary interfaces to prevent conflicts
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (849 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0850/1376] wifi: mac80211: send TWT teardown to peer after setup TX failure Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0852/1376] wifi: mac80211: skip unused probe response countdown offsets Greg Kroah-Hartman
` (147 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+0ec3d1a6cf1fbe79c153,
Slawomir Stepien, Johannes Berg, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Slawomir Stepien <sst@poczta.fm>
[ Upstream commit 0e4532ec658606f76f62eb277e7a933919d36cbb ]
The zd1211rw driver is designed for single-function Wi-Fi dongles and
hardcodes its USB endpoints. When a malformed USB device exposes multiple
interfaces that match the driver's device ID, the driver blindly binds to
all of them.
During probe(), the driver calls usb_reset_device(), which iterates over
all interfaces and invokes the pre_reset() callback for each bound
interface. Since multiple interfaces are bound to zd1211rw, pre_reset() is
called sequentially for each instance, acquiring their respective
&mac->chip.mutex. Because all instances initialize their mutexes with the
same lock class, lockdep detects a task acquiring a lock of the same class
it already holds and flags it as a possible recursive deadlock:
WARNING: possible recursive locking detected
kworker/0:1/11 is trying to acquire lock:
ffff88810371dde0 (&chip->mutex){+.+.}-{4:4}, at:
zd_chip_disable_rxtx+0x20/0x50
drivers/net/wireless/zydas/zd1211rw/zd_chip.c:1465
but task is already holding lock:
ffff8881138ddde0 (&chip->mutex){+.+.}-{4:4}, at: pre_reset+0x28c/0x380
drivers/net/wireless/zydas/zd1211rw/zd_usb.c:1505
Fix this by explicitly rejecting secondary interfaces (bInterfaceNumber !=
0) during probe(). This ensures that only a single instance of the driver
binds to the device, eliminating the recursive locking scenario.
Fixes: e85d0918b54f ("[PATCH] ZyDAS ZD1211 USB-WLAN driver")
Assisted-by: Gemini:gemini-3.5-flash Gemini:gemini-3.1-pro-preview syzbot
Reported-by: syzbot+0ec3d1a6cf1fbe79c153@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=0ec3d1a6cf1fbe79c153
Link: https://syzkaller.appspot.com/ai_job?id=00724ef7-fd77-4cde-9779-895b8f63c2f6
Signed-off-by: Slawomir Stepien <sst@poczta.fm>
Link: https://patch.msgid.link/20260730065231.1644030-1-sst@poczta.fm
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/zydas/zd1211rw/zd_usb.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/net/wireless/zydas/zd1211rw/zd_usb.c b/drivers/net/wireless/zydas/zd1211rw/zd_usb.c
index 9ae10f65f2af0..8b8abcfbbfc8f 100644
--- a/drivers/net/wireless/zydas/zd1211rw/zd_usb.c
+++ b/drivers/net/wireless/zydas/zd1211rw/zd_usb.c
@@ -1352,6 +1352,14 @@ static int probe(struct usb_interface *intf, const struct usb_device_id *id)
struct zd_usb *usb;
struct ieee80211_hw *hw = NULL;
+ /*
+ * ZD1211 devices are single-function. Reject secondary interfaces
+ * to prevent multiple instances from conflicting on hardcoded endpoints
+ * and triggering recursive locking warnings.
+ */
+ if (intf->cur_altsetting->desc.bInterfaceNumber != 0)
+ return -ENODEV;
+
print_id(udev);
if (id->driver_info & DEVICE_INSTALLER)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0852/1376] wifi: mac80211: skip unused probe response countdown offsets
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (850 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0851/1376] wifi: zd1211rw: reject secondary interfaces to prevent conflicts Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0853/1376] wifi: mac80211: disconnect on CSA to channel 0 Greg Kroah-Hartman
` (146 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhao Li, Johannes Berg, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Li <enderaoelyther@gmail.com>
[ Upstream commit fd2bf5e718108c00732eb07fd94a5d8830f62a9f ]
mac80211 copies cfg80211's variable-length countdown offset list into a
zero-initialized fixed-size array, leaving unused entries at zero. The
beacon branch already skips those zero entries, but the AP probe-response
branch writes through them unconditionally.
When a probe-response template has no countdown offset, the write through
an unused zero entry overwrites resp->data[0], corrupting the first byte of
the template. cfg80211 already bounds explicitly supplied non-zero offsets
in nl80211_parse_counter_offsets(), so this is a zero-sentinel bug, not an
out-of-bounds write.
Skip zero probe-response offsets, matching the beacon path.
Fixes: af296bdb8da4 ("mac80211: move csa counters from sdata to beacon/presp")
Link: https://lore.kernel.org/all/20260708195911.84365-6-enderaoelyther@gmail.com/
Assisted-by: Codex:gpt-5
Assisted-by: Claude:opus-4.8
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
Link: https://patch.msgid.link/20260723011001.76851-1-enderaoelyther@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/tx.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 7e23916c9189b..8fc30a773c583 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -5051,7 +5051,8 @@ static void ieee80211_set_beacon_cntdwn(struct ieee80211_sub_if_data *sdata,
if (sdata->vif.type == NL80211_IFTYPE_AP && resp) {
u16 *resp_offsets = resp->cntdwn_counter_offsets;
- resp->data[resp_offsets[i]] = count;
+ if (resp_offsets[i])
+ resp->data[resp_offsets[i]] = count;
}
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0853/1376] wifi: mac80211: disconnect on CSA to channel 0
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (851 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0852/1376] wifi: mac80211: skip unused probe response countdown offsets Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0854/1376] firmware: google: Add bounds checks in coreboot_table_populate() Greg Kroah-Hartman
` (145 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Berg, Emmanuel Grumbach,
Miri Korenblit, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit cf57f0a674cc3e3cda1a789359cc1238b61b9d7d ]
The refactor for the CSA parsing erroneously equates channel
zero and no information present, leading it to ignore a CSA
on an AP that advertises a switch to that (invalid) channel.
This leads to not disconnecting, which we should. For Intel
devices, this can lead to a firmware crash.
Fix this by using an int type for the channel number as well
as the opclass, and using a (negative) value that cannot be
encoded in the element to indicate it's not present.
Fixes: 21c3f8f95554 ("wifi: mac80211: refactor STA CSA parsing flows")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260802111213.3bc833515e40.I255c37c31ca8b0b34e351cf254e16b6071dd8fb3@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/spectmgmt.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/net/mac80211/spectmgmt.c b/net/mac80211/spectmgmt.c
index 073ff9e0f3970..1bdb241e1fd5e 100644
--- a/net/mac80211/spectmgmt.c
+++ b/net/mac80211/spectmgmt.c
@@ -228,7 +228,7 @@ int ieee80211_parse_ch_switch_ie(struct ieee80211_sub_if_data *sdata,
{
enum nl80211_band new_band = current_band;
int new_freq;
- u8 new_chan_no = 0, new_op_class = 0;
+ int new_chan_no = -1, new_op_class = -1;
struct ieee80211_channel *new_chan;
struct cfg80211_chan_def new_chandef = {};
const struct ieee80211_sec_chan_offs_ie *sec_chan_offs;
@@ -257,7 +257,7 @@ int ieee80211_parse_ch_switch_ie(struct ieee80211_sub_if_data *sdata,
new_op_class = ext_chansw_elem->new_operating_class;
if (!ieee80211_operating_class_to_band(new_op_class, &new_band)) {
- new_op_class = 0;
+ new_op_class = -1;
if (!unprot_action)
sdata_info(sdata,
"cannot understand ECSA IE operating class, %d, ignoring\n",
@@ -269,14 +269,14 @@ int ieee80211_parse_ch_switch_ie(struct ieee80211_sub_if_data *sdata,
}
}
- if (!new_op_class && elems->ch_switch_ie) {
+ if (new_op_class < 0 && elems->ch_switch_ie) {
new_chan_no = elems->ch_switch_ie->new_ch_num;
csa_ie->count = elems->ch_switch_ie->count;
csa_ie->mode = elems->ch_switch_ie->mode;
}
/* nothing here we understand */
- if (!new_chan_no)
+ if (new_chan_no < 0)
return 1;
/* Mesh Channel Switch Parameters Element */
@@ -360,7 +360,8 @@ int ieee80211_parse_ch_switch_ie(struct ieee80211_sub_if_data *sdata,
get_unaligned_le16(bwi->info.optional);
} else if (!wide_bw_chansw_ie || !wbcs_elem_to_chandef(wide_bw_chansw_ie,
&new_chandef)) {
- if (!ieee80211_operating_class_to_chandef(new_op_class, new_chan,
+ if (new_op_class < 0 ||
+ !ieee80211_operating_class_to_chandef(new_op_class, new_chan,
&new_chandef))
new_chandef = csa_ie->chanreq.oper;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0854/1376] firmware: google: Add bounds checks in coreboot_table_populate()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (852 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0853/1376] wifi: mac80211: disconnect on CSA to channel 0 Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0855/1376] firmware: coreboot: Validate table bounds Greg Kroah-Hartman
` (144 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Titouan Ameline de Cadeville,
Julius Werner, Tzung-Bi Shih, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Titouan Ameline de Cadeville <titouan.ameline@gmail.com>
[ Upstream commit 7b1a1af4556a4f95ef273e91435fe804cbfcd223 ]
coreboot_table_populate() iterates over firmware-provided table entries
with no validation that the entries stay within the mapped memory
region. A corrupt table with a large `entry->size` advances `ptr_entry`
past the mapped region, causing an out-of-bounds read on the next
iteration.
Add a check before dereferencing `ptr_entry` to ensure the entry header
is readable, and a second check after reading `entry->size` to ensure
the full entry stays within the mapped region.
Pass `len` from coreboot_table_probe() into coreboot_table_populate() to
make the mapped region size available for validation.
Signed-off-by: Titouan Ameline de Cadeville <titouan.ameline@gmail.com>
Reviewed-by: Julius Werner <jwerner@chromium.org>
Link: https://lore.kernel.org/r/20260426214739.117131-1-titouan.ameline@gmail.com
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
Stable-dep-of: a58a57a1076f ("firmware: coreboot: Validate table bounds")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/google/coreboot_table.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/firmware/google/coreboot_table.c b/drivers/firmware/google/coreboot_table.c
index 208652a8087cd..0cf613944951e 100644
--- a/drivers/firmware/google/coreboot_table.c
+++ b/drivers/firmware/google/coreboot_table.c
@@ -101,16 +101,20 @@ void coreboot_driver_unregister(struct coreboot_driver *driver)
}
EXPORT_SYMBOL(coreboot_driver_unregister);
-static int coreboot_table_populate(struct device *dev, void *ptr)
+static int coreboot_table_populate(struct device *dev, void *ptr, resource_size_t len)
{
int i, ret;
void *ptr_entry;
struct coreboot_device *device;
struct coreboot_table_entry *entry;
struct coreboot_table_header *header = ptr;
+ void *ptr_end;
+ ptr_end = ptr + len;
ptr_entry = ptr + header->header_bytes;
for (i = 0; i < header->table_entries; i++) {
+ if (ptr_entry + sizeof(*entry) > ptr_end)
+ return -EINVAL;
entry = ptr_entry;
if (entry->size < sizeof(*entry)) {
@@ -118,6 +122,9 @@ static int coreboot_table_populate(struct device *dev, void *ptr)
return -EINVAL;
}
+ if (ptr_entry + entry->size > ptr_end)
+ return -EINVAL;
+
device = kzalloc(sizeof(device->dev) + entry->size, GFP_KERNEL);
if (!device)
return -ENOMEM;
@@ -183,7 +190,7 @@ static int coreboot_table_probe(struct platform_device *pdev)
if (!ptr)
return -ENOMEM;
- ret = coreboot_table_populate(dev, ptr);
+ ret = coreboot_table_populate(dev, ptr, len);
memunmap(ptr);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0855/1376] firmware: coreboot: Validate table bounds
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (853 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0854/1376] firmware: google: Add bounds checks in coreboot_table_populate() Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0856/1376] powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass Greg Kroah-Hartman
` (143 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Laxman Acharya Padhya, Tzung-Bi Shih,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
[ Upstream commit a58a57a1076f8c5dae0327e3710899478c3be901 ]
The existing coreboot_table_populate() bounds checks limit individual
entries to the mapped length. However, coreboot_table_probe() replaces
the platform resource length with header and table sizes supplied by
firmware before mapping the full table.
A malformed table can overflow the 32-bit size addition or advertise an
extent beyond the resource, causing the driver to map and parse memory
outside the resource. A resource shorter than the fixed header is also
mapped as though it contained a complete header.
Reject resources shorter than the fixed header. After validating the
signature, require a complete header, calculate the advertised extent
with overflow checking, and reject extents beyond the resource before
remapping the table.
Fixes: d384d6f43d1e ("firmware: google memconsole: Add coreboot support")
Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
Link: https://lore.kernel.org/r/20260801165651.42172-1-acharyalaxman8848@gmail.com
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/google/coreboot_table.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/drivers/firmware/google/coreboot_table.c b/drivers/firmware/google/coreboot_table.c
index 0cf613944951e..3a7b9b432b9a2 100644
--- a/drivers/firmware/google/coreboot_table.c
+++ b/drivers/firmware/google/coreboot_table.c
@@ -159,6 +159,7 @@ static int coreboot_table_populate(struct device *dev, void *ptr, resource_size_
static int coreboot_table_probe(struct platform_device *pdev)
{
resource_size_t len;
+ resource_size_t table_span;
struct coreboot_table_header *header;
struct resource *res;
struct device *dev = &pdev->dev;
@@ -170,7 +171,7 @@ static int coreboot_table_probe(struct platform_device *pdev)
return -EINVAL;
len = resource_size(res);
- if (!res->start || !len)
+ if (!res->start || len < sizeof(*header))
return -EINVAL;
/* Check just the header first to make sure things are sane */
@@ -178,19 +179,27 @@ static int coreboot_table_probe(struct platform_device *pdev)
if (!header)
return -ENOMEM;
- len = header->header_bytes + header->table_bytes;
ret = strncmp(header->signature, "LBIO", sizeof(header->signature));
+
+ if (!ret &&
+ (header->header_bytes < sizeof(*header) ||
+ check_add_overflow((resource_size_t)header->header_bytes,
+ (resource_size_t)header->table_bytes,
+ &table_span) ||
+ table_span > len))
+ ret = -EINVAL;
+
memunmap(header);
if (ret) {
dev_warn(dev, "coreboot table missing or corrupt!\n");
return -ENODEV;
}
- ptr = memremap(res->start, len, MEMREMAP_WB);
+ ptr = memremap(res->start, table_span, MEMREMAP_WB);
if (!ptr)
return -ENOMEM;
- ret = coreboot_table_populate(dev, ptr, len);
+ ret = coreboot_table_populate(dev, ptr, table_span);
memunmap(ptr);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0856/1376] powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (854 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0855/1376] firmware: coreboot: Validate table bounds Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0857/1376] powerpc/irq: Fix missing r2 clobber in PCREL inline assembly Greg Kroah-Hartman
` (142 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gou Hao, jiazhenyuan,
Madhavan Srinivasan, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gou Hao <gouhao@uniontech.com>
[ Upstream commit 5aabc192702defb8950e7c81b05c3f4ca8ee43ec ]
smp_muxed_ipi_message_pass() calls smp_ops->cause_ipi() without
checking whether it has been set.
On platforms using muxed IPI (e.g. powernv/pseries), smp_ops->cause_ipi
is initialized to NULL in the static smp_ops and only assigned during
the platform smp_probe() handler. If the IPI subsystem fails to
initialize -- for example when xive_init_ipis() fails and
xive_smp_probe() returns an error -- the probe handler returns early
and cause_ipi is never set. Any subsequent IPI send (e.g.
arch_smp_send_reschedule()) would dereference the NULL pointer.
Add a NULL check to avoid the crash in that situation.
Fixes: 23d72bfd8f9f ("powerpc: Consolidate ipi message mux and demux")
Signed-off-by: Gou Hao <gouhao@uniontech.com>
Reviewed-by: jiazhenyuan <jiazhenyuan@uniontech.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260727104215.184786-6-gouhao@uniontech.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/kernel/smp.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
index 09b2ccf387118..6bf939d15f1f5 100644
--- a/arch/powerpc/kernel/smp.c
+++ b/arch/powerpc/kernel/smp.c
@@ -288,6 +288,9 @@ void smp_muxed_ipi_set_message(int cpu, int msg)
void smp_muxed_ipi_message_pass(int cpu, int msg)
{
+ if (!smp_ops->cause_ipi)
+ return;
+
smp_muxed_ipi_set_message(cpu, msg);
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0857/1376] powerpc/irq: Fix missing r2 clobber in PCREL inline assembly
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (855 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0856/1376] powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0858/1376] MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL Greg Kroah-Hartman
` (141 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Saket Kumar Bhaskar,
Christophe Leroy (CS GROUP), Hari Bathini, Madhavan Srinivasan,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saket Kumar Bhaskar <skb99@linux.ibm.com>
[ Upstream commit 00be69070d91d2be978e752bb117a0a4db0e1281 ]
In CONFIG_PPC_KERNEL_PCREL mode, r2 is no longer reserved for the TOC
pointer and is available as a caller-saved register [0].
Both call_do_irq() and call_do_softirq() use inline assembly to call
functions with stack switching, but fail to list r2 in their clobber
lists. This causes the compiler to assume r2 is preserved across these
calls, leading to register corruption when the called functions
(__do_irq and __do_softirq) clobber r2.
As a result of this kernel crash during interrupt handling is seen and
the kernel fails to boot:
BUG: Unable to handle kernel data access on write at 0xc000000404697638
Faulting instruction address: 0xc0000000000181ec
Oops: Kernel access of bad area, sig: 11 [#1]
NIP [c0000000000181ec] __do_IRQ+0x6c/0xc0
With older GCC, the compiler would conservatively allocate
callee-saved registers (like r31) for values spanning function calls,
accidentally avoiding the bug:
<__do_IRQ>:
00 00 00 60 nop
a6 02 08 7c mflr r0
f8 ff e1 fb std r31,-8(r1)
f0 ff c1 fb std r30,-16(r1)
2d 03 10 06 pla r31,53297316
...
3d e8 ff 4b bl c0000000000165ac <__do_irq>
00 00 21 e8 ld r1,0(r1)
28 00 4d e9 ld r10,40(r13)
40 00 21 38 addi r1,r1,64
2a f9 aa 7f stdx r29,r10,r31
With newer GCC 14, the compiler uses r2 for such values, exposing the
missing clobber specification:
<__do_IRQ>:
00 00 00 60 nop
a6 02 08 7c mflr r0
f0 ff c1 fb std r30,-16(r1)
f8 ff e1 fb std r31,-8(r1)
29 02 10 06 pla r2,36252592 # c0000000022aadc0 <__irq_regs>
...
85 dc ff 4b bl c000000000015ee0 <__do_irq>
00 00 21 e8 ld r1,0(r1)
28 00 2d e9 ld r9,40(r13)
30 00 21 38 addi r1,r1,48
2a 11 c9 7f stdx r30,r9,r2
Fix this by adding r2 to the clobber list for both call_do_irq() and
call_do_softirq() when CONFIG_PPC_KERNEL_PCREL is enabled.
[0]: https://www.mail-archive.com/gcc-patches@gcc.gnu.org/msg313226.html
Fixes: 7e3a68be42e1 ("powerpc/64: vmlinux support building with PCREL addresing")
Signed-off-by: Saket Kumar Bhaskar <skb99@linux.ibm.com>
Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Reviewed-by: Hari Bathini <hbathini@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/10fc2cda485cd22e209a31d786bed1984bdf3982.1785732393.git.skb99@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/kernel/irq.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
index 2e1600a8bbbbf..7ce69e7d6b11a 100644
--- a/arch/powerpc/kernel/irq.c
+++ b/arch/powerpc/kernel/irq.c
@@ -217,8 +217,12 @@ static __always_inline void call_do_softirq(const void *sp)
[sp] "b" (sp), [offset] "i" (THREAD_SIZE - STACK_FRAME_MIN_SIZE),
[callee] "i" (__do_softirq)
: // Clobbers
- "lr", "xer", "ctr", "memory", "cr0", "cr1", "cr5", "cr6",
- "cr7", "r0", "r3", "r4", "r5", "r6", "r7", "r8", "r9", "r10",
+ "lr", "xer", "ctr", "memory", "cr0", "cr1", "cr5", "cr6", "cr7", "r0",
+ /* r2 may be clobbered by the callee when using PCREL mode in the ELFv2 ABI. */
+#ifdef CONFIG_PPC_KERNEL_PCREL
+ "r2",
+#endif
+ "r3", "r4", "r5", "r6", "r7", "r8", "r9", "r10",
"r11", "r12"
);
}
@@ -275,8 +279,12 @@ static __always_inline void call_do_irq(struct pt_regs *regs, void *sp)
[sp] "b" (sp), [offset] "i" (THREAD_SIZE - STACK_FRAME_MIN_SIZE),
[callee] "i" (__do_irq)
: // Clobbers
- "lr", "xer", "ctr", "memory", "cr0", "cr1", "cr5", "cr6",
- "cr7", "r0", "r4", "r5", "r6", "r7", "r8", "r9", "r10",
+ "lr", "xer", "ctr", "memory", "cr0", "cr1", "cr5", "cr6", "cr7", "r0",
+ /* r2 may be clobbered by the callee when using PCREL mode in the ELFv2 ABI. */
+#ifdef CONFIG_PPC_KERNEL_PCREL
+ "r2",
+#endif
+ "r4", "r5", "r6", "r7", "r8", "r9", "r10",
"r11", "r12"
);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0858/1376] MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (856 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0857/1376] powerpc/irq: Fix missing r2 clobber in PCREL inline assembly Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0859/1376] serial: amba-pl011: unprepare console clock on unregister Greg Kroah-Hartman
` (140 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Philippe Mathieu-Daudé,
Thomas Bogendoerfer, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
[ Upstream commit 5475c03fa25f31cfd5f8c7e552f8d10347bbaad9 ]
If tracer wanted to skip a syscall return value was always
overwritten with -ENOSYS. Fix this by checking against original
syscall number and only return -ENOSYS, if it is negative.
Fixes: b6318a903d06 ("MIPS/ptrace: Pick up ptrace/seccomp changed syscalls")
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/kernel/ptrace.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
index 61503a36067e9..2016dd5e8fae0 100644
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -1319,8 +1319,12 @@ long arch_ptrace(struct task_struct *child, long request,
*/
asmlinkage long syscall_trace_enter(struct pt_regs *regs)
{
+ long syscall;
+
user_exit();
+ syscall = current_thread_info()->syscall;
+
if (test_thread_flag(TIF_SYSCALL_TRACE)) {
if (ptrace_report_syscall_entry(regs))
return -1;
@@ -1356,7 +1360,7 @@ asmlinkage long syscall_trace_enter(struct pt_regs *regs)
* Negative syscall numbers are mistaken for rejected syscalls, but
* won't have had the return value set appropriately, so we do so now.
*/
- if (current_thread_info()->syscall < 0)
+ if (syscall < 0)
syscall_set_return_value(current, regs, -ENOSYS, 0);
return current_thread_info()->syscall;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0859/1376] serial: amba-pl011: unprepare console clock on unregister
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (857 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0858/1376] MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0860/1376] tty: clear cdev pointer after cdev_add() failure Greg Kroah-Hartman
` (139 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 7f93da9d78d433c37836d85de475c5d884ad58ed ]
pl011_console_setup() calls clk_prepare() on the UART clock, but the
console provides no matching teardown, so the clock is never unprepared
when the console is unregistered -- via the sysfs "console" attribute or
a driver unbind. Each re-registration prepares the clock again, leaking
one prepare reference per cycle.
Even where preparing the clock has no hardware effect, the stale
reference leaves the clock framework's prepare count unbalanced. For
providers with prepare/unprepare operations or runtime-PM integration,
it may also retain resources after the console is unregistered.
Add a console .exit() callback that clk_unprepare()s the clock,
balancing the clk_prepare() in pl011_console_setup().
Fixes: 4b4851c65d92 ("clk: amba-pl011: convert to clk_prepare()/clk_unprepare()")
Assisted-by: Claude:claude-fable-5
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Link: https://patch.msgid.link/20260724213348.77418-2-kmehltretter@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/amba-pl011.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
index 8934fbdb0cf98..3e1932a3bfbbd 100644
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -2434,6 +2434,15 @@ static int pl011_console_setup(struct console *co, char *options)
return uart_set_options(&uap->port, co, baud, parity, bits, flow);
}
+static int pl011_console_exit(struct console *co)
+{
+ struct uart_amba_port *uap = amba_ports[co->index];
+
+ clk_unprepare(uap->clk);
+
+ return 0;
+}
+
/**
* pl011_console_match - non-standard console matching
* @co: registering console
@@ -2500,6 +2509,7 @@ static struct console amba_console = {
.write = pl011_console_write,
.device = uart_console_device,
.setup = pl011_console_setup,
+ .exit = pl011_console_exit,
.match = pl011_console_match,
.flags = CON_PRINTBUFFER | CON_ANYTIME,
.index = -1,
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0860/1376] tty: clear cdev pointer after cdev_add() failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (858 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0859/1376] serial: amba-pl011: unprepare console clock on unregister Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0861/1376] HID: i2c-hid: Refactor _DSM helper and add i2c-hid-acpi-prp0001 driver Greg Kroah-Hartman
` (138 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 6645856f0df3aeecd45519cb611415b4b89c2223 ]
tty_cdev_add() drops the cdev reference when cdev_add() fails, but
leaves driver->cdevs[index] pointing to freed memory.
tty_unregister_device() later passes that stale pointer to cdev_del(),
causing a use-after-free.
Clear the slot after dropping the reference.
Fixes: c1a752ba2d6b ("tty: don't leak cdev in tty_cdev_add()")
Assisted-by: Claude:claude-fable-5
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Link: https://patch.msgid.link/20260731181844.11330-5-kmehltretter@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/tty_io.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index dcb1769c3625c..5d372fd7423e3 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -3181,8 +3181,10 @@ static int tty_cdev_add(struct tty_driver *driver, dev_t dev,
driver->cdevs[index]->ops = &tty_fops;
driver->cdevs[index]->owner = driver->owner;
err = cdev_add(driver->cdevs[index], dev, count);
- if (err)
+ if (err) {
kobject_put(&driver->cdevs[index]->kobj);
+ driver->cdevs[index] = NULL;
+ }
return err;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0861/1376] HID: i2c-hid: Refactor _DSM helper and add i2c-hid-acpi-prp0001 driver
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (859 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0860/1376] tty: clear cdev pointer after cdev_add() failure Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0862/1376] HID: synchronize input before cleaning up a failed probe Greg Kroah-Hartman
` (137 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, 谢致邦 ,
Jiri Kosina, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: 谢致邦 (XIE Zhibang) <Yeking@Red54.com>
[ Upstream commit fd7c67d05fb695b1deb07f9e213dd7e80e3a8427 ]
Move the _DSM call that gets the HID descriptor address from
i2c-hid-acpi.c into i2c-hid-acpi.h as a static inline so both the ACPI
and the new PRP0001 driver can use it. While refactoring, move the
blacklist check and the _DSM call to the top of probe() to avoid a
pointless alloc when the device is blacklisted or does not implement the
_DSM.
Some devices, for example the Lenovo KaiTian N60d and Inspur CP300L3,
are declared with _HID "PRP0001" and _DSD compatible "hid-over-i2c" but
lack "hid-descr-addr" from the _DSD and provide the HID descriptor
address only through an ACPI _DSM. The OF driver fails to probe them
because it requires hid-descr-addr. Add a new driver that handles these
devices by calling the shared _DSM helper.
Link: https://lore.kernel.org/tencent_F6FC553D1BB737FC00062AD0FEF43C580F0A@qq.com
Fixes: b33752c30023 ("HID: i2c-hid: Reorganize so ACPI and OF are separate modules")
Signed-off-by: 谢致邦 (XIE Zhibang) <Yeking@Red54.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/i2c-hid/Makefile | 2 +-
drivers/hid/i2c-hid/i2c-hid-acpi-prp0001.c | 104 +++++++++++++++++++++
drivers/hid/i2c-hid/i2c-hid-acpi.c | 52 +++--------
drivers/hid/i2c-hid/i2c-hid-acpi.h | 33 +++++++
4 files changed, 152 insertions(+), 39 deletions(-)
create mode 100644 drivers/hid/i2c-hid/i2c-hid-acpi-prp0001.c
create mode 100644 drivers/hid/i2c-hid/i2c-hid-acpi.h
diff --git a/drivers/hid/i2c-hid/Makefile b/drivers/hid/i2c-hid/Makefile
index 55bd5e0f35af3..38d5d827f3ce4 100644
--- a/drivers/hid/i2c-hid/Makefile
+++ b/drivers/hid/i2c-hid/Makefile
@@ -8,7 +8,7 @@ obj-$(CONFIG_I2C_HID_CORE) += i2c-hid.o
i2c-hid-objs = i2c-hid-core.o
i2c-hid-$(CONFIG_DMI) += i2c-hid-dmi-quirks.o
-obj-$(CONFIG_I2C_HID_ACPI) += i2c-hid-acpi.o
+obj-$(CONFIG_I2C_HID_ACPI) += i2c-hid-acpi.o i2c-hid-acpi-prp0001.o
obj-$(CONFIG_I2C_HID_OF) += i2c-hid-of.o
obj-$(CONFIG_I2C_HID_OF_ELAN) += i2c-hid-of-elan.o
obj-$(CONFIG_I2C_HID_OF_GOODIX) += i2c-hid-of-goodix.o
diff --git a/drivers/hid/i2c-hid/i2c-hid-acpi-prp0001.c b/drivers/hid/i2c-hid/i2c-hid-acpi-prp0001.c
new file mode 100644
index 0000000000000..d2cf4714ae7f1
--- /dev/null
+++ b/drivers/hid/i2c-hid/i2c-hid-acpi-prp0001.c
@@ -0,0 +1,104 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * HID over I2C driver for PRP0001 devices missing hid-descr-addr
+ *
+ * Some devices, for example the Lenovo KaiTian N60d and Inspur CP300L3, use
+ * _HID "PRP0001" with _DSD compatible "hid-over-i2c" but lack "hid-descr-addr"
+ * from the _DSD. The HID descriptor address is provided only through an ACPI
+ * _DSM. The TPD0 node in the DSDT shows _DSM Function 1 returning 0x20.
+ *
+ * Copyright (C) 2026 谢致邦 (XIE Zhibang) <Yeking@Red54.com>
+ */
+
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/i2c.h>
+#include <linux/module.h>
+#include <linux/of.h>
+
+#include "i2c-hid.h"
+#include "i2c-hid-acpi.h"
+
+static int i2c_hid_acpi_prp0001_power_up(struct i2chid_ops *ops)
+{
+ /* give the device time to power up */
+ msleep(750);
+ return 0;
+}
+
+static struct i2chid_ops i2c_hid_acpi_prp0001_ops = {
+ .power_up = i2c_hid_acpi_prp0001_power_up,
+ /*
+ * No .restore_sequence needed: the _DSM on these devices returns a
+ * constant (0x20) with no side effects, unlike some PNP0C50 _DSM
+ * implementations that switch the hardware between PS/2 and I2C modes.
+ */
+};
+
+static int i2c_hid_acpi_prp0001_probe(struct i2c_client *client)
+{
+ struct device *dev = &client->dev;
+ struct acpi_device *adev;
+ u16 hid_descriptor_address;
+ int ret;
+
+ /* If hid-descr-addr is present, let i2c-hid-of handle it */
+ if (device_property_present(dev, "hid-descr-addr"))
+ return -ENODEV;
+
+ adev = ACPI_COMPANION(dev);
+ if (!adev)
+ return -ENODEV;
+
+ ret = i2c_hid_acpi_get_descriptor(adev);
+ if (ret < 0)
+ return ret;
+ dev_warn(dev,
+ "hid-descr-addr device property NOT found, using ACPI _DSM fallback. Contact vendor for firmware update!\n");
+ hid_descriptor_address = ret;
+
+ /*
+ * No acpi_device_fix_up_power() needed: TPD0 has no _PS0, _PS3, _PSC
+ * or _PRx methods and follows I2C bus power.
+ */
+ return i2c_hid_core_probe(client, &i2c_hid_acpi_prp0001_ops,
+ hid_descriptor_address, 0);
+}
+
+static const struct of_device_id i2c_hid_acpi_prp0001_of_match[] = {
+ { .compatible = "hid-over-i2c" },
+ {},
+};
+MODULE_DEVICE_TABLE(of, i2c_hid_acpi_prp0001_of_match);
+
+static const struct i2c_device_id i2c_hid_acpi_prp0001_id[] = {
+ { .name = "hid-over-i2c" },
+ { }
+};
+MODULE_DEVICE_TABLE(i2c, i2c_hid_acpi_prp0001_id);
+
+static struct i2c_driver i2c_hid_acpi_prp0001_driver = {
+ .driver = {
+ .name = "i2c_hid_acpi_prp0001",
+ .pm = &i2c_hid_core_pm,
+ .probe_type = PROBE_PREFER_ASYNCHRONOUS,
+ /*
+ * of_match_ptr() makes this NULL when CONFIG_OF=n, but that's
+ * fine: the I2C id_table with "hid-over-i2c" handles matching
+ * via client->name (set by acpi_set_modalias() from the _DSD
+ * compatible property).
+ */
+ .of_match_table = of_match_ptr(i2c_hid_acpi_prp0001_of_match),
+ },
+
+ .probe = i2c_hid_acpi_prp0001_probe,
+ .remove = i2c_hid_core_remove,
+ .shutdown = i2c_hid_core_shutdown,
+ .id_table = i2c_hid_acpi_prp0001_id,
+};
+
+module_i2c_driver(i2c_hid_acpi_prp0001_driver);
+
+MODULE_DESCRIPTION("HID over I2C driver for PRP0001 devices missing hid-descr-addr");
+MODULE_AUTHOR("谢致邦 (XIE Zhibang) <Yeking@Red54.com>");
+MODULE_LICENSE("GPL");
diff --git a/drivers/hid/i2c-hid/i2c-hid-acpi.c b/drivers/hid/i2c-hid/i2c-hid-acpi.c
index abd700a101f46..13f977d6aab61 100644
--- a/drivers/hid/i2c-hid/i2c-hid-acpi.c
+++ b/drivers/hid/i2c-hid/i2c-hid-acpi.c
@@ -25,9 +25,9 @@
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/pm.h>
-#include <linux/uuid.h>
#include "i2c-hid.h"
+#include "i2c-hid-acpi.h"
struct i2c_hid_acpi {
struct i2chid_ops ops;
@@ -48,39 +48,11 @@ static const struct acpi_device_id i2c_hid_acpi_blacklist[] = {
{ }
};
-/* HID I²C Device: 3cdff6f7-4267-4555-ad05-b30a3d8938de */
-static guid_t i2c_hid_guid =
- GUID_INIT(0x3CDFF6F7, 0x4267, 0x4555,
- 0xAD, 0x05, 0xB3, 0x0A, 0x3D, 0x89, 0x38, 0xDE);
-
-static int i2c_hid_acpi_get_descriptor(struct i2c_hid_acpi *ihid_acpi)
-{
- struct acpi_device *adev = ihid_acpi->adev;
- acpi_handle handle = acpi_device_handle(adev);
- union acpi_object *obj;
- u16 hid_descriptor_address;
-
- if (acpi_match_device_ids(adev, i2c_hid_acpi_blacklist) == 0)
- return -ENODEV;
-
- obj = acpi_evaluate_dsm_typed(handle, &i2c_hid_guid, 1, 1, NULL,
- ACPI_TYPE_INTEGER);
- if (!obj) {
- acpi_handle_err(handle, "Error _DSM call to get HID descriptor address failed\n");
- return -ENODEV;
- }
-
- hid_descriptor_address = obj->integer.value;
- ACPI_FREE(obj);
-
- return hid_descriptor_address;
-}
-
static void i2c_hid_acpi_restore_sequence(struct i2chid_ops *ops)
{
struct i2c_hid_acpi *ihid_acpi = container_of(ops, struct i2c_hid_acpi, ops);
- i2c_hid_acpi_get_descriptor(ihid_acpi);
+ i2c_hid_acpi_get_descriptor(ihid_acpi->adev);
}
static void i2c_hid_acpi_shutdown_tail(struct i2chid_ops *ops)
@@ -93,24 +65,28 @@ static void i2c_hid_acpi_shutdown_tail(struct i2chid_ops *ops)
static int i2c_hid_acpi_probe(struct i2c_client *client)
{
struct device *dev = &client->dev;
+ struct acpi_device *adev = ACPI_COMPANION(dev);
struct i2c_hid_acpi *ihid_acpi;
u16 hid_descriptor_address;
int ret;
- ihid_acpi = devm_kzalloc(&client->dev, sizeof(*ihid_acpi), GFP_KERNEL);
+ if (acpi_match_device_ids(adev, i2c_hid_acpi_blacklist) == 0)
+ return -ENODEV;
+
+ ret = i2c_hid_acpi_get_descriptor(adev);
+ if (ret < 0)
+ return ret;
+ hid_descriptor_address = ret;
+
+ ihid_acpi = devm_kzalloc(dev, sizeof(*ihid_acpi), GFP_KERNEL);
if (!ihid_acpi)
return -ENOMEM;
- ihid_acpi->adev = ACPI_COMPANION(dev);
+ ihid_acpi->adev = adev;
ihid_acpi->ops.shutdown_tail = i2c_hid_acpi_shutdown_tail;
ihid_acpi->ops.restore_sequence = i2c_hid_acpi_restore_sequence;
- ret = i2c_hid_acpi_get_descriptor(ihid_acpi);
- if (ret < 0)
- return ret;
- hid_descriptor_address = ret;
-
- acpi_device_fix_up_power(ihid_acpi->adev);
+ acpi_device_fix_up_power(adev);
return i2c_hid_core_probe(client, &ihid_acpi->ops,
hid_descriptor_address, 0);
diff --git a/drivers/hid/i2c-hid/i2c-hid-acpi.h b/drivers/hid/i2c-hid/i2c-hid-acpi.h
new file mode 100644
index 0000000000000..0bbed1853313d
--- /dev/null
+++ b/drivers/hid/i2c-hid/i2c-hid-acpi.h
@@ -0,0 +1,33 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+#ifndef _I2C_HID_ACPI_H
+#define _I2C_HID_ACPI_H
+
+#include <linux/acpi.h>
+#include <linux/uuid.h>
+
+static inline int i2c_hid_acpi_get_descriptor(struct acpi_device *adev)
+{
+ /* HID I²C Device: 3cdff6f7-4267-4555-ad05-b30a3d8938de */
+ static const guid_t i2c_hid_guid =
+ GUID_INIT(0x3CDFF6F7, 0x4267, 0x4555,
+ 0xAD, 0x05, 0xB3, 0x0A, 0x3D, 0x89, 0x38, 0xDE);
+
+ acpi_handle handle = acpi_device_handle(adev);
+ union acpi_object *obj;
+ u16 addr;
+
+ obj = acpi_evaluate_dsm_typed(handle, &i2c_hid_guid,
+ 1, 1, NULL, ACPI_TYPE_INTEGER);
+ if (!obj) {
+ acpi_handle_err(handle,
+ "Error _DSM call to get HID descriptor address failed\n");
+ return -ENODEV;
+ }
+
+ addr = obj->integer.value;
+ ACPI_FREE(obj);
+ return addr;
+}
+
+#endif
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0862/1376] HID: synchronize input before cleaning up a failed probe
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (860 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0861/1376] HID: i2c-hid: Refactor _DSM helper and add i2c-hid-acpi-prp0001 driver Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0863/1376] HID: i2c-hid: Fix "(null)" output when reading report descriptor fails Greg Kroah-Hartman
` (136 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+9eebf5f6544c5e873858,
Yousef Alhouseen, Jiri Kosina, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yousef Alhouseen <alhouseenyousef@gmail.com>
[ Upstream commit 207853d46f7ef2e28042344a1468da8754c3ddbf ]
hid_device_io_start() allows reports to run concurrently with probe. If
the probe subsequently fails, __hid_device_probe() releases driver
resources and clears hdev->driver without first excluding those report
callbacks.
For example, a report may enter hidraw_report_event() while the failure
path frees the associated hidraw object, leading to a use-after-free when
the report takes the object's list lock.
Stop input before performing failed-probe cleanup. This reacquires
driver_input_lock and waits for any report callback already in progress.
Fixes: c849a6143bec ("HID: Separate struct hid_device's driver_lock into two locks.")
Reported-by: syzbot+9eebf5f6544c5e873858@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9eebf5f6544c5e873858
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-core.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 5c33e1a0aef3c..df2e43b27388d 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -2780,6 +2780,8 @@ static int __hid_device_probe(struct hid_device *hdev, struct hid_driver *hdrv)
*/
if (ret) {
+ if (hdev->io_started)
+ hid_device_io_stop(hdev);
devres_release_group(&hdev->dev, hdev->devres_group_id);
hid_close_report(hdev);
hdev->driver = NULL;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0863/1376] HID: i2c-hid: Fix "(null)" output when reading report descriptor fails
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (861 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0862/1376] HID: synchronize input before cleaning up a failed probe Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0864/1376] HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure Greg Kroah-Hartman
` (135 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ai Chao, Mario Limonciello (AMD),
Jiri Kosina, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ai Chao <aichao@kylinos.cn>
[ Upstream commit 8da0f0951deec9f0728ed2d9c54ded1c344b7542 ]
When i2c-hid fails to read the HID report descriptor during device
initialization, the error message prints as:
hid (null): reading report descriptor failed
The HID device name is set in hid_add_device() after calling
hdev->ll_driver->parse(), so when i2c_hid_parse() fails and calls
hid_err(), the device name has not been set yet, resulting in "(null)"
output.
Use dev_err(&client->dev, ...) instead of hid_err(hid, ...) because
the I2C client device is fully initialized with a proper name, providing
meaningful error messages for debugging.
Before: hid (null): reading report descriptor failed
After: i2c_hid i2c-TPD0001:00: reading report descriptor failed
Fixes: 4a200c3b9a40 ("HID: i2c-hid: introduce HID over i2c specification implementation")
Signed-off-by: Ai Chao <aichao@kylinos.cn>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/i2c-hid/i2c-hid-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index 8ce0535fc42d6..0e1adfa9b2931 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -784,7 +784,7 @@ static int i2c_hid_parse(struct hid_device *hid)
ihid->hdesc.wReportDescRegister,
rdesc, rsize);
if (ret) {
- hid_err(hid, "reading report descriptor failed\n");
+ dev_err(&client->dev, "reading report descriptor failed\n");
goto out;
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0864/1376] HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (862 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0863/1376] HID: i2c-hid: Fix "(null)" output when reading report descriptor fails Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0865/1376] HID: lg4ff: validate report length before fixed offsets Greg Kroah-Hartman
` (134 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chao Huang, Douglas Anderson,
Jiri Kosina, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Huang <huangchao@kylinos.cn>
[ Upstream commit 8e2c560faea0220664169f7be4b498915ea1469f ]
If enabling VDDIO fails after VDD has been enabled, the power-up
path returns without disabling VDD. This leaves the regulator enabled
and its enable count unbalanced.
Disable VDD before returning the VDDIO error.
Fixes: eb16f59e8e58 ("HID: i2c-hid: goodix: Add mainboard-vddio-supply")
Signed-off-by: Chao Huang <huangchao@kylinos.cn>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/i2c-hid/i2c-hid-of-goodix.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/hid/i2c-hid/i2c-hid-of-goodix.c b/drivers/hid/i2c-hid/i2c-hid-of-goodix.c
index f1597ad67e7c8..f4dbcd1d1d472 100644
--- a/drivers/hid/i2c-hid/i2c-hid-of-goodix.c
+++ b/drivers/hid/i2c-hid/i2c-hid-of-goodix.c
@@ -51,8 +51,10 @@ static int goodix_i2c_hid_power_up(struct i2chid_ops *ops)
return ret;
ret = regulator_enable(ihid_goodix->vddio);
- if (ret)
+ if (ret) {
+ regulator_disable(ihid_goodix->vdd);
return ret;
+ }
if (ihid_goodix->timings->post_power_delay_ms)
msleep(ihid_goodix->timings->post_power_delay_ms);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0865/1376] HID: lg4ff: validate report length before fixed offsets
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (863 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0864/1376] HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0866/1376] perf thread-stack: Fix heap buffer overflow on branch stack wrap copy Greg Kroah-Hartman
` (133 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiancheng Huang, Jiri Kosina,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiancheng Huang <jchuang@seu.edu.cn>
[ Upstream commit be00988cce4ed44db1e61231d0ab71a64bab44cd ]
lg4ff_raw_event() rewrites fixed report offsets when combined pedals are
enabled. It currently assumes that each product report contains every
source and destination byte used by the rewrite.
Return without rewriting a short report before each product-specific
access. Apply the same bound to the computed offset path.
Fixes: c832f86effbc ("HID: hid-logitech: Add combined pedal support Logitech wheels")
Signed-off-by: Jiancheng Huang <jchuang@seu.edu.cn>
Assisted-by: Codex:gpt-5.6-luna
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-lg4ff.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/hid/hid-lg4ff.c b/drivers/hid/hid-lg4ff.c
index e3fcf1353fb3b..71f168eff29b1 100644
--- a/drivers/hid/hid-lg4ff.c
+++ b/drivers/hid/hid-lg4ff.c
@@ -336,6 +336,8 @@ int lg4ff_raw_event(struct hid_device *hdev, struct hid_report *report,
if (entry->wdata.combine) {
switch (entry->wdata.product_id) {
case USB_DEVICE_ID_LOGITECH_WHEEL:
+ if (size < 7)
+ return 0;
rd[5] = rd[3];
rd[6] = 0x7F;
return 1;
@@ -343,10 +345,14 @@ int lg4ff_raw_event(struct hid_device *hdev, struct hid_report *report,
case USB_DEVICE_ID_LOGITECH_WINGMAN_FFG:
case USB_DEVICE_ID_LOGITECH_MOMO_WHEEL:
case USB_DEVICE_ID_LOGITECH_MOMO_WHEEL2:
+ if (size < 6)
+ return 0;
rd[4] = rd[3];
rd[5] = 0x7F;
return 1;
case USB_DEVICE_ID_LOGITECH_DFP_WHEEL:
+ if (size < 7)
+ return 0;
rd[5] = rd[4];
rd[6] = 0x7F;
return 1;
@@ -366,6 +372,8 @@ int lg4ff_raw_event(struct hid_device *hdev, struct hid_report *report,
}
/* Compute a combined axis when wheel does not supply it */
+ if (size <= offset + 1)
+ return 0;
rd[offset] = (0xFF + rd[offset] - rd[offset+1]) >> 1;
rd[offset+1] = 0x7F;
return 1;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0866/1376] perf thread-stack: Fix heap buffer overflow on branch stack wrap copy
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (864 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0865/1376] HID: lg4ff: validate report length before fixed offsets Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0867/1376] perf auxtrace: Fix queue grow overflow and old array leak Greg Kroah-Hartman
` (132 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot,
Arnaldo Carvalho de Melo, James Clark, Adrian Hunter,
Namhyung Kim, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit ab9c84d1cd59e6b3b73de34982a35a76e3a9b032 ]
thread_stack__br_sample() copies the wrap-around portion of the branch
stack ring buffer with:
nr = min(ts->br_stack_pos, sz);
memcpy(be, &src->entries[0], bsz * ts->br_stack_pos);
'nr' is correctly bounded to min(br_stack_pos, sz) but the memcpy uses
the unbounded ts->br_stack_pos directly. When br_stack_pos exceeds
the remaining destination space 'sz', this writes past the destination
buffer.
Use 'nr' (the bounded value) in the memcpy size, matching the pattern
of the first memcpy in the same function.
Fixes: 86d67180b920 ("perf thread-stack: Add branch stack support")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Reviewed-by: James Clark <james.clark@linaro.org>
Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/thread-stack.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/util/thread-stack.c b/tools/perf/util/thread-stack.c
index c6a0a27b12c2a..47d5922efdee3 100644
--- a/tools/perf/util/thread-stack.c
+++ b/tools/perf/util/thread-stack.c
@@ -642,7 +642,7 @@ void thread_stack__br_sample(struct thread *thread, int cpu,
sz -= nr;
be = &dst->entries[nr];
nr = min(ts->br_stack_pos, sz);
- memcpy(be, &src->entries[0], bsz * ts->br_stack_pos);
+ memcpy(be, &src->entries[0], bsz * nr);
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0867/1376] perf auxtrace: Fix queue grow overflow and old array leak
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (865 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0866/1376] perf thread-stack: Fix heap buffer overflow on branch stack wrap copy Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0868/1376] perf intel-pt: Fix off-by-one in auxtrace_info minimum size check Greg Kroah-Hartman
` (131 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot,
Arnaldo Carvalho de Melo, James Clark, Adrian Hunter,
Namhyung Kim, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 96fcc9ea5f18c083a1fa73da23afef7e953f7dca ]
auxtrace_queues__grow() has two bugs:
1. When idx is UINT_MAX, the caller passes new_nr_queues = idx + 1 = 0.
The function skips growing (since any nr_queues >= 0), returns
success, and the caller accesses queue_array[UINT_MAX] — an OOB
heap write. Fix by rejecting new_nr_queues == 0 up front.
2. The function allocates a new queue_array via calloc and copies
elements from the old array, but never frees the old array. Fix
by saving the old pointer and freeing it after the copy.
Fixes: e502789302a6ece9 ("perf auxtrace: Add helpers for queuing AUX area tracing data")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Reviewed-by: James Clark <james.clark@linaro.org>
Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/auxtrace.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/tools/perf/util/auxtrace.c b/tools/perf/util/auxtrace.c
index ca8682966fae4..0927cfb42b7c5 100644
--- a/tools/perf/util/auxtrace.c
+++ b/tools/perf/util/auxtrace.c
@@ -237,8 +237,12 @@ static int auxtrace_queues__grow(struct auxtrace_queues *queues,
{
unsigned int nr_queues = queues->nr_queues;
struct auxtrace_queue *queue_array;
+ struct auxtrace_queue *old_array = queues->queue_array;
unsigned int i;
+ if (!new_nr_queues)
+ return -EINVAL;
+
if (!nr_queues)
nr_queues = AUXTRACE_INIT_NR_QUEUES;
@@ -253,16 +257,17 @@ static int auxtrace_queues__grow(struct auxtrace_queues *queues,
return -ENOMEM;
for (i = 0; i < queues->nr_queues; i++) {
- list_splice_tail(&queues->queue_array[i].head,
+ list_splice_tail(&old_array[i].head,
&queue_array[i].head);
- queue_array[i].tid = queues->queue_array[i].tid;
- queue_array[i].cpu = queues->queue_array[i].cpu;
- queue_array[i].set = queues->queue_array[i].set;
- queue_array[i].priv = queues->queue_array[i].priv;
+ queue_array[i].tid = old_array[i].tid;
+ queue_array[i].cpu = old_array[i].cpu;
+ queue_array[i].set = old_array[i].set;
+ queue_array[i].priv = old_array[i].priv;
}
queues->nr_queues = nr_queues;
queues->queue_array = queue_array;
+ free(old_array);
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0868/1376] perf intel-pt: Fix off-by-one in auxtrace_info minimum size check
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (866 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0867/1376] perf auxtrace: Fix queue grow overflow and old array leak Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0869/1376] perf intel-bts: " Greg Kroah-Hartman
` (130 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot,
Arnaldo Carvalho de Melo, James Clark, Adrian Hunter,
Namhyung Kim, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit c4362d5e1a5ed4ce2098798f655a636c4340fa20 ]
min_sz is set to sizeof(u64) * INTEL_PT_PER_CPU_MMAPS, but the code
accesses auxtrace_info->priv[INTEL_PT_PER_CPU_MMAPS], which requires
at least INTEL_PT_PER_CPU_MMAPS + 1 elements. A file with exactly
min_sz bytes of priv data passes the size check but the access reads
one u64 past the validated region.
Use (INTEL_PT_PER_CPU_MMAPS + 1) to ensure the highest accessed index
is within bounds.
Fixes: 90e457f7be087005 ("perf tools: Add Intel PT support")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Reviewed-by: James Clark <james.clark@linaro.org>
Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/intel-pt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c
index 61f10578e1212..fa4eb009a9636 100644
--- a/tools/perf/util/intel-pt.c
+++ b/tools/perf/util/intel-pt.c
@@ -4359,7 +4359,7 @@ int intel_pt_process_auxtrace_info(union perf_event *event,
struct perf_session *session)
{
struct perf_record_auxtrace_info *auxtrace_info = &event->auxtrace_info;
- size_t min_sz = sizeof(u64) * INTEL_PT_PER_CPU_MMAPS;
+ size_t min_sz = sizeof(u64) * (INTEL_PT_PER_CPU_MMAPS + 1);
struct intel_pt *pt;
void *info_end;
__u64 *info;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0869/1376] perf intel-bts: Fix off-by-one in auxtrace_info minimum size check
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (867 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0868/1376] perf intel-pt: Fix off-by-one in auxtrace_info minimum size check Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0870/1376] iio: light: tsl2772: fix ALS calibscale readback Greg Kroah-Hartman
` (129 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot,
Arnaldo Carvalho de Melo, James Clark, Adrian Hunter,
Namhyung Kim, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit b9fb8225951ce27e62a2235a71f3ab01137aaec3 ]
Same pattern as the Intel PT fix: min_sz is set to
sizeof(u64) * INTEL_BTS_SNAPSHOT_MODE, but the code accesses
auxtrace_info->priv[INTEL_BTS_SNAPSHOT_MODE], which requires at least
INTEL_BTS_SNAPSHOT_MODE + 1 elements.
Use (INTEL_BTS_SNAPSHOT_MODE + 1) to ensure the highest accessed index
is within bounds.
Fixes: d0170af7004dce9c ("perf tools: Add Intel BTS support")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Reviewed-by: James Clark <james.clark@linaro.org>
Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/intel-bts.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/util/intel-bts.c b/tools/perf/util/intel-bts.c
index 27d9b5c9fec8b..056dde772eabf 100644
--- a/tools/perf/util/intel-bts.c
+++ b/tools/perf/util/intel-bts.c
@@ -829,7 +829,7 @@ int intel_bts_process_auxtrace_info(union perf_event *event,
struct perf_session *session)
{
struct perf_record_auxtrace_info *auxtrace_info = &event->auxtrace_info;
- size_t min_sz = sizeof(u64) * INTEL_BTS_SNAPSHOT_MODE;
+ size_t min_sz = sizeof(u64) * (INTEL_BTS_SNAPSHOT_MODE + 1);
struct intel_bts *bts;
int err;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0870/1376] iio: light: tsl2772: fix ALS calibscale readback
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (868 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0869/1376] perf intel-bts: " Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0871/1376] iio: light: isl29028: return zero in write_raw() on success Greg Kroah-Hartman
` (128 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuanshen Cao, David Lechner,
Jonathan Cameron, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuanshen Cao <alex.caoys@gmail.com>
[ Upstream commit ac75550ab5b5d73649bffea245c2075fd9249bd0 ]
The read_raw() implementation uses IIO_LIGHT to distinguish between the
ambient light and proximity channels when handling
IIO_CHAN_INFO_CALIBSCALE.
However, the ALS channel is registered as IIO_INTENSITY, while
write_raw() correctly writes to IIO_INTENSITY. As a result, reading
in_intensity0_calibscale incorrectly returns the proximity gain instead
of the ALS gain.
This causes the following user-visible behavior:
- Writing in_intensity0_calibscale appears to have no effect because the
readback reports the proximity gain.
- Writing in_proximity0_calibscale causes both in_proximity0_calibscale
and in_intensity0_calibscale to report the same value.
Fix this by checking for IIO_INTENSITY in read_raw(), matching the
channel definition and the existing write_raw() implementation.
Fixes: 3c97c08b5735 ("staging: iio: add TAOS tsl2x7x driver")
Signed-off-by: Yuanshen Cao <alex.caoys@gmail.com>
Reviewed-by: David Lechner <dlechner@baylibre.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/light/tsl2772.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iio/light/tsl2772.c b/drivers/iio/light/tsl2772.c
index cab468a82b616..fffed029c24dd 100644
--- a/drivers/iio/light/tsl2772.c
+++ b/drivers/iio/light/tsl2772.c
@@ -1263,7 +1263,7 @@ static int tsl2772_read_raw(struct iio_dev *indio_dev,
}
break;
case IIO_CHAN_INFO_CALIBSCALE:
- if (chan->type == IIO_LIGHT)
+ if (chan->type == IIO_INTENSITY)
*val = tsl2772_als_gain[chip->settings.als_gain];
else
*val = tsl2772_prox_gain[chip->settings.prox_gain];
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0871/1376] iio: light: isl29028: return zero in write_raw() on success
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (869 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0870/1376] iio: light: tsl2772: fix ALS calibscale readback Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0872/1376] iio: light: tsl2583: " Greg Kroah-Hartman
` (127 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sang-Heon Jeon, Brian Masney,
Jonathan Cameron, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sang-Heon Jeon <ekffu200098@gmail.com>
[ Upstream commit 55b75622829779223b9e32aa9600a8651d3e2df4 ]
isl29028_write_raw() returns the value of pm_runtime_put_autosuspend(),
which is 1 if the device is already runtime suspended.
In that case write() on the sysfs attribute returns 1 instead of the
number of bytes written. Make isl29028_write_raw() always return zero
on success.
Fixes: 2db5054ac28d ("staging: iio: isl29028: add runtime power management support")
Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/light/isl29028.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iio/light/isl29028.c b/drivers/iio/light/isl29028.c
index 95bfb3ffa519a..a23b2af287d5e 100644
--- a/drivers/iio/light/isl29028.c
+++ b/drivers/iio/light/isl29028.c
@@ -414,7 +414,7 @@ static int isl29028_write_raw(struct iio_dev *indio_dev,
if (ret < 0)
return ret;
- return ret;
+ return 0;
}
static int isl29028_read_raw(struct iio_dev *indio_dev,
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0872/1376] iio: light: tsl2583: return zero in write_raw() on success
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (870 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0871/1376] iio: light: isl29028: return zero in write_raw() on success Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0873/1376] net: stmmac: Skip PHY attach if custom PCS is in use Greg Kroah-Hartman
` (126 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sang-Heon Jeon, Brian Masney,
Jonathan Cameron, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sang-Heon Jeon <ekffu200098@gmail.com>
[ Upstream commit 42e8791841e0677418a3ccc97fa5c22a1455f417 ]
tsl2583_write_raw() returns the value of pm_runtime_put_autosuspend(),
which is 1 if the device is already runtime suspended.
In that case write() on the sysfs attribute returns 1 instead of the
number of bytes written. Make tsl2583_write_raw() always return zero
on success.
Fixes: 371894f5d1a0 ("iio: tsl2583: add runtime power management support")
Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/light/tsl2583.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iio/light/tsl2583.c b/drivers/iio/light/tsl2583.c
index 02ad11611b9c5..dfcb8228ada1d 100644
--- a/drivers/iio/light/tsl2583.c
+++ b/drivers/iio/light/tsl2583.c
@@ -800,7 +800,7 @@ static int tsl2583_write_raw(struct iio_dev *indio_dev,
if (ret < 0)
return ret;
- return ret;
+ return 0;
}
static const struct iio_info tsl2583_info = {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0873/1376] net: stmmac: Skip PHY attach if custom PCS is in use
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (871 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0872/1376] iio: light: tsl2583: " Greg Kroah-Hartman
@ 2026-09-12 6:54 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0874/1376] phonet: pep: do not write beyond optlen in getsockopt Greg Kroah-Hartman
` (125 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zxyan Zhu, Maxime Chevallier,
Jakub Kicinski, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zxyan Zhu <zxyan0222@gmail.com>
[ Upstream commit af4d934164457f0578bf90e92ae0fcc5348260cb ]
When a platform provides a custom PCS via the pcs_init callback,
the MAC's phylink_pcs is already configured. In this case, no
traditional PHY device is needed.
Without this, stmmac_init_phy() falls through to the no-phy-node
path and errors out with "no phy found" when the DT has no
phy-handle for such interfaces.
Skip the PHY attach when priv->hw->phylink_pcs is set and
phy_addr is invalid.
Fixes: f0ef433fc264 ("net: stmmac: introduce pcs_init/pcs_exit stmmac operations")
Signed-off-by: Zxyan Zhu <zxyan0222@gmail.com>
Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Link: https://patch.msgid.link/20260729074237.2624940-2-zxyan0222@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 44fd0fadc137d..3074e322a2cc2 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -1183,6 +1183,10 @@ static int stmmac_init_phy(struct net_device *dev)
struct phy_device *phydev;
if (addr < 0) {
+ /* If a custom PCS is in use, no PHY is needed */
+ if (priv->hw->phylink_pcs)
+ return 0;
+
netdev_err(priv->dev, "no phy found\n");
return -ENODEV;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0874/1376] phonet: pep: do not write beyond optlen in getsockopt
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (872 preceding siblings ...)
2026-09-12 6:54 ` [PATCH 6.12 0873/1376] net: stmmac: Skip PHY attach if custom PCS is in use Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0875/1376] blk-cgroup: skip dying blkg in blkcg_activate_policy() Greg Kroah-Hartman
` (124 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rémi Denis-Courmont, Joe Damato,
Stanislav Fomichev, Breno Leitao, Jakub Kicinski, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <leitao@debian.org>
[ Upstream commit 77e5eb0e192aec6710c03ca8144582fd2af36ca4 ]
pep_getsockopt() clamps the reported length to the caller's buffer with
min_t(), but then stores the value with put_user(val, (int __user *)
optval), which always writes sizeof(int) bytes. A getsockopt() call with
an optlen smaller than sizeof(int) thus reports the clamped length yet
writes a full int, one to three bytes past the user buffer.
Write the value with copy_to_user() bounded by len, so at most optlen
bytes are copied, matching the length reported back to userspace.
Fixes: 02a47617cdce ("Phonet: implement GPRS virtual interface over PEP socket")
Acked-by: Rémi Denis-Courmont <remi@remlab.net>
Reviewed-by: Joe Damato <joe@dama.to>
Acked-by: Stanislav Fomichev <sdf@fomichev.me>
Signed-off-by: Breno Leitao <leitao@debian.org>
Link: https://patch.msgid.link/20260729-getsockopt_phase4-v4-4-c44576757c17@debian.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/phonet/pep.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index 2a8dee4a327e4..4a350c4379004 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -1116,7 +1116,7 @@ static int pep_getsockopt(struct sock *sk, int level, int optname,
len = min_t(unsigned int, sizeof(int), len);
if (put_user(len, optlen))
return -EFAULT;
- if (put_user(val, (int __user *) optval))
+ if (copy_to_user(optval, &val, len))
return -EFAULT;
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0875/1376] blk-cgroup: skip dying blkg in blkcg_activate_policy()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (873 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0874/1376] phonet: pep: do not write beyond optlen in getsockopt Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0876/1376] block/blk-stat: drain per-cpu callback stats over possible CPUs Greg Kroah-Hartman
` (123 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zheng Qixing, Tang Yizhou, Yu Kuai,
Tao Cui, Nilay Shroff, Jens Axboe, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Qixing <zhengqixing@huawei.com>
[ Upstream commit 5e9220389920f33b6a804d50c548cd0cd1b04634 ]
When switching IO schedulers on a block device, blkcg_activate_policy()
can race with concurrent blkcg deletion, leading to a use-after-free in
rcu_accelerate_cbs.
T1: T2:
blkg_destroy
kill(&blkg->refcnt) // blkg->refcnt=1->0
blkg_release // call_rcu(__blkg_release)
...
blkg_free_workfn
->pd_free_fn(pd)
elv_iosched_store
elevator_switch
...
iterate blkg list
blkg_get(blkg) // blkg->refcnt=0->1
list_del_init(&blkg->q_node)
blkg_put(pinned_blkg) // blkg->refcnt=1->0
blkg_release // call_rcu again
rcu_accelerate_cbs // uaf
Fix this by checking hlist_unhashed(&blkg->blkcg_node) before getting
a reference to the blkg. This is the same check used in blkg_destroy()
to detect if a blkg has already been destroyed. If the blkg is already
unhashed, skip processing it since it's being destroyed.
Fixes: f1c006f1c685 ("blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() and blkcg_deactivate_policy()")
Signed-off-by: Zheng Qixing <zhengqixing@huawei.com>
Reviewed-by: Tang Yizhou <yizhou.tang@shopee.com>
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Reviewed-by: Tao Cui <cuitao@kylinos.cn>
Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
Link: https://patch.msgid.link/20260802112525.3933753-4-yukuai@kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-cgroup.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index d95104f0fcdcf..8e7e2db4d1c27 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -1573,6 +1573,8 @@ int blkcg_activate_policy(struct gendisk *disk, const struct blkcg_policy *pol)
if (blkg->pd[pol->plid])
continue;
+ if (hlist_unhashed(&blkg->blkcg_node))
+ continue;
/* If prealloc matches, use it; otherwise try GFP_NOWAIT */
if (blkg == pinned_blkg) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0876/1376] block/blk-stat: drain per-cpu callback stats over possible CPUs
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (874 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0875/1376] blk-cgroup: skip dying blkg in blkcg_activate_policy() Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0877/1376] block/blk-iocost: collect per-cpu latency " Greg Kroah-Hartman
` (122 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tao Cui, Yu Kuai, Jens Axboe,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tao Cui <cuitao@kylinos.cn>
[ Upstream commit 9d617828cfc4d9a4d385daa2cd61f9db0592c53f ]
blk_stat_timer_fn() sums and resets a callback's per-cpu buckets using
for_each_online_cpu(). A CPU that goes offline with pending samples is
skipped, so its samples are neither accumulated into the window nor
cleared; they sit in the bucket until the CPU comes back online, at
which point the stale values are flushed into whatever window is then
running.
This silently corrupts the latency picture that consumers (notably
writeback throttling via wbt, and blk-mq latency tracking) base
decisions on around CPU hotplug: under-counting while the CPU is
offline, then a burst of stale data on re-online.
Fixes: 34dbad5d26e2 ("blk-stat: convert to callback-based statistics reporting")
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
Reviewed-by: Yu Kuai <yukuai@fygo.io>
Link: https://patch.msgid.link/20260720093726.28965-2-cui.tao@linux.dev
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-stat.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/block/blk-stat.c b/block/blk-stat.c
index eaf60097bbe17..0149abb59b76b 100644
--- a/block/blk-stat.c
+++ b/block/blk-stat.c
@@ -83,7 +83,7 @@ static void blk_stat_timer_fn(struct timer_list *t)
for (bucket = 0; bucket < cb->buckets; bucket++)
blk_rq_stat_init(&cb->stat[bucket]);
- for_each_online_cpu(cpu) {
+ for_each_possible_cpu(cpu) {
struct blk_rq_stat *cpu_stat;
cpu_stat = per_cpu_ptr(cb->cpu_stat, cpu);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0877/1376] block/blk-iocost: collect per-cpu latency stats over possible CPUs
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (875 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0876/1376] block/blk-stat: drain per-cpu callback stats over possible CPUs Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0878/1376] block/kyber-iosched: flush per-cpu latency buckets " Greg Kroah-Hartman
` (121 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tao Cui, Yu Kuai, Jens Axboe,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tao Cui <cuitao@kylinos.cn>
[ Upstream commit 4e050c5b92c1600415b2cd452583e543036f3d73 ]
ioc_lat_stat() walks ioc->pcpu_stat with for_each_online_cpu() to
compute missed-ppm and rq_wait deltas. An offlined CPU is skipped, so
its delta is dropped from the period and its last_* watermark is not
advanced; on re-online the next collection sees a delta spanning the
whole offline interval, corrupting the latency/vrate picture.
Fixes: 7caa47151ab2 ("blkcg: implement blk-iocost")
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
Reviewed-by: Yu Kuai <yukuai@fygo.io>
Link: https://patch.msgid.link/20260720093726.28965-4-cui.tao@linux.dev
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-iocost.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/block/blk-iocost.c b/block/blk-iocost.c
index a5894ec9696e7..61a347f504d73 100644
--- a/block/blk-iocost.c
+++ b/block/blk-iocost.c
@@ -1603,7 +1603,7 @@ static void ioc_lat_stat(struct ioc *ioc, u32 *missed_ppm_ar, u32 *rq_wait_pct_p
u64 rq_wait_ns = 0;
int cpu, rw;
- for_each_online_cpu(cpu) {
+ for_each_possible_cpu(cpu) {
struct ioc_pcpu_stat *stat = per_cpu_ptr(ioc->pcpu_stat, cpu);
u64 this_rq_wait_ns;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0878/1376] block/kyber-iosched: flush per-cpu latency buckets over possible CPUs
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (876 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0877/1376] block/blk-iocost: collect per-cpu latency " Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0879/1376] ublk: check for ublk_unmap_io() returning 0 Greg Kroah-Hartman
` (120 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tao Cui, Yu Kuai, Jens Axboe,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tao Cui <cuitao@kylinos.cn>
[ Upstream commit 482fc257de95ab181688e9d1dfcc6b6a58857b1e ]
kyber_timer_fn() sums the per-cpu latency histograms with
for_each_online_cpu(). A CPU that goes offline mid-interval leaves its
bucket un-flushed; the samples are lost from the current decision and
re-appear (stale) when the CPU is onlined again.
Fixes: 6e25cb01ea20 ("kyber: implement improved heuristics")
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
Reviewed-by: Yu Kuai <yukuai@fygo.io>
Link: https://patch.msgid.link/20260720093726.28965-5-cui.tao@linux.dev
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/kyber-iosched.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/block/kyber-iosched.c b/block/kyber-iosched.c
index ccfefa6a36696..869e83054c48f 100644
--- a/block/kyber-iosched.c
+++ b/block/kyber-iosched.c
@@ -279,7 +279,7 @@ static void kyber_timer_fn(struct timer_list *t)
bool bad = false;
/* Sum all of the per-cpu latency histograms. */
- for_each_online_cpu(cpu) {
+ for_each_possible_cpu(cpu) {
struct kyber_cpu_latency *cpu_latency;
cpu_latency = per_cpu_ptr(kqd->cpu_latency, cpu);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0879/1376] ublk: check for ublk_unmap_io() returning 0
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (877 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0878/1376] block/kyber-iosched: flush per-cpu latency buckets " Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0880/1376] o2hb_region_dev_store(): avoid goto around fdget()/fdput() Greg Kroah-Hartman
` (119 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Caleb Sander Mateos, Jens Axboe,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Caleb Sander Mateos <csander@purestorage.com>
[ Upstream commit 24fd3706178f1ae5501fd1ff9036e170ed0665ba ]
If the userspace ublk server passes an unmapped address as the data
buffer for a completed ublk read, ublk_unmap_io() will return 0
indicating no bytes could be copied. Currently, this will result in
calling blk_update_request() with nr_bytes=0, which doesn't seem
supported. Fail the I/O with BLK_STS_IOERR in this case instead.
Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver")
Signed-off-by: Caleb Sander Mateos <csander@purestorage.com>
Link: https://patch.msgid.link/20260729171041.45061-3-csander@purestorage.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/ublk_drv.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index df177ea0a47e6..aecac3b6749bb 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -1072,8 +1072,14 @@ static inline void __ublk_complete_rq(struct request *req)
*
* Re-read simply for this unlikely case.
*/
- if (unlikely(unmapped_bytes < io->res))
+ if (unlikely(unmapped_bytes < io->res)) {
+ if (unlikely(!unmapped_bytes)) {
+ res = BLK_STS_IOERR;
+ goto exit;
+ }
+
io->res = unmapped_bytes;
+ }
/*
* Run bio->bi_end_io() with softirqs disabled. If the final fput
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0880/1376] o2hb_region_dev_store(): avoid goto around fdget()/fdput()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (878 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0879/1376] ublk: check for ublk_unmap_io() returning 0 Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0881/1376] ocfs2/cluster: keep heartbeat local node stable Greg Kroah-Hartman
` (118 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Al Viro, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
[ Upstream commit 554ceb7a5e14435725ac59a42bf0708f95721405 ]
Preparation for CLASS(fd) conversion.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Stable-dep-of: 688bc88e2046 ("ocfs2/cluster: keep heartbeat local node stable")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/cluster/heartbeat.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c
index 6914d615ec2dd..5743dff6af4ea 100644
--- a/fs/ocfs2/cluster/heartbeat.c
+++ b/fs/ocfs2/cluster/heartbeat.c
@@ -1778,23 +1778,23 @@ static ssize_t o2hb_region_dev_store(struct config_item *item,
int live_threshold;
if (reg->hr_bdev_file)
- goto out;
+ return -EINVAL;
/* We can't heartbeat without having had our node number
* configured yet. */
if (o2nm_this_node() == O2NM_MAX_NODES)
- goto out;
+ return -EINVAL;
fd = simple_strtol(p, &p, 0);
if (!p || (*p && (*p != '\n')))
- goto out;
+ return -EINVAL;
if (fd < 0 || fd >= INT_MAX)
- goto out;
+ return -EINVAL;
f = fdget(fd);
if (fd_file(f) == NULL)
- goto out;
+ return -EINVAL;
if (reg->hr_blocks == 0 || reg->hr_start_block == 0 ||
reg->hr_block_bytes == 0)
@@ -1916,7 +1916,6 @@ static ssize_t o2hb_region_dev_store(struct config_item *item,
}
out2:
fdput(f);
-out:
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0881/1376] ocfs2/cluster: keep heartbeat local node stable
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (879 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0880/1376] o2hb_region_dev_store(): avoid goto around fdget()/fdput() Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0882/1376] lib/string: fix memchr_inv() for large ranges Greg Kroah-Hartman
` (117 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cen Zhang, Joseph Qi, Mark Fasheh,
Joel Becker, Junxiao Bi, Changwei Ge, Jun Piao, Heming Zhao,
Andrew Morton, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <zzzccc427@gmail.com>
[ Upstream commit 688bc88e2046dd6ce81ce18079b5254cb8dadc0e ]
o2nm_node_local_store() handles local=0 by stopping o2net and setting
cl_local_node to O2NM_INVALID_NODE_NUM, but it leaves cl_has_local set.
That stale state makes o2nm_this_node() return 255, blocks a later local=1
attempt with -EBUSY, and can feed 255 to heartbeat users that call
o2nm_this_node() dynamically.
Clearing cl_has_local is required when the local node is reset. But
heartbeat threads can still be running at that point. They pin the local
node config item at startup, yet o2hb_do_disk_heartbeat() and thread
teardown re-read o2nm_this_node() for the local slot and for
o2nm_undepend_this_node(). Once local=0 has cleared the live local-node
state, those dynamic reads return O2NM_MAX_NODES, which is also the
invalid node number 255.
Store the local node number in the heartbeat region when the region
starts. Use that stable node for heartbeat slot writes/checks,
negotiation messages, and the final configfs undepend. Stop the heartbeat
loop when the current local node no longer matches the stored node, and
clear cl_has_local together with cl_local_node in the local=0 path so
nodemanager state matches node removal.
Validation reproduced this kernel report:
KASAN slab-out-of-bounds in o2hb_do_disk_heartbeat+0x372/0xb30
RIP: 0010:memset+0xf/0x20
Read of size 8
Call trace:
dump_stack_lvl+0x66/0xa0
print_report+0xd0/0x630
o2hb_do_disk_heartbeat+0x372/0xb30 (fs/ocfs2/cluster/heartbeat.c:1079)
srso_alias_return_thunk+0x5/0xfbef5
__virt_addr_valid+0x188/0x2f0
kasan_report+0xe4/0x120
o2hb_do_disk_heartbeat+0x5/0xb30 (fs/ocfs2/cluster/heartbeat.c:1079)
o2hb_thread+0x14e/0x770
kthread_affine_node+0x139/0x180
lockdep_hardirqs_on_prepare+0xda/0x190
trace_hardirqs_on+0x18/0x130
kthread+0x19d/0x1e0
ret_from_fork+0x37a/0x4d0
__switch_to+0x2d5/0x6f0
ret_from_fork_asm+0x1a/0x30
Link: https://lore.kernel.org/20260616074931.3774929-1-zzzccc427@gmail.com
Fixes: a7f6a5fb4bde ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem")
Assisted-by: Codex:gpt-5.5
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Suggested-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/cluster/heartbeat.c | 43 +++++++++++++++++++++++-----------
fs/ocfs2/cluster/nodemanager.c | 19 +++++++++++----
fs/ocfs2/cluster/nodemanager.h | 2 ++
3 files changed, 46 insertions(+), 18 deletions(-)
diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c
index 5743dff6af4ea..ea44ea6efbc6e 100644
--- a/fs/ocfs2/cluster/heartbeat.c
+++ b/fs/ocfs2/cluster/heartbeat.c
@@ -210,6 +210,7 @@ struct o2hb_region {
/* protected by the hr_callback_sem */
struct task_struct *hr_task;
+ u8 hr_node_num;
unsigned int hr_blocks;
unsigned long long hr_start_block;
@@ -357,12 +358,12 @@ static void o2hb_disarm_timeout(struct o2hb_region *reg)
cancel_delayed_work_sync(®->hr_nego_timeout_work);
}
-static int o2hb_send_nego_msg(int key, int type, u8 target)
+static int o2hb_send_nego_msg(int key, int type, u8 target, u8 node_num)
{
struct o2hb_nego_msg msg;
int status, ret;
- msg.node_num = o2nm_this_node();
+ msg.node_num = node_num;
again:
ret = o2net_send_message(type, key, &msg, sizeof(msg),
target, &status);
@@ -380,8 +381,10 @@ static void o2hb_nego_timeout(struct work_struct *work)
unsigned long live_node_bitmap[BITS_TO_LONGS(O2NM_MAX_NODES)];
int master_node, i, ret;
struct o2hb_region *reg;
+ u8 node_num;
reg = container_of(work, struct o2hb_region, hr_nego_timeout_work.work);
+ node_num = reg->hr_node_num;
/* don't negotiate timeout if last hb failed since it is very
* possible io failed. Should let write timeout fence self.
*/
@@ -392,10 +395,10 @@ static void o2hb_nego_timeout(struct work_struct *work)
/* lowest node as master node to make negotiate decision. */
master_node = find_first_bit(live_node_bitmap, O2NM_MAX_NODES);
- if (master_node == o2nm_this_node()) {
+ if (master_node == node_num) {
if (!test_bit(master_node, reg->hr_nego_node_bitmap)) {
printk(KERN_NOTICE "o2hb: node %d hb write hung for %ds on region %s (%pg).\n",
- o2nm_this_node(), O2HB_NEGO_TIMEOUT_MS/1000,
+ node_num, O2HB_NEGO_TIMEOUT_MS / 1000,
config_item_name(®->hr_item), reg_bdev(reg));
set_bit(master_node, reg->hr_nego_node_bitmap);
}
@@ -424,7 +427,7 @@ static void o2hb_nego_timeout(struct work_struct *work)
mlog(ML_HEARTBEAT, "send NEGO_APPROVE msg to node %d\n", i);
ret = o2hb_send_nego_msg(reg->hr_key,
- O2HB_NEGO_APPROVE_MSG, i);
+ O2HB_NEGO_APPROVE_MSG, i, node_num);
if (ret)
mlog(ML_ERROR, "send NEGO_APPROVE msg to node %d fail %d\n",
i, ret);
@@ -432,10 +435,10 @@ static void o2hb_nego_timeout(struct work_struct *work)
} else {
/* negotiate timeout with master node. */
printk(KERN_NOTICE "o2hb: node %d hb write hung for %ds on region %s (%pg), negotiate timeout with node %d.\n",
- o2nm_this_node(), O2HB_NEGO_TIMEOUT_MS/1000, config_item_name(®->hr_item),
+ node_num, O2HB_NEGO_TIMEOUT_MS / 1000, config_item_name(®->hr_item),
reg_bdev(reg), master_node);
ret = o2hb_send_nego_msg(reg->hr_key, O2HB_NEGO_TIMEOUT_MSG,
- master_node);
+ master_node, node_num);
if (ret)
mlog(ML_ERROR, "send NEGO_TIMEOUT msg to node %d fail %d\n",
master_node, ret);
@@ -608,7 +611,9 @@ static int o2hb_issue_node_write(struct o2hb_region *reg,
o2hb_bio_wait_init(write_wc);
- slot = o2nm_this_node();
+ slot = reg->hr_node_num;
+ if (slot >= O2NM_MAX_NODES)
+ return -EINVAL;
bio = o2hb_setup_one_bio(reg, write_wc, &slot, slot+1,
REQ_OP_WRITE | REQ_SYNC);
@@ -677,8 +682,12 @@ static int o2hb_check_own_slot(struct o2hb_region *reg)
struct o2hb_disk_slot *slot;
struct o2hb_disk_heartbeat_block *hb_block;
char *errstr;
+ u8 node_num = reg->hr_node_num;
+
+ if (node_num >= O2NM_MAX_NODES)
+ return 0;
- slot = ®->hr_slots[o2nm_this_node()];
+ slot = ®->hr_slots[node_num];
/* Don't check on our 1st timestamp */
if (!slot->ds_last_time)
return 0;
@@ -719,7 +728,10 @@ static inline void o2hb_prepare_block(struct o2hb_region *reg,
struct o2hb_disk_slot *slot;
struct o2hb_disk_heartbeat_block *hb_block;
- node_num = o2nm_this_node();
+ node_num = reg->hr_node_num;
+ if (node_num >= O2NM_MAX_NODES)
+ return;
+
slot = ®->hr_slots[node_num];
hb_block = (struct o2hb_disk_heartbeat_block *)slot->ds_raw_block;
@@ -1213,7 +1225,7 @@ static int o2hb_thread(void *data)
set_user_nice(current, MIN_NICE);
/* Pin node */
- ret = o2nm_depend_this_node();
+ ret = o2nm_depend_node(reg->hr_node_num);
if (ret) {
mlog(ML_ERROR, "Node has been deleted, ret = %d\n", ret);
reg->hr_node_deleted = 1;
@@ -1222,7 +1234,8 @@ static int o2hb_thread(void *data)
}
while (!kthread_should_stop() &&
- !reg->hr_unclean_stop && !reg->hr_aborted_start) {
+ !reg->hr_unclean_stop && !reg->hr_aborted_start &&
+ o2nm_this_node() == reg->hr_node_num) {
/* We track the time spent inside
* o2hb_do_disk_heartbeat so that we avoid more than
* hr_timeout_ms between disk writes. On busy systems
@@ -1271,7 +1284,7 @@ static int o2hb_thread(void *data)
}
/* Unpin node */
- o2nm_undepend_this_node();
+ o2nm_undepend_node(reg->hr_node_num);
mlog(ML_HEARTBEAT|ML_KTHREAD, "o2hb thread exiting\n");
@@ -1782,7 +1795,8 @@ static ssize_t o2hb_region_dev_store(struct config_item *item,
/* We can't heartbeat without having had our node number
* configured yet. */
- if (o2nm_this_node() == O2NM_MAX_NODES)
+ reg->hr_node_num = o2nm_this_node();
+ if (reg->hr_node_num == O2NM_MAX_NODES)
return -EINVAL;
fd = simple_strtol(p, &p, 0);
@@ -2017,6 +2031,7 @@ static struct config_item *o2hb_heartbeat_group_make_item(struct config_group *g
ret = -ENAMETOOLONG;
goto free;
}
+ reg->hr_node_num = O2NM_MAX_NODES;
spin_lock(&o2hb_live_lock);
reg->hr_region_num = 0;
diff --git a/fs/ocfs2/cluster/nodemanager.c b/fs/ocfs2/cluster/nodemanager.c
index 5fffbed779da7..46e0c9ba8a4ff 100644
--- a/fs/ocfs2/cluster/nodemanager.c
+++ b/fs/ocfs2/cluster/nodemanager.c
@@ -366,6 +366,7 @@ static ssize_t o2nm_node_local_store(struct config_item *item, const char *page,
if (!tmp && cluster->cl_has_local &&
cluster->cl_local_node == node->nd_num) {
o2net_stop_listening(node);
+ cluster->cl_has_local = 0;
cluster->cl_local_node = O2NM_INVALID_NODE_NUM;
}
@@ -787,12 +788,12 @@ void o2nm_undepend_item(struct config_item *item)
configfs_undepend_item(item);
}
-int o2nm_depend_this_node(void)
+int o2nm_depend_node(u8 node_num)
{
int ret = 0;
struct o2nm_node *local_node;
- local_node = o2nm_get_node_by_num(o2nm_this_node());
+ local_node = o2nm_get_node_by_num(node_num);
if (!local_node) {
ret = -EINVAL;
goto out;
@@ -805,17 +806,27 @@ int o2nm_depend_this_node(void)
return ret;
}
-void o2nm_undepend_this_node(void)
+void o2nm_undepend_node(u8 node_num)
{
struct o2nm_node *local_node;
- local_node = o2nm_get_node_by_num(o2nm_this_node());
+ local_node = o2nm_get_node_by_num(node_num);
BUG_ON(!local_node);
o2nm_undepend_item(&local_node->nd_item);
o2nm_node_put(local_node);
}
+int o2nm_depend_this_node(void)
+{
+ return o2nm_depend_node(o2nm_this_node());
+}
+
+void o2nm_undepend_this_node(void)
+{
+ o2nm_undepend_node(o2nm_this_node());
+}
+
static void __exit exit_o2nm(void)
{
diff --git a/fs/ocfs2/cluster/nodemanager.h b/fs/ocfs2/cluster/nodemanager.h
index 2f72f56996bd9..ca3483fb54504 100644
--- a/fs/ocfs2/cluster/nodemanager.h
+++ b/fs/ocfs2/cluster/nodemanager.h
@@ -66,6 +66,8 @@ void o2nm_node_put(struct o2nm_node *node);
int o2nm_depend_item(struct config_item *item);
int o2nm_depend_item_unlocked(struct config_item *item);
void o2nm_undepend_item(struct config_item *item);
+int o2nm_depend_node(u8 node_num);
+void o2nm_undepend_node(u8 node_num);
int o2nm_depend_this_node(void);
void o2nm_undepend_this_node(void);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0882/1376] lib/string: fix memchr_inv() for large ranges
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (880 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0881/1376] ocfs2/cluster: keep heartbeat local node stable Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0883/1376] pps: dont try to wait for negative timeouts in PPS_FETCH Greg Kroah-Hartman
` (116 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bradley Morgan, Akinbou Mita,
Andy Shevchenko, Christoph Lameer, Joern Engel, Kees Cook,
Pekka Enberg, Andrew Morton, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bradley Morgan <include@grrlz.net>
[ Upstream commit c04cffb8c51618538f0c05c478a931eb6e1a806b ]
memchr_inv() takes a size_t length but counts 8 byte words in an unsigned
int. At 32GiB that count wraps, so the scan can quietly miss most of the
range.
Use size_t for the word count.
Link: https://lore.kernel.org/20260621121133.16460-1-include@grrlz.net
Fixes: 798248206b59 ("lib/string.c: introduce memchr_inv()")
Signed-off-by: Bradley Morgan <include@grrlz.net>
Cc: Akinbou Mita <akinobu.mita@gmail.com>
Cc: Andy Shevchenko <andy@kernel.org>
Cc: Christoph Lameer <cl@linux-foundation.org>
Cc: Joern Engel <joern@logfs.org>
Cc: Kees Cook <kees@kernel.org>
Cc: Pekka Enberg <penberg@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/string.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/lib/string.c b/lib/string.c
index e657809fa7189..8d117fed31264 100644
--- a/lib/string.c
+++ b/lib/string.c
@@ -828,7 +828,8 @@ void *memchr_inv(const void *start, int c, size_t bytes)
{
u8 value = c;
u64 value64;
- unsigned int words, prefix;
+ size_t words;
+ unsigned int prefix;
if (bytes <= 16)
return check_bytes8(start, value, bytes);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0883/1376] pps: dont try to wait for negative timeouts in PPS_FETCH
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (881 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0882/1376] lib/string: fix memchr_inv() for large ranges Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0884/1376] pps: clients: gpio: Bypass edges direction check when not needed Greg Kroah-Hartman
` (115 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Calvin Owens, Sashiko,
Rodolfo Giometti, Andrew Morton, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Calvin Owens <calvin@wbinvd.org>
[ Upstream commit 45217e98987a87ff2372386dbf82fd5325db28ea ]
If userspace passes a negative timeout to PPS_FETCH, it triggers a kernel
splat from schedule_timeout():
schedule_timeout: wrong timeout value fffffffffff0bfb4
CPU: 17 UID: 0 PID: 4720 Comm: a.out Not tainted 7.1.0-rc5-x86-kvm-00150-g331d97e36b37 #1 PREEMPT_RT
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-20240910_120124-localhost 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x4b/0x70
schedule_timeout+0xb7/0xe0
pps_cdev_pps_fetch.isra.0+0x93/0x150
pps_cdev_ioctl+0x70/0x310
__x64_sys_ioctl+0x7b/0xc0
do_syscall_64+0xb6/0xfc0
entry_SYSCALL_64_after_hwframe+0x4b/0x53
Here is a trivial reproducer that works with the PPS_CLIENT_KTIMER test
device enabled in the kernel:
#include <stdlib.h>
#include <fcntl.h>
#include <unistd.h>
#include <sys/ioctl.h>
#include <linux/pps.h>
#include <err.h>
int main() {
struct pps_fdata fdata;
int fd;
fd = open("/dev/pps0", O_RDWR);
if (fd == -1)
err(1, "Failed to open /dev/pps0");
fdata.timeout.sec = -1;
fdata.timeout.nsec = 0;
if (ioctl(fd, PPS_FETCH, &fdata))
err(2, "PPS_FETCH failed");
close(fd);
return 0;
}
Sashiko imagines this to be some sort of security problem, which is
obviously really silly. But I think it is still worth fixing, so buggy
userspace code can't trigger the splat.
Silence the splat by using timespec64_to_jiffies(), which hard limits the
timeout to LONG_MAX jiffies. To be safe, explicitly preserve the
-ETIMEDOUT return value userspace sees today if it passes a negative
timeout.
If you really squint, this is still a slight behavior change in that there
are "denormalized" combinations of tv_sec and tv_nsec which used to work
but will now return -ETIMEDOUT. I can't imagine anybody will care about
that...
Link: https://lore.kernel.org/c5c97c3b3c9d66010382094fd538e59a38f4aacf.1781289959.git.calvin@wbinvd.org
Fixes: eae9d2ba0cfc ("LinuxPPS: core support")
Signed-off-by: Calvin Owens <calvin@wbinvd.org>
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/cover.1779733602.git.calvin%40wbinvd.org?part=3
Acked-by: Rodolfo Giometti <giometti@enneenne.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pps/pps.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c
index c6b8b64782761..2e04636f43805 100644
--- a/drivers/pps/pps.c
+++ b/drivers/pps/pps.c
@@ -63,13 +63,19 @@ static int pps_cdev_pps_fetch(struct pps_device *pps, struct pps_fdata *fdata)
err = wait_event_interruptible(pps->queue,
ev != pps->last_ev);
else {
+ struct timespec64 ts;
unsigned long ticks;
dev_dbg(&pps->dev, "timeout %lld.%09d\n",
(long long) fdata->timeout.sec,
fdata->timeout.nsec);
- ticks = fdata->timeout.sec * HZ;
- ticks += fdata->timeout.nsec / (NSEC_PER_SEC / HZ);
+
+ if (fdata->timeout.sec < 0)
+ return -ETIMEDOUT;
+
+ ts.tv_sec = fdata->timeout.sec;
+ ts.tv_nsec = fdata->timeout.nsec;
+ ticks = timespec64_to_jiffies(&ts);
if (ticks != 0) {
err = wait_event_interruptible_timeout(
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0884/1376] pps: clients: gpio: Bypass edges direction check when not needed
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (882 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0883/1376] pps: dont try to wait for negative timeouts in PPS_FETCH Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0885/1376] pps: pps-gpio: split IRQ handler into hardirq timestamper + threaded handler Greg Kroah-Hartman
` (114 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bastien Curutchet, Rodolfo Giometti,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bastien Curutchet <bastien.curutchet@bootlin.com>
[ Upstream commit a01f6287c244f35eeec11ca932d09061181eed8c ]
In the IRQ handler, the GPIO's state is read to verify the direction of
the edge that triggered the interruption before generating the PPS event.
If a pulse is too short, the GPIO line can reach back its original state
before this verification and the PPS event is lost.
This check is needed when info->capture_clear is set because it needs
interruptions on both rising and falling edges. When info->capture_clear
is not set, interruption is triggered by one edge only so this check can
be omitted.
Add a warning if irq_handler is left without triggering any PPS event.
Bypass the edge's direction verification when info->capture_clear is not
set.
Signed-off-by: Bastien Curutchet <bastien.curutchet@bootlin.com>
Acked-by: Rodolfo Giometti <giometti@enneenne.com>
Link: https://lore.kernel.org/r/20250108153012.514925-1-bastien.curutchet@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: b899e0279f90 ("pps-gpio: remove dead capture_clear code")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pps/clients/pps-gpio.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/pps/clients/pps-gpio.c b/drivers/pps/clients/pps-gpio.c
index 1412f8af15f27..027759e2d563c 100644
--- a/drivers/pps/clients/pps-gpio.c
+++ b/drivers/pps/clients/pps-gpio.c
@@ -52,7 +52,9 @@ static irqreturn_t pps_gpio_irq_handler(int irq, void *data)
info = data;
- rising_edge = gpiod_get_value(info->gpio_pin);
+ /* Small trick to bypass the check on edge's direction when capture_clear is unset */
+ rising_edge = info->capture_clear ?
+ gpiod_get_value(info->gpio_pin) : !info->assert_falling_edge;
if ((rising_edge && !info->assert_falling_edge) ||
(!rising_edge && info->assert_falling_edge))
pps_event(info->pps, &ts, PPS_CAPTUREASSERT, data);
@@ -60,6 +62,8 @@ static irqreturn_t pps_gpio_irq_handler(int irq, void *data)
((rising_edge && info->assert_falling_edge) ||
(!rising_edge && !info->assert_falling_edge)))
pps_event(info->pps, &ts, PPS_CAPTURECLEAR, data);
+ else
+ dev_warn_ratelimited(&info->pps->dev, "IRQ did not trigger any PPS event\n");
return IRQ_HANDLED;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0885/1376] pps: pps-gpio: split IRQ handler into hardirq timestamper + threaded handler
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (883 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0884/1376] pps: clients: gpio: Bypass edges direction check when not needed Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0886/1376] pps-gpio: remove dead capture_clear code Greg Kroah-Hartman
` (113 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Byczkowski, Calvin Owens,
Sebastian Andrzej Siewior, Rodolfo Giometti, Andrew Morton,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Byczkowski <by@by-online.de>
[ Upstream commit 93781560b2fdd26fa8499d64db8a95a07e1dc902 ]
Split the pps-gpio interrupt handler into a primary (hardirq) handler that
captures the PPS timestamp at interrupt entry, and a threaded handler that
processes the event. This produces the same two-part handler structure on
both PREEMPT_RT and non-RT kernels.
On non-RT kernels the threaded portion runs immediately after the primary,
with no behavioral change compared to the previous single-handler
implementation.
On PREEMPT_RT, where interrupt handlers are force-threaded by default, the
previous single-handler implementation captured the timestamp inside the
threaded portion, after IRQ-thread scheduling delay. With the split, the
timestamp is captured in true hardirq context as it is on non-RT kernels,
eliminating a significant source of PPS jitter on RT systems.
Link: https://lore.kernel.org/2e32729029fbf6977ecf04665eb00f2efd3e2c17.1780359378.git.calvin@wbinvd.org
Signed-off-by: Michael Byczkowski <by@by-online.de>
Signed-off-by: Calvin Owens <calvin@wbinvd.org>
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Tested-by: Michael Byczkowski <by@by-online.de>
Tested-by: Calvin Owens <calvin@wbinvd.org>
Acked-by: Rodolfo Giometti <giometti@enneenne.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Stable-dep-of: b899e0279f90 ("pps-gpio: remove dead capture_clear code")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pps/clients/pps-gpio.c | 37 +++++++++++++++++++++++-----------
1 file changed, 25 insertions(+), 12 deletions(-)
diff --git a/drivers/pps/clients/pps-gpio.c b/drivers/pps/clients/pps-gpio.c
index 027759e2d563c..99b4ca57a3ab4 100644
--- a/drivers/pps/clients/pps-gpio.c
+++ b/drivers/pps/clients/pps-gpio.c
@@ -35,33 +35,44 @@ struct pps_gpio_device_data {
bool capture_clear;
unsigned int echo_active_ms; /* PPS echo active duration */
unsigned long echo_timeout; /* timer timeout value in jiffies */
+ struct pps_event_time ts; /* timestamp captured in hardirq */
};
/*
* Report the PPS event
*/
-static irqreturn_t pps_gpio_irq_handler(int irq, void *data)
+/*
+ * Primary hardirq handler -- runs in hardirq context even on PREEMPT_RT.
+ * Only captures the timestamp; all other work is deferred to the thread.
+ */
+static irqreturn_t pps_gpio_irq_hardirq(int irq, void *data)
{
- const struct pps_gpio_device_data *info;
- struct pps_event_time ts;
- int rising_edge;
+ struct pps_gpio_device_data *info = data;
+
+ pps_get_ts(&info->ts);
- /* Get the time stamp first */
- pps_get_ts(&ts);
+ return IRQ_WAKE_THREAD;
+}
- info = data;
+/*
+ * Threaded handler -- processes the PPS event using the timestamp
+ * captured in hardirq context above.
+ */
+static irqreturn_t pps_gpio_irq_thread(int irq, void *data)
+{
+ struct pps_gpio_device_data *info = data;
+ int rising_edge;
- /* Small trick to bypass the check on edge's direction when capture_clear is unset */
rising_edge = info->capture_clear ?
gpiod_get_value(info->gpio_pin) : !info->assert_falling_edge;
if ((rising_edge && !info->assert_falling_edge) ||
(!rising_edge && info->assert_falling_edge))
- pps_event(info->pps, &ts, PPS_CAPTUREASSERT, data);
+ pps_event(info->pps, &info->ts, PPS_CAPTUREASSERT, data);
else if (info->capture_clear &&
((rising_edge && info->assert_falling_edge) ||
(!rising_edge && !info->assert_falling_edge)))
- pps_event(info->pps, &ts, PPS_CAPTURECLEAR, data);
+ pps_event(info->pps, &info->ts, PPS_CAPTURECLEAR, data);
else
dev_warn_ratelimited(&info->pps->dev, "IRQ did not trigger any PPS event\n");
@@ -210,8 +221,10 @@ static int pps_gpio_probe(struct platform_device *pdev)
}
/* register IRQ interrupt handler */
- ret = request_irq(data->irq, pps_gpio_irq_handler,
- get_irqf_trigger_flags(data), data->info.name, data);
+ ret = request_threaded_irq(data->irq,
+ pps_gpio_irq_hardirq, pps_gpio_irq_thread,
+ get_irqf_trigger_flags(data) | IRQF_ONESHOT,
+ data->info.name, data);
if (ret) {
pps_unregister_source(data->pps);
dev_err(dev, "failed to acquire IRQ %d\n", data->irq);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0886/1376] pps-gpio: remove dead capture_clear code
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (884 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0885/1376] pps: pps-gpio: split IRQ handler into hardirq timestamper + threaded handler Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0887/1376] rapidio: clear mport->net when rio_add_net() fails Greg Kroah-Hartman
` (112 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Calvin Owens, Rodolfo Giometti,
Andrew Morton, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Calvin Owens <calvin@wbinvd.org>
[ Upstream commit b899e0279f90c3ce4099d68b989dd27861cc5c4f ]
The capture_clear field is never set, and all code conditional on it being
set has been unreachable since the platform data logic was removed from
pps-gpio in ee89646619ba ("pps: clients: gpio: Get rid of legacy platform
data").
I think the only logical thing to do here is to remove it all, since no
in-tree code ever actually used it in the first place, and it has been
completely dead code for over five years (since v5.13).
Sashiko asked some questions about the gpiod_get_value() call which caused
me to look deeper and figure this out, but it did not actually notice
capture_clear is never set.
Link: https://lore.kernel.org/f70196bafcf75d9782dd36ed784e42345b6e8a1b.1783355507.git.calvin@wbinvd.org
Fixes: ee89646619ba ("pps: clients: gpio: Get rid of legacy platform data")
Signed-off-by: Calvin Owens <calvin@wbinvd.org>
Closes: https://sashiko.dev/#/patchset/cover.1779733602.git.calvin%40wbinvd.org?part=1
Acked-by: Rodolfo Giometti <giometti@enneenne.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pps/clients/pps-gpio.c | 37 ++++------------------------------
1 file changed, 4 insertions(+), 33 deletions(-)
diff --git a/drivers/pps/clients/pps-gpio.c b/drivers/pps/clients/pps-gpio.c
index 99b4ca57a3ab4..96e169a35cedb 100644
--- a/drivers/pps/clients/pps-gpio.c
+++ b/drivers/pps/clients/pps-gpio.c
@@ -32,7 +32,6 @@ struct pps_gpio_device_data {
struct gpio_desc *echo_pin;
struct timer_list echo_timer; /* timer to reset echo active state */
bool assert_falling_edge;
- bool capture_clear;
unsigned int echo_active_ms; /* PPS echo active duration */
unsigned long echo_timeout; /* timer timeout value in jiffies */
struct pps_event_time ts; /* timestamp captured in hardirq */
@@ -62,19 +61,8 @@ static irqreturn_t pps_gpio_irq_hardirq(int irq, void *data)
static irqreturn_t pps_gpio_irq_thread(int irq, void *data)
{
struct pps_gpio_device_data *info = data;
- int rising_edge;
-
- rising_edge = info->capture_clear ?
- gpiod_get_value(info->gpio_pin) : !info->assert_falling_edge;
- if ((rising_edge && !info->assert_falling_edge) ||
- (!rising_edge && info->assert_falling_edge))
- pps_event(info->pps, &info->ts, PPS_CAPTUREASSERT, data);
- else if (info->capture_clear &&
- ((rising_edge && info->assert_falling_edge) ||
- (!rising_edge && !info->assert_falling_edge)))
- pps_event(info->pps, &info->ts, PPS_CAPTURECLEAR, data);
- else
- dev_warn_ratelimited(&info->pps->dev, "IRQ did not trigger any PPS event\n");
+
+ pps_event(info->pps, &info->ts, PPS_CAPTUREASSERT, data);
return IRQ_HANDLED;
}
@@ -90,11 +78,6 @@ static void pps_gpio_echo(struct pps_device *pps, int event, void *data)
if (pps->params.mode & PPS_ECHOASSERT)
gpiod_set_value(info->echo_pin, 1);
break;
-
- case PPS_CAPTURECLEAR:
- if (pps->params.mode & PPS_ECHOCLEAR)
- gpiod_set_value(info->echo_pin, 1);
- break;
}
/* fire the timer */
@@ -156,15 +139,8 @@ static int pps_gpio_setup(struct device *dev)
static unsigned long
get_irqf_trigger_flags(const struct pps_gpio_device_data *data)
{
- unsigned long flags = data->assert_falling_edge ?
- IRQF_TRIGGER_FALLING : IRQF_TRIGGER_RISING;
-
- if (data->capture_clear) {
- flags |= ((flags & IRQF_TRIGGER_RISING) ?
- IRQF_TRIGGER_FALLING : IRQF_TRIGGER_RISING);
- }
-
- return flags;
+ return data->assert_falling_edge ? IRQF_TRIGGER_FALLING :
+ IRQF_TRIGGER_RISING;
}
static int pps_gpio_probe(struct platform_device *pdev)
@@ -197,9 +173,6 @@ static int pps_gpio_probe(struct platform_device *pdev)
/* initialize PPS specific parts of the bookkeeping data structure. */
data->info.mode = PPS_CAPTUREASSERT | PPS_OFFSETASSERT |
PPS_ECHOASSERT | PPS_CANWAIT | PPS_TSFMT_TSPEC;
- if (data->capture_clear)
- data->info.mode |= PPS_CAPTURECLEAR | PPS_OFFSETCLEAR |
- PPS_ECHOCLEAR;
data->info.owner = THIS_MODULE;
snprintf(data->info.name, PPS_MAX_NAME_LEN - 1, "%s.%d",
pdev->name, pdev->id);
@@ -211,8 +184,6 @@ static int pps_gpio_probe(struct platform_device *pdev)
/* register PPS source */
pps_default_params = PPS_CAPTUREASSERT | PPS_OFFSETASSERT;
- if (data->capture_clear)
- pps_default_params |= PPS_CAPTURECLEAR | PPS_OFFSETCLEAR;
data->pps = pps_register_source(&data->info, pps_default_params);
if (IS_ERR(data->pps)) {
dev_err(dev, "failed to register IRQ %d as PPS source\n",
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0887/1376] rapidio: clear mport->net when rio_add_net() fails
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (885 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0886/1376] pps-gpio: remove dead capture_clear code Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0888/1376] fat: release buffer head after rebuilding parent Greg Kroah-Hartman
` (111 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Alexandre Bounine,
Matt Porter, Yang yingliang, Andrew Morton, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit b74030fbf187b43c1f85b66a7082e9946511cb5d ]
rio_alloc_net() stores the newly allocated rio_net in mport->net before
rio_scan_alloc_net() registers the device.
If rio_add_net() fails, rio_scan_alloc_net() drops the device reference
with put_device(), which releases the rio_net through the device release
callback. However, mport->net is left pointing at the freed object.
A later mport unregister path can then dereference the dangling mport->net
pointer and may try to free the same rio_net again.
Clear mport->net in the rio_add_net() failure path, matching the cleanup
done for the destID table allocation failure path.
Link: https://lore.kernel.org/20260708070628.721010-1-lgs201920130244@gmail.com
Fixes: e842f9a1edf3 ("rapidio: add check for rio_add_net() in rio_scan_alloc_net()")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Cc: Alexandre Bounine <alex.bou9@gmail.com>
Cc: Matt Porter <mporter@kernel.crashing.org>
Cc: Yang yingliang <yangyingliang@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rapidio/rio-scan.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/rapidio/rio-scan.c b/drivers/rapidio/rio-scan.c
index dcd6619a4b027..3cc25d0534513 100644
--- a/drivers/rapidio/rio-scan.c
+++ b/drivers/rapidio/rio-scan.c
@@ -874,6 +874,7 @@ static struct rio_net *rio_scan_alloc_net(struct rio_mport *mport,
net->dev.release = rio_scan_release_dev;
if (rio_add_net(net)) {
put_device(&net->dev);
+ mport->net = NULL;
net = NULL;
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0888/1376] fat: release buffer head after rebuilding parent
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (886 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0887/1376] rapidio: clear mport->net when rio_add_net() fails Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0889/1376] riscv: dts: sophgo: cv180x: Allow the DMA multiplexer to set channel number for DMA controller Greg Kroah-Hartman
` (110 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yichong Chen, OGAWA Hirofumi,
Christian Brauner, Amit Sahrawat, Namjae Jeon, Ravishankar N,
Andrew Morton, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yichong Chen <chenyichong@uniontech.com>
[ Upstream commit 83e98dbf19ab64e8528e101e20f8d50e1aaa68a8 ]
fat_scan_logstart() leaves the matching directory entry's buffer head in
sinfo.bh for the caller to release, just like fat_scan().
fat_rebuild_parent() uses the directory entry to rebuild the parent inode
for the nostale_ro NFS export path, but does not release sinfo.bh after a
successful scan. Release it once fat_build_inode() has consumed the
directory entry data.
Link: https://lore.kernel.org/20260715020957.1096309-1-chenyichong@uniontech.com
Fixes: f1e6fb0ab451 ("fat (exportfs): rebuild directory-inode if fat_dget()")
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Acked-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Amit Sahrawat <a.sahrawat@samsung.com>
Cc: chenyichong <chenyichong@uniontech.com>
Cc: Namjae Jeon <namjae.jeon@samsung.com>
Cc: Ravishankar N <ravi.n1@samsung.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/fat/nfs.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/fat/nfs.c b/fs/fat/nfs.c
index 509eea96a457d..6e1b371711edd 100644
--- a/fs/fat/nfs.c
+++ b/fs/fat/nfs.c
@@ -250,8 +250,10 @@ struct inode *fat_rebuild_parent(struct super_block *sb, int parent_logstart)
MSDOS_I(dummy_grand_parent)->i_pos = -1;
}
- if (!fat_scan_logstart(dummy_grand_parent, clus_to_match, &sinfo))
+ if (!fat_scan_logstart(dummy_grand_parent, clus_to_match, &sinfo)) {
parent = fat_build_inode(sb, sinfo.de, sinfo.i_pos);
+ brelse(sinfo.bh);
+ }
brelse(parent_bh);
iput(dummy_grand_parent);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0889/1376] riscv: dts: sophgo: cv180x: Allow the DMA multiplexer to set channel number for DMA controller
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (887 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0888/1376] fat: release buffer head after rebuilding parent Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0890/1376] drm/omap: dsi: Do not copy isr table Greg Kroah-Hartman
` (109 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anton D. Stavinskii, Inochi Amaoto,
Chen Wang, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Inochi Amaoto <inochiama@gmail.com>
[ Upstream commit 5011466bade64483bb52bc4a926719d6794e6dab ]
Change the DMA controller compatible to the sophgo,cv1800b-axi-dma,
which supports setting DMA channel number in DMA phandle args.
This dts change does not break backward compatibility as a fallback
compatiable string is added.
Fixes: 514951a81a5e ("riscv: dts: sophgo: cv18xx: add DMA controller")
Reported-by: Anton D. Stavinskii <stavinsky@gmail.com>
Closes: https://github.com/sophgo/linux/issues/9
Tested-by: Anton D. Stavinskii <stavinsky@gmail.com>
Link: https://patch.msgid.link/20260511063818.463877-3-inochiama@gmail.com
Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
Signed-off-by: Chen Wang <chen.wang@linux.dev>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/riscv/boot/dts/sophgo/cv18xx.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/riscv/boot/dts/sophgo/cv18xx.dtsi b/arch/riscv/boot/dts/sophgo/cv18xx.dtsi
index b8063ba6d6d7f..e519a72c093d1 100644
--- a/arch/riscv/boot/dts/sophgo/cv18xx.dtsi
+++ b/arch/riscv/boot/dts/sophgo/cv18xx.dtsi
@@ -298,7 +298,7 @@ sdhci0: mmc@4310000 {
};
dmac: dma-controller@4330000 {
- compatible = "snps,axi-dma-1.01a";
+ compatible = "sophgo,cv1800b-axi-dma", "snps,axi-dma-1.01a";
reg = <0x04330000 0x1000>;
interrupts = <29 IRQ_TYPE_LEVEL_HIGH>;
clocks = <&clk CLK_SDMA_AXI>, <&clk CLK_SDMA_AXI>;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0890/1376] drm/omap: dsi: Do not copy isr table
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (888 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0889/1376] riscv: dts: sophgo: cv180x: Allow the DMA multiplexer to set channel number for DMA controller Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0891/1376] arm64: dts: qcom: agatti: Add missing CX power domain to DISPCC Greg Kroah-Hartman
` (108 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andreas Kemnade, Tomi Valkeinen,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Kemnade <andreas@kemnade.info>
[ Upstream commit 97c03b32b28a9f7f13f768f2b06e1eaafe850e66 ]
To be able to unregister stuff from isrs, the corresponding table was
copied. Nobody seems to unregister stuff that way, so it does not help.
But there are stack-allocated objects passed to these isrs giving chances
of UAF of these objects if irqs are unregistered while they are handled,
so better do not copy that table.
Fixes: 4ae2ddddf44cd ("OMAP: DSS2: DSI: Add ISR support")
Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
Link: https://patch.msgid.link/20260702-dsi-uaf-v2-1-dbb4aa0f0b8e@kemnade.info
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/omapdrm/dss/dsi.c | 7 +------
drivers/gpu/drm/omapdrm/dss/dsi.h | 2 --
2 files changed, 1 insertion(+), 8 deletions(-)
diff --git a/drivers/gpu/drm/omapdrm/dss/dsi.c b/drivers/gpu/drm/omapdrm/dss/dsi.c
index ea63c64d3a1ab..b9b013ba80e2e 100644
--- a/drivers/gpu/drm/omapdrm/dss/dsi.c
+++ b/drivers/gpu/drm/omapdrm/dss/dsi.c
@@ -455,15 +455,10 @@ static irqreturn_t omap_dsi_irq_handler(int irq, void *arg)
del_timer(&dsi->te_timer);
#endif
- /* make a copy and unlock, so that isrs can unregister
- * themselves */
- memcpy(&dsi->isr_tables_copy, &dsi->isr_tables,
- sizeof(dsi->isr_tables));
+ dsi_handle_isrs(&dsi->isr_tables, irqstatus, vcstatus, ciostatus);
spin_unlock(&dsi->irq_lock);
- dsi_handle_isrs(&dsi->isr_tables_copy, irqstatus, vcstatus, ciostatus);
-
dsi_handle_irq_errors(dsi, irqstatus, vcstatus, ciostatus);
dsi_collect_irq_stats(dsi, irqstatus, vcstatus, ciostatus);
diff --git a/drivers/gpu/drm/omapdrm/dss/dsi.h b/drivers/gpu/drm/omapdrm/dss/dsi.h
index 601707c0ecc4e..2b25247ea8935 100644
--- a/drivers/gpu/drm/omapdrm/dss/dsi.h
+++ b/drivers/gpu/drm/omapdrm/dss/dsi.h
@@ -379,8 +379,6 @@ struct dsi_data {
spinlock_t irq_lock;
struct dsi_isr_tables isr_tables;
- /* space for a copy used by the interrupt handler */
- struct dsi_isr_tables isr_tables_copy;
int update_vc;
#ifdef DSI_PERF_MEASURE
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0891/1376] arm64: dts: qcom: agatti: Add missing CX power domain to DISPCC
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (889 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0890/1376] drm/omap: dsi: Do not copy isr table Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0892/1376] remoteproc: Move resource table data structure to its own header Greg Kroah-Hartman
` (107 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Konrad Dybcio,
Imran Shaik, Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Imran Shaik <imran.shaik@oss.qualcomm.com>
[ Upstream commit 26d7b23caa4b1d8208e28c5981a85cf83e658e7c ]
Add the missing power-domains property to associate DISPCC with CX rail.
This is to ensure the genpd performance state votes on the GDSC to get
propagated to the CX rail and to avoid the rail under-voltage conditions.
Fixes: a2b32096709d ("arm64: dts: qcom: qcm2290: Add display nodes")
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Imran Shaik <imran.shaik@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260718-shikra-dispcc-gpucc-v6-12-62703e05ef0f@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/qcm2290.dtsi | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm64/boot/dts/qcom/qcm2290.dtsi b/arch/arm64/boot/dts/qcom/qcm2290.dtsi
index dbc78b2d5095a..d50b36143ebda 100644
--- a/arch/arm64/boot/dts/qcom/qcm2290.dtsi
+++ b/arch/arm64/boot/dts/qcom/qcm2290.dtsi
@@ -1798,6 +1798,7 @@ dispcc: clock-controller@5f00000 {
"gcc_disp_gpll0_div_clk_src",
"dsi0_phy_pll_out_byteclk",
"dsi0_phy_pll_out_dsiclk";
+ power-domains = <&rpmpd QCM2290_VDDCX>;
#power-domain-cells = <1>;
#clock-cells = <1>;
#reset-cells = <1>;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0892/1376] remoteproc: Move resource table data structure to its own header
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (890 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0891/1376] arm64: dts: qcom: agatti: Add missing CX power domain to DISPCC Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0893/1376] remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources() Greg Kroah-Hartman
` (106 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mukesh Ojha, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
[ Upstream commit 0590420c2f90de497d342c9a41a618f46f4d09ab ]
The resource table data structure has traditionally been associated with
the remoteproc framework, where the resource table is included as a
section within the remote processor firmware binary. However, it is also
possible to obtain the resource table through other means—such as from a
reserved memory region populated by the boot firmware, statically
maintained driver data, or via a secure SMC call—when it is not embedded
in the firmware.
There are multiple Qualcomm remote processors (e.g., Venus, Iris, GPU,
etc.) in the upstream kernel that do not use the remoteproc framework to
manage their lifecycle for various reasons.
When Linux is running at EL2, similar to the Qualcomm PAS driver
(qcom_q6v5_pas.c), client drivers for subsystems like video and GPU may
also want to use the resource table SMC call to retrieve and map
resources before they are used by the remote processor.
In such cases, the resource table data structure is no longer tightly
coupled with the remoteproc headers. Client drivers that do not use the
remoteproc framework should still be able to parse the resource table
obtained through alternative means. Therefore, there is a need to
decouple the resource table definitions from the remoteproc headers.
Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260506050107.1985033-2-mukesh.ojha@oss.qualcomm.com
Stable-dep-of: bb840ea69347 ("remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/remoteproc.h | 269 +-------------------------------
include/linux/rsc_table.h | 306 +++++++++++++++++++++++++++++++++++++
2 files changed, 307 insertions(+), 268 deletions(-)
create mode 100644 include/linux/rsc_table.h
diff --git a/include/linux/remoteproc.h b/include/linux/remoteproc.h
index 023fa91bd2a48..de98462d58889 100644
--- a/include/linux/remoteproc.h
+++ b/include/linux/remoteproc.h
@@ -43,274 +43,7 @@
#include <linux/completion.h>
#include <linux/idr.h>
#include <linux/of.h>
-
-/**
- * struct resource_table - firmware resource table header
- * @ver: version number
- * @num: number of resource entries
- * @reserved: reserved (must be zero)
- * @offset: array of offsets pointing at the various resource entries
- *
- * A resource table is essentially a list of system resources required
- * by the remote processor. It may also include configuration entries.
- * If needed, the remote processor firmware should contain this table
- * as a dedicated ".resource_table" ELF section.
- *
- * Some resources entries are mere announcements, where the host is informed
- * of specific remoteproc configuration. Other entries require the host to
- * do something (e.g. allocate a system resource). Sometimes a negotiation
- * is expected, where the firmware requests a resource, and once allocated,
- * the host should provide back its details (e.g. address of an allocated
- * memory region).
- *
- * The header of the resource table, as expressed by this structure,
- * contains a version number (should we need to change this format in the
- * future), the number of available resource entries, and their offsets
- * in the table.
- *
- * Immediately following this header are the resource entries themselves,
- * each of which begins with a resource entry header (as described below).
- */
-struct resource_table {
- u32 ver;
- u32 num;
- u32 reserved[2];
- u32 offset[];
-} __packed;
-
-/**
- * struct fw_rsc_hdr - firmware resource entry header
- * @type: resource type
- * @data: resource data
- *
- * Every resource entry begins with a 'struct fw_rsc_hdr' header providing
- * its @type. The content of the entry itself will immediately follow
- * this header, and it should be parsed according to the resource type.
- */
-struct fw_rsc_hdr {
- u32 type;
- u8 data[];
-} __packed;
-
-/**
- * enum fw_resource_type - types of resource entries
- *
- * @RSC_CARVEOUT: request for allocation of a physically contiguous
- * memory region.
- * @RSC_DEVMEM: request to iommu_map a memory-based peripheral.
- * @RSC_TRACE: announces the availability of a trace buffer into which
- * the remote processor will be writing logs.
- * @RSC_VDEV: declare support for a virtio device, and serve as its
- * virtio header.
- * @RSC_LAST: just keep this one at the end of standard resources
- * @RSC_VENDOR_START: start of the vendor specific resource types range
- * @RSC_VENDOR_END: end of the vendor specific resource types range
- *
- * For more details regarding a specific resource type, please see its
- * dedicated structure below.
- *
- * Please note that these values are used as indices to the rproc_handle_rsc
- * lookup table, so please keep them sane. Moreover, @RSC_LAST is used to
- * check the validity of an index before the lookup table is accessed, so
- * please update it as needed.
- */
-enum fw_resource_type {
- RSC_CARVEOUT = 0,
- RSC_DEVMEM = 1,
- RSC_TRACE = 2,
- RSC_VDEV = 3,
- RSC_LAST = 4,
- RSC_VENDOR_START = 128,
- RSC_VENDOR_END = 512,
-};
-
-#define FW_RSC_ADDR_ANY (-1)
-
-/**
- * struct fw_rsc_carveout - physically contiguous memory request
- * @da: device address
- * @pa: physical address
- * @len: length (in bytes)
- * @flags: iommu protection flags
- * @reserved: reserved (must be zero)
- * @name: human-readable name of the requested memory region
- *
- * This resource entry requests the host to allocate a physically contiguous
- * memory region.
- *
- * These request entries should precede other firmware resource entries,
- * as other entries might request placing other data objects inside
- * these memory regions (e.g. data/code segments, trace resource entries, ...).
- *
- * Allocating memory this way helps utilizing the reserved physical memory
- * (e.g. CMA) more efficiently, and also minimizes the number of TLB entries
- * needed to map it (in case @rproc is using an IOMMU). Reducing the TLB
- * pressure is important; it may have a substantial impact on performance.
- *
- * If the firmware is compiled with static addresses, then @da should specify
- * the expected device address of this memory region. If @da is set to
- * FW_RSC_ADDR_ANY, then the host will dynamically allocate it, and then
- * overwrite @da with the dynamically allocated address.
- *
- * We will always use @da to negotiate the device addresses, even if it
- * isn't using an iommu. In that case, though, it will obviously contain
- * physical addresses.
- *
- * Some remote processors needs to know the allocated physical address
- * even if they do use an iommu. This is needed, e.g., if they control
- * hardware accelerators which access the physical memory directly (this
- * is the case with OMAP4 for instance). In that case, the host will
- * overwrite @pa with the dynamically allocated physical address.
- * Generally we don't want to expose physical addresses if we don't have to
- * (remote processors are generally _not_ trusted), so we might want to
- * change this to happen _only_ when explicitly required by the hardware.
- *
- * @flags is used to provide IOMMU protection flags, and @name should
- * (optionally) contain a human readable name of this carveout region
- * (mainly for debugging purposes).
- */
-struct fw_rsc_carveout {
- u32 da;
- u32 pa;
- u32 len;
- u32 flags;
- u32 reserved;
- u8 name[32];
-} __packed;
-
-/**
- * struct fw_rsc_devmem - iommu mapping request
- * @da: device address
- * @pa: physical address
- * @len: length (in bytes)
- * @flags: iommu protection flags
- * @reserved: reserved (must be zero)
- * @name: human-readable name of the requested region to be mapped
- *
- * This resource entry requests the host to iommu map a physically contiguous
- * memory region. This is needed in case the remote processor requires
- * access to certain memory-based peripherals; _never_ use it to access
- * regular memory.
- *
- * This is obviously only needed if the remote processor is accessing memory
- * via an iommu.
- *
- * @da should specify the required device address, @pa should specify
- * the physical address we want to map, @len should specify the size of
- * the mapping and @flags is the IOMMU protection flags. As always, @name may
- * (optionally) contain a human readable name of this mapping (mainly for
- * debugging purposes).
- *
- * Note: at this point we just "trust" those devmem entries to contain valid
- * physical addresses, but this isn't safe and will be changed: eventually we
- * want remoteproc implementations to provide us ranges of physical addresses
- * the firmware is allowed to request, and not allow firmwares to request
- * access to physical addresses that are outside those ranges.
- */
-struct fw_rsc_devmem {
- u32 da;
- u32 pa;
- u32 len;
- u32 flags;
- u32 reserved;
- u8 name[32];
-} __packed;
-
-/**
- * struct fw_rsc_trace - trace buffer declaration
- * @da: device address
- * @len: length (in bytes)
- * @reserved: reserved (must be zero)
- * @name: human-readable name of the trace buffer
- *
- * This resource entry provides the host information about a trace buffer
- * into which the remote processor will write log messages.
- *
- * @da specifies the device address of the buffer, @len specifies
- * its size, and @name may contain a human readable name of the trace buffer.
- *
- * After booting the remote processor, the trace buffers are exposed to the
- * user via debugfs entries (called trace0, trace1, etc..).
- */
-struct fw_rsc_trace {
- u32 da;
- u32 len;
- u32 reserved;
- u8 name[32];
-} __packed;
-
-/**
- * struct fw_rsc_vdev_vring - vring descriptor entry
- * @da: device address
- * @align: the alignment between the consumer and producer parts of the vring
- * @num: num of buffers supported by this vring (must be power of two)
- * @notifyid: a unique rproc-wide notify index for this vring. This notify
- * index is used when kicking a remote processor, to let it know that this
- * vring is triggered.
- * @pa: physical address
- *
- * This descriptor is not a resource entry by itself; it is part of the
- * vdev resource type (see below).
- *
- * Note that @da should either contain the device address where
- * the remote processor is expecting the vring, or indicate that
- * dynamically allocation of the vring's device address is supported.
- */
-struct fw_rsc_vdev_vring {
- u32 da;
- u32 align;
- u32 num;
- u32 notifyid;
- u32 pa;
-} __packed;
-
-/**
- * struct fw_rsc_vdev - virtio device header
- * @id: virtio device id (as in virtio_ids.h)
- * @notifyid: a unique rproc-wide notify index for this vdev. This notify
- * index is used when kicking a remote processor, to let it know that the
- * status/features of this vdev have changes.
- * @dfeatures: specifies the virtio device features supported by the firmware
- * @gfeatures: a place holder used by the host to write back the
- * negotiated features that are supported by both sides.
- * @config_len: the size of the virtio config space of this vdev. The config
- * space lies in the resource table immediate after this vdev header.
- * @status: a place holder where the host will indicate its virtio progress.
- * @num_of_vrings: indicates how many vrings are described in this vdev header
- * @reserved: reserved (must be zero)
- * @vring: an array of @num_of_vrings entries of 'struct fw_rsc_vdev_vring'.
- *
- * This resource is a virtio device header: it provides information about
- * the vdev, and is then used by the host and its peer remote processors
- * to negotiate and share certain virtio properties.
- *
- * By providing this resource entry, the firmware essentially asks remoteproc
- * to statically allocate a vdev upon registration of the rproc (dynamic vdev
- * allocation is not yet supported).
- *
- * Note:
- * 1. unlike virtualization systems, the term 'host' here means
- * the Linux side which is running remoteproc to control the remote
- * processors. We use the name 'gfeatures' to comply with virtio's terms,
- * though there isn't really any virtualized guest OS here: it's the host
- * which is responsible for negotiating the final features.
- * Yeah, it's a bit confusing.
- *
- * 2. immediately following this structure is the virtio config space for
- * this vdev (which is specific to the vdev; for more info, read the virtio
- * spec). The size of the config space is specified by @config_len.
- */
-struct fw_rsc_vdev {
- u32 id;
- u32 notifyid;
- u32 dfeatures;
- u32 gfeatures;
- u32 config_len;
- u8 status;
- u8 num_of_vrings;
- u8 reserved[2];
- struct fw_rsc_vdev_vring vring[];
-} __packed;
+#include <linux/rsc_table.h>
struct rproc;
diff --git a/include/linux/rsc_table.h b/include/linux/rsc_table.h
new file mode 100644
index 0000000000000..c32c8b6cd2a77
--- /dev/null
+++ b/include/linux/rsc_table.h
@@ -0,0 +1,306 @@
+/*
+ * Resource table and its types data structure
+ *
+ * Copyright(c) 2011 Texas Instruments, Inc.
+ * Copyright(c) 2011 Google, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * * Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in
+ * the documentation and/or other materials provided with the
+ * distribution.
+ * * Neither the name Texas Instruments nor the names of its
+ * contributors may be used to endorse or promote products derived
+ * from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RSC_TABLE_H
+#define RSC_TABLE_H
+
+/**
+ * struct resource_table - firmware resource table header
+ * @ver: version number
+ * @num: number of resource entries
+ * @reserved: reserved (must be zero)
+ * @offset: array of offsets pointing at the various resource entries
+ *
+ * A resource table is essentially a list of system resources required
+ * by the remote processor. It may also include configuration entries.
+ * If needed, the remote processor firmware should contain this table
+ * as a dedicated ".resource_table" ELF section.
+ *
+ * Some resources entries are mere announcements, where the host is informed
+ * of specific remoteproc configuration. Other entries require the host to
+ * do something (e.g. allocate a system resource). Sometimes a negotiation
+ * is expected, where the firmware requests a resource, and once allocated,
+ * the host should provide back its details (e.g. address of an allocated
+ * memory region).
+ *
+ * The header of the resource table, as expressed by this structure,
+ * contains a version number (should we need to change this format in the
+ * future), the number of available resource entries, and their offsets
+ * in the table.
+ *
+ * Immediately following this header are the resource entries themselves,
+ * each of which begins with a resource entry header (as described below).
+ */
+struct resource_table {
+ u32 ver;
+ u32 num;
+ u32 reserved[2];
+ u32 offset[];
+} __packed;
+
+/**
+ * struct fw_rsc_hdr - firmware resource entry header
+ * @type: resource type
+ * @data: resource data
+ *
+ * Every resource entry begins with a 'struct fw_rsc_hdr' header providing
+ * its @type. The content of the entry itself will immediately follow
+ * this header, and it should be parsed according to the resource type.
+ */
+struct fw_rsc_hdr {
+ u32 type;
+ u8 data[];
+} __packed;
+
+/**
+ * enum fw_resource_type - types of resource entries
+ *
+ * @RSC_CARVEOUT: request for allocation of a physically contiguous
+ * memory region.
+ * @RSC_DEVMEM: request to iommu_map a memory-based peripheral.
+ * @RSC_TRACE: announces the availability of a trace buffer into which
+ * the remote processor will be writing logs.
+ * @RSC_VDEV: declare support for a virtio device, and serve as its
+ * virtio header.
+ * @RSC_LAST: just keep this one at the end of standard resources
+ * @RSC_VENDOR_START: start of the vendor specific resource types range
+ * @RSC_VENDOR_END: end of the vendor specific resource types range
+ *
+ * For more details regarding a specific resource type, please see its
+ * dedicated structure below.
+ *
+ * Please note that these values are used as indices to the rproc_handle_rsc
+ * lookup table, so please keep them sane. Moreover, @RSC_LAST is used to
+ * check the validity of an index before the lookup table is accessed, so
+ * please update it as needed.
+ */
+enum fw_resource_type {
+ RSC_CARVEOUT = 0,
+ RSC_DEVMEM = 1,
+ RSC_TRACE = 2,
+ RSC_VDEV = 3,
+ RSC_LAST = 4,
+ RSC_VENDOR_START = 128,
+ RSC_VENDOR_END = 512,
+};
+
+#define FW_RSC_ADDR_ANY (-1)
+
+/**
+ * struct fw_rsc_carveout - physically contiguous memory request
+ * @da: device address
+ * @pa: physical address
+ * @len: length (in bytes)
+ * @flags: iommu protection flags
+ * @reserved: reserved (must be zero)
+ * @name: human-readable name of the requested memory region
+ *
+ * This resource entry requests the host to allocate a physically contiguous
+ * memory region.
+ *
+ * These request entries should precede other firmware resource entries,
+ * as other entries might request placing other data objects inside
+ * these memory regions (e.g. data/code segments, trace resource entries, ...).
+ *
+ * Allocating memory this way helps utilizing the reserved physical memory
+ * (e.g. CMA) more efficiently, and also minimizes the number of TLB entries
+ * needed to map it (in case @rproc is using an IOMMU). Reducing the TLB
+ * pressure is important; it may have a substantial impact on performance.
+ *
+ * If the firmware is compiled with static addresses, then @da should specify
+ * the expected device address of this memory region. If @da is set to
+ * FW_RSC_ADDR_ANY, then the host will dynamically allocate it, and then
+ * overwrite @da with the dynamically allocated address.
+ *
+ * We will always use @da to negotiate the device addresses, even if it
+ * isn't using an iommu. In that case, though, it will obviously contain
+ * physical addresses.
+ *
+ * Some remote processors needs to know the allocated physical address
+ * even if they do use an iommu. This is needed, e.g., if they control
+ * hardware accelerators which access the physical memory directly (this
+ * is the case with OMAP4 for instance). In that case, the host will
+ * overwrite @pa with the dynamically allocated physical address.
+ * Generally we don't want to expose physical addresses if we don't have to
+ * (remote processors are generally _not_ trusted), so we might want to
+ * change this to happen _only_ when explicitly required by the hardware.
+ *
+ * @flags is used to provide IOMMU protection flags, and @name should
+ * (optionally) contain a human readable name of this carveout region
+ * (mainly for debugging purposes).
+ */
+struct fw_rsc_carveout {
+ u32 da;
+ u32 pa;
+ u32 len;
+ u32 flags;
+ u32 reserved;
+ u8 name[32];
+} __packed;
+
+/**
+ * struct fw_rsc_devmem - iommu mapping request
+ * @da: device address
+ * @pa: physical address
+ * @len: length (in bytes)
+ * @flags: iommu protection flags
+ * @reserved: reserved (must be zero)
+ * @name: human-readable name of the requested region to be mapped
+ *
+ * This resource entry requests the host to iommu map a physically contiguous
+ * memory region. This is needed in case the remote processor requires
+ * access to certain memory-based peripherals; _never_ use it to access
+ * regular memory.
+ *
+ * This is obviously only needed if the remote processor is accessing memory
+ * via an iommu.
+ *
+ * @da should specify the required device address, @pa should specify
+ * the physical address we want to map, @len should specify the size of
+ * the mapping and @flags is the IOMMU protection flags. As always, @name may
+ * (optionally) contain a human readable name of this mapping (mainly for
+ * debugging purposes).
+ *
+ * Note: at this point we just "trust" those devmem entries to contain valid
+ * physical addresses, but this isn't safe and will be changed: eventually we
+ * want remoteproc implementations to provide us ranges of physical addresses
+ * the firmware is allowed to request, and not allow firmwares to request
+ * access to physical addresses that are outside those ranges.
+ */
+struct fw_rsc_devmem {
+ u32 da;
+ u32 pa;
+ u32 len;
+ u32 flags;
+ u32 reserved;
+ u8 name[32];
+} __packed;
+
+/**
+ * struct fw_rsc_trace - trace buffer declaration
+ * @da: device address
+ * @len: length (in bytes)
+ * @reserved: reserved (must be zero)
+ * @name: human-readable name of the trace buffer
+ *
+ * This resource entry provides the host information about a trace buffer
+ * into which the remote processor will write log messages.
+ *
+ * @da specifies the device address of the buffer, @len specifies
+ * its size, and @name may contain a human readable name of the trace buffer.
+ *
+ * After booting the remote processor, the trace buffers are exposed to the
+ * user via debugfs entries (called trace0, trace1, etc..).
+ */
+struct fw_rsc_trace {
+ u32 da;
+ u32 len;
+ u32 reserved;
+ u8 name[32];
+} __packed;
+
+/**
+ * struct fw_rsc_vdev_vring - vring descriptor entry
+ * @da: device address
+ * @align: the alignment between the consumer and producer parts of the vring
+ * @num: num of buffers supported by this vring (must be power of two)
+ * @notifyid: a unique rproc-wide notify index for this vring. This notify
+ * index is used when kicking a remote processor, to let it know that this
+ * vring is triggered.
+ * @pa: physical address
+ *
+ * This descriptor is not a resource entry by itself; it is part of the
+ * vdev resource type (see below).
+ *
+ * Note that @da should either contain the device address where
+ * the remote processor is expecting the vring, or indicate that
+ * dynamically allocation of the vring's device address is supported.
+ */
+struct fw_rsc_vdev_vring {
+ u32 da;
+ u32 align;
+ u32 num;
+ u32 notifyid;
+ u32 pa;
+} __packed;
+
+/**
+ * struct fw_rsc_vdev - virtio device header
+ * @id: virtio device id (as in virtio_ids.h)
+ * @notifyid: a unique rproc-wide notify index for this vdev. This notify
+ * index is used when kicking a remote processor, to let it know that the
+ * status/features of this vdev have changes.
+ * @dfeatures: specifies the virtio device features supported by the firmware
+ * @gfeatures: a place holder used by the host to write back the
+ * negotiated features that are supported by both sides.
+ * @config_len: the size of the virtio config space of this vdev. The config
+ * space lies in the resource table immediate after this vdev header.
+ * @status: a place holder where the host will indicate its virtio progress.
+ * @num_of_vrings: indicates how many vrings are described in this vdev header
+ * @reserved: reserved (must be zero)
+ * @vring: an array of @num_of_vrings entries of 'struct fw_rsc_vdev_vring'.
+ *
+ * This resource is a virtio device header: it provides information about
+ * the vdev, and is then used by the host and its peer remote processors
+ * to negotiate and share certain virtio properties.
+ *
+ * By providing this resource entry, the firmware essentially asks remoteproc
+ * to statically allocate a vdev upon registration of the rproc (dynamic vdev
+ * allocation is not yet supported).
+ *
+ * Note:
+ * 1. unlike virtualization systems, the term 'host' here means
+ * the Linux side which is running remoteproc to control the remote
+ * processors. We use the name 'gfeatures' to comply with virtio's terms,
+ * though there isn't really any virtualized guest OS here: it's the host
+ * which is responsible for negotiating the final features.
+ * Yeah, it's a bit confusing.
+ *
+ * 2. immediately following this structure is the virtio config space for
+ * this vdev (which is specific to the vdev; for more info, read the virtio
+ * spec). The size of the config space is specified by @config_len.
+ */
+struct fw_rsc_vdev {
+ u32 id;
+ u32 notifyid;
+ u32 dfeatures;
+ u32 gfeatures;
+ u32 config_len;
+ u8 status;
+ u8 num_of_vrings;
+ u8 reserved[2];
+ struct fw_rsc_vdev_vring vring[];
+} __packed;
+
+#endif /* RSC_TABLE_H */
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0893/1376] remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (891 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0892/1376] remoteproc: Move resource table data structure to its own header Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0894/1376] remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() Greg Kroah-Hartman
` (105 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mukesh Ojha, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
[ Upstream commit 49abb5d6e1ac8169cdfc0c3aa4408e0d90ee5696 ]
Replace the open-coded resource table iteration loop in
rproc_handle_resources() with the rsc_table_for_each_entry() helper.
The remoteproc-specific dispatch logic (vendor resource handling via
rproc_handle_rsc(), RSC_LAST bounds check, handler table lookup) is
moved into a local callback rproc_handle_rsc_entry(), keeping the
iteration mechanics in one canonical place.
The callback receives the payload offset within the table so that
handlers which write back into the resource table (e.g.
rproc_handle_carveout() recording a dynamically allocated address via
rsc_offset) continue to work correctly.
No functional change.
Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260506050107.1985033-3-mukesh.ojha@oss.qualcomm.com
Stable-dep-of: bb840ea69347 ("remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/remoteproc/remoteproc_core.c | 81 +++++++++++++---------------
include/linux/rsc_table.h | 53 ++++++++++++++++++
2 files changed, 91 insertions(+), 43 deletions(-)
diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
index 86dd92067da82..0c11a0b529086 100644
--- a/drivers/remoteproc/remoteproc_core.c
+++ b/drivers/remoteproc/remoteproc_core.c
@@ -1016,60 +1016,55 @@ static rproc_handle_resource_t rproc_loading_handlers[RSC_LAST] = {
[RSC_VDEV] = rproc_handle_vdev,
};
-/* handle firmware resource entries before booting the remote processor */
-static int rproc_handle_resources(struct rproc *rproc,
- rproc_handle_resource_t handlers[RSC_LAST])
+struct rproc_rsc_cb_data {
+ struct rproc *rproc;
+ rproc_handle_resource_t *handlers;
+};
+
+static int rproc_handle_rsc_entry(u32 type, void *rsc, int offset,
+ int avail, void *data)
{
+ struct rproc_rsc_cb_data *d = data;
+ struct rproc *rproc = d->rproc;
struct device *dev = &rproc->dev;
rproc_handle_resource_t handler;
- int ret = 0, i;
-
- if (!rproc->table_ptr)
- return 0;
+ int ret;
- for (i = 0; i < rproc->table_ptr->num; i++) {
- int offset = rproc->table_ptr->offset[i];
- struct fw_rsc_hdr *hdr = (void *)rproc->table_ptr + offset;
- int avail = rproc->table_sz - offset - sizeof(*hdr);
- void *rsc = (void *)hdr + sizeof(*hdr);
+ dev_dbg(dev, "rsc: type %d\n", type);
- /* make sure table isn't truncated */
- if (avail < 0) {
- dev_err(dev, "rsc table is truncated\n");
- return -EINVAL;
- }
-
- dev_dbg(dev, "rsc: type %d\n", hdr->type);
+ if (type >= RSC_VENDOR_START && type <= RSC_VENDOR_END) {
+ ret = rproc_handle_rsc(rproc, type, rsc, offset, avail);
+ if (ret == RSC_HANDLED)
+ return 0;
+ if (ret < 0)
+ return ret;
+ dev_warn(dev, "unsupported vendor resource %d\n", type);
+ return 0;
+ }
- if (hdr->type >= RSC_VENDOR_START &&
- hdr->type <= RSC_VENDOR_END) {
- ret = rproc_handle_rsc(rproc, hdr->type, rsc,
- offset + sizeof(*hdr), avail);
- if (ret == RSC_HANDLED)
- continue;
- else if (ret < 0)
- break;
+ if (type >= RSC_LAST) {
+ dev_warn(dev, "unsupported resource %d\n", type);
+ return 0;
+ }
- dev_warn(dev, "unsupported vendor resource %d\n",
- hdr->type);
- continue;
- }
+ handler = d->handlers[type];
+ if (!handler)
+ return 0;
- if (hdr->type >= RSC_LAST) {
- dev_warn(dev, "unsupported resource %d\n", hdr->type);
- continue;
- }
+ return handler(rproc, rsc, offset, avail);
+}
- handler = handlers[hdr->type];
- if (!handler)
- continue;
+/* handle firmware resource entries before booting the remote processor */
+static int rproc_handle_resources(struct rproc *rproc,
+ rproc_handle_resource_t handlers[RSC_LAST])
+{
+ struct rproc_rsc_cb_data d = { .rproc = rproc, .handlers = handlers };
- ret = handler(rproc, rsc, offset + sizeof(*hdr), avail);
- if (ret)
- break;
- }
+ if (!rproc->table_ptr)
+ return 0;
- return ret;
+ return rsc_table_for_each_entry(rproc->table_ptr, rproc->table_sz,
+ &rproc->dev, rproc_handle_rsc_entry, &d);
}
static int rproc_prepare_subdevices(struct rproc *rproc)
diff --git a/include/linux/rsc_table.h b/include/linux/rsc_table.h
index c32c8b6cd2a77..c6d6d553d8f11 100644
--- a/include/linux/rsc_table.h
+++ b/include/linux/rsc_table.h
@@ -303,4 +303,57 @@ struct fw_rsc_vdev {
struct fw_rsc_vdev_vring vring[];
} __packed;
+/**
+ * rsc_table_for_each_entry() - iterate over all entries in a resource table
+ * @table: pointer to the resource table
+ * @table_sz: total size of the table buffer in bytes
+ * @dev: device used for error logging
+ * @cb: callback invoked for each entry:
+ * @type - value from enum fw_resource_type
+ * @rsc - pointer to the entry payload (past struct fw_rsc_hdr)
+ * @offset - byte offset of the payload within the table; callers
+ * that write back into the table (e.g. to record a
+ * dynamically allocated address) use this to locate the
+ * entry for later update
+ * @avail - bytes available in the payload
+ * @data - caller-supplied private pointer
+ * Return 0 to continue iteration, non-zero to stop.
+ * @data: private pointer forwarded to @cb on every call
+ *
+ * Iterates over every resource entry in @table, performing the standard
+ * truncation check, and invokes @cb for each one. Iteration stops on the
+ * first non-zero return from @cb or on a malformed table.
+ *
+ * Returns 0 after a complete iteration, -EINVAL if the table is truncated,
+ * or the first non-zero value returned by @cb.
+ */
+static inline int rsc_table_for_each_entry(struct resource_table *table,
+ size_t table_sz,
+ struct device *dev,
+ int (*cb)(u32 type, void *rsc,
+ int offset, int avail,
+ void *data),
+ void *data) {
+ int i, ret;
+
+ for (i = 0; i < table->num; i++) {
+ int offset = table->offset[i];
+ struct fw_rsc_hdr *hdr = (void *)table + offset;
+ int avail = table_sz - offset - sizeof(*hdr);
+ int rsc_offset = offset + sizeof(*hdr);
+ void *rsc = (void *)hdr + sizeof(*hdr);
+
+ if (avail < 0) {
+ dev_err(dev, "rsc table is truncated\n");
+ return -EINVAL;
+ }
+
+ ret = cb(hdr->type, rsc, rsc_offset, avail, data);
+ if (ret)
+ return ret;
+ }
+
+ return 0;
+}
+
#endif /* RSC_TABLE_H */
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0894/1376] remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (892 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0893/1376] remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources() Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0895/1376] bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed Greg Kroah-Hartman
` (104 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mukesh Ojha, Bjorn Andersson,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
[ Upstream commit bb840ea69347aff7bde5a208e7b5b180669a7656 ]
table->offset[i] is a u32 from firmware, but was stored into a signed
int. A crafted offset like 0xFFFFFFF0 becomes -16, placing hdr 16 bytes
before the table buffer. The subsequent avail check was bypassed
because the negative int was promoted to a large size_t in the
expression "table_sz - offset - sizeof(*hdr)", yielding a large positive
avail and letting the out-of-bounds hdr->type read proceed undetected.
Store the offset as u32 and validate it with unsigned comparisons before
any pointer arithmetic.
Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Fixes: fd2c15ec1dd3 ("remoteproc: resource table overhaul")
Link: https://lore.kernel.org/r/20260803114331.3277263-6-mukesh.ojha@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/rsc_table.h | 17 +++++++++++------
1 file changed, 11 insertions(+), 6 deletions(-)
diff --git a/include/linux/rsc_table.h b/include/linux/rsc_table.h
index c6d6d553d8f11..4cef11a2e3a2c 100644
--- a/include/linux/rsc_table.h
+++ b/include/linux/rsc_table.h
@@ -337,17 +337,22 @@ static inline int rsc_table_for_each_entry(struct resource_table *table,
int i, ret;
for (i = 0; i < table->num; i++) {
- int offset = table->offset[i];
- struct fw_rsc_hdr *hdr = (void *)table + offset;
- int avail = table_sz - offset - sizeof(*hdr);
- int rsc_offset = offset + sizeof(*hdr);
- void *rsc = (void *)hdr + sizeof(*hdr);
+ u32 offset = table->offset[i];
+ struct fw_rsc_hdr *hdr;
+ int avail, rsc_offset;
+ void *rsc;
- if (avail < 0) {
+ if (offset < sizeof(*table) || offset >= table_sz ||
+ table_sz - offset < sizeof(*hdr)) {
dev_err(dev, "rsc table is truncated\n");
return -EINVAL;
}
+ hdr = (void *)table + offset;
+ avail = table_sz - offset - sizeof(*hdr);
+ rsc_offset = offset + sizeof(*hdr);
+ rsc = (void *)hdr + sizeof(*hdr);
+
ret = cb(hdr->type, rsc, rsc_offset, avail, data);
if (ret)
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0895/1376] bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (893 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0894/1376] remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0896/1376] selftests/mm: add new test cases to the migration test Greg Kroah-Hartman
` (103 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Pu Lehui, Andrii Nakryiko,
Emil Tsalapatis, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pu Lehui <pulehui@huawei.com>
[ Upstream commit 6655c409707ec8ce9ce0850ffe4fe02331fd4d9c ]
A potential invalid storage access issue can occur after replacing a
cgroup bpf prog.
This occurs in the following scenario:
1. prog1 with storage is attached to a cgroup in multi-attach mode.
2. prog1 is replaced with prog2 using BPF_F_REPLACE in multi-attach
mode, but fails midway (e.g. in bpf_trampoline_link_cgroup_shim or
update_effective_progs).
3. A new prog3 is attached to the cgroup in multi-attach mode.
The reason is that __cgroup_bpf_attach overwrites pl->storage with the
new storage prior to attachment completion. When attachment fails
midway, the cleanup path calls bpf_cgroup_storages_free(new_storage) to
free the newly allocated storage, but fails to restore pl->storage back
to old_storage.
Consequently, the still-active prog1 holds invalid or dangling storage
pointers, leading to an invalid memory access when prog1 executes and
calls bpf_get_local_storage. Additionally, original pl->flags and
cgrp->bpf.flags[atype] are left unrestored.
Fix this by saving old_pl_flags, old_storage, and old_flags prior to the
update, and properly restoring all of them in the cleanup path on error.
Fixes: 7d9c3427894f ("bpf: Make cgroup storages shared between programs on the same cgroup")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Pu Lehui <pulehui@huawei.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Link: https://lore.kernel.org/bpf/20260803013934.4036646-1-pulehui@huaweicloud.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/cgroup.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
index ad054a4c782ea..7b8b4e09131dd 100644
--- a/kernel/bpf/cgroup.c
+++ b/kernel/bpf/cgroup.c
@@ -646,8 +646,10 @@ static int __cgroup_bpf_attach(struct cgroup *cgrp,
struct bpf_prog *old_prog = NULL;
struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {};
struct bpf_cgroup_storage *new_storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {};
+ struct bpf_cgroup_storage *old_storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {};
struct bpf_prog *new_prog = prog ? : link->link.prog;
enum cgroup_bpf_attach_type atype;
+ u32 old_flags, old_pl_flags;
struct bpf_prog_list *pl;
struct hlist_head *progs;
int err;
@@ -693,6 +695,8 @@ static int __cgroup_bpf_attach(struct cgroup *cgrp,
if (pl) {
old_prog = pl->prog;
+ old_pl_flags = pl->flags;
+ bpf_cgroup_storages_assign(old_storage, pl->storage);
} else {
struct hlist_node *last = NULL;
@@ -716,6 +720,7 @@ static int __cgroup_bpf_attach(struct cgroup *cgrp,
pl->link = link;
pl->flags = flags;
bpf_cgroup_storages_assign(pl->storage, storage);
+ old_flags = cgrp->bpf.flags[atype];
cgrp->bpf.flags[atype] = saved_flags;
if (type == BPF_LSM_CGROUP) {
@@ -746,12 +751,15 @@ static int __cgroup_bpf_attach(struct cgroup *cgrp,
if (old_prog) {
pl->prog = old_prog;
pl->link = NULL;
+ pl->flags = old_pl_flags;
+ bpf_cgroup_storages_assign(pl->storage, old_storage);
}
bpf_cgroup_storages_free(new_storage);
if (!old_prog) {
hlist_del(&pl->node);
kfree(pl);
}
+ cgrp->bpf.flags[atype] = old_flags;
return err;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0896/1376] selftests/mm: add new test cases to the migration test
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (894 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0895/1376] bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0897/1376] ksm_tests: skip hugepage test when Transparent Hugepages are disabled Greg Kroah-Hartman
` (102 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Donet Tom, Dev Jain, Baolin Wang,
David Hildenbrand, Ritesh Harjani (IBM), Shuah Khan, Zi Yan,
Andrew Morton, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Donet Tom <donettom@linux.ibm.com>
[ Upstream commit 901083d8f5c55dc125834bbc5ac1720014e66758 ]
Added three new test cases to the migration tests:
1. Shared anon THP migration test
This test will mmap shared anon memory, madvise it to
MADV_HUGEPAGE, then do migration entry testing. One thread
will move pages back and forth between nodes whilst other
threads try and access them.
2. Private anon hugetlb migration test
This test will mmap private anon hugetlb memory and then
do the migration entry testing.
3. Shared anon hugetlb migration test
This test will mmap shared anon hugetlb memory and then
do the migration entry testing.
Test results
============
# ./tools/testing/selftests/mm/migration
TAP version 13
1..6
# Starting 6 tests from 1 test cases.
# RUN migration.private_anon ...
# OK migration.private_anon
ok 1 migration.private_anon
# RUN migration.shared_anon ...
# OK migration.shared_anon
ok 2 migration.shared_anon
# RUN migration.private_anon_thp ...
# OK migration.private_anon_thp
ok 3 migration.private_anon_thp
# RUN migration.shared_anon_thp ...
# OK migration.shared_anon_thp
ok 4 migration.shared_anon_thp
# RUN migration.private_anon_htlb ...
# OK migration.private_anon_htlb
ok 5 migration.private_anon_htlb
# RUN migration.shared_anon_htlb ...
# OK migration.shared_anon_htlb
ok 6 migration.shared_anon_htlb
# PASSED: 6 / 6 tests passed.
# Totals: pass:6 fail:0 xfail:0 xpass:0 skip:0 error:0
#
Link: https://lkml.kernel.org/r/20241219102720.4487-1-donettom@linux.ibm.com
Signed-off-by: Donet Tom <donettom@linux.ibm.com>
Reviewed-by: Dev Jain <dev.jain@arm.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Stable-dep-of: 15828a150c58 ("selftests/mm: fix ksm NUMA merge test for systems with memoryless NUMA nodes")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/mm/migration.c | 99 ++++++++++++++++++++++++++
1 file changed, 99 insertions(+)
diff --git a/tools/testing/selftests/mm/migration.c b/tools/testing/selftests/mm/migration.c
index c883ef420d3ba..cfd01e951e89c 100644
--- a/tools/testing/selftests/mm/migration.c
+++ b/tools/testing/selftests/mm/migration.c
@@ -205,4 +205,103 @@ TEST_F_TIMEOUT(migration, private_anon_thp, 2*RUNTIME)
ASSERT_EQ(pthread_cancel(self->threads[i]), 0);
}
+/*
+ * migration test with shared anon THP page
+ */
+
+TEST_F_TIMEOUT(migration, shared_anon_thp, 2*RUNTIME)
+{
+ pid_t pid;
+ uint64_t *ptr;
+ int i;
+
+ if (self->nthreads < 2 || self->n1 < 0 || self->n2 < 0)
+ SKIP(return, "Not enough threads or NUMA nodes available");
+
+ ptr = mmap(NULL, 2 * TWOMEG, PROT_READ | PROT_WRITE,
+ MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+ ASSERT_NE(ptr, MAP_FAILED);
+
+ ptr = (uint64_t *) ALIGN((uintptr_t) ptr, TWOMEG);
+ ASSERT_EQ(madvise(ptr, TWOMEG, MADV_HUGEPAGE), 0);
+
+ memset(ptr, 0xde, TWOMEG);
+ for (i = 0; i < self->nthreads - 1; i++) {
+ pid = fork();
+ if (!pid) {
+ prctl(PR_SET_PDEATHSIG, SIGHUP);
+ /* Parent may have died before prctl so check now. */
+ if (getppid() == 1)
+ kill(getpid(), SIGHUP);
+ access_mem(ptr);
+ } else {
+ self->pids[i] = pid;
+ }
+ }
+
+ ASSERT_EQ(migrate(ptr, self->n1, self->n2), 0);
+ for (i = 0; i < self->nthreads - 1; i++)
+ ASSERT_EQ(kill(self->pids[i], SIGTERM), 0);
+}
+
+/*
+ * migration test with private anon hugetlb page
+ */
+TEST_F_TIMEOUT(migration, private_anon_htlb, 2*RUNTIME)
+{
+ uint64_t *ptr;
+ int i;
+
+ if (self->nthreads < 2 || self->n1 < 0 || self->n2 < 0)
+ SKIP(return, "Not enough threads or NUMA nodes available");
+
+ ptr = mmap(NULL, TWOMEG, PROT_READ | PROT_WRITE,
+ MAP_PRIVATE | MAP_ANONYMOUS | MAP_HUGETLB, -1, 0);
+ ASSERT_NE(ptr, MAP_FAILED);
+
+ memset(ptr, 0xde, TWOMEG);
+ for (i = 0; i < self->nthreads - 1; i++)
+ if (pthread_create(&self->threads[i], NULL, access_mem, ptr))
+ perror("Couldn't create thread");
+
+ ASSERT_EQ(migrate(ptr, self->n1, self->n2), 0);
+ for (i = 0; i < self->nthreads - 1; i++)
+ ASSERT_EQ(pthread_cancel(self->threads[i]), 0);
+}
+
+/*
+ * migration test with shared anon hugetlb page
+ */
+TEST_F_TIMEOUT(migration, shared_anon_htlb, 2*RUNTIME)
+{
+ pid_t pid;
+ uint64_t *ptr;
+ int i;
+
+ if (self->nthreads < 2 || self->n1 < 0 || self->n2 < 0)
+ SKIP(return, "Not enough threads or NUMA nodes available");
+
+ ptr = mmap(NULL, TWOMEG, PROT_READ | PROT_WRITE,
+ MAP_SHARED | MAP_ANONYMOUS | MAP_HUGETLB, -1, 0);
+ ASSERT_NE(ptr, MAP_FAILED);
+
+ memset(ptr, 0xde, TWOMEG);
+ for (i = 0; i < self->nthreads - 1; i++) {
+ pid = fork();
+ if (!pid) {
+ prctl(PR_SET_PDEATHSIG, SIGHUP);
+ /* Parent may have died before prctl so check now. */
+ if (getppid() == 1)
+ kill(getpid(), SIGHUP);
+ access_mem(ptr);
+ } else {
+ self->pids[i] = pid;
+ }
+ }
+
+ ASSERT_EQ(migrate(ptr, self->n1, self->n2), 0);
+ for (i = 0; i < self->nthreads - 1; i++)
+ ASSERT_EQ(kill(self->pids[i], SIGTERM), 0);
+}
+
TEST_HARNESS_MAIN
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0897/1376] ksm_tests: skip hugepage test when Transparent Hugepages are disabled
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (895 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0896/1376] selftests/mm: add new test cases to the migration test Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0898/1376] selftests/mm: ksm_tests: use kselftest framework Greg Kroah-Hartman
` (101 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Li Wang, Aruna Ramakrishna,
Bagas Sanjaya, Catalin Marinas, Dave Hansen, David Hildenbrand,
Joey Gouly, Johannes Weiner, Keith Lucas, Ryan Roberts,
Shuah Khan, Lorenzo Stoakes, Andrew Morton, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Wang <liwang@redhat.com>
[ Upstream commit fdc3bc3497946c6b416a17628907581657102e60 ]
Some systems (e.g. minimal or real-time kernels) may not enable
Transparent Hugepages (THP), causing MADV_HUGEPAGE to return EINVAL. This
patch introduces a runtime check using the existing THP sysfs interface
and skips the hugepage merging test (`-H`) when THP is not available.
To avoid those failures:
# -----------------------------
# running ./ksm_tests -H -s 100
# -----------------------------
# ksm_tests: MADV_HUGEPAGE: Invalid argument
# [FAIL]
not ok 1 ksm_tests -H -s 100 # exit=2
# --------------------
# running ./khugepaged
# --------------------
# Reading PMD pagesize failed# [FAIL]
not ok 1 khugepaged # exit=1
# --------------------
# running ./soft-dirty
# --------------------
# TAP version 13
# 1..15
# ok 1 Test test_simple
# ok 2 Test test_vma_reuse dirty bit of allocated page
# ok 3 Test test_vma_reuse dirty bit of reused address page
# Bail out! Reading PMD pagesize failed# Planned tests != run tests (15 != 3)
# # Totals: pass:3 fail:0 xfail:0 xpass:0 skip:0 error:0
# [FAIL]
not ok 1 soft-dirty # exit=1
# SUMMARY: PASS=0 SKIP=0 FAIL=1
# -------------------
# running ./migration
# -------------------
# TAP version 13
# 1..3
# # Starting 3 tests from 1 test cases.
# # RUN migration.private_anon ...
# # OK migration.private_anon
# ok 1 migration.private_anon
# # RUN migration.shared_anon ...
# # OK migration.shared_anon
# ok 2 migration.shared_anon
# # RUN migration.private_anon_thp ...
# # migration.c:196:private_anon_thp:Expected madvise(ptr, TWOMEG, MADV_HUGEPAGE) (-1) == 0 (0)
# # private_anon_thp: Test terminated by assertion
# # FAIL migration.private_anon_thp
# not ok 3 migration.private_anon_thp
# # FAILED: 2 / 3 tests passed.
# # Totals: pass:2 fail:1 xfail:0 xpass:0 skip:0 error:0
# [FAIL]
not ok 1 migration # exit=1
It's true that CONFIG_TRANSPARENT_HUGEPAGE=y is explicitly enabled in
tools/testing/selftests/mm/config, so ideally the runtime environment
should also support THP.
However, in practice, we've found that on some systems:
- THP is disabled at boot time (transparent_hugepage=never)
- Or manually disabled via sysfs
- Or unavailable in RT kernels, containers, or minimal CI environments
In these cases, the test will fail with EINVAL on madvise(MADV_HUGEPAGE),
even though the kernel config is correct.
To make the test suite more robust and avoid false negatives, this patch
adds a runtime check for /sys/kernel/mm/transparent_hugepage/enabled.
If THP is not available, the hugepage test (-H) is skipped with a clear
message.
Link: https://lkml.kernel.org/r/20250624032748.393836-1-liwang@redhat.com
Signed-off-by: Li Wang <liwang@redhat.com>
Cc: Aruna Ramakrishna <aruna.ramakrishna@oracle.com>
Cc: Bagas Sanjaya <bagasdotme@gmail.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Joey Gouly <joey.gouly@arm.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Keith Lucas <keith.lucas@oracle.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Stable-dep-of: 15828a150c58 ("selftests/mm: fix ksm NUMA merge test for systems with memoryless NUMA nodes")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/mm/khugepaged.c | 5 +++++
tools/testing/selftests/mm/ksm_tests.c | 6 ++++++
tools/testing/selftests/mm/migration.c | 8 ++++++++
tools/testing/selftests/mm/soft-dirty.c | 9 ++++++++-
tools/testing/selftests/mm/thp_settings.c | 11 +++++++++++
tools/testing/selftests/mm/thp_settings.h | 2 ++
6 files changed, 40 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/mm/khugepaged.c b/tools/testing/selftests/mm/khugepaged.c
index 8a4d34cce36b2..6822eb7ea58e8 100644
--- a/tools/testing/selftests/mm/khugepaged.c
+++ b/tools/testing/selftests/mm/khugepaged.c
@@ -1190,6 +1190,11 @@ int main(int argc, char **argv)
.read_ahead_kb = 0,
};
+ if (!thp_is_enabled()) {
+ printf("Transparent Hugepages not available\n");
+ return KSFT_SKIP;
+ }
+
parse_test_type(argc, argv);
setbuf(stdout, NULL);
diff --git a/tools/testing/selftests/mm/ksm_tests.c b/tools/testing/selftests/mm/ksm_tests.c
index b748c48908d9d..faa3d053994df 100644
--- a/tools/testing/selftests/mm/ksm_tests.c
+++ b/tools/testing/selftests/mm/ksm_tests.c
@@ -15,6 +15,7 @@
#include "../kselftest.h"
#include <include/vdso/time64.h>
#include "vm_util.h"
+#include "thp_settings.h"
#define KSM_SYSFS_PATH "/sys/kernel/mm/ksm/"
#define KSM_FP(s) (KSM_SYSFS_PATH s)
@@ -555,6 +556,11 @@ static int ksm_merge_hugepages_time(int merge_type, int mapping, int prot,
unsigned long scan_time_ns;
int pagemap_fd, n_normal_pages, n_huge_pages;
+ if (!thp_is_enabled()) {
+ printf("Transparent Hugepages not available\n");
+ return KSFT_SKIP;
+ }
+
map_size *= MB;
size_t len = map_size;
diff --git a/tools/testing/selftests/mm/migration.c b/tools/testing/selftests/mm/migration.c
index cfd01e951e89c..7ad742c8c1325 100644
--- a/tools/testing/selftests/mm/migration.c
+++ b/tools/testing/selftests/mm/migration.c
@@ -5,6 +5,8 @@
*/
#include "../kselftest_harness.h"
+#include "thp_settings.h"
+
#include <strings.h>
#include <pthread.h>
#include <numa.h>
@@ -186,6 +188,9 @@ TEST_F_TIMEOUT(migration, private_anon_thp, 2*RUNTIME)
uint64_t *ptr;
int i;
+ if (!thp_is_enabled())
+ SKIP(return, "Transparent Hugepages not available");
+
if (self->nthreads < 2 || self->n1 < 0 || self->n2 < 0)
SKIP(return, "Not enough threads or NUMA nodes available");
@@ -215,6 +220,9 @@ TEST_F_TIMEOUT(migration, shared_anon_thp, 2*RUNTIME)
uint64_t *ptr;
int i;
+ if (!thp_is_enabled())
+ SKIP(return, "Transparent Hugepages not available");
+
if (self->nthreads < 2 || self->n1 < 0 || self->n2 < 0)
SKIP(return, "Not enough threads or NUMA nodes available");
diff --git a/tools/testing/selftests/mm/soft-dirty.c b/tools/testing/selftests/mm/soft-dirty.c
index 7b91df12ce5b9..ca65ff3096b25 100644
--- a/tools/testing/selftests/mm/soft-dirty.c
+++ b/tools/testing/selftests/mm/soft-dirty.c
@@ -6,8 +6,10 @@
#include <stdint.h>
#include <malloc.h>
#include <sys/mman.h>
+
#include "../kselftest.h"
#include "vm_util.h"
+#include "thp_settings.h"
#define PAGEMAP_FILE_PATH "/proc/self/pagemap"
#define TEST_ITERATIONS 10000
@@ -78,8 +80,13 @@ static void test_hugepage(int pagemap_fd, int pagesize)
{
char *map;
int i, ret;
- size_t hpage_len = read_pmd_pagesize();
+ if (!thp_is_enabled()) {
+ ksft_test_result_skip("Transparent Hugepages not available\n");
+ return;
+ }
+
+ size_t hpage_len = read_pmd_pagesize();
if (!hpage_len)
ksft_exit_fail_msg("Reading PMD pagesize failed");
diff --git a/tools/testing/selftests/mm/thp_settings.c b/tools/testing/selftests/mm/thp_settings.c
index 577eaab6266fd..38f70155bfbf1 100644
--- a/tools/testing/selftests/mm/thp_settings.c
+++ b/tools/testing/selftests/mm/thp_settings.c
@@ -381,3 +381,14 @@ unsigned long thp_shmem_supported_orders(void)
{
return __thp_supported_orders(true);
}
+
+bool thp_is_enabled(void)
+{
+ if (access(THP_SYSFS, F_OK) != 0)
+ return false;
+
+ int mode = thp_read_string("enabled", thp_enabled_strings);
+
+ /* THP is considered enabled if it's either "always" or "madvise" */
+ return mode == 1 || mode == 3;
+}
diff --git a/tools/testing/selftests/mm/thp_settings.h b/tools/testing/selftests/mm/thp_settings.h
index 876235a23460c..079a58a662b0e 100644
--- a/tools/testing/selftests/mm/thp_settings.h
+++ b/tools/testing/selftests/mm/thp_settings.h
@@ -84,4 +84,6 @@ void thp_set_read_ahead_path(char *path);
unsigned long thp_supported_orders(void);
unsigned long thp_shmem_supported_orders(void);
+bool thp_is_enabled(void);
+
#endif /* __THP_SETTINGS_H__ */
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0898/1376] selftests/mm: ksm_tests: use kselftest framework
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (896 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0897/1376] ksm_tests: skip hugepage test when Transparent Hugepages are disabled Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0899/1376] selftests/mm: fix ksm NUMA merge test for systems with memoryless NUMA nodes Greg Kroah-Hartman
` (100 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mike Rapoport (Microsoft), Donet Tom,
Mark Brown, Sarthak Sharma, Luiz Capitulino, Baolin Wang,
Barry Song, David Hildenbrand, Dev Jain, Jason Gunthorpe,
John Hubbard, Lance Yang, Leon Romanovsky, Liam Howlett, Li Wang,
Lorenzo Stoakes, Michal Hocko, Nico Pache, Peter Xu, Ryan Roberts,
Shuah Khan, Suren Baghdasaryan, Vlastimil Babka, Zi Yan,
Andrew Morton, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Rapoport (Microsoft) <rppt@kernel.org>
[ Upstream commit 4cc68d5f52de9614e2db70f43c52f012d1ebb5ad ]
Convert ksm_tests to use kselftest framework for reporting and tracking
successful and failing runs.
Link: https://lore.kernel.org/20260511162840.375890-16-rppt@kernel.org
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Reviewed-by: Donet Tom <donettom@linux.ibm.com>
Reviewed-by: Mark Brown <broonie@kernel.org>
Tested-by: Sarthak Sharma <sarthak.sharma@arm.com>
Tested-by: Luiz Capitulino <luizcap@redhat.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Barry Song <baohua@kernel.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: John Hubbard <jhubbard@nvidia.com>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Liam Howlett <liam@infradead.org>
Cc: Li Wang <li.wang@linux.dev>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Nico Pache <npache@redhat.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Stable-dep-of: 15828a150c58 ("selftests/mm: fix ksm NUMA merge test for systems with memoryless NUMA nodes")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/mm/ksm_tests.c | 180 +++++++++++--------------
1 file changed, 81 insertions(+), 99 deletions(-)
diff --git a/tools/testing/selftests/mm/ksm_tests.c b/tools/testing/selftests/mm/ksm_tests.c
index faa3d053994df..d99a6bff6344c 100644
--- a/tools/testing/selftests/mm/ksm_tests.c
+++ b/tools/testing/selftests/mm/ksm_tests.c
@@ -203,12 +203,12 @@ static void *allocate_memory(void *ptr, int prot, int mapping, char data, size_
void *map_ptr = mmap(ptr, map_size, PROT_WRITE, mapping, -1, 0);
if (!map_ptr) {
- perror("mmap");
+ ksft_perror("mmap");
return NULL;
}
memset(map_ptr, data, map_size);
if (mprotect(map_ptr, map_size, prot)) {
- perror("mprotect");
+ ksft_perror("mprotect");
munmap(map_ptr, map_size);
return NULL;
}
@@ -229,11 +229,11 @@ static int ksm_do_scan(int scan_count, struct timespec start_time, int timeout)
if (ksm_read_sysfs(KSM_FP("full_scans"), &cur_scan))
return 1;
if (clock_gettime(CLOCK_MONOTONIC_RAW, &cur_time)) {
- perror("clock_gettime");
+ ksft_perror("clock_gettime");
return 1;
}
if ((cur_time.tv_sec - start_time.tv_sec) > timeout) {
- printf("Scan time limit exceeded\n");
+ ksft_print_msg("Scan time limit exceeded\n");
return 1;
}
}
@@ -246,12 +246,12 @@ static int ksm_merge_pages(int merge_type, void *addr, size_t size,
{
if (merge_type == KSM_MERGE_MADVISE) {
if (madvise(addr, size, MADV_MERGEABLE)) {
- perror("madvise");
+ ksft_perror("madvise");
return 1;
}
} else if (merge_type == KSM_MERGE_PRCTL) {
if (prctl(PR_SET_MEMORY_MERGE, 1, 0, 0, 0)) {
- perror("prctl");
+ ksft_perror("prctl");
return 1;
}
}
@@ -270,7 +270,7 @@ static int ksm_unmerge_pages(void *addr, size_t size,
struct timespec start_time, int timeout)
{
if (madvise(addr, size, MADV_UNMERGEABLE)) {
- perror("madvise");
+ ksft_perror("madvise");
return 1;
}
return 0;
@@ -352,7 +352,7 @@ static int check_ksm_merge(int merge_type, int mapping, int prot,
struct timespec start_time;
if (clock_gettime(CLOCK_MONOTONIC_RAW, &start_time)) {
- perror("clock_gettime");
+ ksft_perror("clock_gettime");
return KSFT_FAIL;
}
@@ -366,7 +366,6 @@ static int check_ksm_merge(int merge_type, int mapping, int prot,
/* verify that the right number of pages are merged */
if (assert_ksm_pages_count(page_count)) {
- printf("OK\n");
munmap(map_ptr, page_size * page_count);
if (merge_type == KSM_MERGE_PRCTL)
prctl(PR_SET_MEMORY_MERGE, 0, 0, 0, 0);
@@ -374,7 +373,6 @@ static int check_ksm_merge(int merge_type, int mapping, int prot,
}
err_out:
- printf("Not OK\n");
munmap(map_ptr, page_size * page_count);
return KSFT_FAIL;
}
@@ -386,7 +384,7 @@ static int check_ksm_unmerge(int merge_type, int mapping, int prot, int timeout,
int page_count = 2;
if (clock_gettime(CLOCK_MONOTONIC_RAW, &start_time)) {
- perror("clock_gettime");
+ ksft_perror("clock_gettime");
return KSFT_FAIL;
}
@@ -408,13 +406,11 @@ static int check_ksm_unmerge(int merge_type, int mapping, int prot, int timeout,
/* check that unmerging was successful and 0 pages are currently merged */
if (assert_ksm_pages_count(0)) {
- printf("OK\n");
munmap(map_ptr, page_size * page_count);
return KSFT_PASS;
}
err_out:
- printf("Not OK\n");
munmap(map_ptr, page_size * page_count);
return KSFT_FAIL;
}
@@ -426,7 +422,7 @@ static int check_ksm_zero_page_merge(int merge_type, int mapping, int prot, long
struct timespec start_time;
if (clock_gettime(CLOCK_MONOTONIC_RAW, &start_time)) {
- perror("clock_gettime");
+ ksft_perror("clock_gettime");
return KSFT_FAIL;
}
@@ -453,12 +449,10 @@ static int check_ksm_zero_page_merge(int merge_type, int mapping, int prot, long
else if (!use_zero_pages && !assert_ksm_pages_count(page_count))
goto err_out;
- printf("OK\n");
munmap(map_ptr, page_size * page_count);
return KSFT_PASS;
err_out:
- printf("Not OK\n");
munmap(map_ptr, page_size * page_count);
return KSFT_FAIL;
}
@@ -493,16 +487,16 @@ static int check_ksm_numa_merge(int merge_type, int mapping, int prot, int timeo
int first_node;
if (clock_gettime(CLOCK_MONOTONIC_RAW, &start_time)) {
- perror("clock_gettime");
+ ksft_perror("clock_gettime");
return KSFT_FAIL;
}
if (numa_available() < 0) {
- perror("NUMA support not enabled");
+ ksft_print_msg("NUMA support not enabled\n");
return KSFT_SKIP;
}
if (numa_num_configured_nodes() <= 1) {
- printf("At least 2 NUMA nodes must be available\n");
+ ksft_print_msg("At least 2 NUMA nodes must be available\n");
return KSFT_SKIP;
}
if (ksm_write_sysfs(KSM_FP("merge_across_nodes"), merge_across_nodes))
@@ -513,7 +507,7 @@ static int check_ksm_numa_merge(int merge_type, int mapping, int prot, int timeo
numa1_map_ptr = numa_alloc_onnode(page_size, first_node);
numa2_map_ptr = numa_alloc_onnode(page_size, get_next_mem_node(first_node));
if (!numa1_map_ptr || !numa2_map_ptr) {
- perror("numa_alloc_onnode");
+ ksft_perror("numa_alloc_onnode");
return KSFT_FAIL;
}
@@ -538,13 +532,11 @@ static int check_ksm_numa_merge(int merge_type, int mapping, int prot, int timeo
numa_free(numa1_map_ptr, page_size);
numa_free(numa2_map_ptr, page_size);
- printf("OK\n");
return KSFT_PASS;
err_out:
numa_free(numa1_map_ptr, page_size);
numa_free(numa2_map_ptr, page_size);
- printf("Not OK\n");
return KSFT_FAIL;
}
@@ -557,7 +549,7 @@ static int ksm_merge_hugepages_time(int merge_type, int mapping, int prot,
int pagemap_fd, n_normal_pages, n_huge_pages;
if (!thp_is_enabled()) {
- printf("Transparent Hugepages not available\n");
+ ksft_print_msg("Transparent Hugepages not available\n");
return KSFT_SKIP;
}
@@ -587,36 +579,35 @@ static int ksm_merge_hugepages_time(int merge_type, int mapping, int prot,
else
n_huge_pages++;
}
- printf("Number of normal pages: %d\n", n_normal_pages);
- printf("Number of huge pages: %d\n", n_huge_pages);
+ ksft_print_msg("Number of normal pages: %d\n", n_normal_pages);
+ ksft_print_msg("Number of huge pages: %d\n", n_huge_pages);
memset(map_ptr, '*', len);
if (clock_gettime(CLOCK_MONOTONIC_RAW, &start_time)) {
- perror("clock_gettime");
+ ksft_perror("clock_gettime");
goto err_out;
}
if (ksm_merge_pages(merge_type, map_ptr, map_size, start_time, timeout))
goto err_out;
if (clock_gettime(CLOCK_MONOTONIC_RAW, &end_time)) {
- perror("clock_gettime");
+ ksft_perror("clock_gettime");
goto err_out;
}
scan_time_ns = (end_time.tv_sec - start_time.tv_sec) * NSEC_PER_SEC +
(end_time.tv_nsec - start_time.tv_nsec);
- printf("Total size: %lu MiB\n", map_size / MB);
- printf("Total time: %ld.%09ld s\n", scan_time_ns / NSEC_PER_SEC,
+ ksft_print_msg("Total size: %lu MiB\n", map_size / MB);
+ ksft_print_msg("Total time: %ld.%09ld s\n", scan_time_ns / NSEC_PER_SEC,
scan_time_ns % NSEC_PER_SEC);
- printf("Average speed: %.3f MiB/s\n", (map_size / MB) /
+ ksft_print_msg("Average speed: %.3f MiB/s\n", (map_size / MB) /
((double)scan_time_ns / NSEC_PER_SEC));
munmap(map_ptr_orig, len + HPAGE_SIZE);
return KSFT_PASS;
err_out:
- printf("Not OK\n");
munmap(map_ptr_orig, len + HPAGE_SIZE);
return KSFT_FAIL;
}
@@ -634,30 +625,29 @@ static int ksm_merge_time(int merge_type, int mapping, int prot, int timeout, si
return KSFT_FAIL;
if (clock_gettime(CLOCK_MONOTONIC_RAW, &start_time)) {
- perror("clock_gettime");
+ ksft_perror("clock_gettime");
goto err_out;
}
if (ksm_merge_pages(merge_type, map_ptr, map_size, start_time, timeout))
goto err_out;
if (clock_gettime(CLOCK_MONOTONIC_RAW, &end_time)) {
- perror("clock_gettime");
+ ksft_perror("clock_gettime");
goto err_out;
}
scan_time_ns = (end_time.tv_sec - start_time.tv_sec) * NSEC_PER_SEC +
(end_time.tv_nsec - start_time.tv_nsec);
- printf("Total size: %lu MiB\n", map_size / MB);
- printf("Total time: %ld.%09ld s\n", scan_time_ns / NSEC_PER_SEC,
+ ksft_print_msg("Total size: %lu MiB\n", map_size / MB);
+ ksft_print_msg("Total time: %ld.%09ld s\n", scan_time_ns / NSEC_PER_SEC,
scan_time_ns % NSEC_PER_SEC);
- printf("Average speed: %.3f MiB/s\n", (map_size / MB) /
+ ksft_print_msg("Average speed: %.3f MiB/s\n", (map_size / MB) /
((double)scan_time_ns / NSEC_PER_SEC));
munmap(map_ptr, map_size);
return KSFT_PASS;
err_out:
- printf("Not OK\n");
munmap(map_ptr, map_size);
return KSFT_FAIL;
}
@@ -674,37 +664,36 @@ static int ksm_unmerge_time(int merge_type, int mapping, int prot, int timeout,
if (!map_ptr)
return KSFT_FAIL;
if (clock_gettime(CLOCK_MONOTONIC_RAW, &start_time)) {
- perror("clock_gettime");
+ ksft_perror("clock_gettime");
goto err_out;
}
if (ksm_merge_pages(merge_type, map_ptr, map_size, start_time, timeout))
goto err_out;
if (clock_gettime(CLOCK_MONOTONIC_RAW, &start_time)) {
- perror("clock_gettime");
+ ksft_perror("clock_gettime");
goto err_out;
}
if (ksm_unmerge_pages(map_ptr, map_size, start_time, timeout))
goto err_out;
if (clock_gettime(CLOCK_MONOTONIC_RAW, &end_time)) {
- perror("clock_gettime");
+ ksft_perror("clock_gettime");
goto err_out;
}
scan_time_ns = (end_time.tv_sec - start_time.tv_sec) * NSEC_PER_SEC +
(end_time.tv_nsec - start_time.tv_nsec);
- printf("Total size: %lu MiB\n", map_size / MB);
- printf("Total time: %ld.%09ld s\n", scan_time_ns / NSEC_PER_SEC,
+ ksft_print_msg("Total size: %lu MiB\n", map_size / MB);
+ ksft_print_msg("Total time: %ld.%09ld s\n", scan_time_ns / NSEC_PER_SEC,
scan_time_ns % NSEC_PER_SEC);
- printf("Average speed: %.3f MiB/s\n", (map_size / MB) /
+ ksft_print_msg("Average speed: %.3f MiB/s\n", (map_size / MB) /
((double)scan_time_ns / NSEC_PER_SEC));
munmap(map_ptr, map_size);
return KSFT_PASS;
err_out:
- printf("Not OK\n");
munmap(map_ptr, map_size);
return KSFT_FAIL;
}
@@ -723,24 +712,24 @@ static int ksm_cow_time(int merge_type, int mapping, int prot, int timeout, size
return KSFT_FAIL;
if (clock_gettime(CLOCK_MONOTONIC_RAW, &start_time)) {
- perror("clock_gettime");
+ ksft_perror("clock_gettime");
return KSFT_FAIL;
}
for (size_t i = 0; i < page_count - 1; i = i + 2)
memset(map_ptr + page_size * i, '-', 1);
if (clock_gettime(CLOCK_MONOTONIC_RAW, &end_time)) {
- perror("clock_gettime");
+ ksft_perror("clock_gettime");
return KSFT_FAIL;
}
cow_time_ns = (end_time.tv_sec - start_time.tv_sec) * NSEC_PER_SEC +
(end_time.tv_nsec - start_time.tv_nsec);
- printf("Total size: %lu MiB\n\n", (page_size * page_count) / MB);
- printf("Not merged pages:\n");
- printf("Total time: %ld.%09ld s\n", cow_time_ns / NSEC_PER_SEC,
+ ksft_print_msg("Total size: %lu MiB\n\n", (page_size * page_count) / MB);
+ ksft_print_msg("Not merged pages:\n");
+ ksft_print_msg("Total time: %ld.%09ld s\n", cow_time_ns / NSEC_PER_SEC,
cow_time_ns % NSEC_PER_SEC);
- printf("Average speed: %.3f MiB/s\n\n", ((page_size * (page_count / 2)) / MB) /
+ ksft_print_msg("Average speed: %.3f MiB/s\n\n", ((page_size * (page_count / 2)) / MB) /
((double)cow_time_ns / NSEC_PER_SEC));
/* Create 2000 pairs of duplicate pages */
@@ -752,30 +741,29 @@ static int ksm_cow_time(int merge_type, int mapping, int prot, int timeout, size
goto err_out;
if (clock_gettime(CLOCK_MONOTONIC_RAW, &start_time)) {
- perror("clock_gettime");
+ ksft_perror("clock_gettime");
goto err_out;
}
for (size_t i = 0; i < page_count - 1; i = i + 2)
memset(map_ptr + page_size * i, '-', 1);
if (clock_gettime(CLOCK_MONOTONIC_RAW, &end_time)) {
- perror("clock_gettime");
+ ksft_perror("clock_gettime");
goto err_out;
}
cow_time_ns = (end_time.tv_sec - start_time.tv_sec) * NSEC_PER_SEC +
(end_time.tv_nsec - start_time.tv_nsec);
- printf("Merged pages:\n");
- printf("Total time: %ld.%09ld s\n", cow_time_ns / NSEC_PER_SEC,
+ ksft_print_msg("Merged pages:\n");
+ ksft_print_msg("Total time: %ld.%09ld s\n", cow_time_ns / NSEC_PER_SEC,
cow_time_ns % NSEC_PER_SEC);
- printf("Average speed: %.3f MiB/s\n", ((page_size * (page_count / 2)) / MB) /
+ ksft_print_msg("Average speed: %.3f MiB/s\n", ((page_size * (page_count / 2)) / MB) /
((double)cow_time_ns / NSEC_PER_SEC));
munmap(map_ptr, page_size * page_count);
return KSFT_PASS;
err_out:
- printf("Not OK\n");
munmap(map_ptr, page_size * page_count);
return KSFT_FAIL;
}
@@ -793,6 +781,10 @@ int main(int argc, char *argv[])
bool use_zero_pages = KSM_USE_ZERO_PAGES_DEFAULT;
bool merge_across_nodes = KSM_MERGE_ACROSS_NODES_DEFAULT;
long size_MB = 0;
+ const char *test_descr = "KSM merging";
+
+ ksft_print_header();
+ ksft_set_plan(1);
while ((opt = getopt(argc, argv, "dha:p:l:z:m:s:t:MUZNPCHD")) != -1) {
switch (opt) {
@@ -801,17 +793,13 @@ int main(int argc, char *argv[])
break;
case 'p':
page_count = atol(optarg);
- if (page_count <= 0) {
- printf("The number of pages must be greater than 0\n");
- return KSFT_FAIL;
- }
+ if (page_count <= 0)
+ ksft_exit_fail_msg("The number of pages must be greater than 0\n");
break;
case 'l':
ksm_scan_limit_sec = atoi(optarg);
- if (ksm_scan_limit_sec <= 0) {
- printf("Timeout value must be greater than 0\n");
- return KSFT_FAIL;
- }
+ if (ksm_scan_limit_sec <= 0)
+ ksft_exit_fail_msg("Timeout value must be greater than 0\n");
break;
case 'h':
print_help();
@@ -833,19 +821,15 @@ int main(int argc, char *argv[])
break;
case 's':
size_MB = atoi(optarg);
- if (size_MB <= 0) {
- printf("Size must be greater than 0\n");
- return KSFT_FAIL;
- }
+ if (size_MB <= 0)
+ ksft_exit_fail_msg("Size must be greater than 0\n");
break;
case 't':
{
int tmp = atoi(optarg);
- if (tmp < 0 || tmp > KSM_MERGE_LAST) {
- printf("Invalid merge type\n");
- return KSFT_FAIL;
- }
+ if (tmp < 0 || tmp > KSM_MERGE_LAST)
+ ksft_exit_fail_msg("Invalid merge type\n");
merge_type = tmp;
}
break;
@@ -873,82 +857,80 @@ int main(int argc, char *argv[])
test_name = KSM_COW_TIME;
break;
default:
- return KSFT_FAIL;
+ ksft_exit_fail_msg("Unknown option\n");
}
}
if (prot == 0)
prot = str_to_prot(KSM_PROT_STR_DEFAULT);
- if (access(KSM_SYSFS_PATH, F_OK)) {
- printf("Config KSM not enabled\n");
- return KSFT_SKIP;
- }
+ if (access(KSM_SYSFS_PATH, F_OK))
+ ksft_exit_skip("Config KSM not enabled\n");
- if (ksm_save_def(&ksm_sysfs_old)) {
- printf("Cannot save default tunables\n");
- return KSFT_FAIL;
- }
+ if (ksm_save_def(&ksm_sysfs_old))
+ ksft_exit_fail_msg("Cannot save default tunables\n");
if (ksm_write_sysfs(KSM_FP("run"), 2) ||
ksm_write_sysfs(KSM_FP("sleep_millisecs"), 0) ||
numa_available() ? 0 :
ksm_write_sysfs(KSM_FP("merge_across_nodes"), 1) ||
ksm_write_sysfs(KSM_FP("pages_to_scan"), page_count))
- return KSFT_FAIL;
+ ksft_exit_fail_msg("Cannot set up KSM tunables\n");
switch (test_name) {
case CHECK_KSM_MERGE:
+ test_descr = "KSM merging";
ret = check_ksm_merge(merge_type, MAP_PRIVATE | MAP_ANONYMOUS, prot, page_count,
ksm_scan_limit_sec, page_size);
break;
case CHECK_KSM_UNMERGE:
+ test_descr = "KSM unmerging";
ret = check_ksm_unmerge(merge_type, MAP_PRIVATE | MAP_ANONYMOUS, prot,
ksm_scan_limit_sec, page_size);
break;
case CHECK_KSM_ZERO_PAGE_MERGE:
+ test_descr = "KSM zero page merging";
ret = check_ksm_zero_page_merge(merge_type, MAP_PRIVATE | MAP_ANONYMOUS, prot,
page_count, ksm_scan_limit_sec, use_zero_pages,
page_size);
break;
case CHECK_KSM_NUMA_MERGE:
+ test_descr = "KSM NUMA merging";
ret = check_ksm_numa_merge(merge_type, MAP_PRIVATE | MAP_ANONYMOUS, prot,
ksm_scan_limit_sec, merge_across_nodes, page_size);
break;
case KSM_MERGE_TIME:
- if (size_MB == 0) {
- printf("Option '-s' is required.\n");
- return KSFT_FAIL;
- }
+ if (size_MB == 0)
+ ksft_exit_fail_msg("Option '-s' is required\n");
+ test_descr = "KSM merge time";
ret = ksm_merge_time(merge_type, MAP_PRIVATE | MAP_ANONYMOUS, prot,
ksm_scan_limit_sec, size_MB);
break;
case KSM_MERGE_TIME_HUGE_PAGES:
- if (size_MB == 0) {
- printf("Option '-s' is required.\n");
- return KSFT_FAIL;
- }
+ if (size_MB == 0)
+ ksft_exit_fail_msg("Option '-s' is required\n");
+ test_descr = "KSM merge time with huge pages";
ret = ksm_merge_hugepages_time(merge_type, MAP_PRIVATE | MAP_ANONYMOUS, prot,
ksm_scan_limit_sec, size_MB);
break;
case KSM_UNMERGE_TIME:
- if (size_MB == 0) {
- printf("Option '-s' is required.\n");
- return KSFT_FAIL;
- }
+ if (size_MB == 0)
+ ksft_exit_fail_msg("Option '-s' is required\n");
+ test_descr = "KSM unmerge time";
ret = ksm_unmerge_time(merge_type, MAP_PRIVATE | MAP_ANONYMOUS, prot,
ksm_scan_limit_sec, size_MB);
break;
case KSM_COW_TIME:
+ test_descr = "KSM COW time";
ret = ksm_cow_time(merge_type, MAP_PRIVATE | MAP_ANONYMOUS, prot,
ksm_scan_limit_sec, page_size);
break;
}
- if (ksm_restore(&ksm_sysfs_old)) {
- printf("Cannot restore default tunables\n");
- return KSFT_FAIL;
- }
+ if (ksm_restore(&ksm_sysfs_old))
+ ksft_print_msg("Cannot restore default tunables\n");
+
+ ksft_test_result_report(ret, "%s\n", test_descr);
- return ret;
+ ksft_finished();
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0899/1376] selftests/mm: fix ksm NUMA merge test for systems with memoryless NUMA nodes
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (897 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0898/1376] selftests/mm: ksm_tests: use kselftest framework Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0900/1376] selftests/mm: fix ternary operator precedence in ksm_tests Greg Kroah-Hartman
` (99 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Hildenbrand (Arm),
Sayali Patil, Dev Jain, Liam Howlett, Miaohe Lin, Michal Hocko,
Oscar Salvador, Ritesh Harjani (IBM), Shuah Khan, Zi Yan,
Andrew Morton, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sayali Patil <sayalip@linux.ibm.com>
[ Upstream commit 15828a150c5806869b7feb9e38ad2c0284fbf18a ]
The KSM NUMA merge test allocates identical pages on different NUMA nodes
and verifies KSM behavior with merge_across_nodes enabled and disabled.
On systems with memoryless NUMA nodes, for example:
#numactl -H
available: 2 nodes (0,4)
.....
node 0 cpus: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
node 0 size: 14825 MB
node 0 free: 1382 MB
node 4 cpus:
node 4 size: 0 MB
node 4 free: 0 MB
the test may attempt to allocate memory on a node without memory, causing
numa_alloc_onnode() to fail and resulting in a spurious test failure.
The test currently checks numa_num_configured_nodes() to determine whether
sufficient NUMA nodes are available. However, configured nodes do not
necessarily have memory.
Reuse the existing get_first_mem_node() and get_next_mem_node() helpers to
locate NUMA nodes that actually contain memory, and skip the test when
fewer than two such nodes are available.
Before patch:
---------------------------
running ./ksm_tests -N -m 1
---------------------------
mbind: Invalid argument
ok 1 KSM NUMA merging
Totals: pass:1 fail:0 xfail:0 xpass:0 skip:0 error:0
[PASS]
ok 1 ksm_tests -N -m 1
---------------------------
running ./ksm_tests -N -m 0
---------------------------
mbind: Invalid argument
not ok 1 KSM NUMA merging
Totals: pass:0 fail:1 xfail:0 xpass:0 skip:0 error:0
[FAIL]
not ok 2 ksm_tests -N -m 0 # exit=1
After patch:
---------------------------
running ./ksm_tests -N -m 1
---------------------------
At least 2 NUMA nodes with memory must be available
ok 1
SKIP KSM NUMA merging
Totals: pass:0 fail:0 xfail:0 xpass:0 skip:1 error:0
[PASS]
ok 1 ksm_tests -N -m 1
---------------------------
running ./ksm_tests -N -m 0
---------------------------
At least 2 NUMA nodes with memory must be available
ok 1
SKIP KSM NUMA merging
Totals: pass:0 fail:0 xfail:0 xpass:0 skip:1 error:0
[PASS]
ok 2 ksm_tests -N -m 0
Link: https://lore.kernel.org/78a3b0e3fb94004c0710872c5bab6f7381b7d63c.1783446924.git.sayalip@linux.ibm.com
Fixes: e3820ab252dd ("selftest/vm: fix ksm selftest to run with different NUMA topologies")
Co-developed-by: David Hildenbrand (Arm) <david@kernel.org>
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
Signed-off-by: Sayali Patil <sayalip@linux.ibm.com>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Liam Howlett <liam@infradead.org>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/mm/ksm_tests.c | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
diff --git a/tools/testing/selftests/mm/ksm_tests.c b/tools/testing/selftests/mm/ksm_tests.c
index d99a6bff6344c..57f9cba1b6802 100644
--- a/tools/testing/selftests/mm/ksm_tests.c
+++ b/tools/testing/selftests/mm/ksm_tests.c
@@ -468,9 +468,9 @@ static int get_next_mem_node(int node)
mem_node = i % (max_node + 1);
node_size = numa_node_size(mem_node, NULL);
if (node_size > 0)
- break;
+ return mem_node;
}
- return mem_node;
+ return -ENODEV;
}
static int get_first_mem_node(void)
@@ -483,8 +483,8 @@ static int check_ksm_numa_merge(int merge_type, int mapping, int prot, int timeo
{
void *numa1_map_ptr, *numa2_map_ptr;
struct timespec start_time;
+ int first_node, second_node;
int page_count = 2;
- int first_node;
if (clock_gettime(CLOCK_MONOTONIC_RAW, &start_time)) {
ksft_perror("clock_gettime");
@@ -495,17 +495,19 @@ static int check_ksm_numa_merge(int merge_type, int mapping, int prot, int timeo
ksft_print_msg("NUMA support not enabled\n");
return KSFT_SKIP;
}
- if (numa_num_configured_nodes() <= 1) {
- ksft_print_msg("At least 2 NUMA nodes must be available\n");
+ first_node = get_first_mem_node();
+ second_node = get_next_mem_node(first_node);
+
+ if (second_node < 0) {
+ ksft_print_msg("At least 2 NUMA nodes with memory must be available\n");
return KSFT_SKIP;
}
if (ksm_write_sysfs(KSM_FP("merge_across_nodes"), merge_across_nodes))
return KSFT_FAIL;
/* allocate 2 pages in 2 different NUMA nodes and fill them with the same data */
- first_node = get_first_mem_node();
numa1_map_ptr = numa_alloc_onnode(page_size, first_node);
- numa2_map_ptr = numa_alloc_onnode(page_size, get_next_mem_node(first_node));
+ numa2_map_ptr = numa_alloc_onnode(page_size, second_node);
if (!numa1_map_ptr || !numa2_map_ptr) {
ksft_perror("numa_alloc_onnode");
return KSFT_FAIL;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0900/1376] selftests/mm: fix ternary operator precedence in ksm_tests
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (898 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0899/1376] selftests/mm: fix ksm NUMA merge test for systems with memoryless NUMA nodes Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0901/1376] arm64: dts: qcom: qcs8550-aim300: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies Greg Kroah-Hartman
` (98 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sayali Patil,
David Hildenbrand (Arm), Dev Jain, Liam Howlett, Miaohe Lin,
Michal Hocko, Oscar Salvador, Ritesh Harjani (IBM), Shuah Khan,
Zi Yan, Andrew Morton, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sayali Patil <sayalip@linux.ibm.com>
[ Upstream commit 4e1fbffb3333626682a011db7c4b4e9e40ba96d4 ]
The KSM selftest uses conditional expressions to skip accesses to
merge_across_nodes on systems without NUMA support. However, the ternary
operator is combined with logical OR without parentheses:
a || numa_available() ? 0 : b || c
Due to operator precedence rules, this is parsed as:
(a || numa_available()) ? 0 : (b || c)
instead of the intended:
a || (numa_available() ? 0 : b) || c
Add parentheses around the conditional expressions to ensure the
correct evaluation order.
Link: https://lore.kernel.org/ce859430287ed2642848c933a90eb9a69da361f0.1783446924.git.sayalip@linux.ibm.com
Fixes: 9aa1af954db0 ("selftests: vm: check numa_available() before operating "merge_across_nodes" in ksm_tests")
Signed-off-by: Sayali Patil <sayalip@linux.ibm.com>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Liam Howlett <liam@infradead.org>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/mm/ksm_tests.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/tools/testing/selftests/mm/ksm_tests.c b/tools/testing/selftests/mm/ksm_tests.c
index 57f9cba1b6802..ecb4b1057c6b3 100644
--- a/tools/testing/selftests/mm/ksm_tests.c
+++ b/tools/testing/selftests/mm/ksm_tests.c
@@ -316,8 +316,8 @@ static bool assert_ksm_pages_count(long dupl_page_count)
static int ksm_save_def(struct ksm_sysfs *ksm_sysfs)
{
if (ksm_read_sysfs(KSM_FP("max_page_sharing"), &ksm_sysfs->max_page_sharing) ||
- numa_available() ? 0 :
- ksm_read_sysfs(KSM_FP("merge_across_nodes"), &ksm_sysfs->merge_across_nodes) ||
+ (numa_available() ? 0 :
+ ksm_read_sysfs(KSM_FP("merge_across_nodes"), &ksm_sysfs->merge_across_nodes)) ||
ksm_read_sysfs(KSM_FP("sleep_millisecs"), &ksm_sysfs->sleep_millisecs) ||
ksm_read_sysfs(KSM_FP("pages_to_scan"), &ksm_sysfs->pages_to_scan) ||
ksm_read_sysfs(KSM_FP("run"), &ksm_sysfs->run) ||
@@ -332,8 +332,8 @@ static int ksm_save_def(struct ksm_sysfs *ksm_sysfs)
static int ksm_restore(struct ksm_sysfs *ksm_sysfs)
{
if (ksm_write_sysfs(KSM_FP("max_page_sharing"), ksm_sysfs->max_page_sharing) ||
- numa_available() ? 0 :
- ksm_write_sysfs(KSM_FP("merge_across_nodes"), ksm_sysfs->merge_across_nodes) ||
+ (numa_available() ? 0 :
+ ksm_write_sysfs(KSM_FP("merge_across_nodes"), ksm_sysfs->merge_across_nodes)) ||
ksm_write_sysfs(KSM_FP("pages_to_scan"), ksm_sysfs->pages_to_scan) ||
ksm_write_sysfs(KSM_FP("run"), ksm_sysfs->run) ||
ksm_write_sysfs(KSM_FP("sleep_millisecs"), ksm_sysfs->sleep_millisecs) ||
@@ -874,8 +874,8 @@ int main(int argc, char *argv[])
if (ksm_write_sysfs(KSM_FP("run"), 2) ||
ksm_write_sysfs(KSM_FP("sleep_millisecs"), 0) ||
- numa_available() ? 0 :
- ksm_write_sysfs(KSM_FP("merge_across_nodes"), 1) ||
+ (numa_available() ? 0 :
+ ksm_write_sysfs(KSM_FP("merge_across_nodes"), 1)) ||
ksm_write_sysfs(KSM_FP("pages_to_scan"), page_count))
ksft_exit_fail_msg("Cannot set up KSM tunables\n");
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0901/1376] arm64: dts: qcom: qcs8550-aim300: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (899 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0900/1376] selftests/mm: fix ternary operator precedence in ksm_tests Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0902/1376] arm64: dts: qcom: sm7225-fairphone-fp4: " Greg Kroah-Hartman
` (97 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Manivannan Sadhasivam,
Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
[ Upstream commit c0ea3b6339881c2a5fff0830557b1279d9681036 ]
The QMP PHY expects the vdda-phy supply to be around 0.88V and the
vdda-pll supply to be 1.2V. But these two supplies are swapped for the
USB QMP PHY on this board, feeding 1.2V to vdda-phy and 0.88V to
vdda-pll.
Fix it by swapping the two supplies back.
Fixes: 0b12da4e28d8 ("arm64: dts: qcom: add base AIM300 dtsi")
Reported-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Assisted-by: Claude:opus-4-8
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260803-phy-supply-fix-v1-11-5880630cde3e@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/qcs8550-aim300.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/qcs8550-aim300.dtsi b/arch/arm64/boot/dts/qcom/qcs8550-aim300.dtsi
index e6ac529e6b721..3ead078246f48 100644
--- a/arch/arm64/boot/dts/qcom/qcs8550-aim300.dtsi
+++ b/arch/arm64/boot/dts/qcom/qcs8550-aim300.dtsi
@@ -396,8 +396,8 @@ &usb_1_hsphy {
};
&usb_dp_qmpphy {
- vdda-phy-supply = <&vreg_l3e_1p2>;
- vdda-pll-supply = <&vreg_l3f_0p88>;
+ vdda-phy-supply = <&vreg_l3f_0p88>;
+ vdda-pll-supply = <&vreg_l3e_1p2>;
};
&xo_board {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0902/1376] arm64: dts: qcom: sm7225-fairphone-fp4: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (900 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0901/1376] arm64: dts: qcom: qcs8550-aim300: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0903/1376] scripts/tags.sh: Prevent binary files appearing in cscope.files Greg Kroah-Hartman
` (96 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Manivannan Sadhasivam,
Luca Weiss, Bjorn Andersson, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
[ Upstream commit a3b3a060b696d964c769a7d9dc5835c79e4fe964 ]
The QMP PHY expects the vdda-phy supply to be around 0.88V and the
vdda-pll supply to be 1.2V. But these two supplies are swapped for the
USB QMP PHY on this board, feeding 1.2V to vdda-phy and 0.9V to
vdda-pll.
Fix it by swapping the two supplies back.
Fixes: 4cbea668767d ("arm64: dts: qcom: sm7225: Add device tree for Fairphone 4")
Reported-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Assisted-by: Claude:opus-4-8
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Reviewed-by: Luca Weiss <luca.weiss@fairphone.com>
Link: https://lore.kernel.org/r/20260803-phy-supply-fix-v1-14-5880630cde3e@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts b/arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts
index 2a7c5a33b5dda..dfa3b111ae10f 100644
--- a/arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts
+++ b/arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts
@@ -1143,8 +1143,8 @@ &usb_1_hsphy {
};
&usb_1_qmpphy {
- vdda-phy-supply = <&vreg_l22a>;
- vdda-pll-supply = <&vreg_l16a>;
+ vdda-phy-supply = <&vreg_l16a>;
+ vdda-pll-supply = <&vreg_l22a>;
status = "okay";
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0903/1376] scripts/tags.sh: Prevent binary files appearing in cscope.files
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (901 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0902/1376] arm64: dts: qcom: sm7225-fairphone-fp4: " Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0904/1376] modpost: prevent leak when early return no suffix .o in read_symbols() Greg Kroah-Hartman
` (95 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sergei Litvin, Miguel Ojeda,
Nicolas Schier, Nicolas Schier, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergei Litvin <litvindev@gmail.com>
[ Upstream commit a9b93c34625a27bed5dc0f80ee2a359ceb955172 ]
When executing the command `make COMPILED_SOURCE=1 cscope`, the resulting
`cscope.files` file contains filenames with the extensions *.rlib, *.rmeta,
and *.so.
To fix this, modify the regular expression in the `all_compiled_sources()`
function so that only files with the extensions *.h, *.c, *.S, and *.rs are
accepted.
The issue has been introduced by commit 4f491bb6ea2a ("scripts/tags.sh:
collect compiled source precisely") which implemented the parsing of
compiled sources from *.cmd files instead of using the "find" command.
Fixes: 4f491bb6ea2a ("scripts/tags.sh: collect compiled source precisely")
Signed-off-by: Sergei Litvin <litvindev@gmail.com>
Acked-by: Miguel Ojeda <ojeda@kernel.org>
Tested-by: Nicolas Schier <n.schier@fritz.com>
Reviewed-by: Nicolas Schier <n.schier@fritz.com>
Link: https://patch.msgid.link/20260714083331.69482-1-litvindev@gmail.com
[nsc: cleaned-up commit message line breaks and removed cc trailers]
Signed-off-by: Nicolas Schier <nsc@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/tags.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/scripts/tags.sh b/scripts/tags.sh
index 191e0461d6d5b..4c194ebf7a70d 100755
--- a/scripts/tags.sh
+++ b/scripts/tags.sh
@@ -100,7 +100,7 @@ all_compiled_sources()
{
echo include/generated/autoconf.h
find $ignore -name "*.cmd" -exec \
- grep -Poh '(?<=^ )\S+|(?<== )\S+[^\\](?=$)' {} \+ |
+ grep -Poh '(?<=^ )\S+\.([chS]|rs)(?=\s)|(?<== )\S+\.(?1)(?=$)' {} \+ |
awk '!a[$0]++'
} | xargs realpath -esq $([ -z "$KBUILD_ABS_SRCTREE" ] && echo --relative-to=.) |
sort -u
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0904/1376] modpost: prevent leak when early return no suffix .o in read_symbols()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (902 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0903/1376] scripts/tags.sh: Prevent binary files appearing in cscope.files Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0905/1376] RDMA/erdma: Hold CQ references when processing EQ events Greg Kroah-Hartman
` (94 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robertus Diawan Chris,
Nathan Chancellor, Nicolas Schier, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robertus Diawan Chris <robertusdchris@gmail.com>
[ Upstream commit 9a5b76027ed91680e10f90111d9cba300f96d1ab ]
The allocation for elf info symsearch and hdr from parse_elf() haven't
been released when return because of modname didn't have suffix ".o".
And it seems like the suffix ".o" check did not depends on parse_elf()
to succeed first. So, move the suffix ".o" check before checking
parse_elf() result to prevent resource leak when the modname didn't have
suffix ".o" and return early.
This is reported by Coverity Scan as "Resource leak".
Fixes: 8c9ce89c5b63 ("modpost: simplify mod->name allocation")
Signed-off-by: Robertus Diawan Chris <robertusdchris@gmail.com>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Link: https://patch.msgid.link/20260624044742.144852-1-robertusdchris@gmail.com
Signed-off-by: Nicolas Schier <nsc@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/mod/modpost.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index 07e8a4eb71d04..f17350bf3ddb4 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -1567,14 +1567,14 @@ static void read_symbols(const char *modname)
struct elf_info info = { };
Elf_Sym *sym;
- if (!parse_elf(&info, modname))
- return;
-
if (!strends(modname, ".o")) {
error("%s: filename must be suffixed with .o\n", modname);
return;
}
+ if (!parse_elf(&info, modname))
+ return;
+
/* strip trailing .o */
mod = new_module(modname, strlen(modname) - strlen(".o"));
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0905/1376] RDMA/erdma: Hold CQ references when processing EQ events
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (903 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0904/1376] modpost: prevent leak when early return no suffix .o in read_symbols() Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0906/1376] RDMA/erdma: Hold QP references for AE and CM processing Greg Kroah-Hartman
` (93 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cheng Xu, Leon Romanovsky,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cheng Xu <chengyou@linux.alibaba.com>
[ Upstream commit 98df2aee1459ee1c62c70cbe9b370d2a532aea36 ]
EQ handlers look up CQs from dev->cq_xa and invoke CQ completion or
error callbacks outside the xarray lock. erdma_destroy_cq() can erase the
CQ from the xarray and free its queue buffer and doorbell record while a
previously scheduled EQ handler is still using the CQ.
Add a CQ refcount and take a reference under the xarray lock with
refcount_inc_not_zero(). Remove the CQ from the xarray before dropping
the destroy-path reference, then wait for in-flight EQ users before
releasing CQ resources.
Fixes: 155055771704 ("RDMA/erdma: Add verbs implementation")
Signed-off-by: Cheng Xu <chengyou@linux.alibaba.com>
Link: https://patch.msgid.link/20260730124357.12976-1-chengyou@linux.alibaba.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/erdma/erdma_eq.c | 6 ++++--
drivers/infiniband/hw/erdma/erdma_verbs.c | 12 +++++++++--
drivers/infiniband/hw/erdma/erdma_verbs.h | 25 +++++++++++++++++++++--
3 files changed, 37 insertions(+), 6 deletions(-)
diff --git a/drivers/infiniband/hw/erdma/erdma_eq.c b/drivers/infiniband/hw/erdma/erdma_eq.c
index 5610e7f4c6bf7..6bffbc1b543be 100644
--- a/drivers/infiniband/hw/erdma/erdma_eq.c
+++ b/drivers/infiniband/hw/erdma/erdma_eq.c
@@ -52,7 +52,7 @@ void erdma_aeq_event_handler(struct erdma_dev *dev)
if (FIELD_GET(ERDMA_AEQE_HDR_TYPE_MASK,
le32_to_cpu(aeqe->hdr)) == ERDMA_AE_TYPE_CQ_ERR) {
cqn = le32_to_cpu(aeqe->event_data0);
- cq = find_cq_by_cqn(dev, cqn);
+ cq = erdma_cq_get_by_cqn(dev, cqn);
if (!cq)
continue;
@@ -62,6 +62,7 @@ void erdma_aeq_event_handler(struct erdma_dev *dev)
if (cq->ibcq.event_handler)
cq->ibcq.event_handler(&event,
cq->ibcq.cq_context);
+ erdma_cq_put(cq);
} else {
qpn = le32_to_cpu(aeqe->event_data0);
qp = find_qp_by_qpn(dev, qpn);
@@ -157,7 +158,7 @@ void erdma_ceq_completion_handler(struct erdma_eq_cb *ceq_cb)
poll_cnt++;
cqn = FIELD_GET(ERDMA_CEQE_HDR_CQN_MASK, READ_ONCE(*ceqe));
- cq = find_cq_by_cqn(dev, cqn);
+ cq = erdma_cq_get_by_cqn(dev, cqn);
if (!cq)
continue;
@@ -166,6 +167,7 @@ void erdma_ceq_completion_handler(struct erdma_eq_cb *ceq_cb)
if (cq->ibcq.comp_handler)
cq->ibcq.comp_handler(&cq->ibcq, cq->ibcq.cq_context);
+ erdma_cq_put(cq);
}
notify_eq(&ceq_cb->eq);
diff --git a/drivers/infiniband/hw/erdma/erdma_verbs.c b/drivers/infiniband/hw/erdma/erdma_verbs.c
index 3a65cbe5839ad..c9d454813b1f0 100644
--- a/drivers/infiniband/hw/erdma/erdma_verbs.c
+++ b/drivers/infiniband/hw/erdma/erdma_verbs.c
@@ -1278,6 +1278,7 @@ int erdma_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata)
struct erdma_dev *dev = to_edev(ibcq->device);
struct erdma_ucontext *ctx = rdma_udata_to_drv_context(
udata, struct erdma_ucontext, ibucontext);
+ unsigned long flags;
int err;
struct erdma_cmdq_destroy_cq_req req;
@@ -1292,6 +1293,13 @@ int erdma_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata)
"failed to destroy CQ %u: %d\n",
cq->cqn, err);
+ xa_lock_irqsave(&dev->cq_xa, flags);
+ __xa_erase(&dev->cq_xa, cq->cqn);
+ xa_unlock_irqrestore(&dev->cq_xa, flags);
+
+ erdma_cq_put(cq);
+ wait_for_completion(&cq->free);
+
if (rdma_is_kernel_res(&cq->ibcq.res)) {
dma_free_coherent(&dev->pdev->dev, cq->depth << CQE_SHIFT,
cq->kern_cq.qbuf, cq->kern_cq.qbuf_dma_addr);
@@ -1302,8 +1310,6 @@ int erdma_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata)
put_mtt_entries(dev, &cq->user_cq.qbuf_mem);
}
- xa_erase(&dev->cq_xa, cq->cqn);
-
return 0;
}
@@ -1932,6 +1938,8 @@ int erdma_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
cq->ibcq.cqe = depth;
cq->depth = depth;
cq->assoc_eqn = attr->comp_vector + 1;
+ refcount_set(&cq->refcount, 1);
+ init_completion(&cq->free);
ret = xa_alloc_cyclic(&dev->cq_xa, &cq->cqn, cq,
XA_LIMIT(1, dev->attrs.max_cq - 1),
diff --git a/drivers/infiniband/hw/erdma/erdma_verbs.h b/drivers/infiniband/hw/erdma/erdma_verbs.h
index f9408ccc8bad0..22ceb5fe7ca2a 100644
--- a/drivers/infiniband/hw/erdma/erdma_verbs.h
+++ b/drivers/infiniband/hw/erdma/erdma_verbs.h
@@ -7,6 +7,9 @@
#ifndef __ERDMA_VERBS_H__
#define __ERDMA_VERBS_H__
+#include <linux/completion.h>
+#include <linux/refcount.h>
+
#include "erdma.h"
/* RDMA Capability. */
@@ -341,6 +344,8 @@ struct erdma_cq {
u32 depth;
u32 assoc_eqn;
+ refcount_t refcount;
+ struct completion free;
union {
struct erdma_kcq_info kern_cq;
@@ -355,9 +360,25 @@ static inline struct erdma_qp *find_qp_by_qpn(struct erdma_dev *dev, int id)
return (struct erdma_qp *)xa_load(&dev->qp_xa, id);
}
-static inline struct erdma_cq *find_cq_by_cqn(struct erdma_dev *dev, int id)
+static inline struct erdma_cq *erdma_cq_get_by_cqn(struct erdma_dev *dev,
+ int id)
+{
+ struct erdma_cq *cq;
+ unsigned long flags;
+
+ xa_lock_irqsave(&dev->cq_xa, flags);
+ cq = xa_load(&dev->cq_xa, id);
+ if (cq && !refcount_inc_not_zero(&cq->refcount))
+ cq = NULL;
+ xa_unlock_irqrestore(&dev->cq_xa, flags);
+
+ return cq;
+}
+
+static inline void erdma_cq_put(struct erdma_cq *cq)
{
- return (struct erdma_cq *)xa_load(&dev->cq_xa, id);
+ if (refcount_dec_and_test(&cq->refcount))
+ complete(&cq->free);
}
void erdma_qp_get(struct erdma_qp *qp);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0906/1376] RDMA/erdma: Hold QP references for AE and CM processing
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (904 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0905/1376] RDMA/erdma: Hold CQ references when processing EQ events Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0907/1376] RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ Greg Kroah-Hartman
` (92 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cheng Xu, Leon Romanovsky,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cheng Xu <chengyou@linux.alibaba.com>
[ Upstream commit a52eeff32024f190b3bdc99088c7becccd4fa60b ]
AE QP fatal events and iWARP CM paths load QPs from dev->qp_xa
and then use or reference them outside the xarray lock.
erdma_destroy_qp() can drop the destroy-path reference and free QP
resources while such a lookup is in flight.
Add erdma_qp_get_by_qpn() to acquire a kref under the xarray
lock with kref_get_unless_zero(). Remove the QP from the xarray
before dropping the destroy-path reference so no new lookup can acquire
it while destruction waits for existing users.
Fixes: 155055771704 ("RDMA/erdma: Add verbs implementation")
Signed-off-by: Cheng Xu <chengyou@linux.alibaba.com>
Link: https://patch.msgid.link/20260730124357.12976-2-chengyou@linux.alibaba.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/erdma/erdma_cm.c | 6 ++----
drivers/infiniband/hw/erdma/erdma_eq.c | 3 ++-
drivers/infiniband/hw/erdma/erdma_verbs.c | 6 +++++-
drivers/infiniband/hw/erdma/erdma_verbs.h | 15 +++++++++++++++
4 files changed, 24 insertions(+), 6 deletions(-)
diff --git a/drivers/infiniband/hw/erdma/erdma_cm.c b/drivers/infiniband/hw/erdma/erdma_cm.c
index e0acc185e7193..f0c8ebf62a057 100644
--- a/drivers/infiniband/hw/erdma/erdma_cm.c
+++ b/drivers/infiniband/hw/erdma/erdma_cm.c
@@ -1021,10 +1021,9 @@ int erdma_connect(struct iw_cm_id *id, struct iw_cm_conn_param *params)
if (laddr->sa_family != AF_INET || raddr->sa_family != AF_INET)
return -EAFNOSUPPORT;
- qp = find_qp_by_qpn(dev, params->qpn);
+ qp = erdma_qp_get_by_qpn(dev, params->qpn);
if (!qp)
return -ENOENT;
- erdma_qp_get(qp);
ret = sock_create(AF_INET, SOCK_STREAM, IPPROTO_TCP, &s);
if (ret < 0)
@@ -1154,10 +1153,9 @@ int erdma_accept(struct iw_cm_id *id, struct iw_cm_conn_param *params)
return -ECONNRESET;
}
- qp = find_qp_by_qpn(dev, params->qpn);
+ qp = erdma_qp_get_by_qpn(dev, params->qpn);
if (!qp)
return -ENOENT;
- erdma_qp_get(qp);
down_write(&qp->state_lock);
if (qp->attrs.iwarp.state > ERDMA_QPS_IWARP_RTR) {
diff --git a/drivers/infiniband/hw/erdma/erdma_eq.c b/drivers/infiniband/hw/erdma/erdma_eq.c
index 6bffbc1b543be..e4161e85422c6 100644
--- a/drivers/infiniband/hw/erdma/erdma_eq.c
+++ b/drivers/infiniband/hw/erdma/erdma_eq.c
@@ -65,7 +65,7 @@ void erdma_aeq_event_handler(struct erdma_dev *dev)
erdma_cq_put(cq);
} else {
qpn = le32_to_cpu(aeqe->event_data0);
- qp = find_qp_by_qpn(dev, qpn);
+ qp = erdma_qp_get_by_qpn(dev, qpn);
if (!qp)
continue;
@@ -75,6 +75,7 @@ void erdma_aeq_event_handler(struct erdma_dev *dev)
if (qp->ibqp.event_handler)
qp->ibqp.event_handler(&event,
qp->ibqp.qp_context);
+ erdma_qp_put(qp);
}
}
diff --git a/drivers/infiniband/hw/erdma/erdma_verbs.c b/drivers/infiniband/hw/erdma/erdma_verbs.c
index c9d454813b1f0..057efff532b4f 100644
--- a/drivers/infiniband/hw/erdma/erdma_verbs.c
+++ b/drivers/infiniband/hw/erdma/erdma_verbs.c
@@ -1321,6 +1321,7 @@ int erdma_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata)
udata, struct erdma_ucontext, ibucontext);
struct erdma_cmdq_destroy_qp_req req;
union erdma_mod_qp_params params;
+ unsigned long flags;
int err;
down_write(&qp->state_lock);
@@ -1348,6 +1349,10 @@ int erdma_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata)
"failed to destroy QP %u: %d\n",
QP_ID(qp), err);
+ xa_lock_irqsave(&dev->qp_xa, flags);
+ __xa_erase(&dev->qp_xa, QP_ID(qp));
+ xa_unlock_irqrestore(&dev->qp_xa, flags);
+
erdma_qp_put(qp);
wait_for_completion(&qp->safe_free);
@@ -1361,7 +1366,6 @@ int erdma_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata)
if (qp->cep)
erdma_cep_put(qp->cep);
- xa_erase(&dev->qp_xa, QP_ID(qp));
return 0;
}
diff --git a/drivers/infiniband/hw/erdma/erdma_verbs.h b/drivers/infiniband/hw/erdma/erdma_verbs.h
index 22ceb5fe7ca2a..a752bf7c4c1ec 100644
--- a/drivers/infiniband/hw/erdma/erdma_verbs.h
+++ b/drivers/infiniband/hw/erdma/erdma_verbs.h
@@ -360,6 +360,21 @@ static inline struct erdma_qp *find_qp_by_qpn(struct erdma_dev *dev, int id)
return (struct erdma_qp *)xa_load(&dev->qp_xa, id);
}
+static inline struct erdma_qp *erdma_qp_get_by_qpn(struct erdma_dev *dev,
+ int id)
+{
+ struct erdma_qp *qp;
+ unsigned long flags;
+
+ xa_lock_irqsave(&dev->qp_xa, flags);
+ qp = xa_load(&dev->qp_xa, id);
+ if (qp && !kref_get_unless_zero(&qp->ref))
+ qp = NULL;
+ xa_unlock_irqrestore(&dev->qp_xa, flags);
+
+ return qp;
+}
+
static inline struct erdma_cq *erdma_cq_get_by_cqn(struct erdma_dev *dev,
int id)
{
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0907/1376] RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (905 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0906/1376] RDMA/erdma: Hold QP references for AE and CM processing Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0908/1376] ARM: 9481/2: breakpoint: CFI breakpoints only on demand Greg Kroah-Hartman
` (91 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yehyeong Lee, Bart Van Assche,
Leon Romanovsky, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
[ Upstream commit 961ac0f0c5e414abdd6b33fae84b311d9fde0bd0 ]
srp_recv_done() passes wc->byte_len to srp_process_rsp(). It passes
nothing to srp_process_cred_req() and srp_process_aer_req(), which read
fixed-size fields from the receive buffer without checking that those
fields were received.
The buffer size is max_ti_iu_len, which comes from the login response
and is not validated. A target that advertises 8 and then sends an
8-byte SRP_CRED_REQ makes the initiator read req->tag from beyond the
end of the buffer. req->tag is copied into the SRP_CRED_RSP and sent
back, so those bytes reach the target. SRP_AER_REQ behaves the same way
and also reads req->lun.
The leak is 8 bytes per response. max_ti_iu_len also decides which slab
cache the buffer comes from. With 8 the buffer is a kmalloc-8 object and
the read is entirely outside it:
BUG: KASAN: slab-out-of-bounds in srp_recv_done+0x172b/0x1aa0
Read of size 8 at addr ffff888104714da8 by task kworker/u8:3/50
which belongs to the cache kmalloc-8 of size 8
The buggy address is located 0 bytes to the right of
allocated 8-byte region [ffff888104714da0, ffff888104714da8)
Without KASAN the returned bytes are whatever is next in the slab. One
run returned ".strtab".
rsp->data[3] in srp_process_rsp() has the same problem: only
resp_data_len is checked before it is read.
Drop a request that is shorter than the structure being parsed, and
check byte_len before the tsk_mgmt read.
Fixes: bb12588a38e6 ("IB/srp: Implement SRP_CRED_REQ and SRP_AER_REQ")
Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Link: https://patch.msgid.link/20260729093203.1503201-1-yhlee@isslab.korea.ac.kr
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/ulp/srp/ib_srp.c | 45 +++++++++++++++++++----------
1 file changed, 30 insertions(+), 15 deletions(-)
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index ce1505a8ee8d8..13eddbe0841aa 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -1943,7 +1943,8 @@ static void srp_process_rsp(struct srp_rdma_ch *ch, struct srp_rsp *rsp,
ch->req_lim += be32_to_cpu(rsp->req_lim_delta);
if (rsp->tag == ch->tsk_mgmt_tag) {
ch->tsk_mgmt_status = -1;
- if (be32_to_cpu(rsp->resp_data_len) >= 4)
+ if (be32_to_cpu(rsp->resp_data_len) >= 4 &&
+ byte_len >= sizeof(*rsp) + 4)
ch->tsk_mgmt_status = rsp->data[3];
complete(&ch->tsk_mgmt_done);
} else {
@@ -2043,13 +2044,20 @@ static int srp_response_common(struct srp_rdma_ch *ch, s32 req_delta,
}
static void srp_process_cred_req(struct srp_rdma_ch *ch,
- struct srp_cred_req *req)
+ struct srp_cred_req *req, u32 byte_len)
{
- struct srp_cred_rsp rsp = {
- .opcode = SRP_CRED_RSP,
- .tag = req->tag,
- };
- s32 delta = be32_to_cpu(req->req_lim_delta);
+ struct srp_cred_rsp rsp = { .opcode = SRP_CRED_RSP };
+ s32 delta;
+
+ if (byte_len < sizeof(*req)) {
+ shost_printk(KERN_ERR, ch->target->scsi_host, PFX
+ "dropping truncated SRP_CRED_REQ (%u bytes received, %zu expected)\n",
+ byte_len, sizeof(*req));
+ return;
+ }
+
+ rsp.tag = req->tag;
+ delta = be32_to_cpu(req->req_lim_delta);
if (srp_response_common(ch, delta, &rsp, sizeof(rsp)))
shost_printk(KERN_ERR, ch->target->scsi_host, PFX
@@ -2057,14 +2065,21 @@ static void srp_process_cred_req(struct srp_rdma_ch *ch,
}
static void srp_process_aer_req(struct srp_rdma_ch *ch,
- struct srp_aer_req *req)
+ struct srp_aer_req *req, u32 byte_len)
{
struct srp_target_port *target = ch->target;
- struct srp_aer_rsp rsp = {
- .opcode = SRP_AER_RSP,
- .tag = req->tag,
- };
- s32 delta = be32_to_cpu(req->req_lim_delta);
+ struct srp_aer_rsp rsp = { .opcode = SRP_AER_RSP };
+ s32 delta;
+
+ if (byte_len < sizeof(*req)) {
+ shost_printk(KERN_ERR, target->scsi_host, PFX
+ "dropping truncated SRP_AER_REQ (%u bytes received, %zu expected)\n",
+ byte_len, sizeof(*req));
+ return;
+ }
+
+ rsp.tag = req->tag;
+ delta = be32_to_cpu(req->req_lim_delta);
shost_printk(KERN_ERR, target->scsi_host, PFX
"ignoring AER for LUN %llu\n", scsilun_to_int(&req->lun));
@@ -2106,11 +2121,11 @@ static void srp_recv_done(struct ib_cq *cq, struct ib_wc *wc)
break;
case SRP_CRED_REQ:
- srp_process_cred_req(ch, iu->buf);
+ srp_process_cred_req(ch, iu->buf, wc->byte_len);
break;
case SRP_AER_REQ:
- srp_process_aer_req(ch, iu->buf);
+ srp_process_aer_req(ch, iu->buf, wc->byte_len);
break;
case SRP_T_LOGOUT:
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0908/1376] ARM: 9481/2: breakpoint: CFI breakpoints only on demand
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (906 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0907/1376] RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0909/1376] ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults Greg Kroah-Hartman
` (90 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, slipher, Mark Rutland, Linus Walleij,
Russell King, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <linusw@kernel.org>
[ Upstream commit 8ed9bff906cf8036531d1559f10e82733a52b41f ]
This removes the stub hw_breakpoint_cfi_handler() from ARM, making
it not steal breakpoint type 0x03 (ARM_ENTRY_CFI_BREAKPOINT) unless
CFI is actively used in the kernel.
When not instrumenting with CFI, or when a breakpoint is issued in
userspace, we fall through to return 1 from hw_breakpoint_pending()
"unhandled fault" so userspace can make use of this breakpoint.
Tested with LKDTM and this command line:
echo CFI_FORWARD_PROTO > /sys/kernel/debug/provoke-crash/DIRECT
still works as expected.
Closes: https://lore.kernel.org/lkml/kJqktbpLphg_Pk5I5SPptgTLjl3E3eq5mN5UzCslyFj7Q1Irp-wDid4mj5eQVd2iZtRGXgeZd8goq195EkXdjyt864YMc8mVb2B9NGH91NQ=@protonmail.com/
Fixes: c3f89986fde7 ("ARM: 9391/2: hw_breakpoint: Handle CFI breakpoints")
Reported-by: slipher <slipher@protonmail.com>
Suggested-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/kernel/hw_breakpoint.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/arch/arm/kernel/hw_breakpoint.c b/arch/arm/kernel/hw_breakpoint.c
index a12efd0f43e81..6819d4c1f3521 100644
--- a/arch/arm/kernel/hw_breakpoint.c
+++ b/arch/arm/kernel/hw_breakpoint.c
@@ -929,10 +929,6 @@ static void hw_breakpoint_cfi_handler(struct pt_regs *regs)
break;
}
}
-#else
-static void hw_breakpoint_cfi_handler(struct pt_regs *regs)
-{
-}
#endif
/*
@@ -964,9 +960,14 @@ static int hw_breakpoint_pending(unsigned long addr, unsigned int fsr,
case ARM_ENTRY_SYNC_WATCHPOINT:
watchpoint_handler(addr, fsr, regs);
break;
+#ifdef CONFIG_CFI
case ARM_ENTRY_CFI_BREAKPOINT:
- hw_breakpoint_cfi_handler(regs);
+ if (user_mode(regs))
+ ret = 1; /* Don't handle userspace BKPT */
+ else
+ hw_breakpoint_cfi_handler(regs);
break;
+#endif
default:
ret = 1; /* Unhandled fault. */
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0909/1376] ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (907 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0908/1376] ARM: 9481/2: breakpoint: CFI breakpoints only on demand Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0910/1376] ocfs2: synchronize heartbeat callbacks with o2net teardown Greg Kroah-Hartman
` (89 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Stoakes (ARM), Linus Walleij,
Qi Xi, Xie Yuanbin, Russell King, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xie Yuanbin <xieyuanbin1@huawei.com>
[ Upstream commit 1039bffd6ae9c75b42b7d148d6c1106134107b66 ]
When CONFIG_DEBUG_USER=y, and cmdline "user_debug=31" is set,
a user fault may trigger show_pte() without any lock.
If another thread in the same process concurrently calls munmap(),
the page table pages may be freed while show_pte() is still traversing
them, causing a use-after-free in show_pte().
If CONFIG_ARM_LPAE=y, this may cause a kernel panic if the pages table
of PMD are freed when show_pte() is running.
Acquire mmap_write_lock() around show_pte() for user faults to fix the
contention.
For user faults, additionally restrict that show_pte() is called only
when the addr is a user-space address (addr < TASK_SIZE). This is because
the lock of tsk->mm only protects the virtual memory of user address space,
furthermore, dumping the page tables of a kernel-space address for user
faults is unnecessary and may have security implications.
Keep everything unchanged for kernel faults, because the kernel is
already in the "oops" state, acquiring a lock may risk a deadlock.
Co-developed-by: Qi Xi <xiqi2@huawei.com>
Fixes: 6d021b724481 ("ARM: dump pgd, pmd and pte states on unhandled data abort faults")
Link: https://lore.kernel.org/20260716014022.2823-1-xieyuanbin1@huawei.com
Acked-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Qi Xi <xiqi2@huawei.com>
Signed-off-by: Xie Yuanbin <xieyuanbin1@huawei.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mm/fault.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
index 16b5a7d214808..6763a7c660780 100644
--- a/arch/arm/mm/fault.c
+++ b/arch/arm/mm/fault.c
@@ -205,7 +205,11 @@ __do_user_fault(unsigned long addr, unsigned int fsr, unsigned int sig,
pr_err("8<--- cut here ---\n");
pr_err("%s: unhandled page fault (%d) at 0x%08lx, code 0x%03x\n",
tsk->comm, sig, addr, fsr);
- show_pte(KERN_ERR, tsk->mm, addr);
+ if (likely(addr < TASK_SIZE)) {
+ mmap_write_lock(tsk->mm);
+ show_pte(KERN_ERR, tsk->mm, addr);
+ mmap_write_unlock(tsk->mm);
+ }
show_regs(regs);
}
#endif
@@ -649,7 +653,15 @@ do_DataAbort(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
pr_alert("8<--- cut here ---\n");
pr_alert("Unhandled fault: %s (0x%03x) at 0x%08lx\n",
inf->name, fsr, addr);
- show_pte(KERN_ALERT, current->mm, addr);
+ if (likely(user_mode(regs))) {
+ if (addr < TASK_SIZE) {
+ mmap_write_lock(current->mm);
+ show_pte(KERN_ALERT, current->mm, addr);
+ mmap_write_unlock(current->mm);
+ }
+ } else {
+ show_pte(KERN_ALERT, current->mm, addr);
+ }
arm_notify_die("", regs, inf->sig, inf->code, (void __user *)addr,
fsr, 0);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0910/1376] ocfs2: synchronize heartbeat callbacks with o2net teardown
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (908 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0909/1376] ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0911/1376] clk: rockchip: rk3576: fix source muxes for SPI0..SPI4 Greg Kroah-Hartman
` (88 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cen Zhang, Joseph Qi, Changwei Ge,
Heming Zhao, Joel Becker, Jun Piao, Junxiao Bi, Mark Fasheh,
Andrew Morton, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <zzzccc427@gmail.com>
[ Upstream commit 3e326f3bf16506873777444608e8b715aab74a7a ]
Patch series "ocfs2: harden heartbeat teardown races".
This series fixes two OCFS2 heartbeat/o2net teardown races found by
KASAN.
This patch (of 2):
Heartbeat callbacks stay registered while configfs local-node teardown
enters o2net_stop_listening(). A node-down event can still run through
o2net_disconnect_node() and o2net_set_nn_state() while teardown is
destroying o2net_wq, so the later queue/flush operations can hit a dead
workqueue. KASAN has caught this as a slab-use-after-free in
__queue_work() with the call chain:
KASAN slab-use-after-free in __queue_work+0x56/0xa90
Read of size 4
Call trace:
dump_stack_lvl+0x66/0xa0
print_report+0xce/0x630
__queue_work+0x56/0xa90
srso_alias_return_thunk+0x5/0xfbef5
__virt_addr_valid+0x19f/0x330
kasan_report+0xe0/0x110
__queue_delayed_work+0x58/0x1e0
queue_delayed_work_on+0xb4/0xc0
o2net_set_nn_state+0x467/0x840
o2net_disconnect_node+0x7b/0xe0
o2net_hb_node_down_cb+0x54/0x60
o2hb_run_event_list+0x236/0x2d0
o2hb_check_slot+0xad4/0xbc0
lock_release+0xc8/0x290
o2hb_check_slot+0x9ea/0xbc0
trace_hardirqs_on+0x18/0x130
o2hb_do_disk_heartbeat+0x646/0xb30 (fs/ocfs2/cluster/heartbeat.c:1079)
__lock_acquire+0x466/0x2260
lockdep_hardirqs_on_prepare+0xea/0x1a0
ktime_get_with_offset+0xe9/0x230
o2hb_thread+0x14e/0x770
kthread+0x1ad/0x1f0
ret_from_fork+0x3c9/0x540
__switch_to+0x2e9/0x730
ret_from_fork_asm+0x1a/0x30
Allocated by task stack:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
__kasan_kmalloc+0xaa/0xb0
__kmalloc_noprof+0x292/0x760
__alloc_workqueue+0x736/0xc60
alloc_workqueue_noprof+0xb1/0x110
o2net_start_listening+0xe5/0x430
o2nm_node_local_store+0x184/0x310
configfs_write_iter+0x18a/0x210
vfs_write+0x469/0x810
ksys_write+0xd2/0x170
do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87)
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task stack:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x5f/0x80
kfree+0x313/0x590
rcu_core+0x4f4/0x1320
handle_softirqs+0x156/0x660
queue_delayed_work_on
o2net_set_nn_state
o2net_disconnect_node
o2net_hb_node_down_cb
o2hb_run_event_list
Keep heartbeat callbacks registered so quorum state still tracks node
state, but stop them from driving o2net reconnect/disconnect work once
local teardown starts. Mark the transport offline before destroying
o2net_wq, wait for any in-flight heartbeat callback to finish, and delay
bring-up replay until the new local node is published through
o2nm_this_node().
The replay also has to stay serialized with heartbeat callback delivery.
Otherwise a live-node snapshot can be copied, a real hb_down callback
can install -ENOTCONN for a peer, and the stale replay can call
o2net_hb_node_up() for that same peer and queue reconnect work even
though heartbeat is already down.
The buggy scenario involves two paths, with each column showing the order
within that path:
local-node teardown: heartbeat node-down callback:
1. configfs local-off enters 1. o2hb_run_event_list() invokes
o2net_stop_listening(). o2net_hb_node_down_cb().
2. teardown heads for 2. the callback reaches
destroy_workqueue(o2net_wq). o2net_disconnect_node() and
o2net_set_nn_state().
3. teardown destroys and NULLs 3. the callback flushes or queues
o2net_wq. work through o2net_wq.
Link: https://lore.kernel.org/20260624095310.763763-1-zzzccc427@gmail.com
Link: https://lore.kernel.org/20260624095310.763763-2-zzzccc427@gmail.com
Fixes: 98211489d414 ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem")
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Assisted-by: Codex:gpt-5.5
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Mark Fasheh <mark@fasheh.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/cluster/heartbeat.c | 43 ++++++++++++++----
fs/ocfs2/cluster/heartbeat.h | 5 ++
fs/ocfs2/cluster/nodemanager.c | 4 ++
fs/ocfs2/cluster/tcp.c | 83 +++++++++++++++++++++++++++-------
fs/ocfs2/cluster/tcp.h | 1 +
5 files changed, 109 insertions(+), 27 deletions(-)
diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c
index ea44ea6efbc6e..6170e202e56e3 100644
--- a/fs/ocfs2/cluster/heartbeat.c
+++ b/fs/ocfs2/cluster/heartbeat.c
@@ -1476,13 +1476,38 @@ void o2hb_init(void)
o2hb_debug_init();
}
-/* if we're already in a callback then we're already serialized by the sem */
-static void o2hb_fill_node_map_from_callback(unsigned long *map,
- unsigned int bits)
+static void __o2hb_fill_node_map(unsigned long *map, unsigned int bits)
{
bitmap_copy(map, o2hb_live_node_bitmap, bits);
}
+void o2hb_callback_read_lock(void)
+{
+ down_read(&o2hb_callback_sem);
+}
+
+void o2hb_callback_read_unlock(void)
+{
+ up_read(&o2hb_callback_sem);
+}
+
+void o2hb_synchronize_callbacks(void)
+{
+ down_write(&o2hb_callback_sem);
+ up_write(&o2hb_callback_sem);
+}
+
+/*
+ * Callers must already hold o2hb_callback_sem for read or write so the copy
+ * stays serialized with callback delivery.
+ */
+void o2hb_fill_node_map_locked(unsigned long *map, unsigned int bits)
+{
+ spin_lock(&o2hb_live_lock);
+ __o2hb_fill_node_map(map, bits);
+ spin_unlock(&o2hb_live_lock);
+}
+
/*
* get a map of all nodes that are heartbeating in any regions
*/
@@ -1490,11 +1515,9 @@ void o2hb_fill_node_map(unsigned long *map, unsigned int bits)
{
/* callers want to serialize this map and callbacks so that they
* can trust that they don't miss nodes coming to the party */
- down_read(&o2hb_callback_sem);
- spin_lock(&o2hb_live_lock);
- o2hb_fill_node_map_from_callback(map, bits);
- spin_unlock(&o2hb_live_lock);
- up_read(&o2hb_callback_sem);
+ o2hb_callback_read_lock();
+ o2hb_fill_node_map_locked(map, bits);
+ o2hb_callback_read_unlock();
}
EXPORT_SYMBOL_GPL(o2hb_fill_node_map);
@@ -2566,7 +2589,7 @@ int o2hb_check_node_heartbeating_no_sem(u8 node_num)
unsigned long testing_map[BITS_TO_LONGS(O2NM_MAX_NODES)];
spin_lock(&o2hb_live_lock);
- o2hb_fill_node_map_from_callback(testing_map, O2NM_MAX_NODES);
+ __o2hb_fill_node_map(testing_map, O2NM_MAX_NODES);
spin_unlock(&o2hb_live_lock);
if (!test_bit(node_num, testing_map)) {
mlog(ML_HEARTBEAT,
@@ -2583,7 +2606,7 @@ int o2hb_check_node_heartbeating_from_callback(u8 node_num)
{
unsigned long testing_map[BITS_TO_LONGS(O2NM_MAX_NODES)];
- o2hb_fill_node_map_from_callback(testing_map, O2NM_MAX_NODES);
+ o2hb_fill_node_map_locked(testing_map, O2NM_MAX_NODES);
if (!test_bit(node_num, testing_map)) {
mlog(ML_HEARTBEAT,
"node (%u) does not have heartbeating enabled.\n",
diff --git a/fs/ocfs2/cluster/heartbeat.h b/fs/ocfs2/cluster/heartbeat.h
index 8ef8c1b9eeb76..2ca2b657583c0 100644
--- a/fs/ocfs2/cluster/heartbeat.h
+++ b/fs/ocfs2/cluster/heartbeat.h
@@ -58,6 +58,11 @@ int o2hb_register_callback(const char *region_uuid,
struct o2hb_callback_func *hc);
void o2hb_unregister_callback(const char *region_uuid,
struct o2hb_callback_func *hc);
+void o2hb_callback_read_lock(void);
+void o2hb_callback_read_unlock(void);
+void o2hb_synchronize_callbacks(void);
+void o2hb_fill_node_map_locked(unsigned long *map,
+ unsigned int bits);
void o2hb_fill_node_map(unsigned long *map,
unsigned int bits);
void o2hb_exit(void);
diff --git a/fs/ocfs2/cluster/nodemanager.c b/fs/ocfs2/cluster/nodemanager.c
index 46e0c9ba8a4ff..b65fc6eeae6e0 100644
--- a/fs/ocfs2/cluster/nodemanager.c
+++ b/fs/ocfs2/cluster/nodemanager.c
@@ -325,6 +325,7 @@ static ssize_t o2nm_node_local_store(struct config_item *item, const char *page,
struct o2nm_node *node = to_o2nm_node(item);
struct o2nm_cluster *cluster;
unsigned long tmp;
+ bool starting = false;
char *p = (char *)page;
ssize_t ret;
@@ -361,6 +362,7 @@ static ssize_t o2nm_node_local_store(struct config_item *item, const char *page,
ret = o2net_start_listening(node);
if (ret)
goto out;
+ starting = true;
}
if (!tmp && cluster->cl_has_local &&
@@ -374,6 +376,8 @@ static ssize_t o2nm_node_local_store(struct config_item *item, const char *page,
if (node->nd_local) {
cluster->cl_has_local = tmp;
cluster->cl_local_node = node->nd_num;
+ if (starting)
+ o2net_complete_start_listening(node);
}
ret = count;
diff --git a/fs/ocfs2/cluster/tcp.c b/fs/ocfs2/cluster/tcp.c
index 2b8fa3e782fb6..15b726a3a1fc7 100644
--- a/fs/ocfs2/cluster/tcp.c
+++ b/fs/ocfs2/cluster/tcp.c
@@ -105,6 +105,8 @@ static struct socket *o2net_listen_sock;
* destroying the work queue.
*/
static struct workqueue_struct *o2net_wq;
+/* Heartbeat callbacks stay registered across local-node off/on. */
+static bool o2net_listening;
static struct work_struct o2net_listen_work;
static struct o2hb_callback_func o2net_hb_up, o2net_hb_down;
@@ -1691,6 +1693,19 @@ static void o2net_still_up(struct work_struct *work)
/* ------------------------------------------------------------ */
+static void o2net_hb_node_up(struct o2net_node *nn)
+{
+ /* ensure an immediate connect attempt */
+ nn->nn_last_connect_attempt = jiffies -
+ (msecs_to_jiffies(o2net_reconnect_delay()) + 1);
+
+ spin_lock(&nn->nn_lock);
+ atomic_set(&nn->nn_timeout, 0);
+ if (nn->nn_persistent_error)
+ o2net_set_nn_state(nn, NULL, 0, 0);
+ spin_unlock(&nn->nn_lock);
+}
+
void o2net_disconnect_node(struct o2nm_node *node)
{
struct o2net_node *nn = o2net_nn_from_num(node->nd_num);
@@ -1712,41 +1727,39 @@ void o2net_disconnect_node(struct o2nm_node *node)
static void o2net_hb_node_down_cb(struct o2nm_node *node, int node_num,
void *data)
{
+ u8 this_node;
+
o2quo_hb_down(node_num);
if (!node)
- return;
+ goto out;
- if (node_num != o2nm_this_node())
+ this_node = o2nm_this_node();
+ if (!READ_ONCE(o2net_listening) || this_node == O2NM_MAX_NODES)
+ goto out;
+
+ if (node_num != this_node)
o2net_disconnect_node(node);
+out:
BUG_ON(atomic_read(&o2net_connected_peers) < 0);
}
static void o2net_hb_node_up_cb(struct o2nm_node *node, int node_num,
void *data)
{
- struct o2net_node *nn = o2net_nn_from_num(node_num);
+ u8 this_node;
o2quo_hb_up(node_num);
BUG_ON(!node);
- /* ensure an immediate connect attempt */
- nn->nn_last_connect_attempt = jiffies -
- (msecs_to_jiffies(o2net_reconnect_delay()) + 1);
+ this_node = o2nm_this_node();
+ if (!READ_ONCE(o2net_listening) || this_node == O2NM_MAX_NODES)
+ return;
- if (node_num != o2nm_this_node()) {
- /* believe it or not, accept and node heartbeating testing
- * can succeed for this node before we got here.. so
- * only use set_nn_state to clear the persistent error
- * if that hasn't already happened */
- spin_lock(&nn->nn_lock);
- atomic_set(&nn->nn_timeout, 0);
- if (nn->nn_persistent_error)
- o2net_set_nn_state(nn, NULL, 0, 0);
- spin_unlock(&nn->nn_lock);
- }
+ if (node_num != this_node)
+ o2net_hb_node_up(o2net_nn_from_num(node_num));
}
void o2net_unregister_hb_callbacks(void)
@@ -1755,6 +1768,37 @@ void o2net_unregister_hb_callbacks(void)
o2hb_unregister_callback(NULL, &o2net_hb_down);
}
+/*
+ * Delay heartbeat-driven network work until the local node is fully published
+ * through o2nm_this_node(), then replay the nodes that are already live while
+ * callback delivery stays blocked.
+ */
+void o2net_complete_start_listening(struct o2nm_node *node)
+{
+ unsigned long live_nodes[BITS_TO_LONGS(O2NM_MAX_NODES)];
+ unsigned long node_num;
+ u8 local_node;
+
+ local_node = o2nm_this_node();
+ if (WARN_ON_ONCE(local_node == O2NM_MAX_NODES))
+ return;
+ if (WARN_ON_ONCE(local_node != node->nd_num))
+ return;
+ if (WARN_ON_ONCE(!o2net_wq))
+ return;
+
+ o2hb_callback_read_lock();
+ WRITE_ONCE(o2net_listening, true);
+ o2hb_fill_node_map_locked(live_nodes, O2NM_MAX_NODES);
+ for_each_set_bit(node_num, live_nodes, O2NM_MAX_NODES) {
+ if (node_num == local_node)
+ continue;
+
+ o2net_hb_node_up(o2net_nn_from_num(node_num));
+ }
+ o2hb_callback_read_unlock();
+}
+
int o2net_register_hb_callbacks(void)
{
int ret;
@@ -2033,6 +2077,8 @@ int o2net_start_listening(struct o2nm_node *node)
{
int ret = 0;
+ if (WARN_ON_ONCE(READ_ONCE(o2net_listening)))
+ return -EBUSY;
BUG_ON(o2net_wq != NULL);
BUG_ON(o2net_listen_sock != NULL);
@@ -2064,6 +2110,9 @@ void o2net_stop_listening(struct o2nm_node *node)
BUG_ON(o2net_wq == NULL);
BUG_ON(o2net_listen_sock == NULL);
+ WRITE_ONCE(o2net_listening, false);
+ o2hb_synchronize_callbacks();
+
/* stop the listening socket from generating work */
write_lock_bh(&sock->sk->sk_callback_lock);
sock->sk->sk_data_ready = sock->sk->sk_user_data;
diff --git a/fs/ocfs2/cluster/tcp.h b/fs/ocfs2/cluster/tcp.h
index a75b551d31c7b..2e86d42b5faf9 100644
--- a/fs/ocfs2/cluster/tcp.h
+++ b/fs/ocfs2/cluster/tcp.h
@@ -96,6 +96,7 @@ struct o2nm_node;
int o2net_register_hb_callbacks(void);
void o2net_unregister_hb_callbacks(void);
int o2net_start_listening(struct o2nm_node *node);
+void o2net_complete_start_listening(struct o2nm_node *node);
void o2net_stop_listening(struct o2nm_node *node);
void o2net_disconnect_node(struct o2nm_node *node);
int o2net_num_connected_peers(void);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0911/1376] clk: rockchip: rk3576: fix source muxes for SPI0..SPI4
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (909 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0910/1376] ocfs2: synchronize heartbeat callbacks with o2net teardown Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0912/1376] drm/sun4i: vi scaler: Fix coefficient selection Greg Kroah-Hartman
` (87 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexey Charkov, Heiko Stuebner,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Charkov <alchark@flipper.net>
[ Upstream commit 586ff159ec02533c17dd928641529cb0b52e9c62 ]
The TRM defines available source muxes for SPI0..SPI4 as
- b00: clk_gpll_div6_src
- b01: clk_gpll_div8_src
- b10: clk_cpll_div10_src
- b11: clk_xin_osc0_func
Which doesn't match what the current clock driver implements, making it
impossible to derive some SPI clock rates such as 37.125 MHz (which
requires clk_gpll_div8_src as the source mux).
Add a correct mux definition per TRM and point SPI0..SPI4 clocks at it.
Fixes: cc40f5baa91b ("clk: rockchip: Add clock controller for the RK3576")
Signed-off-by: Alexey Charkov <alchark@flipper.net>
Link: https://patch.msgid.link/20260805-rk3576-spi-clk-v1-1-2f040d0d163b@flipper.net
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/rockchip/clk-rk3576.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/drivers/clk/rockchip/clk-rk3576.c b/drivers/clk/rockchip/clk-rk3576.c
index 595e010341f73..0746d2d07095b 100644
--- a/drivers/clk/rockchip/clk-rk3576.c
+++ b/drivers/clk/rockchip/clk-rk3576.c
@@ -313,6 +313,7 @@ PNAME(mux_100m_24m_lclk0_p) = { "clk_cpll_div10", "xin24m", "lclk_asrc_src_0" }
PNAME(mux_100m_24m_lclk1_p) = { "clk_cpll_div10", "xin24m", "lclk_asrc_src_1" };
PNAME(mux_150m_100m_50m_24m_p) = { "clk_gpll_div8", "clk_cpll_div10", "clk_cpll_div20", "xin24m" };
PNAME(mux_200m_100m_50m_24m_p) = { "clk_gpll_div6", "clk_cpll_div10", "clk_cpll_div20", "xin24m" };
+PNAME(mux_200m_150m_100m_24m_p) = { "clk_gpll_div6", "clk_gpll_div8", "clk_cpll_div10", "xin24m" };
PNAME(mux_400m_200m_100m_24m_p) = { "clk_gpll_div3", "clk_gpll_div6", "clk_cpll_div10", "xin24m" };
PNAME(mux_500m_250m_100m_24m_p) = { "clk_cpll_div2", "clk_cpll_div4", "clk_cpll_div10", "xin24m" };
PNAME(mux_600m_400m_300m_24m_p) = { "clk_gpll_div2", "clk_gpll_div3", "clk_gpll_div4", "xin24m" };
@@ -702,19 +703,19 @@ static struct rockchip_clk_branch rk3576_clk_branches[] __initdata = {
RK3576_CLKGATE_CON(16), 0, GFLAGS),
GATE(PCLK_SPI4, "pclk_spi4", "pclk_bus_root", 0,
RK3576_CLKGATE_CON(16), 1, GFLAGS),
- COMPOSITE_NODIV(CLK_SPI0, "clk_spi0", mux_200m_100m_50m_24m_p, 0,
+ COMPOSITE_NODIV(CLK_SPI0, "clk_spi0", mux_200m_150m_100m_24m_p, 0,
RK3576_CLKSEL_CON(70), 13, 2, MFLAGS,
RK3576_CLKGATE_CON(16), 2, GFLAGS),
- COMPOSITE_NODIV(CLK_SPI1, "clk_spi1", mux_200m_100m_50m_24m_p, 0,
+ COMPOSITE_NODIV(CLK_SPI1, "clk_spi1", mux_200m_150m_100m_24m_p, 0,
RK3576_CLKSEL_CON(71), 0, 2, MFLAGS,
RK3576_CLKGATE_CON(16), 3, GFLAGS),
- COMPOSITE_NODIV(CLK_SPI2, "clk_spi2", mux_200m_100m_50m_24m_p, 0,
+ COMPOSITE_NODIV(CLK_SPI2, "clk_spi2", mux_200m_150m_100m_24m_p, 0,
RK3576_CLKSEL_CON(71), 2, 2, MFLAGS,
RK3576_CLKGATE_CON(16), 4, GFLAGS),
- COMPOSITE_NODIV(CLK_SPI3, "clk_spi3", mux_200m_100m_50m_24m_p, 0,
+ COMPOSITE_NODIV(CLK_SPI3, "clk_spi3", mux_200m_150m_100m_24m_p, 0,
RK3576_CLKSEL_CON(71), 4, 2, MFLAGS,
RK3576_CLKGATE_CON(16), 5, GFLAGS),
- COMPOSITE_NODIV(CLK_SPI4, "clk_spi4", mux_200m_100m_50m_24m_p, 0,
+ COMPOSITE_NODIV(CLK_SPI4, "clk_spi4", mux_200m_150m_100m_24m_p, 0,
RK3576_CLKSEL_CON(71), 6, 2, MFLAGS,
RK3576_CLKGATE_CON(16), 6, GFLAGS),
GATE(PCLK_WDT0, "pclk_wdt0", "pclk_bus_root", 0,
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0912/1376] drm/sun4i: vi scaler: Fix coefficient selection
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (910 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0911/1376] clk: rockchip: rk3576: fix source muxes for SPI0..SPI4 Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0913/1376] of: property: add of_graph_get_next_port() Greg Kroah-Hartman
` (86 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jernej Skrabec, Chen-Yu Tsai,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jernej Skrabec <jernej.skrabec@gmail.com>
[ Upstream commit 5c31990b21f0b535732deb2b658b78b07464f56c ]
Currently, vertical coefficients are selected based on horizontal
scaling, which is wrong. Additionally, chroma coefficients should be
selected based on format subsampling.
Fix all that.
Fixes: b862a648de3b ("drm/sun4i: Add support for HW scaling to DE2")
Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Reviewed-by: Chen-Yu Tsai <wens@kernel.org>
Link: https://patch.msgid.link/263a4a41442a3c8b072b170256b72658f1b90802.1785772659.git.jernej.skrabec@gmail.com
Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/sun4i/sun8i_vi_scaler.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/sun4i/sun8i_vi_scaler.c b/drivers/gpu/drm/sun4i/sun8i_vi_scaler.c
index 7ba75011adf9f..328b84df2ee5e 100644
--- a/drivers/gpu/drm/sun4i/sun8i_vi_scaler.c
+++ b/drivers/gpu/drm/sun4i/sun8i_vi_scaler.c
@@ -891,20 +891,26 @@ static void sun8i_vi_scaler_set_coeff(struct regmap *map, u32 base,
lan3coefftab32_left[offset + i]);
regmap_write(map, SUN8I_SCALER_VSU_YHCOEFF1(base, i),
lan3coefftab32_right[offset + i]);
+ }
+ offset = sun8i_vi_scaler_coef_index(vstep) *
+ SUN8I_VI_SCALER_COEFF_COUNT;
+ for (i = 0; i < SUN8I_VI_SCALER_COEFF_COUNT; i++)
+ regmap_write(map, SUN8I_SCALER_VSU_YVCOEFF(base, i),
+ lan2coefftab32[offset + i]);
+
+ offset = sun8i_vi_scaler_coef_index(hstep / format->hsub) *
+ SUN8I_VI_SCALER_COEFF_COUNT;
+ for (i = 0; i < SUN8I_VI_SCALER_COEFF_COUNT; i++) {
regmap_write(map, SUN8I_SCALER_VSU_CHCOEFF0(base, i),
ch_left[offset + i]);
regmap_write(map, SUN8I_SCALER_VSU_CHCOEFF1(base, i),
ch_right[offset + i]);
}
-
- offset = sun8i_vi_scaler_coef_index(hstep) *
+ offset = sun8i_vi_scaler_coef_index(vstep / format->vsub) *
SUN8I_VI_SCALER_COEFF_COUNT;
- for (i = 0; i < SUN8I_VI_SCALER_COEFF_COUNT; i++) {
- regmap_write(map, SUN8I_SCALER_VSU_YVCOEFF(base, i),
- lan2coefftab32[offset + i]);
+ for (i = 0; i < SUN8I_VI_SCALER_COEFF_COUNT; i++)
regmap_write(map, SUN8I_SCALER_VSU_CVCOEFF(base, i),
cy[offset + i]);
- }
}
void sun8i_vi_scaler_enable(struct sun8i_mixer *mixer, int layer, bool enable)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0913/1376] of: property: add of_graph_get_next_port()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (911 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0912/1376] drm/sun4i: vi scaler: Fix coefficient selection Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0914/1376] of: property: add of_graph_get_next_port_endpoint() Greg Kroah-Hartman
` (85 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuninori Morimoto, Rob Herring (Arm),
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
[ Upstream commit 02ac5f9d6caec96071103f7c62b5117526e47b64 ]
We have endpoint base functions
- of_graph_get_next_endpoint()
- of_graph_get_endpoint_count()
- for_each_endpoint_of_node()
Here, for_each_endpoint_of_node() loop finds each endpoints
ports {
port@0 {
(1) endpoint {...};
};
port@1 {
(2) endpoint {...};
};
...
};
In above case, it finds endpoint as (1) -> (2) -> ...
Basically, user/driver knows which port is used for what, but not in
all cases. For example on flexible/generic driver case, how many ports
are used is not fixed.
For example Sound Generic Card driver which is very flexible/generic and
used from many venders can't know how many ports are used, and used for
what, because it depends on each vender SoC and/or its used board.
And more, the port can have multi endpoints. For example Generic Sound
Card case, it supports many type of connection between CPU / Codec, and
some of them uses multi endpoint in one port. see below.
ports {
(A) port@0 {
(1) endpoint@0 {...};
(2) endpoint@1 {...};
};
(B) port@1 {
(3) endpoint {...};
};
...
};
Generic Sound Card want to handle each connection via "port" base instead
of "endpoint" base. But, it is very difficult to handle each "port" via
existing for_each_endpoint_of_node(). Because getting each "port" via
of_get_parent() from each "endpoint" doesn't work. For example in above
case, both (1) (2) endpoint has same "port" (= A).
Add "port" base functions.
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://lore.kernel.org/r/87ldyeb5t9.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Stable-dep-of: 62bac3202042 ("drm/sun4i: tcon-top: Keep mixer routes distinct")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/of/property.c | 54 ++++++++++++++++++++++++++++++++++++++++
include/linux/of_graph.h | 28 +++++++++++++++++++++
2 files changed, 82 insertions(+)
diff --git a/drivers/of/property.c b/drivers/of/property.c
index 906a33ae717f7..7c8fb5dd4cb19 100644
--- a/drivers/of/property.c
+++ b/drivers/of/property.c
@@ -630,6 +630,43 @@ struct device_node *of_graph_get_port_by_id(struct device_node *parent, u32 id)
}
EXPORT_SYMBOL(of_graph_get_port_by_id);
+/**
+ * of_graph_get_next_port() - get next port node.
+ * @parent: pointer to the parent device node, or parent ports node
+ * @prev: previous port node, or NULL to get first
+ *
+ * Parent device node can be used as @parent whether device node has ports node
+ * or not. It will work same as ports@0 node.
+ *
+ * Return: A 'port' node pointer with refcount incremented. Refcount
+ * of the passed @prev node is decremented.
+ */
+struct device_node *of_graph_get_next_port(const struct device_node *parent,
+ struct device_node *prev)
+{
+ if (!parent)
+ return NULL;
+
+ if (!prev) {
+ struct device_node *node __free(device_node) =
+ of_get_child_by_name(parent, "ports");
+
+ if (node)
+ parent = node;
+
+ return of_get_child_by_name(parent, "port");
+ }
+
+ do {
+ prev = of_get_next_child(parent, prev);
+ if (!prev)
+ break;
+ } while (!of_node_name_eq(prev, "port"));
+
+ return prev;
+}
+EXPORT_SYMBOL(of_graph_get_next_port);
+
/**
* of_graph_get_next_endpoint() - get next endpoint node
* @parent: pointer to the parent device node
@@ -823,6 +860,23 @@ unsigned int of_graph_get_endpoint_count(const struct device_node *np)
}
EXPORT_SYMBOL(of_graph_get_endpoint_count);
+/**
+ * of_graph_get_port_count() - get the number of port in a device or ports node
+ * @np: pointer to the device or ports node
+ *
+ * Return: count of port of this device or ports node
+ */
+unsigned int of_graph_get_port_count(struct device_node *np)
+{
+ unsigned int num = 0;
+
+ for_each_of_graph_port(np, port)
+ num++;
+
+ return num;
+}
+EXPORT_SYMBOL(of_graph_get_port_count);
+
/**
* of_graph_get_remote_node() - get remote parent device_node for given port/endpoint
* @node: pointer to parent device_node containing graph port/endpoint
diff --git a/include/linux/of_graph.h b/include/linux/of_graph.h
index a4bea62bfa290..44518f3583a44 100644
--- a/include/linux/of_graph.h
+++ b/include/linux/of_graph.h
@@ -11,6 +11,7 @@
#ifndef __LINUX_OF_GRAPH_H
#define __LINUX_OF_GRAPH_H
+#include <linux/cleanup.h>
#include <linux/types.h>
#include <linux/errno.h>
@@ -37,14 +38,29 @@ struct of_endpoint {
for (child = of_graph_get_next_endpoint(parent, NULL); child != NULL; \
child = of_graph_get_next_endpoint(parent, child))
+/**
+ * for_each_of_graph_port - iterate over every port in a device or ports node
+ * @parent: parent device or ports node containing port
+ * @child: loop variable pointing to the current port node
+ *
+ * When breaking out of the loop, and continue to use the @child, you need to
+ * use return_ptr(@child) or no_free_ptr(@child) not to call __free() for it.
+ */
+#define for_each_of_graph_port(parent, child) \
+ for (struct device_node *child __free(device_node) = of_graph_get_next_port(parent, NULL);\
+ child != NULL; child = of_graph_get_next_port(parent, child))
+
#ifdef CONFIG_OF
bool of_graph_is_present(const struct device_node *node);
int of_graph_parse_endpoint(const struct device_node *node,
struct of_endpoint *endpoint);
unsigned int of_graph_get_endpoint_count(const struct device_node *np);
+unsigned int of_graph_get_port_count(struct device_node *np);
struct device_node *of_graph_get_port_by_id(struct device_node *node, u32 id);
struct device_node *of_graph_get_next_endpoint(const struct device_node *parent,
struct device_node *previous);
+struct device_node *of_graph_get_next_port(const struct device_node *parent,
+ struct device_node *port);
struct device_node *of_graph_get_endpoint_by_regs(
const struct device_node *parent, int port_reg, int reg);
struct device_node *of_graph_get_remote_endpoint(
@@ -73,6 +89,11 @@ static inline unsigned int of_graph_get_endpoint_count(const struct device_node
return 0;
}
+static inline unsigned int of_graph_get_port_count(struct device_node *np)
+{
+ return 0;
+}
+
static inline struct device_node *of_graph_get_port_by_id(
struct device_node *node, u32 id)
{
@@ -86,6 +107,13 @@ static inline struct device_node *of_graph_get_next_endpoint(
return NULL;
}
+static inline struct device_node *of_graph_get_next_port(
+ const struct device_node *parent,
+ struct device_node *previous)
+{
+ return NULL;
+}
+
static inline struct device_node *of_graph_get_endpoint_by_regs(
const struct device_node *parent, int port_reg, int reg)
{
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0914/1376] of: property: add of_graph_get_next_port_endpoint()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (912 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0913/1376] of: property: add of_graph_get_next_port() Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0915/1376] drm/sun4i: tcon: Set output mux for DSI and LVDS Greg Kroah-Hartman
` (84 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuninori Morimoto, Rob Herring (Arm),
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
[ Upstream commit 58fe47d6ac7413172e1fa88324fb1b4c0eb2c0a2 ]
We already have of_graph_get_next_endpoint(), but it is not
intuitive to use in some case.
(X) node {
(Y) ports {
(P0) port@0 { endpoint { remote-endpoint = ...; };};
(P10) port@1 { endpoint { remote-endpoint = ...; };
(P11) endpoint { remote-endpoint = ...; };};
(P2) port@2 { endpoint { remote-endpoint = ...; };};
};
};
For example, if I want to handle port@1's 2 endpoints (= P10, P11),
I want to use like below
P10 = of_graph_get_next_endpoint(port1, NULL);
P11 = of_graph_get_next_endpoint(port1, P10);
But 1st one will be error, because of_graph_get_next_endpoint()
requested 1st parameter is "node" (X) or "ports" (Y), not but "port".
Below works well, but it will get P0
P0 = of_graph_get_next_endpoint(node, NULL);
P0 = of_graph_get_next_endpoint(ports, NULL);
In other words, we can't handle P10/P11 directly via
of_graph_get_next_endpoint().
There is another non intuitive behavior on of_graph_get_next_endpoint().
In case of if I could get P10 pointer for some way, and if I want to
handle port@1 things by loop, I would like use it like below
/*
* "ep" is now P10, and handle port1 things here,
* but we don't know how many endpoints port1 have.
*
* Because "ep" is non NULL now, we can use port1
* as of_graph_get_next_endpoint(port1, xxx)
*/
do {
/* do something for port1 specific things here */
} while (ep = of_graph_get_next_endpoint(port1, ep))
But it also not worked as I expected.
I expect it will be P10 -> P11 -> NULL,
but it will be P10 -> P11 -> P2, because
of_graph_get_next_endpoint() will fetch "endpoint" beyond the "port".
It is not useful for generic driver.
To handle endpoint more intuitive, create of_graph_get_next_port_endpoint()
of_graph_get_next_port_endpoint(port1, NULL); // P10
of_graph_get_next_port_endpoint(port1, P10); // P11
of_graph_get_next_port_endpoint(port1, P11); // NULL
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://lore.kernel.org/r/87jzdyb5t5.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Stable-dep-of: 62bac3202042 ("drm/sun4i: tcon-top: Keep mixer routes distinct")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/of/property.c | 27 +++++++++++++++++++++++++++
include/linux/of_graph.h | 21 +++++++++++++++++++++
2 files changed, 48 insertions(+)
diff --git a/drivers/of/property.c b/drivers/of/property.c
index 7c8fb5dd4cb19..0b1d28b249bdb 100644
--- a/drivers/of/property.c
+++ b/drivers/of/property.c
@@ -667,6 +667,33 @@ struct device_node *of_graph_get_next_port(const struct device_node *parent,
}
EXPORT_SYMBOL(of_graph_get_next_port);
+/**
+ * of_graph_get_next_port_endpoint() - get next endpoint node in port.
+ * If it reached to end of the port, it will return NULL.
+ * @port: pointer to the target port node
+ * @prev: previous endpoint node, or NULL to get first
+ *
+ * Return: An 'endpoint' node pointer with refcount incremented. Refcount
+ * of the passed @prev node is decremented.
+ */
+struct device_node *of_graph_get_next_port_endpoint(const struct device_node *port,
+ struct device_node *prev)
+{
+ while (1) {
+ prev = of_get_next_child(port, prev);
+ if (!prev)
+ break;
+ if (WARN(!of_node_name_eq(prev, "endpoint"),
+ "non endpoint node is used (%pOF)", prev))
+ continue;
+
+ break;
+ }
+
+ return prev;
+}
+EXPORT_SYMBOL(of_graph_get_next_port_endpoint);
+
/**
* of_graph_get_next_endpoint() - get next endpoint node
* @parent: pointer to the parent device node
diff --git a/include/linux/of_graph.h b/include/linux/of_graph.h
index 44518f3583a44..a692d9d979a64 100644
--- a/include/linux/of_graph.h
+++ b/include/linux/of_graph.h
@@ -50,6 +50,18 @@ struct of_endpoint {
for (struct device_node *child __free(device_node) = of_graph_get_next_port(parent, NULL);\
child != NULL; child = of_graph_get_next_port(parent, child))
+/**
+ * for_each_of_graph_port_endpoint - iterate over every endpoint in a port node
+ * @parent: parent port node
+ * @child: loop variable pointing to the current endpoint node
+ *
+ * When breaking out of the loop, and continue to use the @child, you need to
+ * use return_ptr(@child) or no_free_ptr(@child) not to call __free() for it.
+ */
+#define for_each_of_graph_port_endpoint(parent, child) \
+ for (struct device_node *child __free(device_node) = of_graph_get_next_port_endpoint(parent, NULL);\
+ child != NULL; child = of_graph_get_next_port_endpoint(parent, child))
+
#ifdef CONFIG_OF
bool of_graph_is_present(const struct device_node *node);
int of_graph_parse_endpoint(const struct device_node *node,
@@ -61,6 +73,8 @@ struct device_node *of_graph_get_next_endpoint(const struct device_node *parent,
struct device_node *previous);
struct device_node *of_graph_get_next_port(const struct device_node *parent,
struct device_node *port);
+struct device_node *of_graph_get_next_port_endpoint(const struct device_node *port,
+ struct device_node *prev);
struct device_node *of_graph_get_endpoint_by_regs(
const struct device_node *parent, int port_reg, int reg);
struct device_node *of_graph_get_remote_endpoint(
@@ -114,6 +128,13 @@ static inline struct device_node *of_graph_get_next_port(
return NULL;
}
+static inline struct device_node *of_graph_get_next_port_endpoint(
+ const struct device_node *parent,
+ struct device_node *previous)
+{
+ return NULL;
+}
+
static inline struct device_node *of_graph_get_endpoint_by_regs(
const struct device_node *parent, int port_reg, int reg)
{
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0915/1376] drm/sun4i: tcon: Set output mux for DSI and LVDS
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (913 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0914/1376] of: property: add of_graph_get_next_port_endpoint() Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0916/1376] drm/sun4i: tcon: Drop TCON TOP device reference Greg Kroah-Hartman
` (83 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jernej Skrabec, Chen-Yu Tsai,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jernej Skrabec <jernej.skrabec@gmail.com>
[ Upstream commit 9c90199b39637ad94253c4fd8e7b1333ca1d3e0d ]
DSI and LVDS skip output mux setup, so TCON TOP cannot route the selected
mixer. Configure them like other channel 0 outputs.
In practice this matters for D1, where channel 0 TCONs are fed through
TCON TOP. The remaining set_mux implementations only handle TMDS and
return an error for other encoder types, as before.
Fixes: b9b52d2f4aaf ("drm/sun4i: Add support for D1 TCONs")
Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Acked-by: Chen-Yu Tsai <wens@kernel.org>
Link: https://patch.msgid.link/7e9dad9eed2e91a79c4e1202caa8fed7c2427531.1785772659.git.jernej.skrabec@gmail.com
Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/sun4i/sun4i_tcon.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c
index a1a2c845ade0c..1b710013b9cb3 100644
--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c
+++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c
@@ -717,9 +717,11 @@ void sun4i_tcon_mode_set(struct sun4i_tcon *tcon,
case DRM_MODE_ENCODER_DSI:
/* DSI is tied to special case of CPU interface */
sun4i_tcon0_mode_set_cpu(tcon, encoder, mode);
+ sun4i_tcon_set_mux(tcon, 0, encoder);
break;
case DRM_MODE_ENCODER_LVDS:
sun4i_tcon0_mode_set_lvds(tcon, encoder, mode);
+ sun4i_tcon_set_mux(tcon, 0, encoder);
break;
case DRM_MODE_ENCODER_NONE:
sun4i_tcon0_mode_set_rgb(tcon, encoder, mode);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0916/1376] drm/sun4i: tcon: Drop TCON TOP device reference
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (914 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0915/1376] drm/sun4i: tcon: Set output mux for DSI and LVDS Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0917/1376] drm/sun4i: hdmi: Dont leak sync polarity bits into packet control Greg Kroah-Hartman
` (82 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jernej Skrabec, Chen-Yu Tsai,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jernej Skrabec <jernej.skrabec@gmail.com>
[ Upstream commit 8208832a38ff3d2560eb8a77a9d7a2f17d8ebcdc ]
of_find_device_by_node() takes a device reference. Drop it after mux
configuration succeeds.
Fixes: 0305189afb32 ("drm/sun4i: tcon: Add support for R40 TCON")
Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Acked-by: Chen-Yu Tsai <wens@kernel.org>
Link: https://patch.msgid.link/871a3108086c15a483eef23301984c8d2254dfa7.1785772659.git.jernej.skrabec@gmail.com
Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/sun4i/sun4i_tcon.c | 19 +++++++++----------
1 file changed, 9 insertions(+), 10 deletions(-)
diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c
index 1b710013b9cb3..901e84de5aef9 100644
--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c
+++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c
@@ -1409,7 +1409,7 @@ static int sun8i_r40_tcon_tv_set_mux(struct sun4i_tcon *tcon,
{
struct device_node *port, *remote;
struct platform_device *pdev;
- int id, ret;
+ int id, ret = 0;
/* find TCON TOP platform device and TCON id */
@@ -1432,21 +1432,20 @@ static int sun8i_r40_tcon_tv_set_mux(struct sun4i_tcon *tcon,
if (IS_ENABLED(CONFIG_DRM_SUN8I_TCON_TOP) &&
encoder->encoder_type == DRM_MODE_ENCODER_TMDS) {
ret = sun8i_tcon_top_set_hdmi_src(&pdev->dev, id);
- if (ret) {
- put_device(&pdev->dev);
- return ret;
- }
+ if (ret)
+ goto out_put_device;
}
if (IS_ENABLED(CONFIG_DRM_SUN8I_TCON_TOP)) {
ret = sun8i_tcon_top_de_config(&pdev->dev, tcon->id, id);
- if (ret) {
- put_device(&pdev->dev);
- return ret;
- }
+ if (ret)
+ goto out_put_device;
}
- return 0;
+out_put_device:
+ put_device(&pdev->dev);
+
+ return ret;
}
static const struct sun4i_tcon_quirks sun4i_a10_quirks = {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0917/1376] drm/sun4i: hdmi: Dont leak sync polarity bits into packet control
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (915 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0916/1376] drm/sun4i: tcon: Drop TCON TOP device reference Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0918/1376] drm/sun4i: crtc: Propagate layer initialization error Greg Kroah-Hartman
` (81 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jernej Skrabec, Chen-Yu Tsai,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jernej Skrabec <jernej.skrabec@gmail.com>
[ Upstream commit f5c3b1b0d228624786d22973a20c908c84e1a576 ]
sun4i_hdmi_enable() keeps using the same variable after it programmed
the video timing polarity register with it. The leftover TX_CLK, HSYNC
and VSYNC bits are then ORed into the packet control register, where
each nibble selects the packet type sent in one slot.
As a result, slot 0 selects packet type 3 instead of the AVI infoframe
whenever the mode has positive HSYNC polarity, and the TX_CLK bits set
nibbles which the driver never programs.
Assign the packet types instead of ORing them into the stale value.
Fixes: 9ca6bc246035 ("drm/sun4i: hdmi: Move mode_set into enable")
Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Acked-by: Chen-Yu Tsai <wens@kernel.org>
Link: https://patch.msgid.link/51ba0918ce016a4b45313d5df1b6ce31b8c8731e.1785772659.git.jernej.skrabec@gmail.com
Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
index b3649449de302..a48bef891f05a 100644
--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
@@ -146,7 +146,7 @@ static void sun4i_hdmi_enable(struct drm_encoder *encoder,
drm_atomic_helper_connector_hdmi_update_infoframes(connector, state);
- val |= SUN4I_HDMI_PKT_CTRL_TYPE(0, SUN4I_HDMI_PKT_AVI);
+ val = SUN4I_HDMI_PKT_CTRL_TYPE(0, SUN4I_HDMI_PKT_AVI);
val |= SUN4I_HDMI_PKT_CTRL_TYPE(1, SUN4I_HDMI_PKT_END);
writel(val, hdmi->base + SUN4I_HDMI_PKT_CTRL_REG(0));
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0918/1376] drm/sun4i: crtc: Propagate layer initialization error
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (916 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0917/1376] drm/sun4i: hdmi: Dont leak sync polarity bits into packet control Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0919/1376] drm/sun4i: tcon: Drop remote endpoint reference Greg Kroah-Hartman
` (80 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jernej Skrabec, Chen-Yu Tsai,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jernej Skrabec <jernej.skrabec@gmail.com>
[ Upstream commit 7061ff05ed4a3cf16e83f7e3ad09cbd212508a32 ]
sun4i_crtc_init() returns plain NULL when layer initialization fails,
while all its other error paths return an error pointer. The only
caller, sun4i_tcon_bind(), checks the result with IS_ERR() and happily
continues with tcon->crtc set to NULL. sun4i_rgb_init() and
sun4i_lvds_init() then dereference it in drm_crtc_mask(), which
oopses.
Return the error pointer instead.
Fixes: dcd215801b02 ("drm/sun4i: Drop primary layer pointer from sun4i_drv")
Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Acked-by: Chen-Yu Tsai <wens@kernel.org>
Link: https://patch.msgid.link/b26a0d427d9dfae9c82e3ca90a67d24d8ece5a28.1785772659.git.jernej.skrabec@gmail.com
Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/sun4i/sun4i_crtc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/sun4i/sun4i_crtc.c b/drivers/gpu/drm/sun4i/sun4i_crtc.c
index 18e74047b0f56..3e90aeb68c480 100644
--- a/drivers/gpu/drm/sun4i/sun4i_crtc.c
+++ b/drivers/gpu/drm/sun4i/sun4i_crtc.c
@@ -208,7 +208,7 @@ struct sun4i_crtc *sun4i_crtc_init(struct drm_device *drm,
planes = sunxi_engine_layers_init(drm, engine);
if (IS_ERR(planes)) {
dev_err(drm->dev, "Couldn't create the planes\n");
- return NULL;
+ return ERR_CAST(planes);
}
/* find primary and cursor planes for drm_crtc_init_with_planes */
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0919/1376] drm/sun4i: tcon: Drop remote endpoint reference
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (917 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0918/1376] drm/sun4i: crtc: Propagate layer initialization error Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0920/1376] drm/sun4i: dw-hdmi: Drop TCON TOP port reference Greg Kroah-Hartman
` (79 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jernej Skrabec, Chen-Yu Tsai,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jernej Skrabec <jernej.skrabec@gmail.com>
[ Upstream commit 3f77e4072630e2301efdbe521e7fca10311043ec ]
sun4i_tcon_of_get_id_from_port() never drops the reference taken by
of_graph_get_remote_endpoint(). The function is not only called during
bind, but also on every mode set through sun8i_r40_tcon_tv_set_mux(),
so the leak accumulates.
Fixes: e8d5bbf7f4c4 ("drm/sun4i: tcon: get TCON ID and matching engine with remote endpoint ID")
Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Acked-by: Chen-Yu Tsai <wens@kernel.org>
Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Link: https://patch.msgid.link/3f5ec952ad80cb51efebf2fe230df50259041a23.1785772659.git.jernej.skrabec@gmail.com
Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/sun4i/sun4i_tcon.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c
index 901e84de5aef9..ab4409dcbf302 100644
--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c
+++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c
@@ -972,6 +972,7 @@ static int sun4i_tcon_of_get_id_from_port(struct device_node *port)
continue;
ret = of_property_read_u32(remote, "reg", ®);
+ of_node_put(remote);
if (ret)
continue;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0920/1376] drm/sun4i: dw-hdmi: Drop TCON TOP port reference
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (918 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0919/1376] drm/sun4i: tcon: Drop remote endpoint reference Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0921/1376] drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz Greg Kroah-Hartman
` (78 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jernej Skrabec, Chen-Yu Tsai,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jernej Skrabec <jernej.skrabec@gmail.com>
[ Upstream commit d2a242e5688a17b79c89cd966cd31820c5096d80 ]
When the HDMI controller is fed by TCON TOP, the port node used to
enumerate the possible CRTCs is never released.
Fixes: 57e23de02f48 ("drm/sun4i: DW HDMI: Expand algorithm for possible crtcs")
Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Acked-by: Chen-Yu Tsai <wens@kernel.org>
Link: https://patch.msgid.link/43ffcc17f7c3f94c1d7bd1ee89134c766e84df35.1785772659.git.jernej.skrabec@gmail.com
Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
index 4727dfaa8fb98..af9be9ba8b96a 100644
--- a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
+++ b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
@@ -83,6 +83,8 @@ static u32 sun8i_dw_hdmi_find_possible_crtcs(struct drm_device *drm,
of_node_put(remote_port);
}
}
+
+ of_node_put(port);
} else {
crtcs = drm_of_find_possible_crtcs(drm, node);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0921/1376] drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (919 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0920/1376] drm/sun4i: dw-hdmi: Drop TCON TOP port reference Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0922/1376] cpufreq: imx6q: fix devres accumulation across driver rebind Greg Kroah-Hartman
` (77 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jernej Skrabec, Chen-Yu Tsai,
Chen-Yu Tsai, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jernej Skrabec <jernej.skrabec@gmail.com>
[ Upstream commit 0ba6deddaae74f0539c0303bfb5f860adbe1a68b ]
The 8-bit entry of the last MPLL row (594 MHz) doesn't lock reliably on
H6. 4K@60 RGB/YUV444, which is the mode that reaches this entry, doesn't
come up.
Align the value with the vendor driver. Other entries are left alone,
they are used by lower pixel clocks which work fine.
Tested with 4K@60 on a LG TV.
Fixes: 0fb4b858b102 ("drm/sun4i: Add support for H6 HDMI PHY")
Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Acked-by: Chen-Yu Tsai <wens@kernel.org>
Reviewed-by: Chen-Yu Tsai <wens@csie.org>
Link: https://patch.msgid.link/aec9060209473b8176eb43bc7c63c20b21306adf.1785772659.git.jernej.skrabec@gmail.com
Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c b/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c
index 4fa69c463dc46..489ea94693ffa 100644
--- a/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c
+++ b/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c
@@ -91,7 +91,7 @@ static const struct dw_hdmi_mpll_config sun50i_h6_mpll_cfg[] = {
},
}, {
594000000, {
- { 0x1a40, 0x0003 },
+ { 0x1a7c, 0x0003 },
{ 0x3b4c, 0x0003 },
{ 0x5a64, 0x0003 },
},
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0922/1376] cpufreq: imx6q: fix devres accumulation across driver rebind
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (920 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0921/1376] drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0923/1376] cpufreq: imx6q: fix out-of-bounds write when probed more than once Greg Kroah-Hartman
` (76 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Viresh Kumar,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 22c23c72c3b21fa3ec3db5070dfc0582794e0ef9 ]
imx6_soc_volt is allocated with devm_kcalloc(cpu_dev, ...), where cpu_dev
is the CPU device from get_cpu_device(0). That device is never unbound, so
its devres list is never released, and imx6q_cpufreq_remove() does not free
the array either. Every probe therefore adds an allocation that stays for
the lifetime of the system.
Allocate against the platform device instead. Its devres is released when
the driver is unbound, which is exactly the lifetime the array wants:
imx6q_set_target() reads it, and nothing may reach that after
cpufreq_unregister_driver().
That makes the array actually go away on unbind, so also clear the
file-scope pointer in remove and on the failed-probe path, rather than
leave it pointing at memory devres is about to release.
Tested by rebinding the driver on qemu's mcimx6ul-evk.
Fixes: b4573d1d657a ("cpufreq: imx6q: correct VDDSOC/PU voltage scaling when cpufreq is changed")
Assisted-by: Claude:claude-opus-5
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/imx6q-cpufreq.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/cpufreq/imx6q-cpufreq.c b/drivers/cpufreq/imx6q-cpufreq.c
index 33c1df7f683e4..853534f0fec88 100644
--- a/drivers/cpufreq/imx6q-cpufreq.c
+++ b/drivers/cpufreq/imx6q-cpufreq.c
@@ -401,7 +401,7 @@ static int imx6q_cpufreq_probe(struct platform_device *pdev)
}
/* Make imx6_soc_volt array's size same as arm opp number */
- imx6_soc_volt = devm_kcalloc(cpu_dev, num, sizeof(*imx6_soc_volt),
+ imx6_soc_volt = devm_kcalloc(&pdev->dev, num, sizeof(*imx6_soc_volt),
GFP_KERNEL);
if (imx6_soc_volt == NULL) {
ret = -ENOMEM;
@@ -486,6 +486,7 @@ static int imx6q_cpufreq_probe(struct platform_device *pdev)
return 0;
free_freq_table:
+ imx6_soc_volt = NULL;
dev_pm_opp_free_cpufreq_table(cpu_dev, &freq_table);
out_free_opp:
dev_pm_opp_of_remove_table(cpu_dev);
@@ -507,6 +508,7 @@ static int imx6q_cpufreq_probe(struct platform_device *pdev)
static void imx6q_cpufreq_remove(struct platform_device *pdev)
{
cpufreq_unregister_driver(&imx6q_cpufreq_driver);
+ imx6_soc_volt = NULL;
dev_pm_opp_free_cpufreq_table(cpu_dev, &freq_table);
dev_pm_opp_of_remove_table(cpu_dev);
regulator_put(arm_reg);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0923/1376] cpufreq: imx6q: fix out-of-bounds write when probed more than once
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (921 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0922/1376] cpufreq: imx6q: fix devres accumulation across driver rebind Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0924/1376] IB/isert: delay the final Login Response until the session is registered Greg Kroah-Hartman
` (75 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Viresh Kumar,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 8c3afcf27fa4582c1ab912503dc8a4ebb8dc0f82 ]
imx6_soc_volt is allocated fresh on every probe, sized to the number of
ARM OPPs:
imx6_soc_volt = devm_kcalloc(cpu_dev, num, sizeof(*imx6_soc_volt),
GFP_KERNEL);
but it is filled through soc_opp_count, which has static storage and is
never reset. A second bind after an unbind keeps indexing from where the
first one stopped, and writes past the end of the new array.
Unbinding and rebinding the driver on qemu's mcimx6ul-evk, under KASAN:
BUG: KASAN: slab-out-of-bounds in imx6q_cpufreq_probe+0x3b0/0xa34
Write of size 4 at addr c5e90480 by task binder/73
imx6q_cpufreq_probe from platform_probe+0x88/0xe4
platform_probe from really_probe+0x108/0x384
bind_store from kernfs_fop_write_iter+0x1b4/0x28c
The write lands one u32 past the end of the allocation.
soc_opp_count is only read a few lines below the loop that fills it, so it
never needed static storage. Make it a local.
Fixes: b4573d1d657a ("cpufreq: imx6q: correct VDDSOC/PU voltage scaling when cpufreq is changed")
Assisted-by: Claude:claude-opus-5
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/imx6q-cpufreq.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/cpufreq/imx6q-cpufreq.c b/drivers/cpufreq/imx6q-cpufreq.c
index 853534f0fec88..51520307c4b04 100644
--- a/drivers/cpufreq/imx6q-cpufreq.c
+++ b/drivers/cpufreq/imx6q-cpufreq.c
@@ -55,7 +55,6 @@ static unsigned int max_freq;
static unsigned int transition_latency;
static u32 *imx6_soc_volt;
-static u32 soc_opp_count;
static int imx6q_set_target(struct cpufreq_policy *policy, unsigned int index)
{
@@ -331,6 +330,7 @@ static int imx6q_cpufreq_probe(struct platform_device *pdev)
const struct property *prop;
const __be32 *val;
u32 nr, i, j;
+ u32 soc_opp_count = 0;
cpu_dev = get_cpu_device(0);
if (!cpu_dev) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0924/1376] IB/isert: delay the final Login Response until the session is registered
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (922 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0923/1376] cpufreq: imx6q: fix out-of-bounds write when probed more than once Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0925/1376] IB/isert: post the full-feature receive buffers after session registration Greg Kroah-Hartman
` (74 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yehyeong Lee, Leon Romanovsky,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
[ Upstream commit 464f5afa92d071a226f88424803b0fcf88093ede ]
isert_put_login_tx() puts the final Login Response on the wire before
__transport_register_session(), which iscsi_post_login_handler() reaches
only after iscsi_target_do_login() returns. An initiator that issues a
SCSI command as soon as it sees that response can have it executed against
an se_session whose se_tpg is still NULL, and the ib-comp-wq worker oopses
on the NULL dereference.
Oops: general protection fault, probably for non-canonical address 0xdffffc000000000f: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000078-0x000000000000007f]
CPU: 0 UID: 0 PID: 178 Comm: kworker/0:1H Not tainted 7.2.0-rc5-V2CTL-gf5098b6bae76 #10 PREEMPT(lazy)
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: ib-comp-wq ib_cq_poll_work
RIP: 0010:target_submit+0xbe/0x390
Code: fa 48 c1 ea 03 80 3c 02 00 0f 85 89 02 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 64 24 18 49 8d 7c 24 78 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 5a 02 00 00 48 8d 7b 78 4d 8b 6c 24 78 48 b8 00
RSP: 0018:ffff8881058cfa78 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: ffff88810c78c6f0 RCX: ffffffff964bb363
RDX: 000000000000000f RSI: 00000000fffffe00 RDI: 0000000000000078
RBP: 1ffff11020b19f52 R08: 0000000000000001 R09: ffffed1020b19f52
R10: 0000000000000003 R11: ffff88810596c000 R12: 0000000000000000
R13: ffff88810c61b000 R14: ffff88810c6a3400 R15: ffff88810c61b044
FS: 0000000000000000(0000) GS:ffff8881822b2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1f1b83c000 CR3: 000000006fe72001 CR4: 0000000000770ef0
PKRU: 55555554
Call Trace:
<TASK>
? __pfx__raw_spin_lock_bh+0x10/0x10
? __pfx_target_submit+0x10/0x10
? mutex_lock+0x81/0xe0
? __pfx_mutex_lock+0x10/0x10
? iscsit_execute_cmd+0x650/0x850
iscsit_sequence_cmd+0x186/0x3d0
iscsit_process_scsi_cmd+0x87/0x300
isert_recv_done+0x1002/0x2390
? __pfx_isert_recv_done+0x10/0x10
? rxe_poll_cq+0x253/0x3d0
? finish_task_switch.isra.0+0x1dc/0xa70
__ib_process_cq+0xe1/0x390
ib_cq_poll_work+0x46/0x150
process_one_work+0x633/0x1030
? assign_work+0x11d/0x370
worker_thread+0x45b/0xd10
? __pfx_worker_thread+0x10/0x10
? __pfx_worker_thread+0x10/0x10
kthread+0x2c6/0x3b0
? recalc_sigpending+0x15c/0x1e0
? __pfx_kthread+0x10/0x10
ret_from_fork+0x36e/0x5a0
? __pfx_ret_from_fork+0x10/0x10
? __switch_to+0x572/0xdd0
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
Delay the final Login Response instead. isert_get_rx_pdu() runs from
iscsi_target_rx_thread() after conn->rx_login_comp, completed by
iscsi_post_login_handler() after __transport_register_session(); iscsi-TCP
and cxgbit already take PDUs from that thread, isert alone does not. The
buffers are still posted first, so the initiator's first command does not
meet an empty receive queue and nothing depends on RNR flow control, and
the header and payload live in isert_conn, not in the struct iscsi_login
that iscsi_target_nego_release() frees first.
Over rxe, 400 login cycles per run, the oops appeared in 10 of 20
unpatched runs and in none of 20 runs with this patch. An
initiator that never waits is handled by the next patch.
Not tested: iWARP, discovery sessions over iSER, and real HCAs.
Fixes: b8d26b3be8b3 ("iser-target: Add iSCSI Extensions for RDMA (iSER) target driver")
Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Link: https://patch.msgid.link/20260731041212.1733364-1-yhlee@isslab.korea.ac.kr
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/ulp/isert/ib_isert.c | 20 ++++++++++++++++++--
drivers/infiniband/ulp/isert/ib_isert.h | 1 +
2 files changed, 19 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index 1fcaf7df8b398..d0e3d1cf5b41b 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -59,6 +59,8 @@ static void isert_recv_done(struct ib_cq *cq, struct ib_wc *wc);
static void isert_send_done(struct ib_cq *cq, struct ib_wc *wc);
static void isert_login_recv_done(struct ib_cq *cq, struct ib_wc *wc);
static void isert_login_send_done(struct ib_cq *cq, struct ib_wc *wc);
+static void isert_unmap_tx_desc(struct iser_tx_desc *tx_desc,
+ struct ib_device *ib_dev);
static int isert_sg_tablesize_set(const char *val, const struct kernel_param *kp)
{
@@ -498,6 +500,8 @@ isert_connect_release(struct isert_conn *isert_conn)
if (isert_conn->qp)
isert_destroy_qp(isert_conn);
+ isert_unmap_tx_desc(&isert_conn->login_tx_desc, device->ib_device);
+
if (isert_conn->login_desc)
isert_free_login_buf(isert_conn);
@@ -958,14 +962,17 @@ isert_put_login_tx(struct iscsit_conn *conn, struct iscsi_login *login,
mutex_lock(&isert_conn->mutex);
isert_conn->state = ISER_CONN_FULL_FEATURE;
mutex_unlock(&isert_conn->mutex);
- goto post_send;
+
+ /* Sent from isert_get_rx_pdu() after registration. */
+ isert_conn->login_rsp_pending = true;
+ return 0;
}
ret = isert_login_post_recv(isert_conn);
if (ret)
return ret;
}
-post_send:
+
ret = isert_login_post_send(isert_conn, tx_desc);
if (ret)
return ret;
@@ -2625,8 +2632,17 @@ static void isert_free_conn(struct iscsit_conn *conn)
static void isert_get_rx_pdu(struct iscsit_conn *conn)
{
+ struct isert_conn *isert_conn = conn->context;
struct completion comp;
+ /* The session is registered by now; see isert_put_login_tx(). */
+ if (isert_conn->login_rsp_pending) {
+ isert_conn->login_rsp_pending = false;
+ if (isert_login_post_send(isert_conn,
+ &isert_conn->login_tx_desc))
+ return;
+ }
+
init_completion(&comp);
wait_for_completion_interruptible(&comp);
diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h
index 0b2dfd6e7e270..0bac5aa66c802 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.h
+++ b/drivers/infiniband/ulp/isert/ib_isert.h
@@ -178,6 +178,7 @@ struct isert_conn {
struct completion login_comp;
struct completion login_req_comp;
struct iser_tx_desc login_tx_desc;
+ bool login_rsp_pending;
struct rdma_cm_id *cm_id;
struct ib_qp *qp;
struct ib_cq *cq;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0925/1376] IB/isert: post the full-feature receive buffers after session registration
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (923 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0924/1376] IB/isert: delay the final Login Response until the session is registered Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0926/1376] RDMA/siw: Fix use-after-free in siw_accept() Greg Kroah-Hartman
` (73 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yehyeong Lee, Leon Romanovsky,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
[ Upstream commit 5247dde9daac7e107853b6fea043f7f47be033f7 ]
isert_put_login_tx() posts the full-feature receive buffers before
__transport_register_session() runs, so an initiator that does not wait
for the final Login Response can still have a SCSI command executed
against an se_session whose se_tpg is NULL - the same oops as the
previous patch, at target_submit+0xbe.
Post them from isert_get_rx_pdu(), which the previous patch already uses
to send that response, and post them before that send: the receive queue
is filled at the moment the initiator is told it may use it. Allocating
there keeps the existing property that a memory allocation failure cannot
happen once the final Login Response is on the wire.
The receive queue is already empty between the final Login Request and
isert_post_recvm(); this moves the second point later, from a median of
92 us to 172 us over 1200 logins. Only an initiator that sends before it
has been told to can reach that window, and on IB and RoCE its send is
retried there until the buffers appear - isert_rdma_accept() asks for
rnr_retry_count = 7. iWARP has no RNR flow control, so there the same
send terminates the connection instead.
Measured over rxe, 400 login cycles per run, with an initiator that does
not wait: an instrumented build counted no entries to isert_recv_done()
before the buffers are posted in 10 runs, where that initiator oopsed
8 of 10 unpatched runs and 5 of 10 with only the previous patch.
Not tested: iWARP, discovery sessions over iSER, and real HCAs.
Fixes: b8d26b3be8b3 ("iser-target: Add iSCSI Extensions for RDMA (iSER) target driver")
Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Link: https://patch.msgid.link/20260731041212.1733364-2-yhlee@isslab.korea.ac.kr
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/ulp/isert/ib_isert.c | 41 ++++++++++++-------------
1 file changed, 20 insertions(+), 21 deletions(-)
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index d0e3d1cf5b41b..6483a55170cd1 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -949,21 +949,7 @@ isert_put_login_tx(struct iscsit_conn *conn, struct iscsi_login *login,
}
if (!login->login_failed) {
if (login->login_complete) {
- ret = isert_alloc_rx_descriptors(isert_conn);
- if (ret)
- return ret;
-
- ret = isert_post_recvm(isert_conn,
- ISERT_QP_MAX_RECV_DTOS);
- if (ret)
- return ret;
-
- /* Now we are in FULL_FEATURE phase */
- mutex_lock(&isert_conn->mutex);
- isert_conn->state = ISER_CONN_FULL_FEATURE;
- mutex_unlock(&isert_conn->mutex);
-
- /* Sent from isert_get_rx_pdu() after registration. */
+ /* Posted and sent from isert_get_rx_pdu(). */
isert_conn->login_rsp_pending = true;
return 0;
}
@@ -2635,13 +2621,26 @@ static void isert_get_rx_pdu(struct iscsit_conn *conn)
struct isert_conn *isert_conn = conn->context;
struct completion comp;
+ /* The login timeout timer can fail the login after isert_put_login_tx(). */
+ if (!isert_conn->login_rsp_pending)
+ return;
+
+ isert_conn->login_rsp_pending = false;
+
/* The session is registered by now; see isert_put_login_tx(). */
- if (isert_conn->login_rsp_pending) {
- isert_conn->login_rsp_pending = false;
- if (isert_login_post_send(isert_conn,
- &isert_conn->login_tx_desc))
- return;
- }
+ if (isert_alloc_rx_descriptors(isert_conn))
+ return;
+
+ if (isert_post_recvm(isert_conn, ISERT_QP_MAX_RECV_DTOS))
+ return;
+
+ /* Now we are in FULL_FEATURE phase */
+ mutex_lock(&isert_conn->mutex);
+ isert_conn->state = ISER_CONN_FULL_FEATURE;
+ mutex_unlock(&isert_conn->mutex);
+
+ if (isert_login_post_send(isert_conn, &isert_conn->login_tx_desc))
+ return;
init_completion(&comp);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0926/1376] RDMA/siw: Fix use-after-free in siw_accept()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (924 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0925/1376] IB/isert: post the full-feature receive buffers after session registration Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0927/1376] module: replace use of system_wq with system_dfl_wq Greg Kroah-Hartman
` (72 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shuangpeng Bai, Leon Romanovsky,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
[ Upstream commit a9394971825933074032794a5feee5211509c774 ]
siw_accept() looks up the QP supplied by userspace. If that QP is
already in RTS, the function jumps to error cleanup before associating
the incoming CEP with it.
The cleanup tests whether qp->cep is non-NULL and assumes the current
call installed the association. However, qp->cep can point to the CEP
of an existing connection. The cleanup then drops a reference from the
incoming cep, not qp->cep. Once the incoming endpoint loses its
remaining references, this can free it before the subsequent cep->qp
store, causing a use-after-free. It also clears the existing QP
association.
Only release the association reference when qp->cep is the incoming
CEP. This preserves an existing association and avoids accessing the
freed endpoint.
Fixes: 6c52fdc244b5 ("rdma/siw: connection management")
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Link: https://patch.msgid.link/20260801213632.1086548-1-shuangpeng.kernel@gmail.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/sw/siw/siw_cm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/sw/siw/siw_cm.c b/drivers/infiniband/sw/siw/siw_cm.c
index 49ff121f77fe4..bb7d909639071 100644
--- a/drivers/infiniband/sw/siw/siw_cm.c
+++ b/drivers/infiniband/sw/siw/siw_cm.c
@@ -1701,7 +1701,7 @@ int siw_accept(struct iw_cm_id *id, struct iw_cm_conn_param *params)
cep->state = SIW_EPSTATE_CLOSED;
siw_free_cm_id(cep);
- if (qp->cep) {
+ if (qp->cep == cep) {
siw_cep_put(cep);
qp->cep = NULL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0927/1376] module: replace use of system_wq with system_dfl_wq
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (925 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0926/1376] RDMA/siw: Fix use-after-free in siw_accept() Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0928/1376] module: use strscpy() to copy module names in stats and dup tracking Greg Kroah-Hartman
` (71 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tejun Heo, Marco Crivellari,
Petr Pavlu, Sami Tolvanen, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Crivellari <marco.crivellari@suse.com>
[ Upstream commit 581ac2d4a58b81669cc6abf645a558bce5cf14ab ]
Currently if a user enqueues a work item using schedule_delayed_work() the
used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use
WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to
schedule_work() that is using system_wq and queue_work(), that makes use
again of WORK_CPU_UNBOUND.
This lack of consistency cannot be addressed without refactoring the API.
This continues the effort to refactor workqueue APIs, which began with
the introduction of new workqueues and a new alloc_workqueue flag in:
commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq")
commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag")
Switch to using system_dfl_wq, the new unbound workqueue, because the
users do not benefit from a per-cpu workqueue.
Suggested-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Marco Crivellari <marco.crivellari@suse.com>
Reviewed-by: Petr Pavlu <petr.pavlu@suse.com>
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Stable-dep-of: 5eecb11b543f ("module/dups: Fix use-after-free in kmod_dup_req lifetime handling")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/module/dups.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/kernel/module/dups.c b/kernel/module/dups.c
index bd2149fbe1173..0b633f2edda6b 100644
--- a/kernel/module/dups.c
+++ b/kernel/module/dups.c
@@ -113,7 +113,7 @@ static void kmod_dup_request_complete(struct work_struct *work)
* let this linger forever as this is just a boot optimization for
* possible abuses of vmalloc() incurred by finit_module() thrashing.
*/
- queue_delayed_work(system_wq, &kmod_req->delete_work, 60 * HZ);
+ queue_delayed_work(system_dfl_wq, &kmod_req->delete_work, 60 * HZ);
}
bool kmod_dup_request_exists_wait(char *module_name, bool wait, int *dup_ret)
@@ -240,7 +240,7 @@ void kmod_dup_request_announce(char *module_name, int ret)
* There is no rush. But we also don't want to hold the
* caller up forever or introduce any boot delays.
*/
- queue_work(system_wq, &kmod_req->complete_work);
+ queue_work(system_dfl_wq, &kmod_req->complete_work);
out:
mutex_unlock(&kmod_dup_mutex);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0928/1376] module: use strscpy() to copy module names in stats and dup tracking
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (926 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0927/1376] module: replace use of system_wq with system_dfl_wq Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0929/1376] module/dups: Inform duplicate requests about the result directly Greg Kroah-Hartman
` (70 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Naveen Kumar Chaudhary, Petr Pavlu,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naveen Kumar Chaudhary <naveen.osdev@gmail.com>
[ Upstream commit 93c29ebd1622fb0670701e1c1b3a978a5cac08b7 ]
Both try_add_failed_module() and kmod_dup_request_exists_wait() use
memcpy() with strlen() to copy module names into fixed-size
char[MODULE_NAME_LEN] buffers. Neither performs a bounds check on the
copy. Current callers always pass names originating from
mod->name (itself char[MODULE_NAME_LEN]), so this is not exploitable
today. However both functions accept a plain const char * with no
documented length contract, making them latent buffer overflows if a
future caller passes a longer string.
Replace memcpy() with strscpy() in both sites, which bounds the copy
to MODULE_NAME_LEN and always NUL-terminates.
Signed-off-by: Naveen Kumar Chaudhary <naveen.osdev@gmail.com>
Reviewed-by: Petr Pavlu <petr.pavlu@suse.com>
Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
Stable-dep-of: 5eecb11b543f ("module/dups: Fix use-after-free in kmod_dup_req lifetime handling")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/module/dups.c | 2 +-
kernel/module/stats.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/kernel/module/dups.c b/kernel/module/dups.c
index 0b633f2edda6b..6ecc42193de24 100644
--- a/kernel/module/dups.c
+++ b/kernel/module/dups.c
@@ -129,7 +129,7 @@ bool kmod_dup_request_exists_wait(char *module_name, bool wait, int *dup_ret)
if (!new_kmod_req)
return false;
- memcpy(new_kmod_req->name, module_name, strlen(module_name));
+ strscpy(new_kmod_req->name, module_name);
INIT_WORK(&new_kmod_req->complete_work, kmod_dup_request_complete);
INIT_DELAYED_WORK(&new_kmod_req->delete_work, kmod_dup_request_delete);
init_completion(&new_kmod_req->first_req_done);
diff --git a/kernel/module/stats.c b/kernel/module/stats.c
index 3ba0e98b3c910..2a4e2f6708965 100644
--- a/kernel/module/stats.c
+++ b/kernel/module/stats.c
@@ -253,7 +253,7 @@ int try_add_failed_module(const char *name, enum fail_dup_mod_reason reason)
mod_fail = kzalloc(sizeof(*mod_fail), GFP_KERNEL);
if (!mod_fail)
return -ENOMEM;
- memcpy(mod_fail->name, name, strlen(name));
+ strscpy(mod_fail->name, name);
__set_bit(reason, &mod_fail->dup_fail_mask);
atomic_long_inc(&mod_fail->count);
list_add_rcu(&mod_fail->list, &dup_failed_modules);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0929/1376] module/dups: Inform duplicate requests about the result directly
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (927 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0928/1376] module: use strscpy() to copy module names in stats and dup tracking Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0930/1376] module/dups: Fix use-after-free in kmod_dup_req lifetime handling Greg Kroah-Hartman
` (69 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Petr Pavlu, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Pavlu <petr.pavlu@suse.com>
[ Upstream commit d258ed8a86bb46bbbbc84fb914478259a1e694a4 ]
When kmod_dup_request_announce() announces the completion of
a request_module() call to duplicate waiters, it queues a work item to
invoke kmod_dup_request_complete(), and only that function calls
complete_all().
This adds an arbitrary delay that is unnecessary and provides little
benefit. Call complete_all() directly from kmod_dup_request_announce()
instead.
Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
Stable-dep-of: 5eecb11b543f ("module/dups: Fix use-after-free in kmod_dup_req lifetime handling")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/module/dups.c | 43 +++++++++----------------------------------
1 file changed, 9 insertions(+), 34 deletions(-)
diff --git a/kernel/module/dups.c b/kernel/module/dups.c
index 6ecc42193de24..7b9b08031d7d2 100644
--- a/kernel/module/dups.c
+++ b/kernel/module/dups.c
@@ -48,7 +48,6 @@ struct kmod_dup_req {
struct list_head list;
char name[MODULE_NAME_LEN];
struct completion first_req_done;
- struct work_struct complete_work;
struct delayed_work delete_work;
int dup_ret;
};
@@ -93,29 +92,6 @@ static void kmod_dup_request_delete(struct work_struct *work)
kfree(kmod_req);
}
-static void kmod_dup_request_complete(struct work_struct *work)
-{
- struct kmod_dup_req *kmod_req;
-
- kmod_req = container_of(work, struct kmod_dup_req, complete_work);
-
- /*
- * This will ensure that the kernel will let all the waiters get
- * informed its time to check the return value. It's time to
- * go home.
- */
- complete_all(&kmod_req->first_req_done);
-
- /*
- * Now that we have allowed prior request_module() calls to go on
- * with life, let's schedule deleting this entry. We don't have
- * to do it right away, but we *eventually* want to do it so to not
- * let this linger forever as this is just a boot optimization for
- * possible abuses of vmalloc() incurred by finit_module() thrashing.
- */
- queue_delayed_work(system_dfl_wq, &kmod_req->delete_work, 60 * HZ);
-}
-
bool kmod_dup_request_exists_wait(char *module_name, bool wait, int *dup_ret)
{
struct kmod_dup_req *kmod_req, *new_kmod_req;
@@ -130,7 +106,6 @@ bool kmod_dup_request_exists_wait(char *module_name, bool wait, int *dup_ret)
return false;
strscpy(new_kmod_req->name, module_name);
- INIT_WORK(&new_kmod_req->complete_work, kmod_dup_request_complete);
INIT_DELAYED_WORK(&new_kmod_req->delete_work, kmod_dup_request_delete);
init_completion(&new_kmod_req->first_req_done);
@@ -230,17 +205,17 @@ void kmod_dup_request_announce(char *module_name, int ret)
kmod_req->dup_ret = ret;
+ /* Inform all duplicate waiters to check the return value. */
+ complete_all(&kmod_req->first_req_done);
+
/*
- * If we complete() here we may allow duplicate threads
- * to continue before the first one that submitted the
- * request. We're in no rush also, given that each and
- * every bounce back to userspace is slow we avoid that
- * with a slight delay here. So queueue up the completion
- * and let duplicates suffer, just wait a tad bit longer.
- * There is no rush. But we also don't want to hold the
- * caller up forever or introduce any boot delays.
+ * Now that we have allowed prior request_module() calls to go on
+ * with life, let's schedule deleting this entry. We don't have
+ * to do it right away, but we *eventually* want to do it so to not
+ * let this linger forever as this is just a boot optimization for
+ * possible abuses of vmalloc() incurred by finit_module() thrashing.
*/
- queue_work(system_dfl_wq, &kmod_req->complete_work);
+ queue_delayed_work(system_dfl_wq, &kmod_req->delete_work, 60 * HZ);
out:
mutex_unlock(&kmod_dup_mutex);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0930/1376] module/dups: Fix use-after-free in kmod_dup_req lifetime handling
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (928 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0929/1376] module/dups: Inform duplicate requests about the result directly Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0931/1376] RDMA/erdma: restrict the driver to little-endian systems Greg Kroah-Hartman
` (68 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Aaron Tomlin, Petr Pavlu,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Pavlu <petr.pavlu@suse.com>
[ Upstream commit 5eecb11b543f9f417bcf0dea239ff99c6af65dbd ]
The kmod dups code uses RCU to ensure that a kmod_dup_req instance is freed
only after it is no longer referenced. When releasing an instance, the
kmod_dup_request_delete() function removes the kmod_dup_req from the
dup_kmod_reqs list, waits via synchronize_rcu() and finally frees it.
However, this doesn't work correctly because parallel users referencing the
instance in kmod_dup_request_exists_wait() don't enter an RCU read-side
critical section. This can result in a use-after-free.
The kmod_dup_request_exists_wait() function may need to hold a valid
reference to a kmod_dup_req instance across a blocking wait until the
corresponding modprobe command completes. This makes it unsuitable for RCU.
Fix the issue by changing the lifecycle management of kmod_dup_req to use
reference counting.
Fixes: 8660484ed1cf ("module: add debugging auto-load duplicate module support")
Reviewed-by: Aaron Tomlin <atomlin@atomlin.com>
Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/module/dups.c | 56 +++++++++++++++++++++++++++++++-------------
1 file changed, 40 insertions(+), 16 deletions(-)
diff --git a/kernel/module/dups.c b/kernel/module/dups.c
index 7b9b08031d7d2..c21b675c239b7 100644
--- a/kernel/module/dups.c
+++ b/kernel/module/dups.c
@@ -30,6 +30,7 @@
#include <linux/ptrace.h>
#include <linux/async.h>
#include <linux/uaccess.h>
+#include <linux/refcount.h>
#include "internal.h"
@@ -38,13 +39,12 @@
static bool enable_dups_trace = IS_ENABLED(CONFIG_MODULE_DEBUG_AUTOLOAD_DUPS_TRACE);
module_param(enable_dups_trace, bool_enable_only, 0644);
-/*
- * Protects dup_kmod_reqs list, adds / removals with RCU.
- */
+/* A mutex-protected list of active kmod requests. */
static DEFINE_MUTEX(kmod_dup_mutex);
static LIST_HEAD(dup_kmod_reqs);
struct kmod_dup_req {
+ refcount_t refcount;
struct list_head list;
char name[MODULE_NAME_LEN];
struct completion first_req_done;
@@ -52,12 +52,24 @@ struct kmod_dup_req {
int dup_ret;
};
+static void get_kmod_req(struct kmod_dup_req *kmod_req)
+{
+ refcount_inc(&kmod_req->refcount);
+}
+
+static void put_kmod_req(struct kmod_dup_req *kmod_req)
+{
+ if (refcount_dec_and_test(&kmod_req->refcount))
+ kfree(kmod_req);
+}
+
static struct kmod_dup_req *kmod_dup_request_lookup(char *module_name)
{
struct kmod_dup_req *kmod_req;
- list_for_each_entry_rcu(kmod_req, &dup_kmod_reqs, list,
- lockdep_is_held(&kmod_dup_mutex)) {
+ lockdep_assert_held(&kmod_dup_mutex);
+
+ list_for_each_entry(kmod_req, &dup_kmod_reqs, list) {
if (strlen(kmod_req->name) == strlen(module_name) &&
!memcmp(kmod_req->name, module_name, strlen(module_name))) {
return kmod_req;
@@ -86,10 +98,10 @@ static void kmod_dup_request_delete(struct work_struct *work)
* just returning 0.
*/
mutex_lock(&kmod_dup_mutex);
- list_del_rcu(&kmod_req->list);
- synchronize_rcu();
+ list_del(&kmod_req->list);
mutex_unlock(&kmod_dup_mutex);
- kfree(kmod_req);
+
+ put_kmod_req(kmod_req);
}
bool kmod_dup_request_exists_wait(char *module_name, bool wait, int *dup_ret)
@@ -105,6 +117,7 @@ bool kmod_dup_request_exists_wait(char *module_name, bool wait, int *dup_ret)
if (!new_kmod_req)
return false;
+ refcount_set(&new_kmod_req->refcount, 1);
strscpy(new_kmod_req->name, module_name);
INIT_DELAYED_WORK(&new_kmod_req->delete_work, kmod_dup_request_delete);
init_completion(&new_kmod_req->first_req_done);
@@ -136,10 +149,12 @@ bool kmod_dup_request_exists_wait(char *module_name, bool wait, int *dup_ret)
* keep tab on duplicates later.
*/
pr_debug("New request_module() for %s\n", module_name);
- list_add_rcu(&new_kmod_req->list, &dup_kmod_reqs);
+ list_add(&new_kmod_req->list, &dup_kmod_reqs);
mutex_unlock(&kmod_dup_mutex);
return false;
}
+
+ get_kmod_req(kmod_req);
mutex_unlock(&kmod_dup_mutex);
/* We are dealing with a duplicate request now */
@@ -169,7 +184,7 @@ bool kmod_dup_request_exists_wait(char *module_name, bool wait, int *dup_ret)
* calls bail out right away.
*/
*dup_ret = 0;
- return true;
+ goto out;
}
/*
@@ -184,12 +199,14 @@ bool kmod_dup_request_exists_wait(char *module_name, bool wait, int *dup_ret)
TASK_KILLABLE);
if (ret) {
*dup_ret = ret;
- return true;
+ goto out;
}
/* Now the duplicate request has the same exact return value as the first request */
*dup_ret = kmod_req->dup_ret;
+out:
+ put_kmod_req(kmod_req);
return true;
}
@@ -199,15 +216,25 @@ void kmod_dup_request_announce(char *module_name, int ret)
mutex_lock(&kmod_dup_mutex);
+ /*
+ * Look for a kmod_dup_req previously added in
+ * kmod_dup_request_exists_wait(). Note that a request_module_nowait()
+ * without its own kmod_dup_req entry can announce a result of
+ * a concurrent request_module() call.
+ */
kmod_req = kmod_dup_request_lookup(module_name);
- if (!kmod_req)
- goto out;
+ if (!kmod_req || completion_done(&kmod_req->first_req_done)) {
+ mutex_unlock(&kmod_dup_mutex);
+ return;
+ }
kmod_req->dup_ret = ret;
/* Inform all duplicate waiters to check the return value. */
complete_all(&kmod_req->first_req_done);
+ mutex_unlock(&kmod_dup_mutex);
+
/*
* Now that we have allowed prior request_module() calls to go on
* with life, let's schedule deleting this entry. We don't have
@@ -216,7 +243,4 @@ void kmod_dup_request_announce(char *module_name, int ret)
* possible abuses of vmalloc() incurred by finit_module() thrashing.
*/
queue_delayed_work(system_dfl_wq, &kmod_req->delete_work, 60 * HZ);
-
-out:
- mutex_unlock(&kmod_dup_mutex);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0931/1376] RDMA/erdma: restrict the driver to little-endian systems
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (929 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0930/1376] module/dups: Fix use-after-free in kmod_dup_req lifetime handling Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0932/1376] wifi: mac80211: skip default WMM setup for AP_VLAN links Greg Kroah-Hartman
` (67 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cheng Xu, Leon Romanovsky,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <leonro@nvidia.com>
[ Upstream commit a12d9145145b21c50531afb6e3f711b1f34e1465 ]
The eRDMA device interface requires explicit byte ordering, but several
DMA-visible values that should be little-endian remain native-endian.
Command request payloads are copied verbatim, data-path SQE headers are
written without cpu_to_le64(), and kernel doorbell records are assigned
plain u64 values. The command completion path also reads a little-endian
SQE header without conversion.
These paths are byte-swapped on big-endian kernels and can break command
processing during probe. Since complete big-endian support requires
converting every device-visible structure, depend on !CPU_BIG_ENDIAN.
Fixes: ca7fd6cff3b8 ("RDMA/erdma: Add driver to kernel build environment")
Link: https://patch.msgid.link/20260806-missing-endianness-conversion-for-64-v1-1-896327c1aff1@nvidia.com
Acked-by: Cheng Xu <chengyou@linux.alibaba.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/erdma/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/erdma/Kconfig b/drivers/infiniband/hw/erdma/Kconfig
index 267fc1f3c42af..745e5551773f5 100644
--- a/drivers/infiniband/hw/erdma/Kconfig
+++ b/drivers/infiniband/hw/erdma/Kconfig
@@ -1,7 +1,7 @@
# SPDX-License-Identifier: GPL-2.0-only
config INFINIBAND_ERDMA
tristate "Alibaba Elastic RDMA Adapter (ERDMA) support"
- depends on PCI_MSI && 64BIT
+ depends on PCI_MSI && 64BIT && !CPU_BIG_ENDIAN
depends on INFINIBAND_ADDR_TRANS
depends on INFINIBAND_USER_ACCESS
help
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0932/1376] wifi: mac80211: skip default WMM setup for AP_VLAN links
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (930 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0931/1376] RDMA/erdma: restrict the driver to little-endian systems Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0933/1376] arm64: hibernate: mask DAIF before restoring hibernated kernel Greg Kroah-Hartman
` (66 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Felix Fietkau, Johannes Berg,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@nbd.name>
[ Upstream commit 4d8cfff012aaa971d50b01823b1015c1073c3ff6 ]
AP_VLAN interfaces are never passed to the driver, so setting default WMM
parameters on their links trips the check-sdata-in-driver warning in
drv_conf_tx(), as well as in the BSS_CHANGED_QOS link info notification.
Skip it, matching the existing AP_VLAN handling in this function.
Fixes: 2259d14499d1 ("wifi: mac80211: set default WMM parameters on all links")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Link: https://patch.msgid.link/20260804082608.2011433-1-nbd@nbd.name
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/link.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/mac80211/link.c b/net/mac80211/link.c
index 29813394bbff1..7e249e2f93bfa 100644
--- a/net/mac80211/link.c
+++ b/net/mac80211/link.c
@@ -340,7 +340,8 @@ static int ieee80211_vif_update_links(struct ieee80211_sub_if_data *sdata,
link = links[link_id];
ieee80211_link_init(sdata, link_id, &link->data, &link->conf);
ieee80211_link_setup(&link->data);
- ieee80211_set_wmm_default(&link->data, true, non_sta);
+ if (sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
+ ieee80211_set_wmm_default(&link->data, true, non_sta);
}
if (new_links == 0)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0933/1376] arm64: hibernate: mask DAIF before restoring hibernated kernel
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (931 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0932/1376] wifi: mac80211: skip default WMM setup for AP_VLAN links Greg Kroah-Hartman
@ 2026-09-12 6:55 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0934/1376] arm64: hibernate: Restore DAIF state on error Greg Kroah-Hartman
` (65 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ada Couprie Diaz, Vladimir Murzin,
Jinjie Ruan, Will Deacon, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ada Couprie Diaz <ada.coupriediaz@arm.com>
[ Upstream commit 684bde100117931f4c51c644a95f42f2dab041bc ]
The arm64 hibernate code manages the exception masking in an unsound
way, leading to potential crashes and/or warnings during resume.
When a hibernation image is saved in `swsusp_arch_suspend()`, all DAIF
exceptions are masked (by virtue of `local_daif_save()`), and the
suspended image is saved assuming that all DAIF exceptions will remain
masked when the image is restored.
When a hibernation image is resumed by `swsusp_arch_resume()`, only
interrupts are masked (by virtue of `local_irq_disable()` in
`resume_target_kernel()`). When pseudo-NMI is enabled the DAIF.IF bits
will be clear, and regardless of pseudo-NMI the DAIF.DA bits will be
clear.
This means that there are two problems:
(1) It is possible to take Debug, SError, or pseudo-NMI exceptions
during the resume process. This is unsafe, as during the resume
process both the old ane new kernels will tranisently be in an
inconsistent state, and swsusp_arch_suspend_exit() won't retain
an executable mapping of any exception vectors.
Any exception taken here will be fatal and silent.
(2) When re-entering the resumed kernel, some DAIF bits will be clear
unexpectedly. This permits Debug, SError, or pseudo-NMI exceptions
to be taken for a short period while the resumed kernel is not yet
in a consistent state.
This is detected by CONFIG_ARM64_DEBUG_PRIORITY_MASKING.
Avoid these issues by masking all DAIF exceptions during resume.
Fixes: 82869ac57b5d ("arm64: kernel: Add support for hibernate/suspend-to-disk")
Signed-off-by: Ada Couprie Diaz <ada.coupriediaz@arm.com>
Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com>
Reviewed-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kernel/hibernate.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/arch/arm64/kernel/hibernate.c b/arch/arm64/kernel/hibernate.c
index 945983735815c..7b9f82ccdf0e4 100644
--- a/arch/arm64/kernel/hibernate.c
+++ b/arch/arm64/kernel/hibernate.c
@@ -459,9 +459,21 @@ int __nocfi swsusp_arch_resume(void)
if (el2_reset_needed())
__hyp_set_vectors(el2_vectors);
+ /*
+ * It is necessary to mask all DAIF exceptions here as:
+ *
+ * - The copy of swsusp_arch_suspend_exit() in the hibernation
+ * text cannot handle taking any exceptions.
+ *
+ * - The suspended kernel masked all DAIF exceptions in
+ * swsusp_arch_resume(), and expects to be re-entered in the
+ * same state : with all DAIF exceptions masked.
+ */
+ local_daif_save();
hibernate_exit(virt_to_phys(tmp_pg_dir), resume_hdr.ttbr1_el1,
resume_hdr.reenter_kernel, restore_pblist,
resume_hdr.__hyp_stub_vectors, virt_to_phys(zero_page));
+ unreachable();
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0934/1376] arm64: hibernate: Restore DAIF state on error
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (932 preceding siblings ...)
2026-09-12 6:55 ` [PATCH 6.12 0933/1376] arm64: hibernate: mask DAIF before restoring hibernated kernel Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0935/1376] mfd: rave-sp: validate received frame payload lengths Greg Kroah-Hartman
` (64 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladimir Murzin, Jinjie Ruan,
Will Deacon, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Murzin <vladimir.murzin@arm.com>
[ Upstream commit 541549827889d0380fd73f8aacb5de6ef7a5a1ac ]
Sashiko AI has reported that if swsusp_mte_save_tags() for some reason
fails we return from swsusp_arch_suspend() with DAIF being masked -
that is not what we'd expect. Restore the saved DAIF state before
returning from the error path.
Fixes: ee11f332af96 ("arm64: mte: Save tags when hibernating")
Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com>
Reviewed-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kernel/hibernate.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/kernel/hibernate.c b/arch/arm64/kernel/hibernate.c
index 7b9f82ccdf0e4..44d31b019efd5 100644
--- a/arch/arm64/kernel/hibernate.c
+++ b/arch/arm64/kernel/hibernate.c
@@ -342,8 +342,10 @@ int swsusp_arch_suspend(void)
crash_prepare_suspend();
ret = swsusp_mte_save_tags();
- if (ret)
+ if (ret) {
+ local_daif_restore(flags);
return ret;
+ }
sleep_cpu = smp_processor_id();
ret = swsusp_save();
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0935/1376] mfd: rave-sp: validate received frame payload lengths
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (933 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0934/1376] arm64: hibernate: Restore DAIF state on error Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0936/1376] mfd: iqs62x: Reject zero-length firmware records Greg Kroah-Hartman
` (63 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Lee Jones, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ Upstream commit 0be718b5451bd83865d6e2a8d750ca7886c4772a ]
A received RAVE-SP frame contains protocol data followed by a
variant-specific one- or two-byte checksum. rave_sp_receive_frame() derives
a checksum pointer before proving that the frame contains the checksum,
then passes the checksum-inclusive length to handlers that index the
command, acknowledgment ID and event-data bytes or derive a reply payload
length.
Name those protocol field offsets, prove the checksum extent before
deriving the protocol-data length, pass only that data length to the
handlers, and require the complete event or reply prefix before consuming
it.
Fixes: 538ee27290fa ("mfd: Add driver for RAVE Supervisory Processor")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://lore.kernel.org/all/20260706092337.78754-1-pengpeng@iscas.ac.cn/
Link: https://patch.msgid.link/20260720115523.99956-1-pengpeng@iscas.ac.cn
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/rave-sp.c | 64 +++++++++++++++++++++++++++++--------------
1 file changed, 44 insertions(+), 20 deletions(-)
diff --git a/drivers/mfd/rave-sp.c b/drivers/mfd/rave-sp.c
index c1b78d127a261..05d26d92df03e 100644
--- a/drivers/mfd/rave-sp.c
+++ b/drivers/mfd/rave-sp.c
@@ -63,6 +63,12 @@
#define RAVE_SP_TX_BUFFER_SIZE \
(RAVE_SP_STX_ETX_SIZE + 2 * RAVE_SP_RX_BUFFER_SIZE)
+enum rave_sp_frame_offset {
+ RAVE_SP_FRAME_CODE_OFFSET,
+ RAVE_SP_FRAME_ACK_ID_OFFSET,
+ RAVE_SP_FRAME_DATA_OFFSET,
+};
+
/**
* enum rave_sp_deframer_state - Possible state for de-framer
*
@@ -352,7 +358,7 @@ int rave_sp_exec(struct rave_sp *sp,
int command, ret = 0;
u8 ackid;
- command = sp->variant->cmd.translate(data[0]);
+ command = sp->variant->cmd.translate(data[RAVE_SP_FRAME_CODE_OFFSET]);
if (command < 0)
return command;
@@ -366,8 +372,8 @@ int rave_sp_exec(struct rave_sp *sp,
sp->reply = &reply;
mutex_unlock(&sp->reply_lock);
- data[0] = command;
- data[1] = ackid;
+ data[RAVE_SP_FRAME_CODE_OFFSET] = command;
+ data[RAVE_SP_FRAME_ACK_ID_OFFSET] = ackid;
rave_sp_write(sp, data, data_size);
@@ -388,16 +394,23 @@ EXPORT_SYMBOL_GPL(rave_sp_exec);
static void rave_sp_receive_event(struct rave_sp *sp,
const unsigned char *data, size_t length)
{
- u8 cmd[] = {
- [0] = rave_sp_reply_code(data[0]),
- [1] = data[1],
- };
+ unsigned long action;
+ u8 cmd[RAVE_SP_FRAME_DATA_OFFSET];
+
+ if (length < RAVE_SP_FRAME_DATA_OFFSET + 1) {
+ dev_warn(&sp->serdev->dev, "Dropping short event frame\n");
+ return;
+ }
+
+ cmd[RAVE_SP_FRAME_CODE_OFFSET] =
+ rave_sp_reply_code(data[RAVE_SP_FRAME_CODE_OFFSET]);
+ cmd[RAVE_SP_FRAME_ACK_ID_OFFSET] = data[RAVE_SP_FRAME_ACK_ID_OFFSET];
rave_sp_write(sp, cmd, sizeof(cmd));
- blocking_notifier_call_chain(&sp->event_notifier_list,
- rave_sp_action_pack(data[0], data[2]),
- NULL);
+ action = rave_sp_action_pack(data[RAVE_SP_FRAME_CODE_OFFSET],
+ data[RAVE_SP_FRAME_DATA_OFFSET]);
+ blocking_notifier_call_chain(&sp->event_notifier_list, action, NULL);
}
static void rave_sp_receive_reply(struct rave_sp *sp,
@@ -405,27 +418,35 @@ static void rave_sp_receive_reply(struct rave_sp *sp,
{
struct device *dev = &sp->serdev->dev;
struct rave_sp_reply *reply;
- const size_t payload_length = length - 2;
+ size_t payload_length;
+
+ if (length < RAVE_SP_FRAME_DATA_OFFSET) {
+ dev_warn(dev, "Dropping short reply frame\n");
+ return;
+ }
+ payload_length = length - RAVE_SP_FRAME_DATA_OFFSET;
mutex_lock(&sp->reply_lock);
reply = sp->reply;
if (reply) {
- if (reply->code == data[0] && reply->ackid == data[1] &&
+ if (reply->code == data[RAVE_SP_FRAME_CODE_OFFSET] &&
+ reply->ackid == data[RAVE_SP_FRAME_ACK_ID_OFFSET] &&
payload_length >= reply->length) {
/*
* We are relying on memcpy(dst, src, 0) to be a no-op
* when handling commands that have a no-payload reply
*/
- memcpy(reply->data, &data[2], reply->length);
+ memcpy(reply->data, &data[RAVE_SP_FRAME_DATA_OFFSET],
+ reply->length);
complete(&reply->received);
sp->reply = NULL;
} else {
dev_err(dev, "Ignoring incorrect reply\n");
dev_dbg(dev, "Code: expected = 0x%08x received = 0x%08x\n",
- reply->code, data[0]);
+ reply->code, data[RAVE_SP_FRAME_CODE_OFFSET]);
dev_dbg(dev, "ACK ID: expected = 0x%08x received = 0x%08x\n",
- reply->ackid, data[1]);
+ reply->ackid, data[RAVE_SP_FRAME_ACK_ID_OFFSET]);
dev_dbg(dev, "Length: expected = %zu received = %zu\n",
reply->length, payload_length);
}
@@ -439,10 +460,10 @@ static void rave_sp_receive_frame(struct rave_sp *sp,
size_t length)
{
const size_t checksum_length = sp->variant->checksum->length;
- const size_t payload_length = length - checksum_length;
- const u8 *crc_reported = &data[payload_length];
struct device *dev = &sp->serdev->dev;
u8 crc_calculated[RAVE_SP_CHECKSUM_SIZE];
+ const u8 *crc_reported;
+ size_t payload_length;
if (unlikely(checksum_length > sizeof(crc_calculated))) {
dev_warn(dev, "Checksum too long, dropping\n");
@@ -457,6 +478,9 @@ static void rave_sp_receive_frame(struct rave_sp *sp,
return;
}
+ payload_length = length - checksum_length;
+ crc_reported = &data[payload_length];
+
sp->variant->checksum->subroutine(data, payload_length,
crc_calculated);
@@ -465,10 +489,10 @@ static void rave_sp_receive_frame(struct rave_sp *sp,
return;
}
- if (rave_sp_id_is_event(data[0]))
- rave_sp_receive_event(sp, data, length);
+ if (rave_sp_id_is_event(data[RAVE_SP_FRAME_CODE_OFFSET]))
+ rave_sp_receive_event(sp, data, payload_length);
else
- rave_sp_receive_reply(sp, data, length);
+ rave_sp_receive_reply(sp, data, payload_length);
}
static size_t rave_sp_receive_buf(struct serdev_device *serdev,
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0936/1376] mfd: iqs62x: Reject zero-length firmware records
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (934 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0935/1376] mfd: rave-sp: validate received frame payload lengths Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0937/1376] drm/amdgpu/gfx6: Fixup emit_cntxcntl() Greg Kroah-Hartman
` (62 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Lee Jones, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ Upstream commit 08ea045e0b82cbcadb7a2efc43a23561489a00f2 ]
struct iqs62x_fw_rec includes the first data byte in its fixed-size header,
so the parser advances by len - 1 bytes after that header. A zero len makes
the size_t cursor update move back by one byte, so the next record overlaps
the current record instead of following a valid declared extent.
Reject zero-length records and express the remaining-size check without an
offset addition.
Fixes: 4d9cf7df8d35 ("mfd: Add support for Azoteq IQS620A/621/622/624/625")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://lore.kernel.org/all/20260706091034.75865-1-pengpeng@iscas.ac.cn/
Link: https://patch.msgid.link/20260720115423.94994-1-pengpeng@iscas.ac.cn
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/iqs62x.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mfd/iqs62x.c b/drivers/mfd/iqs62x.c
index ee017617d1d1b..412ae7777f729 100644
--- a/drivers/mfd/iqs62x.c
+++ b/drivers/mfd/iqs62x.c
@@ -237,7 +237,7 @@ static int iqs62x_firmware_parse(struct iqs62x_core *iqs62x,
fw_rec = (struct iqs62x_fw_rec *)(fw->data + pos);
pos += sizeof(*fw_rec);
- if (pos + fw_rec->len - 1 > fw->size) {
+ if (!fw_rec->len || fw_rec->len - 1 > fw->size - pos) {
ret = -EINVAL;
break;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0937/1376] drm/amdgpu/gfx6: Fixup emit_cntxcntl()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (935 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0936/1376] mfd: iqs62x: Reject zero-length firmware records Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0938/1376] ext4: fix spurious message about orphan cleanup on RO fs Greg Kroah-Hartman
` (61 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Timur Kristóf, Alex Deucher,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <timur.kristof@gmail.com>
[ Upstream commit 1edb323406aaf05739804d2faa2561f2d43bcd09 ]
Set bits on dword 2 like GFX7-8 except load_global_uconfig
which doesn't exist on GFX6.
Emit VS_PARTIAL_FLUSH before VGT_FLUSH like GFX7-8.
For reference see old PAL which explains the bit fields in
this register and that load_global_uconfig doesn't exist on GFX6
and also see gfx_v7_ring_emit_cntxcntl() for the GFX7 code
which this commit follows.
Fixes: 2cd46ad22383 ("drm/amdgpu: add graphic pipeline implementation for si v8")
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 28 ++++++++++++++++++++-------
1 file changed, 21 insertions(+), 7 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c
index 90c426ee877b6..0c08247fb5474 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c
@@ -1859,11 +1859,13 @@ static int gfx_v6_0_ring_test_ring(struct amdgpu_ring *ring)
return r;
}
-static void gfx_v6_0_ring_emit_vgt_flush(struct amdgpu_ring *ring)
+static void gfx_v6_0_ring_emit_event_write(struct amdgpu_ring *ring,
+ uint32_t event_type,
+ uint32_t event_index)
{
amdgpu_ring_write(ring, PACKET3(PACKET3_EVENT_WRITE, 0));
- amdgpu_ring_write(ring, EVENT_TYPE(VGT_FLUSH) |
- EVENT_INDEX(0));
+ amdgpu_ring_write(ring, EVENT_TYPE(event_type) |
+ EVENT_INDEX(event_index));
}
static void gfx_v6_0_ring_emit_fence(struct amdgpu_ring *ring, u64 addr,
@@ -3000,10 +3002,22 @@ static uint64_t gfx_v6_0_get_gpu_clock_counter(struct amdgpu_device *adev)
static void gfx_v6_ring_emit_cntxcntl(struct amdgpu_ring *ring, uint32_t flags)
{
- if (flags & AMDGPU_HAVE_CTX_SWITCH)
- gfx_v6_0_ring_emit_vgt_flush(ring);
+ u32 dw2 = 0x80000000; /* set load_enable otherwise this package is just NOPs */
+
+ if (flags & AMDGPU_HAVE_CTX_SWITCH) {
+ gfx_v6_0_ring_emit_event_write(ring, VS_PARTIAL_FLUSH, 4);
+ gfx_v6_0_ring_emit_event_write(ring, VGT_FLUSH, 0);
+
+ /* set load_global_config (load_global_uconfig doesn't exist on GFX6) */
+ dw2 |= 0x1;
+ /* set load_cs_sh_regs */
+ dw2 |= 0x01000000;
+ /* set load_per_context_state & load_gfx_sh_regs */
+ dw2 |= 0x10002;
+ }
+
amdgpu_ring_write(ring, PACKET3(PACKET3_CONTEXT_CONTROL, 1));
- amdgpu_ring_write(ring, 0x80000000);
+ amdgpu_ring_write(ring, dw2);
amdgpu_ring_write(ring, 0);
}
@@ -3539,7 +3553,7 @@ static const struct amdgpu_ring_funcs gfx_v6_0_ring_funcs_gfx = {
14 + 14 + 14 + /* gfx_v6_0_ring_emit_fence x3 for user fence, vm fence */
7 + 4 + /* gfx_v6_0_ring_emit_pipeline_sync */
SI_FLUSH_GPU_TLB_NUM_WREG * 5 + 7 + 6 + /* gfx_v6_0_ring_emit_vm_flush */
- 3 + 2 + /* gfx_v6_ring_emit_cntxcntl including vgt flush */
+ 3 + 2 + 2 + /* gfx_v6_ring_emit_cntxcntl including VGT flush */
5, /* SURFACE_SYNC */
.emit_ib_size = 6, /* gfx_v6_0_ring_emit_ib */
.emit_ib = gfx_v6_0_ring_emit_ib,
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0938/1376] ext4: fix spurious message about orphan cleanup on RO fs
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (936 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0937/1376] drm/amdgpu/gfx6: Fixup emit_cntxcntl() Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0939/1376] arm64: dts: ti: k3-am64: Fix MDIO clock reference for ICSSG0 node Greg Kroah-Hartman
` (60 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tigran Aivazian, Jan Kara, Baokun Li,
Theodore Tso, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.cz>
[ Upstream commit 5aa98f874c013bcce9bb84ffded2f0ef886e4e33 ]
When orphan_file feature is enabled, ext4_orphan_cleanup() was always
walking through the orphan file looking for orphan inodes. This is
mostly harmless but for read-only filesystem it results in spurious
"orphan cleanup on readonly fs" message and in other cornercases it
could result in similar somewhat misleading messages. Skip orphan
cleanup if the orphan file is empty to avoid confusing messages.
Fixes: 02f310fcf47f ("ext4: Speedup ext4 orphan inode handling")
Reported-by: Tigran Aivazian <aivazian.tigran@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Reviewed-by: Baokun Li <libaokun@linux.alibaba.com>
Link: https://patch.msgid.link/20260803160037.64285-2-jack@suse.cz
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/orphan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/ext4/orphan.c b/fs/ext4/orphan.c
index 7a5893dc18114..13cbf94c7cc2e 100644
--- a/fs/ext4/orphan.c
+++ b/fs/ext4/orphan.c
@@ -388,7 +388,7 @@ void ext4_orphan_cleanup(struct super_block *sb, struct ext4_super_block *es)
struct ext4_orphan_info *oi = &EXT4_SB(sb)->s_orphan_info;
int inodes_per_ob = ext4_inodes_per_orphan_block(sb);
- if (!es->s_last_orphan && !oi->of_blocks) {
+ if (!es->s_last_orphan && ext4_orphan_file_empty(sb)) {
ext4_debug("no orphan inodes to clean up\n");
return;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0939/1376] arm64: dts: ti: k3-am64: Fix MDIO clock reference for ICSSG0 node
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (937 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0938/1376] ext4: fix spurious message about orphan cleanup on RO fs Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0940/1376] phy: sunplus: fix error handling in sp_uphy_init() Greg Kroah-Hartman
` (59 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Meghana Malladi, Vignesh Raghavendra,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Meghana Malladi <m-malladi@ti.com>
[ Upstream commit 197df050a10fe216971b45a79f07195c86a02236 ]
MDIO clock index changed from 62:3 to 81:0 to match proper clock
definition in the SoC device tree. Clock Id 81:0 belongs to ICSSG0
core clock, where as 62 belongs to EQEP2 device.
See: https://software-dl.ti.com/tisci/esd/latest/5_soc_doc/am64x/clocks.html
Fixes: c9087e3898a1d0 ("arm64: dts: ti: k3-am64-main: Add ICSSG nodes")
Signed-off-by: Meghana Malladi <m-malladi@ti.com>
Link: https://patch.msgid.link/20260706092229.82674-1-m-malladi@ti.com
Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am64-main.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am64-main.dtsi b/arch/arm64/boot/dts/ti/k3-am64-main.dtsi
index 7eae18399caa6..7c6ba86cf8eed 100644
--- a/arch/arm64/boot/dts/ti/k3-am64-main.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am64-main.dtsi
@@ -1349,7 +1349,7 @@ tx_pru0_1: txpru@c000 {
icssg0_mdio: mdio@32400 {
compatible = "ti,davinci_mdio";
reg = <0x32400 0x100>;
- clocks = <&k3_clks 62 3>;
+ clocks = <&k3_clks 81 0>;
clock-names = "fck";
#address-cells = <1>;
#size-cells = <0>;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0940/1376] phy: sunplus: fix error handling in sp_uphy_init()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (938 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0939/1376] arm64: dts: ti: k3-am64: Fix MDIO clock reference for ICSSG0 node Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0941/1376] phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table Greg Kroah-Hartman
` (58 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Felix Gu, Philipp Zabel, Vinod Koul,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <ustc.gu@gmail.com>
[ Upstream commit 8b2683bc4cc18c581b7cd24f227cbe61abca7f4d ]
Fix the error paths of sp_uphy_init() to undo exactly what each stage
did: return directly if clk_prepare_enable() fails, release only the clock
if reset_control_deassert() fails, and jump to err_reset if
update_disc_vol() fails so the clock and reset are not leaked.
Fixes: 99d9ccd97385 ("phy: usb: Add USB2.0 phy driver for Sunplus SP7021")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Link: https://patch.msgid.link/20260803-sunplus-usb3-v1-1-5a562524c869@gmail.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/sunplus/phy-sunplus-usb2.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/phy/sunplus/phy-sunplus-usb2.c b/drivers/phy/sunplus/phy-sunplus-usb2.c
index 637a5fbae6d9a..0ad4c7160d17c 100644
--- a/drivers/phy/sunplus/phy-sunplus-usb2.c
+++ b/drivers/phy/sunplus/phy-sunplus-usb2.c
@@ -116,11 +116,11 @@ static int sp_uphy_init(struct phy *phy)
ret = clk_prepare_enable(usbphy->phy_clk);
if (ret)
- goto err_clk;
+ return ret;
ret = reset_control_deassert(usbphy->rstc);
if (ret)
- goto err_reset;
+ goto err_clk;
/* Default value modification */
writel(HIGH_MASK_BITS | 0x4002, usbphy->moon4_regs + UPHY_CONTROL0);
@@ -129,7 +129,7 @@ static int sp_uphy_init(struct phy *phy)
/* disconnect voltage */
ret = update_disc_vol(usbphy);
if (ret < 0)
- return ret;
+ goto err_reset;
/* board uphy 0 internal register modification for tid certification */
val = readl(usbphy->phy_regs + CONFIG9);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0941/1376] phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (939 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0940/1376] phy: sunplus: fix error handling in sp_uphy_init() Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0942/1376] perf trace-event: Fix buffer overflow in read_string() Greg Kroah-Hartman
` (57 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Riesch, Gerald Loacker,
Vinod Koul, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gerald Loacker <gerald.loacker@wolfvision.net>
[ Upstream commit 4fae43e33a7c10951fbdc6baf409d51bd66aaefb ]
The rk1808 hsfreq table capped at 2499 Mbps, preventing a data rate of
exactly 2500 Mbps. Extend the final entry to 2500 Mbps to support this
rate.
This is essential for RK3588 reusing this array and fully supporting
rates up to 2500 Mbps.
Fixes: bd1f775d6027 ("phy/rockchip: add Innosilicon-based CSI dphy")
Reviewed-by: Michael Riesch <michael.riesch@collabora.com>
Signed-off-by: Gerald Loacker <gerald.loacker@wolfvision.net>
Link: https://patch.msgid.link/20260725-feature-mipi-csi-dphy-4k60-v4-1-5b2c4626d31e@wolfvision.net
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/rockchip/phy-rockchip-inno-csidphy.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c b/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c
index 279e19e7546b6..2c1f8e3645df1 100644
--- a/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c
+++ b/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c
@@ -157,7 +157,7 @@ static const struct hsfreq_range rk1808_mipidphy_hsfreq_ranges[] = {
{ 299, 0x06}, { 399, 0x08}, { 499, 0x0b}, { 599, 0x0e},
{ 699, 0x10}, { 799, 0x12}, { 999, 0x16}, {1199, 0x1e},
{1399, 0x23}, {1599, 0x2d}, {1799, 0x32}, {1999, 0x37},
- {2199, 0x3c}, {2399, 0x41}, {2499, 0x46}
+ {2199, 0x3c}, {2399, 0x41}, {2500, 0x46}
};
static const struct hsfreq_range rk3326_mipidphy_hsfreq_ranges[] = {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0942/1376] perf trace-event: Fix buffer overflow in read_string()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (940 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0941/1376] phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0943/1376] drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets Greg Kroah-Hartman
` (56 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tanushree Shah, Namhyung Kim,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tanushree Shah <tshah@linux.ibm.com>
[ Upstream commit 1121a7af1833f8b5723f1e32685b461614353d5d ]
read_string() writes into buf[BUFSIZ] one byte at a time without
checking 'size' against the buffer bound before each write. A
string longer than BUFSIZ in the input overflows the stack buffer.
Add a bounds check before each write to prevent overflow. On
overflow the function returns NULL, matching its other error paths.
Fixes: 9215545e99d8 ("perf: Convert perf tracing data into a tracing_data event")
Signed-off-by: Tanushree Shah <tshah@linux.ibm.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/trace-event-read.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/tools/perf/util/trace-event-read.c b/tools/perf/util/trace-event-read.c
index 1162c49b80825..72379cb8f5fd3 100644
--- a/tools/perf/util/trace-event-read.c
+++ b/tools/perf/util/trace-event-read.c
@@ -127,6 +127,11 @@ static char *read_string(void)
}
}
+ if (size >= (int)sizeof(buf) - 1) {
+ pr_debug("string too long (max %zu bytes)", sizeof(buf) - 1);
+ goto out;
+ }
+
buf[size++] = c;
if (!c)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0943/1376] drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (941 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0942/1376] perf trace-event: Fix buffer overflow in read_string() Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0944/1376] drm/amdgpu/gfx6: Use PFP on the compute queues too Greg Kroah-Hartman
` (55 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Timur Kristóf, Alex Deucher,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <timur.kristof@gmail.com>
[ Upstream commit 7aac4242a11991d530eee3e141d6e445d5f11c22 ]
Implement the emit_switch_buffer() function instead of emitting
them duing emit_ib, emit_pipeline_sync and emit_vm_flush.
Note that it isn't necessary to emit these in both
emit_pipeline_sync() and emit_vm_flush() because
amdgpu_vm_flush() already calls these when calling
either of those functions.
Fixes: 2cd46ad22383 ("drm/amdgpu: add graphic pipeline implementation for si v8")
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 38 ++++++++++-----------------
1 file changed, 14 insertions(+), 24 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c
index 0c08247fb5474..2e517f4d75879 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c
@@ -1904,12 +1904,6 @@ static void gfx_v6_0_ring_emit_ib(struct amdgpu_ring *ring,
unsigned vmid = AMDGPU_JOB_GET_VMID(job);
u32 header, control = 0;
- /* insert SWITCH_BUFFER packet before first IB in the ring frame */
- if (flags & AMDGPU_HAVE_CTX_SWITCH) {
- amdgpu_ring_write(ring, PACKET3(PACKET3_SWITCH_BUFFER, 0));
- amdgpu_ring_write(ring, 0);
- }
-
if (ib->flags & AMDGPU_IB_FLAG_CE)
header = PACKET3(PACKET3_INDIRECT_BUFFER_CONST, 2);
else
@@ -2344,14 +2338,6 @@ static void gfx_v6_0_ring_emit_pipeline_sync(struct amdgpu_ring *ring)
amdgpu_ring_write(ring, seq);
amdgpu_ring_write(ring, 0xffffffff);
amdgpu_ring_write(ring, 4); /* poll interval */
-
- if (usepfp) {
- /* synce CE with ME to prevent CE fetch CEIB before context switch done */
- amdgpu_ring_write(ring, PACKET3(PACKET3_SWITCH_BUFFER, 0));
- amdgpu_ring_write(ring, 0);
- amdgpu_ring_write(ring, PACKET3(PACKET3_SWITCH_BUFFER, 0));
- amdgpu_ring_write(ring, 0);
- }
}
static void gfx_v6_0_ring_emit_vm_flush(struct amdgpu_ring *ring,
@@ -2375,12 +2361,6 @@ static void gfx_v6_0_ring_emit_vm_flush(struct amdgpu_ring *ring,
/* sync PFP to ME, otherwise we might get invalid PFP reads */
amdgpu_ring_write(ring, PACKET3(PACKET3_PFP_SYNC_ME, 0));
amdgpu_ring_write(ring, 0x0);
-
- /* synce CE with ME to prevent CE fetch CEIB before context switch done */
- amdgpu_ring_write(ring, PACKET3(PACKET3_SWITCH_BUFFER, 0));
- amdgpu_ring_write(ring, 0);
- amdgpu_ring_write(ring, PACKET3(PACKET3_SWITCH_BUFFER, 0));
- amdgpu_ring_write(ring, 0);
}
}
@@ -3000,6 +2980,12 @@ static uint64_t gfx_v6_0_get_gpu_clock_counter(struct amdgpu_device *adev)
return clock;
}
+static void gfx_v6_0_ring_emit_sb(struct amdgpu_ring *ring)
+{
+ amdgpu_ring_write(ring, PACKET3(PACKET3_SWITCH_BUFFER, 0));
+ amdgpu_ring_write(ring, 0);
+}
+
static void gfx_v6_ring_emit_cntxcntl(struct amdgpu_ring *ring, uint32_t flags)
{
u32 dw2 = 0x80000000; /* set load_enable otherwise this package is just NOPs */
@@ -3551,11 +3537,12 @@ static const struct amdgpu_ring_funcs gfx_v6_0_ring_funcs_gfx = {
.emit_frame_size =
5 + 5 + /* hdp flush / invalidate */
14 + 14 + 14 + /* gfx_v6_0_ring_emit_fence x3 for user fence, vm fence */
- 7 + 4 + /* gfx_v6_0_ring_emit_pipeline_sync */
- SI_FLUSH_GPU_TLB_NUM_WREG * 5 + 7 + 6 + /* gfx_v6_0_ring_emit_vm_flush */
+ 7 + /* gfx_v6_0_ring_emit_pipeline_sync */
+ SI_FLUSH_GPU_TLB_NUM_WREG * 5 + 7 + 2 + /* gfx_v6_0_ring_emit_vm_flush */
+ 3 * 2 + /* gfx_v6_0_ring_emit_sb x3 (from amdgpu_vm_flush, amdgpu_ib_schedule) */
3 + 2 + 2 + /* gfx_v6_ring_emit_cntxcntl including VGT flush */
5, /* SURFACE_SYNC */
- .emit_ib_size = 6, /* gfx_v6_0_ring_emit_ib */
+ .emit_ib_size = 4, /* gfx_v6_0_ring_emit_ib */
.emit_ib = gfx_v6_0_ring_emit_ib,
.emit_fence = gfx_v6_0_ring_emit_fence,
.emit_pipeline_sync = gfx_v6_0_ring_emit_pipeline_sync,
@@ -3563,6 +3550,7 @@ static const struct amdgpu_ring_funcs gfx_v6_0_ring_funcs_gfx = {
.test_ring = gfx_v6_0_ring_test_ring,
.test_ib = gfx_v6_0_ring_test_ib,
.insert_nop = amdgpu_ring_insert_nop,
+ .emit_switch_buffer = gfx_v6_0_ring_emit_sb,
.emit_cntxcntl = gfx_v6_ring_emit_cntxcntl,
.emit_wreg = gfx_v6_0_ring_emit_wreg,
.emit_mem_sync = gfx_v6_0_emit_mem_sync,
@@ -3580,8 +3568,9 @@ static const struct amdgpu_ring_funcs gfx_v6_0_ring_funcs_compute = {
7 + /* gfx_v6_0_ring_emit_pipeline_sync */
SI_FLUSH_GPU_TLB_NUM_WREG * 5 + 7 + /* gfx_v6_0_ring_emit_vm_flush */
14 + 14 + 14 + /* gfx_v6_0_ring_emit_fence x3 for user fence, vm fence */
+ 3 * 2 + /* gfx_v6_0_ring_emit_sb x3 (from amdgpu_vm_flush, amdgpu_ib_schedule) */
5, /* SURFACE_SYNC */
- .emit_ib_size = 6, /* gfx_v6_0_ring_emit_ib */
+ .emit_ib_size = 4, /* gfx_v6_0_ring_emit_ib */
.emit_ib = gfx_v6_0_ring_emit_ib,
.emit_fence = gfx_v6_0_ring_emit_fence,
.emit_pipeline_sync = gfx_v6_0_ring_emit_pipeline_sync,
@@ -3589,6 +3578,7 @@ static const struct amdgpu_ring_funcs gfx_v6_0_ring_funcs_compute = {
.test_ring = gfx_v6_0_ring_test_ring,
.test_ib = gfx_v6_0_ring_test_ib,
.insert_nop = amdgpu_ring_insert_nop,
+ .emit_switch_buffer = gfx_v6_0_ring_emit_sb,
.emit_wreg = gfx_v6_0_ring_emit_wreg,
.emit_mem_sync = gfx_v6_0_emit_mem_sync,
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0944/1376] drm/amdgpu/gfx6: Use PFP on the compute queues too
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (942 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0943/1376] drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0945/1376] scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path Greg Kroah-Hartman
` (54 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Timur Kristóf, Alex Deucher,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <timur.kristof@gmail.com>
[ Upstream commit 60f20946cd318518ddc2c0da12103c666b2b9564 ]
On GFX6, the compute rings use the same CP path as
the graphics ring. The only difference is that they
don't support draw commands. (As opposed to GFX7 and
newer which have a separate command parser that is
called MEC for compute queues.)
This means that we have to take into consideration
that the PFP also exists on compute queues on GFX6:
Use PFP for register writes on both graphics and
compute queues.
In the pipeline sync, use the PFP to wait for the
previous fence (and not the ME) to prevent the PFP
from starting to execute the next submission while
the ME is still in the previous submission.
After a VM flush, emit PFP_SYNC_ME on compute
queues as well.
Fixes: 2cd46ad22383 ("drm/amdgpu: add graphic pipeline implementation for si v8")
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c
index 2e517f4d75879..9b294ef10fd7d 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c
@@ -2325,7 +2325,7 @@ static int gfx_v6_0_cp_resume(struct amdgpu_device *adev)
static void gfx_v6_0_ring_emit_pipeline_sync(struct amdgpu_ring *ring)
{
- int usepfp = (ring->funcs->type == AMDGPU_RING_TYPE_GFX);
+ int usepfp = 1;
uint32_t seq = ring->fence_drv.sync_seq;
uint64_t addr = ring->fence_drv.gpu_addr;
@@ -2343,7 +2343,7 @@ static void gfx_v6_0_ring_emit_pipeline_sync(struct amdgpu_ring *ring)
static void gfx_v6_0_ring_emit_vm_flush(struct amdgpu_ring *ring,
unsigned vmid, uint64_t pd_addr)
{
- int usepfp = (ring->funcs->type == AMDGPU_RING_TYPE_GFX);
+ int usepfp = 1;
amdgpu_gmc_emit_flush_gpu_tlb(ring, vmid, pd_addr);
@@ -2367,7 +2367,7 @@ static void gfx_v6_0_ring_emit_vm_flush(struct amdgpu_ring *ring,
static void gfx_v6_0_ring_emit_wreg(struct amdgpu_ring *ring,
uint32_t reg, uint32_t val)
{
- int usepfp = (ring->funcs->type == AMDGPU_RING_TYPE_GFX);
+ int usepfp = 1;
amdgpu_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3));
amdgpu_ring_write(ring, (WRITE_DATA_ENGINE_SEL(usepfp) |
@@ -3566,7 +3566,7 @@ static const struct amdgpu_ring_funcs gfx_v6_0_ring_funcs_compute = {
.emit_frame_size =
5 + 5 + /* hdp flush / invalidate */
7 + /* gfx_v6_0_ring_emit_pipeline_sync */
- SI_FLUSH_GPU_TLB_NUM_WREG * 5 + 7 + /* gfx_v6_0_ring_emit_vm_flush */
+ SI_FLUSH_GPU_TLB_NUM_WREG * 5 + 7 + 2 + /* gfx_v6_0_ring_emit_vm_flush */
14 + 14 + 14 + /* gfx_v6_0_ring_emit_fence x3 for user fence, vm fence */
3 * 2 + /* gfx_v6_0_ring_emit_sb x3 (from amdgpu_vm_flush, amdgpu_ib_schedule) */
5, /* SURFACE_SYNC */
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0945/1376] scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (943 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0944/1376] drm/amdgpu/gfx6: Use PFP on the compute queues too Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0946/1376] firmware_loader: do not queue completed sysfs fallback requests Greg Kroah-Hartman
` (53 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manish Rangankar, Nilesh Javali,
Hannes Reinecke, Martin K. Petersen (Oracle), Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manish Rangankar <mrangankar@marvell.com>
[ Upstream commit 5cbc49d5c4cd20c18041e86958103045216d2190 ]
qla2x00_sysfs_read_vpd() called ha->isp_ops->read_optrom() a second time
after releasing optrom_mutex. The repeated read is redundant and, unlike
the first, runs without optrom_mutex held, exposing flash access to
concurrent optrom operations. Drop the duplicate call.
Fixes: 5fa8774c7f38 ("scsi: qla2xxx: Add 28xx flash primary/secondary status/image mechanism")
Signed-off-by: Manish Rangankar <mrangankar@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Link: https://patch.msgid.link/20260723050413.3897522-7-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/qla2xxx/qla_attr.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
index a8b62bf31be20..a5c031f92b0a8 100644
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -580,7 +580,6 @@ qla2x00_sysfs_read_vpd(struct file *filp, struct kobject *kobj,
ha->isp_ops->read_optrom(vha, ha->vpd, faddr, ha->vpd_size);
mutex_unlock(&ha->optrom_mutex);
- ha->isp_ops->read_optrom(vha, ha->vpd, faddr, ha->vpd_size);
skip:
return memory_read_from_buffer(buf, count, &off, ha->vpd, ha->vpd_size);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0946/1376] firmware_loader: do not queue completed sysfs fallback requests
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (944 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0945/1376] scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0947/1376] pinctrl: rockchip: Reset the pin count when recalculating SoC data Greg Kroah-Hartman
` (52 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mukesh Ojha, Danilo Krummrich,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
[ Upstream commit b48373c901951fad1a26bd7c33ad91172b3945b5 ]
fw_load_sysfs_fallback() calls device_add() before adding the fw_priv to
pending_fw_head. device_add() publishes the fallback loading interface, so
a userspace helper which discovers the device by scanning sysfs can write 0
to the loading attribute and complete the request before it is queued as
pending.
In that interleaving firmware_loading_store() calls fw_state_done() while
pending_list still points to itself, so it cannot remove an entry from
pending_fw_head. The subsequent unconditional list_add() then queues an
already-completed fw_priv. Once the request is released, pending_fw_head
can retain a pointer to freed memory and the next fallback request can
fault while validating the list.
Only in-flight fallback requests need suspend or reboot abort handling. If
the request is already DONE after device_add(), return success from the
fallback path without sending another uevent, waiting again, or queueing it
as pending. This preserves the invariant that pending_fw_head contains only
active fallback requests.
Fixes: 75d95e2e39b2 ("firmware_loader: fix use-after-free in firmware_fallback_sysfs")
Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Link: https://patch.msgid.link/20260716081601.1674470-1-mukesh.ojha@oss.qualcomm.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/firmware_loader/fallback.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/base/firmware_loader/fallback.c b/drivers/base/firmware_loader/fallback.c
index 3ef0b312ae719..00d6b6e594616 100644
--- a/drivers/base/firmware_loader/fallback.c
+++ b/drivers/base/firmware_loader/fallback.c
@@ -95,6 +95,16 @@ static int fw_load_sysfs_fallback(struct fw_sysfs *fw_sysfs, long timeout)
retval = -EINTR;
goto out;
}
+
+ /*
+ * device_add() exposes the loading interface before pending_list is
+ * linked into pending_fw_head, so fw_state_done() may run first.
+ */
+ if (fw_state_is_done(fw_priv)) {
+ mutex_unlock(&fw_lock);
+ goto out;
+ }
+
list_add(&fw_priv->pending_list, &pending_fw_head);
mutex_unlock(&fw_lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0947/1376] pinctrl: rockchip: Reset the pin count when recalculating SoC data
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (945 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0946/1376] firmware_loader: do not queue completed sysfs fallback requests Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0948/1376] hugetlbfs: release subpool on fill_super failure Greg Kroah-Hartman
` (51 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Simon Glass, Linus Walleij,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Glass <sjg@chromium.org>
[ Upstream commit 5b695c191cc85f0fd62eec885b55d01468dc9f2c ]
rockchip_pinctrl_get_soc_data() mutates the static per-SoC data. The
iomux and drive offsets are recalculated idempotently, since a rerun
anchors at the values calculated before, but the total pin count only
accumulates: each run adds every bank's pins again. When the probe is
deferred and runs a second time, nr_pins doubles and every bank's
pin_base shifts, so later pin lookups resolve to the wrong bank and
the wrong registers.
Reset the pin count at the start of the calculation, so that a rerun
produces the same values.
This is verified on a Luckfox Pico Mini B (RV1103, with the pending
RV1106 series applied) by forcing the probe to defer once: without
this patch the second probe calculates nr_pins=304 instead of 152 and
no GPIO bank comes up; with it the recalculation matches the first
run and all banks work.
Fixes: d3e5116119bd ("pinctrl: add pinctrl driver for Rockchip SoCs")
Link: https://sashiko.dev/#/patchset/20260729132736.3807082-1-sjg@chromium.org?part=4
Assisted-by: Claude:claude-opus-5
Signed-off-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/pinctrl-rockchip.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c
index 894dde9446844..bd3cfeffaac10 100644
--- a/drivers/pinctrl/pinctrl-rockchip.c
+++ b/drivers/pinctrl/pinctrl-rockchip.c
@@ -3409,6 +3409,16 @@ static struct rockchip_pin_ctrl *rockchip_pinctrl_get_soc_data(
pmu_offs = ctrl->pmu_mux_offset;
drv_pmu_offs = ctrl->pmu_drv_offset;
drv_grf_offs = ctrl->grf_drv_offset;
+
+ /*
+ * This function mutates the static per-SoC data. Most of it is
+ * idempotent: recalculated iomux and drv offsets anchor at the
+ * values calculated by a previous run. The pin count is not, so
+ * reset it here; otherwise it accumulates when the probe runs
+ * again after a probe deferral, shifting every bank's pin_base.
+ */
+ ctrl->nr_pins = 0;
+
bank = ctrl->pin_banks;
for (i = 0; i < ctrl->nr_banks; ++i, ++bank) {
int bank_pins = 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0948/1376] hugetlbfs: release subpool on fill_super failure
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (946 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0947/1376] pinctrl: rockchip: Reset the pin count when recalculating SoC data Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0949/1376] soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() Greg Kroah-Hartman
` (50 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yichong Chen, David Hildenbrand,
Muchun Song, Oscar Salvador, Andrew Morton, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yichong Chen <chenyichong@uniontech.com>
[ Upstream commit 308ab73e97c87bd0e142b11758faab7f88d82854 ]
hugetlbfs_fill_super() allocates a hugepage subpool when size or min_size
mount options are specified. hugepage_new_subpool() may also reserve huge
pages for min_size.
If root dentry creation fails after the subpool is created, the failure
path frees the subpool with kfree(). This bypasses hugepage_put_subpool()
and can leave min_size reservations charged.
Use hugepage_put_subpool() on the failure path, matching the normal
put_super path.
Link: https://lore.kernel.org/20260720021900.1376309-1-chenyichong@uniontech.com
Fixes: 7ca02d0ae586 ("hugetlbfs: accept subpool min_size mount option and setup accordingly")
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Oscar Salvador <osalvador@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/hugetlbfs/inode.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index b0c3b4399a793..734eb08bafc92 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -1506,7 +1506,8 @@ hugetlbfs_fill_super(struct super_block *sb, struct fs_context *fc)
goto out_free;
return 0;
out_free:
- kfree(sbinfo->spool);
+ if (sbinfo->spool)
+ hugepage_put_subpool(sbinfo->spool);
kfree(sbinfo);
return -ENOMEM;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0949/1376] soc: fsl: qe: check platform_driver_register() in qe_ic_of_init()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (947 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0948/1376] hugetlbfs: release subpool on fill_super failure Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0950/1376] phy: qcom-sgmii-eth: relax order of .power_on() vs .set_mode*() Greg Kroah-Hartman
` (49 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linkai Gong, Maxim Kochetkov,
Christophe Leroy (CS GROUP), Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linkai Gong <gonglinkai@kylinos.cn>
[ Upstream commit fbdba2a67fa7c0e7570bcbf9f28b782d6100270d ]
qe_ic_of_init() ignored the return value of platform_driver_register()
and always returned success. Propagate the error to the initcall.
Fixes: be7ecbd240b2 ("soc: fsl: qe: convert QE interrupt controller to platform_device")
Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn>
Reviewed-by: Maxim Kochetkov <fido_max@inbox.ru>
Link: https://lore.kernel.org/r/20260731094608.1883391-1-gonglinkai@kylinos.cn
Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/fsl/qe/qe_ic.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/soc/fsl/qe/qe_ic.c b/drivers/soc/fsl/qe/qe_ic.c
index bbae3d39c7bed..f17de6000ff24 100644
--- a/drivers/soc/fsl/qe/qe_ic.c
+++ b/drivers/soc/fsl/qe/qe_ic.c
@@ -481,7 +481,6 @@ static struct platform_driver qe_ic_driver =
static int __init qe_ic_of_init(void)
{
- platform_driver_register(&qe_ic_driver);
- return 0;
+ return platform_driver_register(&qe_ic_driver);
}
subsys_initcall(qe_ic_of_init);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0950/1376] phy: qcom-sgmii-eth: relax order of .power_on() vs .set_mode*()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (948 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0949/1376] soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0951/1376] phy: qcom: sgmii-eth: vote for both voltage rails with correct current loads Greg Kroah-Hartman
` (48 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mohd Ayaan Anwar, Vinod Koul,
Vladimir Oltean, Russell King (Oracle), Jakub Kicinski,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
[ Upstream commit ebe8b48b88ad012cf6067226e184e9173b7ea9d6 ]
Allow any order of the .power_on() and .set_mode*() methods as per the
recent discussion. This means phy_power_on() with this SerDes will now
restore the previous setup without requiring a subsequent
phy_set_mode*() call.
Tested-by: Mohd Ayaan Anwar <mohd.anwar@oss.qualcomm.com>
Acked-by: Vinod Koul <vkoul@kernel.org>
Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Link: https://patch.msgid.link/E1vxS4P-0000000BQXs-0vGB@rmk-PC.armlinux.org.uk
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 4f81684a1d10 ("phy: qcom: sgmii-eth: vote for both voltage rails with correct current loads")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/qualcomm/phy-qcom-sgmii-eth.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/drivers/phy/qualcomm/phy-qcom-sgmii-eth.c b/drivers/phy/qualcomm/phy-qcom-sgmii-eth.c
index 5b1c82459c126..d46a5e4df830a 100644
--- a/drivers/phy/qualcomm/phy-qcom-sgmii-eth.c
+++ b/drivers/phy/qualcomm/phy-qcom-sgmii-eth.c
@@ -267,8 +267,17 @@ static int qcom_dwmac_sgmii_phy_calibrate(struct phy *phy)
static int qcom_dwmac_sgmii_phy_power_on(struct phy *phy)
{
struct qcom_dwmac_sgmii_phy_data *data = phy_get_drvdata(phy);
+ int ret;
- return clk_prepare_enable(data->refclk);
+ ret = clk_prepare_enable(data->refclk);
+ if (ret < 0)
+ return ret;
+
+ ret = qcom_dwmac_sgmii_phy_calibrate(phy);
+ if (ret < 0)
+ clk_disable_unprepare(data->refclk);
+
+ return ret;
}
static int qcom_dwmac_sgmii_phy_power_off(struct phy *phy)
@@ -293,6 +302,9 @@ static int qcom_dwmac_sgmii_phy_set_speed(struct phy *phy, int speed)
if (speed != data->speed)
data->speed = speed;
+ if (phy->power_count == 0)
+ return 0;
+
return qcom_dwmac_sgmii_phy_calibrate(phy);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0951/1376] phy: qcom: sgmii-eth: vote for both voltage rails with correct current loads
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (949 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0950/1376] phy: qcom-sgmii-eth: relax order of .power_on() vs .set_mode*() Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0952/1376] phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend Greg Kroah-Hartman
` (47 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mohd Ayaan Anwar,
Manivannan Sadhasivam, Vinod Koul, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mohd Ayaan Anwar <mohd.anwar@oss.qualcomm.com>
[ Upstream commit 4f81684a1d1018d7d0e5579f08d95e7701279358 ]
The SerDes PHY has two voltage supply rails, vdda-0p9 and vdda-1p2,
that must both be enabled for calibration to succeed. Without them:
qcom-dwmac-sgmii-phy 8909000.phy: QSERDES_COM_C_READY_STATUS timed-out
qcom-ethqos 23040000.ethernet eth0: __stmmac_open: Serdes powerup failed
The driver relied solely on the PHY framework's implicit enable of
'phy-supply', which only voted for a single rail and set no current
load. Use devm_regulator_bulk_get_const() to acquire both supplies and
set the peak current loads (46 mA for vdda-0p9, 15 mA for vdda-1p2)
as required by the hardware.
Fixes: 601d06277007 ("phy: qcom: add the SGMII SerDes PHY driver")
Signed-off-by: Mohd Ayaan Anwar <mohd.anwar@oss.qualcomm.com>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Link: https://patch.msgid.link/20260804-b4-sgmiieth_serdes_regulator-v2-2-c4bc688177dd@oss.qualcomm.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/qualcomm/phy-qcom-sgmii-eth.c | 37 ++++++++++++++++++++---
1 file changed, 33 insertions(+), 4 deletions(-)
diff --git a/drivers/phy/qualcomm/phy-qcom-sgmii-eth.c b/drivers/phy/qualcomm/phy-qcom-sgmii-eth.c
index d46a5e4df830a..8de0fba25ecff 100644
--- a/drivers/phy/qualcomm/phy-qcom-sgmii-eth.c
+++ b/drivers/phy/qualcomm/phy-qcom-sgmii-eth.c
@@ -10,6 +10,7 @@
#include <linux/phy/phy.h>
#include <linux/platform_device.h>
#include <linux/regmap.h>
+#include <linux/regulator/consumer.h>
#include "phy-qcom-qmp-pcs-sgmii.h"
#include "phy-qcom-qmp-qserdes-com-v5.h"
@@ -25,7 +26,15 @@
#define QSERDES_PCS_SGMIIPHY_READY BIT(7)
#define QSERDES_COM_C_PLL_LOCKED BIT(1)
+static const struct regulator_bulk_data qcom_dwmac_sgmii_phy_vregs[] = {
+ { .supply = "vdda-0p9", .init_load_uA = 46000 },
+ { .supply = "vdda-1p2", .init_load_uA = 15000 },
+};
+
+#define QCOM_SGMII_NUM_SUPPLIES ARRAY_SIZE(qcom_dwmac_sgmii_phy_vregs)
+
struct qcom_dwmac_sgmii_phy_data {
+ struct regulator_bulk_data *vregs;
struct regmap *regmap;
struct clk *refclk;
int speed;
@@ -269,13 +278,24 @@ static int qcom_dwmac_sgmii_phy_power_on(struct phy *phy)
struct qcom_dwmac_sgmii_phy_data *data = phy_get_drvdata(phy);
int ret;
- ret = clk_prepare_enable(data->refclk);
- if (ret < 0)
+ ret = regulator_bulk_enable(QCOM_SGMII_NUM_SUPPLIES, data->vregs);
+ if (ret)
return ret;
+ ret = clk_prepare_enable(data->refclk);
+ if (ret)
+ goto err_disable_regulators;
+
ret = qcom_dwmac_sgmii_phy_calibrate(phy);
- if (ret < 0)
- clk_disable_unprepare(data->refclk);
+ if (ret)
+ goto err_disable_clk;
+
+ return 0;
+
+err_disable_clk:
+ clk_disable_unprepare(data->refclk);
+err_disable_regulators:
+ regulator_bulk_disable(QCOM_SGMII_NUM_SUPPLIES, data->vregs);
return ret;
}
@@ -292,6 +312,8 @@ static int qcom_dwmac_sgmii_phy_power_off(struct phy *phy)
clk_disable_unprepare(data->refclk);
+ regulator_bulk_disable(QCOM_SGMII_NUM_SUPPLIES, data->vregs);
+
return 0;
}
@@ -331,6 +353,7 @@ static int qcom_dwmac_sgmii_phy_probe(struct platform_device *pdev)
struct phy_provider *provider;
void __iomem *base;
struct phy *phy;
+ int ret;
data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL);
if (!data)
@@ -355,6 +378,12 @@ static int qcom_dwmac_sgmii_phy_probe(struct platform_device *pdev)
if (IS_ERR(data->refclk))
return PTR_ERR(data->refclk);
+ ret = devm_regulator_bulk_get_const(dev, QCOM_SGMII_NUM_SUPPLIES,
+ qcom_dwmac_sgmii_phy_vregs,
+ &data->vregs);
+ if (ret)
+ return ret;
+
provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate);
if (IS_ERR(provider))
return PTR_ERR(provider);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0952/1376] phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (950 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0951/1376] phy: qcom: sgmii-eth: vote for both voltage rails with correct current loads Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0953/1376] phy: qcom: snps-femto-v2: " Greg Kroah-Hartman
` (46 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abel Vesa, Dmitry Baryshkov,
Loic Poulain, Vinod Koul, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Loic Poulain <loic.poulain@oss.qualcomm.com>
[ Upstream commit 8e3687f7e18fe84372e86875709d56c37e7525a8 ]
There is a small window where the runtime suspend callback may run
after pm_runtime_enable() and before pm_runtime_forbid(). In this
case, a crash occurs because runtime suspend/resume dereferences
qmp->phy pointer, which is not yet initialized:
`if (!qmp->phy->init_count) {`
This can also happen if user re-enables runtime-pm via the sysfs
attribute before qmp phy is initialized.
Similarly to other qcom phy drivers, introduce a qmp->phy_initialized
variable that can be used to avoid relying on the possibly uninitialized
phy pointer.
Fixes: e464a3180a43 ("phy: qcom-qmp-usb: split off the legacy USB+dp_com support")
Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Link: https://patch.msgid.link/20260722-qcom-usb-phy-fix-null-v6-3-534f7e61b9a6@oss.qualcomm.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/qualcomm/phy-qcom-qmp-usb-legacy.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-usb-legacy.c b/drivers/phy/qualcomm/phy-qcom-qmp-usb-legacy.c
index 8bf951b0490cf..fc490589c8e48 100644
--- a/drivers/phy/qualcomm/phy-qcom-qmp-usb-legacy.c
+++ b/drivers/phy/qualcomm/phy-qcom-qmp-usb-legacy.c
@@ -542,6 +542,8 @@ struct qmp_usb {
enum phy_mode mode;
+ bool phy_initialized;
+
struct phy *phy;
struct clk_fixed_rate pipe_clk_fixed;
@@ -895,6 +897,7 @@ static int qmp_usb_legacy_power_off(struct phy *phy)
static int qmp_usb_legacy_enable(struct phy *phy)
{
+ struct qmp_usb *qmp = phy_get_drvdata(phy);
int ret;
ret = qmp_usb_legacy_init(phy);
@@ -904,14 +907,19 @@ static int qmp_usb_legacy_enable(struct phy *phy)
ret = qmp_usb_legacy_power_on(phy);
if (ret)
qmp_usb_legacy_exit(phy);
+ else
+ qmp->phy_initialized = true;
return ret;
}
static int qmp_usb_legacy_disable(struct phy *phy)
{
+ struct qmp_usb *qmp = phy_get_drvdata(phy);
int ret;
+ qmp->phy_initialized = false;
+
ret = qmp_usb_legacy_power_off(phy);
if (ret)
return ret;
@@ -988,7 +996,7 @@ static int __maybe_unused qmp_usb_legacy_runtime_suspend(struct device *dev)
dev_vdbg(dev, "Suspending QMP phy, mode:%d\n", qmp->mode);
- if (!qmp->phy->init_count) {
+ if (!qmp->phy_initialized) {
dev_vdbg(dev, "PHY not initialized, bailing out\n");
return 0;
}
@@ -1009,7 +1017,7 @@ static int __maybe_unused qmp_usb_legacy_runtime_resume(struct device *dev)
dev_vdbg(dev, "Resuming QMP phy, mode:%d\n", qmp->mode);
- if (!qmp->phy->init_count) {
+ if (!qmp->phy_initialized) {
dev_vdbg(dev, "PHY not initialized, bailing out\n");
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0953/1376] phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (951 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0952/1376] phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0954/1376] phy: qcom: qmp-usb: " Greg Kroah-Hartman
` (45 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Konrad Dybcio,
Abel Vesa, Loic Poulain, Vinod Koul, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Loic Poulain <loic.poulain@oss.qualcomm.com>
[ Upstream commit c271a6926ea7d3c9566b033d63fd4e8c488dc860 ]
Runtime PM must be enabled before creating the PHY, since phy_create()
only enables runtime PM on the PHY device if it is already enabled on
this parent device. However, the runtime PM callbacks dereference the
hsphy instance, which is not yet ready, leaving a window where a suspend
callback may trigger a NULL pointer dereference.
Take a runtime PM usage reference with pm_runtime_get_noresume() before
enabling runtime PM and release it once the PHY has been created, so that
no runtime suspend can run before the PHY is ready. This also prevents a
short window where an unnecessary runtime suspend can occur.
Use the devres-managed version to ensure PM runtime is symmetrically
disabled during driver removal for proper cleanup.
Fixes: 0d75f508a9d5 ("phy: qcom-snps: Add runtime suspend and resume handlers")
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Link: https://patch.msgid.link/20260722-qcom-usb-phy-fix-null-v6-5-534f7e61b9a6@oss.qualcomm.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c | 26 ++++++++++++++-----
1 file changed, 20 insertions(+), 6 deletions(-)
diff --git a/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c b/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c
index eb0b0f61d98e0..980ad1fb1e2e3 100644
--- a/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c
+++ b/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c
@@ -599,8 +599,18 @@ static int qcom_snps_hsphy_probe(struct platform_device *pdev)
return dev_err_probe(dev, ret,
"failed to get regulator supplies\n");
+ /*
+ * Enable runtime PM before creating the PHY, phy_create() only enables
+ * it on the PHY device if already enabled on the parent. Hold a usage
+ * reference so callbacks cannot run before the PHY is ready.
+ */
+ pm_runtime_get_noresume(dev);
pm_runtime_set_active(dev);
- pm_runtime_enable(dev);
+ ret = devm_pm_runtime_enable(dev);
+ if (ret) {
+ pm_runtime_put_noidle(dev);
+ return ret;
+ }
/*
* Prevent runtime pm from being ON by default. Users can enable
* it using power/control in sysfs.
@@ -611,6 +621,7 @@ static int qcom_snps_hsphy_probe(struct platform_device *pdev)
if (IS_ERR(generic_phy)) {
ret = PTR_ERR(generic_phy);
dev_err(dev, "failed to create phy, %d\n", ret);
+ pm_runtime_put_noidle(dev);
return ret;
}
hsphy->phy = generic_phy;
@@ -620,12 +631,15 @@ static int qcom_snps_hsphy_probe(struct platform_device *pdev)
qcom_snps_hsphy_read_override_param_seq(dev);
phy_provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate);
- if (!IS_ERR(phy_provider))
- dev_dbg(dev, "Registered Qcom-SNPS HS phy\n");
- else
- pm_runtime_disable(dev);
+ if (IS_ERR(phy_provider)) {
+ pm_runtime_put_noidle(dev);
+ return PTR_ERR(phy_provider);
+ }
- return PTR_ERR_OR_ZERO(phy_provider);
+ dev_dbg(dev, "Registered Qcom-SNPS HS phy\n");
+ pm_runtime_put(dev);
+
+ return 0;
}
static struct platform_driver qcom_snps_hsphy_driver = {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0954/1376] phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (952 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0953/1376] phy: qcom: snps-femto-v2: " Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0955/1376] md/raid5: round bitmap stripes with sector division Greg Kroah-Hartman
` (44 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Loic Poulain, Vinod Koul,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Loic Poulain <loic.poulain@oss.qualcomm.com>
[ Upstream commit 142c5593379273264474f31d5956b1a0065cd576 ]
There is a small window where the runtime suspend callback may run
after pm_runtime_enable() and before pm_runtime_forbid(). In this
case, a crash occurs because runtime suspend/resume dereferences
qmp->phy pointer, which is not yet initialized:
`if (!qmp->phy->init_count) {`
This can also happen if user re-enables runtime-pm via the sysfs
attribute before qmp phy is initialized.
Similarly to other qcom phy drivers, introduce a qmp->phy_initialized
variable that can be used to avoid relying on the possibly uninitialized
phy pointer.
Fixes: e464a3180a43 ("phy: qcom-qmp-usb: split off the legacy USB+dp_com support")
Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Link: https://patch.msgid.link/20260722-qcom-usb-phy-fix-null-v6-6-534f7e61b9a6@oss.qualcomm.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/qualcomm/phy-qcom-qmp-usb.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-usb.c b/drivers/phy/qualcomm/phy-qcom-qmp-usb.c
index c12efd127a612..2f1b967864b94 100644
--- a/drivers/phy/qualcomm/phy-qcom-qmp-usb.c
+++ b/drivers/phy/qualcomm/phy-qcom-qmp-usb.c
@@ -1256,6 +1256,8 @@ struct qmp_usb {
enum phy_mode mode;
+ bool phy_initialized;
+
struct phy *phy;
struct clk_fixed_rate pipe_clk_fixed;
@@ -1786,6 +1788,7 @@ static int qmp_usb_power_off(struct phy *phy)
static int qmp_usb_enable(struct phy *phy)
{
+ struct qmp_usb *qmp = phy_get_drvdata(phy);
int ret;
ret = qmp_usb_init(phy);
@@ -1795,14 +1798,19 @@ static int qmp_usb_enable(struct phy *phy)
ret = qmp_usb_power_on(phy);
if (ret)
qmp_usb_exit(phy);
+ else
+ qmp->phy_initialized = true;
return ret;
}
static int qmp_usb_disable(struct phy *phy)
{
+ struct qmp_usb *qmp = phy_get_drvdata(phy);
int ret;
+ qmp->phy_initialized = false;
+
ret = qmp_usb_power_off(phy);
if (ret)
return ret;
@@ -1878,7 +1886,7 @@ static int __maybe_unused qmp_usb_runtime_suspend(struct device *dev)
dev_vdbg(dev, "Suspending QMP phy, mode:%d\n", qmp->mode);
- if (!qmp->phy->init_count) {
+ if (!qmp->phy_initialized) {
dev_vdbg(dev, "PHY not initialized, bailing out\n");
return 0;
}
@@ -1898,7 +1906,7 @@ static int __maybe_unused qmp_usb_runtime_resume(struct device *dev)
dev_vdbg(dev, "Resuming QMP phy, mode:%d\n", qmp->mode);
- if (!qmp->phy->init_count) {
+ if (!qmp->phy_initialized) {
dev_vdbg(dev, "PHY not initialized, bailing out\n");
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0955/1376] md/raid5: round bitmap stripes with sector division
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (953 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0954/1376] phy: qcom: qmp-usb: " Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0956/1376] md: avoid stale clone I/O accounting timestamps Greg Kroah-Hartman
` (43 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mykola Marzhan, Yu Kuai, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <yukuai@fygo.io>
[ Upstream commit 17ea021ae74987d6064c8195c4922fa025753892 ]
raid5_bitmap_sector_map() aligns the array range to full RAID5 stripe
widths before converting it to component sectors. That width is
chunk_sectors multiplied by the number of data disks, and it is not
always a power of two.
Reproduce with a 4-disk RAID5, 1024-sector chunks, and three data disks.
The full-stripe width is 3072 sectors. For a one-sector write at array
sector 3072, correct rounding gives array range [3072, 6144), which maps
to component range [1024, 2048). The old round_down()/round_up() logic
instead gives [1024, 4096), which maps to [0, 1024).
Use sector_div() based arithmetic so the rounded range is aligned to the
actual RAID5 stripe width.
The deterministic mapper test now reports the fixed component range as
[1024, 2048), while the old mask-based range was [0, 1024).
Fixes: 9c89f604476c ("md/raid5: implement pers->bitmap_sector()")
Reported-by: Mykola Marzhan <mykola@meshstor.io>
Link: https://lore.kernel.org/all/20260726185916.2223460-1-mykola@meshstor.io/
Tested-by: Mykola Marzhan <mykola@meshstor.io>
Link: https://patch.msgid.link/20260802195038.164272-6-yukuai@kernel.org
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/raid5.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index ef1a1a8507792..bdd620d89c672 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -5918,8 +5918,11 @@ static void raid5_bitmap_sector(struct mddev *mddev, sector_t *offset,
sectors_per_chunk = conf->chunk_sectors *
(conf->raid_disks - conf->max_degraded);
- start = round_down(start, sectors_per_chunk);
- end = round_up(end, sectors_per_chunk);
+ sector_div(start, sectors_per_chunk);
+ start *= sectors_per_chunk;
+ if (sector_div(end, sectors_per_chunk))
+ end++;
+ end *= sectors_per_chunk;
start = raid5_compute_sector(conf, start, 0, &dd_idx, NULL);
end = raid5_compute_sector(conf, end, 0, &dd_idx, NULL);
@@ -5937,8 +5940,10 @@ static void raid5_bitmap_sector(struct mddev *mddev, sector_t *offset,
sectors_per_chunk = conf->prev_chunk_sectors *
(conf->previous_raid_disks - conf->max_degraded);
- prev_start = round_down(prev_start, sectors_per_chunk);
- prev_end = round_down(prev_end, sectors_per_chunk);
+ sector_div(prev_start, sectors_per_chunk);
+ prev_start *= sectors_per_chunk;
+ sector_div(prev_end, sectors_per_chunk);
+ prev_end *= sectors_per_chunk;
prev_start = raid5_compute_sector(conf, prev_start, 1, &dd_idx, NULL);
prev_end = raid5_compute_sector(conf, prev_end, 1, &dd_idx, NULL);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0956/1376] md: avoid stale clone I/O accounting timestamps
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (954 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0955/1376] md/raid5: round bitmap stripes with sector division Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0957/1376] md/raid1: dont set array_frozen in raid1_takeover() Greg Kroah-Hartman
` (42 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mykola Marzhan, Yu Kuai, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <yukuai@fygo.io>
[ Upstream commit 45102fc8330525d35675b1c193242bba101df5ee ]
md_clone_bio() always allocates the clone from mddev->io_clone_set, even
when queue I/O stats are disabled. In that case it does not call
bio_start_io_acct(), but it also left md_io_clone->start_time untouched.
The clone private data comes from a mempool and can contain data from a
previous user. md_end_clone_io() checks start_time to decide whether it
needs to call bio_end_io_acct(), so a stale non-zero value can make the
completion path end accounting that was never started for this bio.
Set start_time to 0 in the no-stats branch. This keeps the end path tied
to whether bio_start_io_acct() actually ran.
Fixes: c687297b8845 ("md: also clone new io if io accounting is disabled")
Tested-by: Mykola Marzhan <mykola@meshstor.io>
Link: https://patch.msgid.link/20260802195038.164272-8-yukuai@kernel.org
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/md.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index dedd8a583f7e6..79ca70ca797db 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -8836,6 +8836,8 @@ static void md_clone_bio(struct mddev *mddev, struct bio **bio)
md_io_clone->mddev = mddev;
if (blk_queue_io_stat(bdev->bd_disk->queue))
md_io_clone->start_time = bio_start_io_acct(*bio);
+ else
+ md_io_clone->start_time = 0;
if (bio_data_dir(*bio) == WRITE && mddev->bitmap) {
md_io_clone->offset = (*bio)->bi_iter.bi_sector;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0957/1376] md/raid1: dont set array_frozen in raid1_takeover()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (955 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0956/1376] md: avoid stale clone I/O accounting timestamps Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0958/1376] coresight: etm4x: fix wrong check of etm4x_sspcicrn_present() Greg Kroah-Hartman
` (41 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bruce Johnston, Yu Kuai, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bruce Johnston <bjohnsto@redhat.com>
[ Upstream commit dc386aa0ac0a3ec06c9a3ea9b064b073fb72a916 ]
raid1_takeover() sets conf->array_frozen = 1 on the newly-allocated
r1conf and nothing ever clears it, so every I/O to the array stalls
permanently once _wait_barrier() sees it stuck at 1.
This used to be harmless: level_store() called mddev_resume() right
after pers->run(), which called raid1_quiesce(mddev, 0) and cleared
array_frozen back to 0 regardless of what raid1_takeover() set. Commit
b39f35ebe86d ("md: don't quiesce in mddev_suspend()") removed that
quiesce(mddev, 0) call, so the pre-set now sticks.
setup_conf() already zero-initializes the new r1conf via kzalloc, so
just don't set array_frozen here.
Same class of bug as commit 892da88d1cd9 ("md/raid10: fix a
'conf->barrier' leakage in raid10_takeover()"), also triggered by
b39f35ebe86d.
Fixes: b39f35ebe86d ("md: don't quiesce in mddev_suspend()")
Link: https://issues.redhat.com/browse/RHEL-191802
Signed-off-by: Bruce Johnston <bjohnsto@redhat.com>
Link: https://patch.msgid.link/20260803180240.1177104-1-bjohnsto@redhat.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/raid1.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index c6ad1f97cdace..32b2eb2a169c3 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -3482,8 +3482,6 @@ static void *raid1_takeover(struct mddev *mddev)
mddev->new_chunk_sectors = 0;
conf = setup_conf(mddev);
if (!IS_ERR(conf)) {
- /* Array must appear to be quiesced */
- conf->array_frozen = 1;
mddev_clear_unsupported_flags(mddev,
UNSUPPORTED_MDDEV_FLAGS);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0958/1376] coresight: etm4x: fix wrong check of etm4x_sspcicrn_present()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (956 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0957/1376] md/raid1: dont set array_frozen in raid1_takeover() Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0959/1376] coresight: Change syncfreq to be a u8 Greg Kroah-Hartman
` (40 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Leo Yan, Yeoreum Yun,
Suzuki K Poulose, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yeoreum Yun <yeoreum.yun@arm.com>
[ Upstream commit 0e1cd4270b42a257c139165622091e1e8c7104a7 ]
According to Embedded Trace Macrocell Architecture Specification
ETMv4.0 to ETM4.6 [0], TRCSSPCICR<n> is present only if all of
the following are true:
- TRCIDR4.NUMSSCC > n.
- TRCIDR4.NUMPC > 0b0000.
- TRCSSCSR<n>.PC == 0b1.
Comment for etm4x_sspcicrn_present() is align with the specification.
However, the check should use drvdata->nr_pe_cmp to check TRCIDR4.NUMPC
not nr_pe.
Link: https://developer.arm.com/documentation/ihi0064/latest/ [0]
Fixes: f6a18f354c58 ("coresight: etm4x: Handle access to TRCSSPCICRn")
Reviewed-by: Leo Yan <leo.yan@arm.com>
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20260725113645.57519-2-yeoreum.yun@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwtracing/coresight/coresight-etm4x-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
index 05958827b3bbc..2762c1e429987 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
@@ -87,7 +87,7 @@ static int etm4_probe_cpu(unsigned int cpu);
static inline bool etm4x_sspcicrn_present(struct etmv4_drvdata *drvdata, int n)
{
return (n < drvdata->nr_ss_cmp) &&
- drvdata->nr_pe &&
+ drvdata->nr_pe_cmp &&
(drvdata->config.ss_status[n] & TRCSSCSRn_PC);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0959/1376] coresight: Change syncfreq to be a u8
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (957 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0958/1376] coresight: etm4x: fix wrong check of etm4x_sspcicrn_present() Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0960/1376] coresight: etm4x: fix underflow for usage of (nrseqstate - 1) Greg Kroah-Hartman
` (39 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mike Leach, Leo Yan, James Clark,
Suzuki K Poulose, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Clark <james.clark@linaro.org>
[ Upstream commit 10d4dbdc8fbce586b17be07b8138e025381453dd ]
TRCSYNCPR.PERIOD is the only functional part of TRCSYNCPR and it only
has 5 valid bits so it can be stored in a u8.
Reviewed-by: Mike Leach <mike.leach@linaro.org>
Reviewed-by: Leo Yan <leo.yan@arm.com>
Tested-by: Leo Yan <leo.yan@arm.com>
Signed-off-by: James Clark <james.clark@linaro.org>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20251128-james-cs-syncfreq-v8-1-4d319764cc58@linaro.org
Stable-dep-of: 1674d9bff807 ("coresight: etm4x: fix underflow for usage of (nrseqstate - 1)")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwtracing/coresight/coresight-etm4x.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h
index 3683966bd0603..b2ee6f771cf76 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x.h
+++ b/drivers/hwtracing/coresight/coresight-etm4x.h
@@ -825,7 +825,6 @@ struct etmv4_config {
u32 eventctrl1;
u32 stall_ctrl;
u32 ts_ctrl;
- u32 syncfreq;
u32 ccctlr;
u32 bb_ctrl;
u32 vinst_ctrl;
@@ -833,6 +832,7 @@ struct etmv4_config {
u32 vissctlr;
u32 vipcssctlr;
u8 seq_idx;
+ u8 syncfreq;
u32 seq_ctrl[ETM_MAX_SEQ_STATES];
u32 seq_rst;
u32 seq_state;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0960/1376] coresight: etm4x: fix underflow for usage of (nrseqstate - 1)
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (958 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0959/1376] coresight: Change syncfreq to be a u8 Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0961/1376] coresight: etm4x: fix leaked trace id Greg Kroah-Hartman
` (38 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Leo Yan, Suzuki K Poulose,
Yeoreum Yun, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yeoreum Yun <yeoreum.yun@arm.com>
[ Upstream commit 1674d9bff8073bdee5dbc200f56fc3caa28d0566 ]
According to IHI006H Embedded Trace Macrocell Architecture
Specification[0], TRCSEQEVR<n> is implemented only when
TRCIDR5.NUMSEQSTATE is 0b100, in which case n ranges from 0 to 2;
otherwise, TRCIDR5.NUMSEQSTATE is 0b000.
IOW, the number of usage in the initialisation or setting
TRCSEQEVR<n> with drvdata->nrseqstate - 1 in the loop could make
underflow issue when TRCIDR5.NUMSEQSTATE is 0b000.
Therefore, introduce nr_seq_ctrls field and untie it from nrseqstate.
As part of this introduce ETM_MAX_SEQ_TRANSITIONS macro and
apply nr_seq_ctrls and above macro to TRCSEQEVR<n> relevant fields setup.
Link: https://developer.arm.com/documentation/ihi0064/latest/ [0]
Fixes: 2e1cdfe184b5 ("coresight-etm4x: Adding CoreSight ETM4x driver")
Suggested-by: Leo Yan <leo.yan@arm.com>
Suggested-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20260725113645.57519-3-yeoreum.yun@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwtracing/coresight/coresight-etm4x-cfg.c | 2 +-
drivers/hwtracing/coresight/coresight-etm4x-core.c | 9 ++++++---
drivers/hwtracing/coresight/coresight-etm4x-sysfs.c | 6 ++++--
drivers/hwtracing/coresight/coresight-etm4x.h | 7 +++++--
4 files changed, 16 insertions(+), 8 deletions(-)
diff --git a/drivers/hwtracing/coresight/coresight-etm4x-cfg.c b/drivers/hwtracing/coresight/coresight-etm4x-cfg.c
index c302072b293a3..e1a59b4345052 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x-cfg.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x-cfg.c
@@ -76,7 +76,7 @@ static int etm4_cfg_map_reg_offset(struct etmv4_drvdata *drvdata,
} else if ((offset & GENMASK(11, 4)) == TRCSEQEVRn(0)) {
/* sequencer state control registers */
idx = (offset & GENMASK(3, 0)) / 4;
- if (idx < ETM_MAX_SEQ_STATES) {
+ if (idx < ETM_MAX_SEQ_TRANSITIONS) {
reg_csdev->driver_regval = &drvcfg->seq_ctrl[idx];
err = 0;
}
diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
index 2762c1e429987..0157dc5b08928 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
@@ -527,7 +527,8 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata)
etm4x_relaxed_write32(csa, config->vissctlr, TRCVISSCTLR);
if (drvdata->nr_pe_cmp)
etm4x_relaxed_write32(csa, config->vipcssctlr, TRCVIPCSSCTLR);
- for (i = 0; i < drvdata->nrseqstate - 1; i++)
+
+ for (i = 0; i < drvdata->nr_seq_ctrls; i++)
etm4x_relaxed_write32(csa, config->seq_ctrl[i], TRCSEQEVRn(i));
if (drvdata->nrseqstate) {
etm4x_relaxed_write32(csa, config->seq_rst, TRCSEQRSTEVR);
@@ -1415,6 +1416,8 @@ static void etm4_init_arch_data(void *info)
drvdata->lpoverride = (etmidr5 & TRCIDR5_LPOVERRIDE) && (!drvdata->skip_power_up);
/* NUMSEQSTATE, bits[27:25] number of sequencer states implemented */
drvdata->nrseqstate = FIELD_GET(TRCIDR5_NUMSEQSTATE_MASK, etmidr5);
+ if (drvdata->nrseqstate)
+ drvdata->nr_seq_ctrls = ETM_MAX_SEQ_TRANSITIONS;
/* NUMCNTR, bits[30:28] number of counters available for tracing */
drvdata->nr_cntr = FIELD_GET(TRCIDR5_NUMCNTR_MASK, etmidr5);
etm4_cs_lock(drvdata, csa);
@@ -1824,7 +1827,7 @@ static int __etm4_cpu_save(struct etmv4_drvdata *drvdata)
if (drvdata->nr_pe_cmp)
state->trcvipcssctlr = etm4x_read32(csa, TRCVIPCSSCTLR);
- for (i = 0; i < drvdata->nrseqstate - 1; i++)
+ for (i = 0; i < drvdata->nr_seq_ctrls; i++)
state->trcseqevr[i] = etm4x_read32(csa, TRCSEQEVRn(i));
if (drvdata->nrseqstate) {
@@ -1958,7 +1961,7 @@ static void __etm4_cpu_restore(struct etmv4_drvdata *drvdata)
if (drvdata->nr_pe_cmp)
etm4x_relaxed_write32(csa, state->trcvipcssctlr, TRCVIPCSSCTLR);
- for (i = 0; i < drvdata->nrseqstate - 1; i++)
+ for (i = 0; i < drvdata->nr_seq_ctrls; i++)
etm4x_relaxed_write32(csa, state->trcseqevr[i], TRCSEQEVRn(i));
if (drvdata->nrseqstate) {
diff --git a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
index a9f19629f3f84..2a96a4c43a631 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
@@ -221,7 +221,7 @@ static ssize_t reset_store(struct device *dev,
config->vipcssctlr = 0x0;
/* Disable seq events */
- for (i = 0; i < drvdata->nrseqstate-1; i++)
+ for (i = 0; i < drvdata->nr_seq_ctrls; i++)
config->seq_ctrl[i] = 0x0;
config->seq_rst = 0x0;
config->seq_state = 0x0;
@@ -1393,9 +1393,11 @@ static ssize_t seq_idx_store(struct device *dev,
struct etmv4_drvdata *drvdata = dev_get_drvdata(dev->parent);
struct etmv4_config *config = &drvdata->config;
+ if (!drvdata->nr_seq_ctrls)
+ return -ENOTSUPP;
if (kstrtoul(buf, 16, &val))
return -EINVAL;
- if (val >= drvdata->nrseqstate - 1)
+ if (val >= drvdata->nr_seq_ctrls)
return -EINVAL;
/*
diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h
index b2ee6f771cf76..e8fe685a76015 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x.h
+++ b/drivers/hwtracing/coresight/coresight-etm4x.h
@@ -570,6 +570,7 @@
#define ETM_MAX_NR_PE 8
#define ETMv4_MAX_CNTR 4
#define ETM_MAX_SEQ_STATES 4
+#define ETM_MAX_SEQ_TRANSITIONS 3
#define ETM_MAX_EXT_INP_SEL 4
#define ETM_MAX_EXT_INP 256
#define ETM_MAX_EXT_OUT 4
@@ -833,7 +834,7 @@ struct etmv4_config {
u32 vipcssctlr;
u8 seq_idx;
u8 syncfreq;
- u32 seq_ctrl[ETM_MAX_SEQ_STATES];
+ u32 seq_ctrl[ETM_MAX_SEQ_TRANSITIONS];
u32 seq_rst;
u32 seq_state;
u8 cntr_idx;
@@ -885,7 +886,7 @@ struct etmv4_save_state {
u32 trcvissctlr;
u32 trcvipcssctlr;
- u32 trcseqevr[ETM_MAX_SEQ_STATES];
+ u32 trcseqevr[ETM_MAX_SEQ_TRANSITIONS];
u32 trcseqrstevr;
u32 trcseqstr;
u32 trcextinselr;
@@ -938,6 +939,7 @@ struct etmv4_save_state {
* @numcidc: Number of contextID comparators.
* @numvmidc: Number of VMID comparators.
* @nrseqstate: The number of sequencer states that are implemented.
+ * @nr_seq_ctrls: The number of sequence state transition control registers.
* @nr_event: Indicates how many events the trace unit support.
* @nr_resource:The number of resource selection pairs available for tracing.
* @nr_ss_cmp: Number of single-shot comparator controls that are available.
@@ -1004,6 +1006,7 @@ struct etmv4_drvdata {
u8 numextinsel;
u8 numvmidc;
u8 nrseqstate;
+ u8 nr_seq_ctrls;
u8 nr_event;
u8 nr_resource;
u8 nr_ss_cmp;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0961/1376] coresight: etm4x: fix leaked trace id
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (959 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0960/1376] coresight: etm4x: fix underflow for usage of (nrseqstate - 1) Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0962/1376] regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling Greg Kroah-Hartman
` (37 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jie Gan, Leo Yan, Yeoreum Yun,
Suzuki K Poulose, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yeoreum Yun <yeoreum.yun@arm.com>
[ Upstream commit 467e5862ccb0eed907002f4c6d3badfe34360940 ]
If etm4_enable_sysfs() fails in cscfg_csdev_enable_active_config(),
the trace ID may be leaked because it is not released.
To address this, call etm4_release_trace_id() when etm4_enable_sysfs()
fails in cscfg_csdev_enable_active_config().
Fixes: 7ebd0ec6cf94 ("coresight: configfs: Allow configfs to activate configuration")
Reviewed-by: Jie Gan <jie.gan@oss.qualcomm.com>
Reviewed-by: Leo Yan <leo.yan@arm.com>
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20260725113645.57519-4-yeoreum.yun@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwtracing/coresight/coresight-etm4x-core.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
index 0157dc5b08928..312abd57ddce9 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
@@ -854,8 +854,10 @@ static int etm4_enable_sysfs(struct coresight_device *csdev)
cscfg_config_sysfs_get_active_cfg(&cfg_hash, &preset);
if (cfg_hash) {
ret = cscfg_csdev_enable_active_config(csdev, cfg_hash, preset);
- if (ret)
+ if (ret) {
+ etm4_release_trace_id(drvdata);
return ret;
+ }
}
spin_lock(&drvdata->spinlock);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0962/1376] regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (960 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0961/1376] coresight: etm4x: fix leaked trace id Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0963/1376] ACPI: video: Release PCI device reference after lookup Greg Kroah-Hartman
` (36 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Konrad Dybcio,
Kamal Wadhwa, Mark Brown, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kamal Wadhwa <kamal.wadhwa@oss.qualcomm.com>
[ Upstream commit abd14bebb87e0fa2749371272c8b31d6ee5f0a36 ]
Currently, when `rpmh_regulator_set_mode_bypass()` helper function
is called to set bypass mode, it sends PMIC4's BOB bypass mode
value for even if its a PMIC5 BOB.
To fix this, introduce new hw_data parameter`pmic_bypass_mode`
to store bypass mode value. Use it to send correct PMIC bypass
mode value that corresponds to PMIC4/5 BOB regulators from the
helper function.
Fixes: 610f29e5cc0e8d58 ("regulator: qcom-rpmh: Update PMIC modes for PMIC5")
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Kamal Wadhwa <kamal.wadhwa@oss.qualcomm.com>
Link: https://patch.msgid.link/20260801-b4-read-rpmh-v5-v6-2-9fcb54928523@oss.qualcomm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/qcom-rpmh-regulator.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/regulator/qcom-rpmh-regulator.c b/drivers/regulator/qcom-rpmh-regulator.c
index 7870722b6ee21..62fd0da48407a 100644
--- a/drivers/regulator/qcom-rpmh-regulator.c
+++ b/drivers/regulator/qcom-rpmh-regulator.c
@@ -77,6 +77,7 @@ enum rpmh_regulator_type {
* @hpm_min_load_uA: Minimum load current in microamps that requires
* high power mode (HPM) operation. This is used
* for LDO hardware type regulators only.
+ * @pmic_bypass_mode: The PMIC bypass mode value.
* @pmic_mode_map: Array indexed by regulator framework mode
* containing PMIC hardware modes. Must be large
* enough to index all framework modes supported
@@ -91,6 +92,7 @@ struct rpmh_vreg_hw_data {
int n_linear_ranges;
int n_voltages;
int hpm_min_load_uA;
+ int pmic_bypass_mode;
const int *pmic_mode_map;
unsigned int (*of_map_mode)(unsigned int mode);
};
@@ -277,7 +279,7 @@ static int rpmh_regulator_vrm_set_mode_bypass(struct rpmh_vreg *vreg,
return pmic_mode;
if (bypassed)
- cmd.data = PMIC4_BOB_MODE_PASS;
+ cmd.data = vreg->hw_data->pmic_bypass_mode;
else
cmd.data = pmic_mode;
@@ -692,6 +694,7 @@ static const struct rpmh_vreg_hw_data pmic4_bob = {
},
.n_linear_ranges = 1,
.n_voltages = 84,
+ .pmic_bypass_mode = PMIC4_BOB_MODE_PASS,
.pmic_mode_map = pmic_mode_map_pmic4_bob,
.of_map_mode = rpmh_regulator_pmic4_bob_of_map_mode,
};
@@ -900,6 +903,7 @@ static const struct rpmh_vreg_hw_data pmic5_bob = {
},
.n_linear_ranges = 1,
.n_voltages = 32,
+ .pmic_bypass_mode = PMIC5_BOB_MODE_PASS,
.pmic_mode_map = pmic_mode_map_pmic5_bob,
.of_map_mode = rpmh_regulator_pmic4_bob_of_map_mode,
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0963/1376] ACPI: video: Release PCI device reference after lookup
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (961 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0962/1376] regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0964/1376] perf/x86/intel/pt: Add support for pause / resume Greg Kroah-Hartman
` (35 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuho Choi, Rafael J. Wysocki,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <dbgh9129@gmail.com>
[ Upstream commit 3d7ed9b8ef47b8bcae1fc3e12f7590a217862a89 ]
video_detect_portege_r100() uses pci_get_device() only as a boolean
check for the Trident CyberBlade XP4m32 device. pci_get_device() takes a
reference on a matching PCI device, but the callback returns without
releasing it.
Drop the reference after selecting the vendor backlight quirk so the PCI
device can be released normally.
Fixes: 35a341c9b25d ("ACPI: video: Add acpi_backlight=vendor quirk for Toshiba Portégé R100")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Link: https://patch.msgid.link/20260807015734.913361-1-dbgh9129@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/video_detect.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
index 2c120ade8f51a..2a562cb425081 100644
--- a/drivers/acpi/video_detect.c
+++ b/drivers/acpi/video_detect.c
@@ -137,8 +137,10 @@ static int video_detect_portege_r100(const struct dmi_system_id *d)
struct pci_dev *dev;
/* Search for Trident CyberBlade XP4m32 to confirm Portégé R100 */
dev = pci_get_device(PCI_VENDOR_ID_TRIDENT, 0x2100, NULL);
- if (dev)
+ if (dev) {
acpi_backlight_dmi = acpi_backlight_vendor;
+ pci_dev_put(dev);
+ }
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0964/1376] perf/x86/intel/pt: Add support for pause / resume
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (962 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0963/1376] ACPI: video: Release PCI device reference after lookup Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0965/1376] perf/x86/intel/pt: Factor out pt_config_enable() Greg Kroah-Hartman
` (34 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrian Hunter,
Peter Zijlstra (Intel), Andi Kleen, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <adrian.hunter@intel.com>
[ Upstream commit 08c7454ceb948d773fcd0ff7b6fb9c315e2f801a ]
Prevent tracing to start if aux_paused.
Implement support for PERF_EF_PAUSE / PERF_EF_RESUME. When aux_paused, stop
tracing. When not aux_paused, only start tracing if it isn't currently
meant to be stopped.
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Andi Kleen <ak@linux.intel.com>
Link: https://lkml.kernel.org/r/20241022155920.17511-4-adrian.hunter@intel.com
Stable-dep-of: 2e17bf3a469a ("perf/x86/intel/pt: Fix stop/start with no update")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/events/intel/pt.c | 73 ++++++++++++++++++++++++++++++++++++--
arch/x86/events/intel/pt.h | 4 +++
2 files changed, 74 insertions(+), 3 deletions(-)
diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c
index a087bc0c54987..4b0373bc8ab44 100644
--- a/arch/x86/events/intel/pt.c
+++ b/arch/x86/events/intel/pt.c
@@ -418,6 +418,9 @@ static void pt_config_start(struct perf_event *event)
struct pt *pt = this_cpu_ptr(&pt_ctx);
u64 ctl = event->hw.aux_config;
+ if (READ_ONCE(event->hw.aux_paused))
+ return;
+
ctl |= RTIT_CTL_TRACEEN;
if (READ_ONCE(pt->vmx_on))
perf_aux_output_flag(&pt->handle, PERF_AUX_FLAG_PARTIAL);
@@ -534,7 +537,24 @@ static void pt_config(struct perf_event *event)
reg |= (event->attr.config & PT_CONFIG_MASK);
event->hw.aux_config = reg;
+
+ /*
+ * Allow resume before starting so as not to overwrite a value set by a
+ * PMI.
+ */
+ barrier();
+ WRITE_ONCE(pt->resume_allowed, 1);
+ /* Configuration is complete, it is now OK to handle an NMI */
+ barrier();
+ WRITE_ONCE(pt->handle_nmi, 1);
+ barrier();
pt_config_start(event);
+ barrier();
+ /*
+ * Allow pause after starting so its pt_config_stop() doesn't race with
+ * pt_config_start().
+ */
+ WRITE_ONCE(pt->pause_allowed, 1);
}
static void pt_config_stop(struct perf_event *event)
@@ -1516,6 +1536,7 @@ void intel_pt_interrupt(void)
buf = perf_aux_output_begin(&pt->handle, event);
if (!buf) {
event->hw.state = PERF_HES_STOPPED;
+ WRITE_ONCE(pt->resume_allowed, 0);
return;
}
@@ -1524,6 +1545,7 @@ void intel_pt_interrupt(void)
ret = pt_buffer_reset_markers(buf, &pt->handle);
if (ret) {
perf_aux_output_end(&pt->handle, 0);
+ WRITE_ONCE(pt->resume_allowed, 0);
return;
}
@@ -1578,6 +1600,26 @@ static void pt_event_start(struct perf_event *event, int mode)
struct pt *pt = this_cpu_ptr(&pt_ctx);
struct pt_buffer *buf;
+ if (mode & PERF_EF_RESUME) {
+ if (READ_ONCE(pt->resume_allowed)) {
+ u64 status;
+
+ /*
+ * Only if the trace is not active and the error and
+ * stopped bits are clear, is it safe to start, but a
+ * PMI might have just cleared these, so resume_allowed
+ * must be checked again also.
+ */
+ rdmsrl(MSR_IA32_RTIT_STATUS, status);
+ if (!(status & (RTIT_STATUS_TRIGGEREN |
+ RTIT_STATUS_ERROR |
+ RTIT_STATUS_STOPPED)) &&
+ READ_ONCE(pt->resume_allowed))
+ pt_config_start(event);
+ }
+ return;
+ }
+
buf = perf_aux_output_begin(&pt->handle, event);
if (!buf)
goto fail_stop;
@@ -1588,7 +1630,6 @@ static void pt_event_start(struct perf_event *event, int mode)
goto fail_end_stop;
}
- WRITE_ONCE(pt->handle_nmi, 1);
hwc->state = 0;
pt_config_buffer(buf);
@@ -1606,6 +1647,12 @@ static void pt_event_stop(struct perf_event *event, int mode)
{
struct pt *pt = this_cpu_ptr(&pt_ctx);
+ if (mode & PERF_EF_PAUSE) {
+ if (READ_ONCE(pt->pause_allowed))
+ pt_config_stop(event);
+ return;
+ }
+
/*
* Protect against the PMI racing with disabling wrmsr,
* see comment in intel_pt_interrupt().
@@ -1613,6 +1660,15 @@ static void pt_event_stop(struct perf_event *event, int mode)
WRITE_ONCE(pt->handle_nmi, 0);
barrier();
+ /*
+ * Prevent a resume from attempting to restart tracing, or a pause
+ * during a subsequent start. Do this after clearing handle_nmi so that
+ * pt_event_snapshot_aux() will not re-allow them.
+ */
+ WRITE_ONCE(pt->pause_allowed, 0);
+ WRITE_ONCE(pt->resume_allowed, 0);
+ barrier();
+
pt_config_stop(event);
if (event->hw.state == PERF_HES_STOPPED)
@@ -1662,6 +1718,10 @@ static long pt_event_snapshot_aux(struct perf_event *event,
if (WARN_ON_ONCE(!buf->snapshot))
return 0;
+ /* Prevent pause/resume from attempting to start/stop tracing */
+ WRITE_ONCE(pt->pause_allowed, 0);
+ WRITE_ONCE(pt->resume_allowed, 0);
+ barrier();
/*
* There is no PT interrupt in this mode, so stop the trace and it will
* remain stopped while the buffer is copied.
@@ -1681,8 +1741,13 @@ static long pt_event_snapshot_aux(struct perf_event *event,
* Here, handle_nmi tells us if the tracing was on.
* If the tracing was on, restart it.
*/
- if (READ_ONCE(pt->handle_nmi))
+ if (READ_ONCE(pt->handle_nmi)) {
+ WRITE_ONCE(pt->resume_allowed, 1);
+ barrier();
pt_config_start(event);
+ barrier();
+ WRITE_ONCE(pt->pause_allowed, 1);
+ }
return ret;
}
@@ -1798,7 +1863,9 @@ static __init int pt_init(void)
if (!intel_pt_validate_hw_cap(PT_CAP_topa_multiple_entries))
pt_pmu.pmu.capabilities = PERF_PMU_CAP_AUX_NO_SG;
- pt_pmu.pmu.capabilities |= PERF_PMU_CAP_EXCLUSIVE | PERF_PMU_CAP_ITRACE;
+ pt_pmu.pmu.capabilities |= PERF_PMU_CAP_EXCLUSIVE |
+ PERF_PMU_CAP_ITRACE |
+ PERF_PMU_CAP_AUX_PAUSE;
pt_pmu.pmu.attr_groups = pt_attr_groups;
pt_pmu.pmu.task_ctx_nr = perf_sw_context;
pt_pmu.pmu.event_init = pt_event_init;
diff --git a/arch/x86/events/intel/pt.h b/arch/x86/events/intel/pt.h
index a1b6c04b7f684..7ee94fc6d7cb5 100644
--- a/arch/x86/events/intel/pt.h
+++ b/arch/x86/events/intel/pt.h
@@ -119,6 +119,8 @@ struct pt_filters {
* @filters: last configured filters
* @handle_nmi: do handle PT PMI on this cpu, there's an active event
* @vmx_on: 1 if VMX is ON on this cpu
+ * @pause_allowed: PERF_EF_PAUSE is allowed to stop tracing
+ * @resume_allowed: PERF_EF_RESUME is allowed to start tracing
* @output_base: cached RTIT_OUTPUT_BASE MSR value
* @output_mask: cached RTIT_OUTPUT_MASK MSR value
*/
@@ -127,6 +129,8 @@ struct pt {
struct pt_filters filters;
int handle_nmi;
int vmx_on;
+ int pause_allowed;
+ int resume_allowed;
u64 output_base;
u64 output_mask;
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0965/1376] perf/x86/intel/pt: Factor out pt_config_enable()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (963 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0964/1376] perf/x86/intel/pt: Add support for pause / resume Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0966/1376] perf/x86/intel/pt: Use bitwise access for PERF_HES_STOPPED Greg Kroah-Hartman
` (33 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrian Hunter,
Peter Zijlstra (Intel), Yi Lai, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <adrian.hunter@intel.com>
[ Upstream commit c6df517796189723ffbdd7679206c97d3642c2ef ]
pt_config() enables tracing by allowing NMIs and pause/resume, issuing
the necessary barriers, and calling pt_config_start(). A later change
needs to re-enable tracing on a (re-)start path without repeating the
full pt_config() setup (filters, RTIT_CTL, buffer configuration).
Factor that enabling sequence out into a new helper, pt_config_enable(),
so it can be called on its own.
No functional change intended.
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Tested-by: Yi Lai <yi1.lai@intel.com>
Link: https://patch.msgid.link/20260721070254.13557-2-adrian.hunter@intel.com
Stable-dep-of: 2e17bf3a469a ("perf/x86/intel/pt: Fix stop/start with no update")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/events/intel/pt.c | 41 ++++++++++++++++++++++----------------
1 file changed, 24 insertions(+), 17 deletions(-)
diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c
index 4b0373bc8ab44..94714c20cefbe 100644
--- a/arch/x86/events/intel/pt.c
+++ b/arch/x86/events/intel/pt.c
@@ -499,6 +499,29 @@ static u64 pt_config_filters(struct perf_event *event)
return rtit_ctl;
}
+static void pt_config_enable(struct perf_event *event)
+{
+ struct pt *pt = this_cpu_ptr(&pt_ctx);
+
+ /*
+ * Allow resume before starting so as not to overwrite a value set by a
+ * PMI.
+ */
+ barrier();
+ WRITE_ONCE(pt->resume_allowed, 1);
+ /* Configuration is complete, it is now OK to handle an NMI */
+ barrier();
+ WRITE_ONCE(pt->handle_nmi, 1);
+ barrier();
+ pt_config_start(event);
+ barrier();
+ /*
+ * Allow pause after starting so its pt_config_stop() doesn't race with
+ * pt_config_start().
+ */
+ WRITE_ONCE(pt->pause_allowed, 1);
+}
+
static void pt_config(struct perf_event *event)
{
struct pt *pt = this_cpu_ptr(&pt_ctx);
@@ -538,23 +561,7 @@ static void pt_config(struct perf_event *event)
event->hw.aux_config = reg;
- /*
- * Allow resume before starting so as not to overwrite a value set by a
- * PMI.
- */
- barrier();
- WRITE_ONCE(pt->resume_allowed, 1);
- /* Configuration is complete, it is now OK to handle an NMI */
- barrier();
- WRITE_ONCE(pt->handle_nmi, 1);
- barrier();
- pt_config_start(event);
- barrier();
- /*
- * Allow pause after starting so its pt_config_stop() doesn't race with
- * pt_config_start().
- */
- WRITE_ONCE(pt->pause_allowed, 1);
+ pt_config_enable(event);
}
static void pt_config_stop(struct perf_event *event)
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0966/1376] perf/x86/intel/pt: Use bitwise access for PERF_HES_STOPPED
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (964 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0965/1376] perf/x86/intel/pt: Factor out pt_config_enable() Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0967/1376] perf/x86/intel/pt: Fix stop/start with no update Greg Kroah-Hartman
` (32 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrian Hunter,
Peter Zijlstra (Intel), Yi Lai, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <adrian.hunter@intel.com>
[ Upstream commit 265bb4ef75fa657f4957d72087a6a246b89d5f0d ]
The Intel PT driver reads and writes event->hw.state as a whole value,
assuming it is either 0 or PERF_HES_STOPPED. That is true today, but a
subsequent fix needs to also track an open AUX output buffer using the
PERF_HES_UPTODATE bit of the same field.
When more than one bit can be set, whole-value assignments would
overwrite the other bits and whole-value comparisons would fail to match.
Convert all accesses to set, clear and test the PERF_HES_STOPPED bit
individually, in preparation for that change.
No functional change intended: event->hw.state currently only ever
holds 0 or PERF_HES_STOPPED, so the bitwise forms are equivalent.
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Tested-by: Yi Lai <yi1.lai@intel.com>
Link: https://patch.msgid.link/20260721070254.13557-3-adrian.hunter@intel.com
Stable-dep-of: 2e17bf3a469a ("perf/x86/intel/pt: Fix stop/start with no update")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/events/intel/pt.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c
index 94714c20cefbe..d060a705ea30f 100644
--- a/arch/x86/events/intel/pt.c
+++ b/arch/x86/events/intel/pt.c
@@ -1537,12 +1537,12 @@ void intel_pt_interrupt(void)
perf_aux_output_end(&pt->handle, local_xchg(&buf->data_size, 0));
- if (!event->hw.state) {
+ if (!(event->hw.state & PERF_HES_STOPPED)) {
int ret;
buf = perf_aux_output_begin(&pt->handle, event);
if (!buf) {
- event->hw.state = PERF_HES_STOPPED;
+ event->hw.state |= PERF_HES_STOPPED;
WRITE_ONCE(pt->resume_allowed, 0);
return;
}
@@ -1637,7 +1637,7 @@ static void pt_event_start(struct perf_event *event, int mode)
goto fail_end_stop;
}
- hwc->state = 0;
+ hwc->state &= ~PERF_HES_STOPPED;
pt_config_buffer(buf);
pt_config(event);
@@ -1647,7 +1647,7 @@ static void pt_event_start(struct perf_event *event, int mode)
fail_end_stop:
perf_aux_output_end(&pt->handle, 0);
fail_stop:
- hwc->state = PERF_HES_STOPPED;
+ hwc->state |= PERF_HES_STOPPED;
}
static void pt_event_stop(struct perf_event *event, int mode)
@@ -1678,10 +1678,10 @@ static void pt_event_stop(struct perf_event *event, int mode)
pt_config_stop(event);
- if (event->hw.state == PERF_HES_STOPPED)
+ if (event->hw.state & PERF_HES_STOPPED)
return;
- event->hw.state = PERF_HES_STOPPED;
+ event->hw.state |= PERF_HES_STOPPED;
if (mode & PERF_EF_UPDATE) {
struct pt_buffer *buf = perf_get_aux(&pt->handle);
@@ -1776,10 +1776,10 @@ static int pt_event_add(struct perf_event *event, int mode)
if (mode & PERF_EF_START) {
pt_event_start(event, 0);
ret = -EINVAL;
- if (hwc->state == PERF_HES_STOPPED)
+ if (hwc->state & PERF_HES_STOPPED)
goto fail;
} else {
- hwc->state = PERF_HES_STOPPED;
+ hwc->state |= PERF_HES_STOPPED;
}
ret = 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0967/1376] perf/x86/intel/pt: Fix stop/start with no update
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (965 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0966/1376] perf/x86/intel/pt: Use bitwise access for PERF_HES_STOPPED Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0968/1376] sched/fair: Check CPU capacity before comparing group types during load balance Greg Kroah-Hartman
` (31 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrian Hunter,
Peter Zijlstra (Intel), Yi Lai, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <adrian.hunter@intel.com>
[ Upstream commit 2e17bf3a469a41457a3bc31b1f8fd66b6ce94a6d ]
If pt_event_stop() is called without PERF_EF_UPDATE flag, then
perf_aux_output_end() is not called. A subsequent call to pt_event_start()
will call perf_aux_output_begin() again which violates the rule against
nesting and triggers a WARNING in perf_aux_output_begin().
Originally, pt_event_stop() was never called without PERF_EF_UPDATE,
because the only code paths to do so are from event overflow, and Intel PT
does not do that.
However the introduction of group throttling by commit 9734e25fbf5ae
("perf: Fix the throttle logic for a group") meant that an Intel PT event
could be throttled if it was part of a group. Throttling calls PMU
->stop() / ->start() callbacks without flags.
An example is when AUX area sampling is used. The following commands
hit the issue:
echo 10000 > /proc/sys/kernel/perf_event_max_sample_rate
perf record -F32000 --aux-sample -e '{intel_pt//u,cycles:u}' \
-- bash -c 'for i in `seq 1 100000` ; do true ; done'
Use PERF_HES_UPTODATE to track whether perf_aux_output_begin() and
perf_aux_output_end() are balanced. A cleared PERF_HES_UPTODATE bit
indicates that an AUX output context is still open.
Amend pt_event_start() / pt_event_stop() accordingly so that begin/end
stay balanced:
- In non-snapshot mode, stop() always closes the buffer (the buffer may
have run out of space, and that accounting is done by the update), so
a following start() opens a fresh one as before.
- In snapshot/overwrite mode, stop() without PERF_EF_UPDATE leaves the
buffer open so that pt_event_snapshot_aux() can still copy from it,
and start() then only re-enables tracing instead of calling
perf_aux_output_begin() again.
Note that pt_event_del() calls pt_event_stop() with PERF_EF_UPDATE flag set
(as is required by the documentation), so a final call to
perf_aux_output_end() is assured.
Fixes: 52ca9ced3f707 ("perf/x86/intel/pt: Add Intel PT PMU driver")
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Tested-by: Yi Lai <yi1.lai@intel.com>
Link: https://patch.msgid.link/20260721070254.13557-4-adrian.hunter@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/events/intel/pt.c | 45 ++++++++++++++++++++++++++++++--------
1 file changed, 36 insertions(+), 9 deletions(-)
diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c
index d060a705ea30f..86f0b17446e6f 100644
--- a/arch/x86/events/intel/pt.c
+++ b/arch/x86/events/intel/pt.c
@@ -1537,6 +1537,8 @@ void intel_pt_interrupt(void)
perf_aux_output_end(&pt->handle, local_xchg(&buf->data_size, 0));
+ event->hw.state |= PERF_HES_UPTODATE;
+
if (!(event->hw.state & PERF_HES_STOPPED)) {
int ret;
@@ -1558,6 +1560,8 @@ void intel_pt_interrupt(void)
pt_config_buffer(buf);
pt_config_start(event);
+
+ event->hw.state &= ~PERF_HES_UPTODATE;
}
}
@@ -1627,6 +1631,18 @@ static void pt_event_start(struct perf_event *event, int mode)
return;
}
+ /*
+ * Re-start subsequent to a call to pt_event_stop() without the
+ * PERF_EF_UPDATE flag. Absence of PERF_HES_UPTODATE indicates that
+ * perf_aux_output_begin() has already been called. This path can
+ * come about only in snapshot/overwrite mode - see pt_event_stop().
+ */
+ if (!(hwc->state & PERF_HES_UPTODATE)) {
+ hwc->state &= ~PERF_HES_STOPPED;
+ pt_config_enable(event);
+ return;
+ }
+
buf = perf_aux_output_begin(&pt->handle, event);
if (!buf)
goto fail_stop;
@@ -1637,7 +1653,7 @@ static void pt_event_start(struct perf_event *event, int mode)
goto fail_end_stop;
}
- hwc->state &= ~PERF_HES_STOPPED;
+ hwc->state &= ~(PERF_HES_STOPPED | PERF_HES_UPTODATE);
pt_config_buffer(buf);
pt_config(event);
@@ -1647,12 +1663,13 @@ static void pt_event_start(struct perf_event *event, int mode)
fail_end_stop:
perf_aux_output_end(&pt->handle, 0);
fail_stop:
- hwc->state |= PERF_HES_STOPPED;
+ hwc->state |= PERF_HES_STOPPED | PERF_HES_UPTODATE;
}
static void pt_event_stop(struct perf_event *event, int mode)
{
struct pt *pt = this_cpu_ptr(&pt_ctx);
+ struct pt_buffer *buf;
if (mode & PERF_EF_PAUSE) {
if (READ_ONCE(pt->pause_allowed))
@@ -1678,17 +1695,24 @@ static void pt_event_stop(struct perf_event *event, int mode)
pt_config_stop(event);
- if (event->hw.state & PERF_HES_STOPPED)
- return;
-
event->hw.state |= PERF_HES_STOPPED;
- if (mode & PERF_EF_UPDATE) {
- struct pt_buffer *buf = perf_get_aux(&pt->handle);
+ if (event->hw.state & PERF_HES_UPTODATE)
+ return;
- if (!buf)
- return;
+ buf = perf_get_aux(&pt->handle);
+ if (!buf)
+ return;
+ /*
+ * When not in snapshot/overwrite mode, there is a possibility that the
+ * buffer has run out of space. The accounting for that is handled by
+ * the update, so always update in that case. Snapshot/overwrite mode is
+ * treated differently to allow for pt_event_snapshot_aux() which can
+ * still get called if the AUX-sampling event is not stopped until after
+ * PT is stopped.
+ */
+ if ((mode & PERF_EF_UPDATE) || !buf->snapshot) {
if (WARN_ON_ONCE(pt->handle.event != event))
return;
@@ -1703,6 +1727,7 @@ static void pt_event_stop(struct perf_event *event, int mode)
local_xchg(&buf->data_size,
buf->nr_pages << PAGE_SHIFT);
perf_aux_output_end(&pt->handle, local_xchg(&buf->data_size, 0));
+ event->hw.state |= PERF_HES_UPTODATE;
}
}
@@ -1773,6 +1798,8 @@ static int pt_event_add(struct perf_event *event, int mode)
if (pt->handle.event)
goto fail;
+ event->hw.state |= PERF_HES_UPTODATE;
+
if (mode & PERF_EF_START) {
pt_event_start(event, 0);
ret = -EINVAL;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0968/1376] sched/fair: Check CPU capacity before comparing group types during load balance
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (966 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0967/1376] perf/x86/intel/pt: Fix stop/start with no update Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0969/1376] Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event Greg Kroah-Hartman
` (30 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ricardo Neri, Peter Zijlstra (Intel),
Christian Loehle, Chen Yu, Tim Chen, Vincent Guittot,
Andrea Righi, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
[ Upstream commit 50b101f6e586b4417d060a976fd831cd87e86e2b ]
update_sd_pick_busiest() may incorrectly select a fully_busy group as the
busiest group when its per-CPU capacity exceeds that of the destination
CPU. This happens because the type of busiest group is initialized to
group_has_spare and allows the fully_busy group to win the type comparison.
update_sd_pick_busiest() should not choose a candidate scheduling group
with at most one runnable task if its per-CPU capacity is greater than that
of the destination CPU. Such a check already exists, but it is done too
late: after the type comparison, preventing a subsequent fully_busy group
of equal per-CPU capacity from being correctly selected.
Move this check to occur before comparing group types.
Fixes: 0b0695f2b34a ("sched/fair: Rework load_balance()")
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Christian Loehle <christian.loehle@arm.com>
Reviewed-by: Chen Yu <yu.c.chen@intel.com>
Reviewed-by: Tim Chen <tim.c.chen@linux.intel.com>
Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
Tested-by: Christian Loehle <christian.loehle@arm.com>
Tested-by: Andrea Righi <arighi@nvidia.com>
Link: https://patch.msgid.link/20260720-rneri-fix-cas-clusters-v6-3-bb500bf4afd4@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sched/fair.c | 22 +++++++++++-----------
1 file changed, 11 insertions(+), 11 deletions(-)
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 4be1df2b90df0..616ad9f86b228 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -10537,6 +10537,17 @@ static bool update_sd_pick_busiest(struct lb_env *env,
sds->local_stat.group_type != group_has_spare))
return false;
+ /*
+ * Candidate sg has no more than one task per CPU and has higher
+ * per-CPU capacity. Migrating tasks to less capable CPUs may harm
+ * throughput. Maximize throughput, power/energy consequences are not
+ * considered.
+ */
+ if ((env->sd->flags & SD_ASYM_CPUCAPACITY) &&
+ (sgs->group_type <= group_fully_busy) &&
+ (capacity_greater(sg->sgc->min_capacity, capacity_of(env->dst_cpu))))
+ return false;
+
if (sgs->group_type > busiest->group_type)
return true;
@@ -10638,17 +10649,6 @@ static bool update_sd_pick_busiest(struct lb_env *env,
break;
}
- /*
- * Candidate sg has no more than one task per CPU and has higher
- * per-CPU capacity. Migrating tasks to less capable CPUs may harm
- * throughput. Maximize throughput, power/energy consequences are not
- * considered.
- */
- if ((env->sd->flags & SD_ASYM_CPUCAPACITY) &&
- (sgs->group_type <= group_fully_busy) &&
- (capacity_greater(sg->sgc->min_capacity, capacity_of(env->dst_cpu))))
- return false;
-
return true;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0969/1376] Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (967 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0968/1376] sched/fair: Check CPU capacity before comparing group types during load balance Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0970/1376] Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() Greg Kroah-Hartman
` (29 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bartosz Golaszewski, Zijun Hu,
Luiz Augusto von Dentz, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <zijun.hu@oss.qualcomm.com>
[ Upstream commit cf81f0a3db2a5c34ee6e4ea379c631fab6d13e01 ]
qca_set_bdaddr() waits for HCI_EV_VENDOR when sending
EDL_WRITE_BD_ADDR_OPCODE (0xFC14), but the controller responds with
Command Complete event as confirmed by btmon on WCN7850:
< HCI Command: Vendor (0x3f|0x0014) plen 6 #3 [hci0]
11 22 33 44 55 66
> HCI Event: Command Complete (0x0e) plen 4 #4 [hci0]
Vendor (0x3f|0x0014) ncmd 1
Status: Success (0x00)
Fix by passing 0 as the event parameter to __hci_cmd_sync_ev() to
wait for the command complete event instead.
Fixes: 5c0a1001c8be ("Bluetooth: hci_qca: Add helper to set device address")
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btqca.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/bluetooth/btqca.c b/drivers/bluetooth/btqca.c
index 083a599eec74d..c6709791d59cc 100644
--- a/drivers/bluetooth/btqca.c
+++ b/drivers/bluetooth/btqca.c
@@ -996,8 +996,7 @@ int qca_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr)
baswap(&bdaddr_swapped, bdaddr);
skb = __hci_cmd_sync_ev(hdev, EDL_WRITE_BD_ADDR_OPCODE, 6,
- &bdaddr_swapped, HCI_EV_VENDOR,
- HCI_INIT_TIMEOUT);
+ &bdaddr_swapped, 0, HCI_INIT_TIMEOUT);
if (IS_ERR(skb)) {
err = PTR_ERR(skb);
bt_dev_err(hdev, "QCA Change address cmd failed (%d)", err);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0970/1376] Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (968 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0969/1376] Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0971/1376] Bluetooth: btusb: refactor endpoint lookup Greg Kroah-Hartman
` (28 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zijun Hu, Luiz Augusto von Dentz,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <zijun.hu@oss.qualcomm.com>
[ Upstream commit d0b15d812688d3f0f3fe1c4426e12814d0c294dc ]
btusb_set_bdaddr_wcn6855() sends the address without swapping byte
order for VSC 0xFC14, but the command expects the address in reversed
byte order compared to other HCI commands like HCI_Create_Connection,
resulting in a wrong BD_ADDR being set.
btmon log on WCN6855 shows VSC 0xFC14 is sent with swapped bytes
11 22 33 44 55 66, and Read BD ADDR returns the expected address
11:22:33:44:55:66:
< HCI Command: Vendor (0x3f|0x0014) plen 6 #3 [hci0]
11 22 33 44 55 66
> HCI Event: Command Complete (0x0e) plen 4 #4 [hci0]
Vendor (0x3f|0x0014) ncmd 1
Status: Success (0x00)
< HCI Command: Read BD ADDR (0x04|0x0009) plen 0 #11 [hci0]
> HCI Event: Command Complete (0x0e) plen 10 #12 [hci0]
Read BD ADDR (0x04|0x0009) ncmd 1
Status: Success (0x00)
Address: 11:22:33:44:55:66 (OUI 11-22-33)
Fix by swapping the input address before issuing the command.
Fixes: b40f58b97386 ("Bluetooth: btusb: Add Qualcomm Bluetooth SoC WCN6855 support")
Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btusb.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 047652598ab6c..75e84a7e5abfd 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -2990,14 +2990,15 @@ static int btusb_set_bdaddr_ath3012(struct hci_dev *hdev,
static int btusb_set_bdaddr_wcn6855(struct hci_dev *hdev,
const bdaddr_t *bdaddr)
{
+ bdaddr_t bdaddr_swapped;
struct sk_buff *skb;
- u8 buf[6];
long ret;
- memcpy(buf, bdaddr, sizeof(bdaddr_t));
+ baswap(&bdaddr_swapped, bdaddr);
- skb = __hci_cmd_sync_ev(hdev, 0xfc14, sizeof(buf), buf,
- HCI_EV_CMD_COMPLETE, HCI_INIT_TIMEOUT);
+ skb = __hci_cmd_sync_ev(hdev, 0xfc14, sizeof(bdaddr_swapped),
+ &bdaddr_swapped, HCI_EV_CMD_COMPLETE,
+ HCI_INIT_TIMEOUT);
if (IS_ERR(skb)) {
ret = PTR_ERR(skb);
bt_dev_err(hdev, "Change address command failed (%ld)", ret);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0971/1376] Bluetooth: btusb: refactor endpoint lookup
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (969 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0970/1376] Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0972/1376] Bluetooth: btusb: Record matched usb_device_id into btusb_data Greg Kroah-Hartman
` (27 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johan Hovold, Luiz Augusto von Dentz,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 5c31aaa05624b54dc18c9e313bcee5a88c025593 ]
Use the common USB helper for looking up bulk and interrupt endpoints
instead of open coding.
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Stable-dep-of: 33c6a8d01889 ("Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btusb.c | 51 ++++++---------------------------------
1 file changed, 8 insertions(+), 43 deletions(-)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 75e84a7e5abfd..4299ba57d48f8 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -3597,31 +3597,14 @@ static inline int __set_diag_interface(struct hci_dev *hdev)
{
struct btusb_data *data = hci_get_drvdata(hdev);
struct usb_interface *intf = data->diag;
- int i;
+ int ret;
if (!data->diag)
return -ENODEV;
- data->diag_tx_ep = NULL;
- data->diag_rx_ep = NULL;
-
- for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
- struct usb_endpoint_descriptor *ep_desc;
-
- ep_desc = &intf->cur_altsetting->endpoint[i].desc;
-
- if (!data->diag_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
- data->diag_tx_ep = ep_desc;
- continue;
- }
-
- if (!data->diag_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
- data->diag_rx_ep = ep_desc;
- continue;
- }
- }
-
- if (!data->diag_tx_ep || !data->diag_rx_ep) {
+ ret = usb_find_common_endpoints(intf->cur_altsetting, &data->diag_rx_ep,
+ &data->diag_tx_ep, NULL, NULL);
+ if (ret) {
bt_dev_err(hdev, "invalid diagnostic descriptors");
return -ENODEV;
}
@@ -3822,12 +3805,11 @@ static const struct file_operations force_poll_sync_fops = {
static int btusb_probe(struct usb_interface *intf,
const struct usb_device_id *id)
{
- struct usb_endpoint_descriptor *ep_desc;
struct gpio_desc *reset_gpio;
struct btusb_data *data;
struct hci_dev *hdev;
unsigned ifnum_base;
- int i, err, priv_size;
+ int err, priv_size;
BT_DBG("intf %p id %p", intf, id);
@@ -3864,26 +3846,9 @@ static int btusb_probe(struct usb_interface *intf,
if (!data)
return -ENOMEM;
- for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
- ep_desc = &intf->cur_altsetting->endpoint[i].desc;
-
- if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) {
- data->intr_ep = ep_desc;
- continue;
- }
-
- if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
- data->bulk_tx_ep = ep_desc;
- continue;
- }
-
- if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
- data->bulk_rx_ep = ep_desc;
- continue;
- }
- }
-
- if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep) {
+ err = usb_find_common_endpoints(intf->cur_altsetting, &data->bulk_rx_ep,
+ &data->bulk_tx_ep, &data->intr_ep, NULL);
+ if (err) {
kfree(data);
return -ENODEV;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0972/1376] Bluetooth: btusb: Record matched usb_device_id into btusb_data
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (970 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0971/1376] Bluetooth: btusb: refactor endpoint lookup Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0973/1376] Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices Greg Kroah-Hartman
` (26 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zijun Hu, Luiz Augusto von Dentz,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <zijun.hu@oss.qualcomm.com>
[ Upstream commit ff50db7a522e7bd3bd1c4db6da715e4bdb53af97 ]
Add @match_id to btusb_data to record the matched usb_device_id
which will be used later.
Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Stable-dep-of: 33c6a8d01889 ("Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btusb.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 4299ba57d48f8..662c9651cc9db 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -949,6 +949,7 @@ struct btusb_data {
bool usb_alt6_packet_flow;
int isoc_altsetting;
int suspend_count;
+ const struct usb_device_id *match_id;
int (*recv_event)(struct hci_dev *hdev, struct sk_buff *skb);
int (*recv_acl)(struct hci_dev *hdev, struct sk_buff *skb);
@@ -3846,6 +3847,7 @@ static int btusb_probe(struct usb_interface *intf,
if (!data)
return -ENOMEM;
+ data->match_id = id;
err = usb_find_common_endpoints(intf->cur_altsetting, &data->bulk_rx_ep,
&data->bulk_tx_ep, &data->intr_ep, NULL);
if (err) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0973/1376] Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (971 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0972/1376] Bluetooth: btusb: Record matched usb_device_id into btusb_data Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0974/1376] perf trace-event: Fix integer truncation in do_read() and skip() Greg Kroah-Hartman
` (25 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zijun Hu, Luiz Augusto von Dentz,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <zijun.hu@oss.qualcomm.com>
[ Upstream commit 33c6a8d01889a84cc773c0c20c8323bce84af27d ]
Devcoredump is not enabled for ATH3012 or QCA_ROME, but they
unconditionally populate devcoredump fields in btusb_setup_qca().
Fix by populating devcoredump fields only when BTUSB_QCA_WCN6855 is
set, which marks the first generation of QCA BT SoCs for which
devcoredump is enabled.
Fixes: 20981ce2d5a5 ("Bluetooth: btusb: Add WCN6855 devcoredump support")
Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btusb.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 662c9651cc9db..941f2968bced1 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -3570,8 +3570,10 @@ static int btusb_setup_qca(struct hci_dev *hdev)
if (err)
return err;
- btdata->qca_dump.fw_version = le32_to_cpu(ver.patch_version);
- btdata->qca_dump.controller_id = le32_to_cpu(ver.rom_version);
+ if (btdata->match_id->driver_info & BTUSB_QCA_WCN6855) {
+ btdata->qca_dump.fw_version = le32_to_cpu(ver.patch_version);
+ btdata->qca_dump.controller_id = le32_to_cpu(ver.rom_version);
+ }
if (!(status & QCA_SYSCFG_UPDATED)) {
err = btusb_setup_qca_load_nvm(hdev, &ver, info);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0974/1376] perf trace-event: Fix integer truncation in do_read() and skip()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (972 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0973/1376] Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0975/1376] block/bdev: lift block size restrictions to 64k Greg Kroah-Hartman
` (24 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tanushree Shah, Namhyung Kim,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tanushree Shah <tshah@linux.ibm.com>
[ Upstream commit c108c1391be0826920991d24532fbae8f6373ddc ]
The do_read() and skip() functions use 'int' for size parameters,
truncating 64-bit sizes from callers. This causes two issues:
1. Uninitialized memory dump: do_read() reads fewer bytes than
allocated, leaving uninitialized heap memory that gets written
to output files.
2. Out-of-bounds read: Parsing functions process the full 64-bit
size while only partial data was read into the buffer.
Change do_read(), __do_read(), and skip() to use size_t for size
parameters and ssize_t for return values (where applicable), matching
read()/write() system calls.
Update callers to use ssize_t for storing return values.
Fixes: 4a31e56599d4 ("perf tools: Get rid of read_or_die() in trace-event-read.c")
Signed-off-by: Tanushree Shah <tshah@linux.ibm.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/trace-event-read.c | 28 ++++++++++++++--------------
1 file changed, 14 insertions(+), 14 deletions(-)
diff --git a/tools/perf/util/trace-event-read.c b/tools/perf/util/trace-event-read.c
index 72379cb8f5fd3..b0d3957c48e6c 100644
--- a/tools/perf/util/trace-event-read.c
+++ b/tools/perf/util/trace-event-read.c
@@ -25,18 +25,18 @@ static int input_fd;
static ssize_t trace_data_size;
static bool repipe;
-static int __do_read(int fd, void *buf, int size)
+static ssize_t __do_read(int fd, void *buf, size_t size)
{
- int rsize = size;
+ size_t rsize = size;
while (size) {
- int ret = read(fd, buf, size);
+ ssize_t ret = read(fd, buf, size);
if (ret <= 0)
return -1;
if (repipe) {
- int retw = write(STDOUT_FILENO, buf, ret);
+ ssize_t retw = write(STDOUT_FILENO, buf, ret);
if (retw <= 0 || retw != ret) {
pr_debug("repiping input file");
@@ -51,13 +51,13 @@ static int __do_read(int fd, void *buf, int size)
return rsize;
}
-static int do_read(void *data, int size)
+static ssize_t do_read(void *data, size_t size)
{
- int r;
+ ssize_t r;
r = __do_read(input_fd, data, size);
if (r <= 0) {
- pr_debug("reading input file (size expected=%d received=%d)",
+ pr_debug("reading input file (size expected=%zu received=%zd)",
size, r);
return -1;
}
@@ -68,10 +68,10 @@ static int do_read(void *data, int size)
}
/* If it fails, the next read will report it */
-static void skip(int size)
+static void skip(size_t size)
{
char buf[BUFSIZ];
- int r;
+ size_t r;
while (size) {
r = size > BUFSIZ ? BUFSIZ : size;
@@ -202,7 +202,7 @@ static int read_header_files(struct tep_handle *pevent)
unsigned long long size;
char *header_page;
char buf[BUFSIZ];
- int ret = 0;
+ ssize_t ret = 0;
if (do_read(buf, 12) < 0)
return -1;
@@ -250,7 +250,7 @@ static int read_header_files(struct tep_handle *pevent)
static int read_ftrace_file(struct tep_handle *pevent, unsigned long long size)
{
- int ret;
+ ssize_t ret;
char *buf;
buf = malloc(size);
@@ -276,7 +276,7 @@ static int read_ftrace_file(struct tep_handle *pevent, unsigned long long size)
static int read_event_file(struct tep_handle *pevent, char *sys,
unsigned long long size)
{
- int ret;
+ ssize_t ret;
char *buf;
buf = malloc(size);
@@ -322,7 +322,7 @@ static int read_event_files(struct tep_handle *pevent)
int systems;
int count;
int i,x;
- int ret;
+ ssize_t ret;
systems = read4(pevent);
@@ -350,7 +350,7 @@ static int read_saved_cmdline(struct tep_handle *pevent)
{
unsigned long long size;
char *buf;
- int ret;
+ ssize_t ret;
/* it can have 0 size */
size = read8(pevent);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0975/1376] block/bdev: lift block size restrictions to 64k
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (973 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0974/1376] perf trace-event: Fix integer truncation in do_read() and skip() Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0976/1376] scsi: core: Pass a struct scsi_driver to scsi_{,un}register_driver() Greg Kroah-Hartman
` (23 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hannes Reinecke,
Matthew Wilcox (Oracle), Luis Chamberlain, Christian Brauner,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luis Chamberlain <mcgrof@kernel.org>
[ Upstream commit 47dd67532303803a87f43195e088b3b4bcf0454d ]
We now can support blocksizes larger than PAGE_SIZE, so in theory
we should be able to lift the restriction up to the max supported page
cache order. However bound ourselves to what we can currently validate
and test. Through blktests and fstest we can validate up to 64k today.
Reviewed-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: "Matthew Wilcox (Oracle)" <willy@infradead.org>
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Link: https://lore.kernel.org/r/20250221223823.1680616-8-mcgrof@kernel.org
Signed-off-by: Christian Brauner <brauner@kernel.org>
Stable-dep-of: bb31844d88b7 ("scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/bdev.c | 3 +--
include/linux/blkdev.h | 8 +++++++-
2 files changed, 8 insertions(+), 3 deletions(-)
diff --git a/block/bdev.c b/block/bdev.c
index e96ff382a1ce9..1092998d28d42 100644
--- a/block/bdev.c
+++ b/block/bdev.c
@@ -198,8 +198,7 @@ int sb_set_blocksize(struct super_block *sb, int size)
{
if (set_blocksize(sb->s_bdev_file, size))
return 0;
- /* If we get here, we know size is power of two
- * and it's value is between 512 and PAGE_SIZE */
+ /* If we get here, we know size is validated */
sb->s_blocksize = size;
sb->s_blocksize_bits = blksize_bits(size);
return sb->s_blocksize;
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 33f5b16c0fd9a..5a90245fbd8ec 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -268,10 +268,16 @@ static inline dev_t disk_devt(struct gendisk *disk)
return MKDEV(disk->major, disk->first_minor);
}
+/*
+ * We should strive for 1 << (PAGE_SHIFT + MAX_PAGECACHE_ORDER)
+ * however we constrain this to what we can validate and test.
+ */
+#define BLK_MAX_BLOCK_SIZE SZ_64K
+
/* blk_validate_limits() validates bsize, so drivers don't usually need to */
static inline int blk_validate_block_size(unsigned long bsize)
{
- if (bsize < 512 || bsize > PAGE_SIZE || !is_power_of_2(bsize))
+ if (bsize < 512 || bsize > BLK_MAX_BLOCK_SIZE || !is_power_of_2(bsize))
return -EINVAL;
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0976/1376] scsi: core: Pass a struct scsi_driver to scsi_{,un}register_driver()
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (974 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0975/1376] block/bdev: lift block size restrictions to 64k Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0977/1376] scsi: core: sysfs: Make use of bus callbacks Greg Kroah-Hartman
` (22 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Wang, Uwe Kleine-König,
Bart Van Assche, Martin K. Petersen, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
[ Upstream commit 7d42bcea57ae139e2ed754425cc5fc44e260c890 ]
This aligns with what other subsystems do, reduces boilerplate a bit for
device drivers and is less error prone.
Reviewed-by: Peter Wang <peter.wang@mediatek.com>
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/ac17fdea58e384cb514c639306d48ce0005820b0.1766133330.git.u.kleine-koenig@baylibre.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Stable-dep-of: bb31844d88b7 ("scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/ch.c | 4 ++--
drivers/scsi/scsi_sysfs.c | 4 +++-
drivers/scsi/sd.c | 4 ++--
drivers/scsi/ses.c | 4 ++--
drivers/scsi/sr.c | 4 ++--
drivers/scsi/st.c | 4 ++--
drivers/ufs/core/ufshcd.c | 4 ++--
include/scsi/scsi_driver.h | 4 ++--
8 files changed, 17 insertions(+), 15 deletions(-)
diff --git a/drivers/scsi/ch.c b/drivers/scsi/ch.c
index fa07a6f54003e..f2b63e4b9b99e 100644
--- a/drivers/scsi/ch.c
+++ b/drivers/scsi/ch.c
@@ -1014,7 +1014,7 @@ static int __init init_ch_module(void)
SCSI_CHANGER_MAJOR);
goto fail1;
}
- rc = scsi_register_driver(&ch_template.gendrv);
+ rc = scsi_register_driver(&ch_template);
if (rc < 0)
goto fail2;
return 0;
@@ -1028,7 +1028,7 @@ static int __init init_ch_module(void)
static void __exit exit_ch_module(void)
{
- scsi_unregister_driver(&ch_template.gendrv);
+ scsi_unregister_driver(&ch_template);
unregister_chrdev(SCSI_CHANGER_MAJOR, "ch");
class_unregister(&ch_sysfs_class);
idr_destroy(&ch_index_idr);
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index e669768a7a5bf..7f69f0613c08c 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -1609,8 +1609,10 @@ void scsi_remove_target(struct device *dev)
}
EXPORT_SYMBOL(scsi_remove_target);
-int __scsi_register_driver(struct device_driver *drv, struct module *owner)
+int __scsi_register_driver(struct scsi_driver *sdrv, struct module *owner)
{
+ struct device_driver *drv = &sdrv->gendrv;
+
drv->bus = &scsi_bus_type;
drv->owner = owner;
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index ab5cf8460aca5..929d3c37879e5 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -4378,7 +4378,7 @@ static int __init init_sd(void)
goto err_out_class;
}
- err = scsi_register_driver(&sd_template.gendrv);
+ err = scsi_register_driver(&sd_template);
if (err)
goto err_out_driver;
@@ -4405,7 +4405,7 @@ static void __exit exit_sd(void)
SCSI_LOG_HLQUEUE(3, printk("exit_sd: exiting sd driver\n"));
- scsi_unregister_driver(&sd_template.gendrv);
+ scsi_unregister_driver(&sd_template);
mempool_destroy(sd_page_pool);
class_unregister(&sd_disk_class);
diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index 7e1f085ad350a..23d93cb110a6c 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -920,7 +920,7 @@ static int __init ses_init(void)
if (err)
return err;
- err = scsi_register_driver(&ses_template.gendrv);
+ err = scsi_register_driver(&ses_template);
if (err)
goto out_unreg;
@@ -933,7 +933,7 @@ static int __init ses_init(void)
static void __exit ses_exit(void)
{
- scsi_unregister_driver(&ses_template.gendrv);
+ scsi_unregister_driver(&ses_template);
scsi_unregister_interface(&ses_interface);
}
diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
index 803fc9c132298..3b71fee9cf3c7 100644
--- a/drivers/scsi/sr.c
+++ b/drivers/scsi/sr.c
@@ -994,7 +994,7 @@ static int __init init_sr(void)
rc = register_blkdev(SCSI_CDROM_MAJOR, "sr");
if (rc)
return rc;
- rc = scsi_register_driver(&sr_template.gendrv);
+ rc = scsi_register_driver(&sr_template);
if (rc)
unregister_blkdev(SCSI_CDROM_MAJOR, "sr");
@@ -1003,7 +1003,7 @@ static int __init init_sr(void)
static void __exit exit_sr(void)
{
- scsi_unregister_driver(&sr_template.gendrv);
+ scsi_unregister_driver(&sr_template);
unregister_blkdev(SCSI_CDROM_MAJOR, "sr");
}
diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index 3e982c166baf9..62d1ed02f7e8b 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -4510,7 +4510,7 @@ static int __init init_st(void)
goto err_class;
}
- err = scsi_register_driver(&st_template.gendrv);
+ err = scsi_register_driver(&st_template);
if (err)
goto err_chrdev;
@@ -4526,7 +4526,7 @@ static int __init init_st(void)
static void __exit exit_st(void)
{
- scsi_unregister_driver(&st_template.gendrv);
+ scsi_unregister_driver(&st_template);
unregister_chrdev_region(MKDEV(SCSI_TAPE_MAJOR, 0),
ST_MAX_TAPE_ENTRIES);
class_unregister(&st_sysfs_class);
diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
index 98bf5bc6f383e..bcbe478bc4032 100644
--- a/drivers/ufs/core/ufshcd.c
+++ b/drivers/ufs/core/ufshcd.c
@@ -10935,7 +10935,7 @@ static int __init ufshcd_core_init(void)
ufs_debugfs_init();
- ret = scsi_register_driver(&ufs_dev_wlun_template.gendrv);
+ ret = scsi_register_driver(&ufs_dev_wlun_template);
if (ret)
ufs_debugfs_exit();
return ret;
@@ -10944,7 +10944,7 @@ static int __init ufshcd_core_init(void)
static void __exit ufshcd_core_exit(void)
{
ufs_debugfs_exit();
- scsi_unregister_driver(&ufs_dev_wlun_template.gendrv);
+ scsi_unregister_driver(&ufs_dev_wlun_template);
}
module_init(ufshcd_core_init);
diff --git a/include/scsi/scsi_driver.h b/include/scsi/scsi_driver.h
index c0e89996bdb3f..40aba9a9349a6 100644
--- a/include/scsi/scsi_driver.h
+++ b/include/scsi/scsi_driver.h
@@ -25,9 +25,9 @@ struct scsi_driver {
#define scsi_register_driver(drv) \
__scsi_register_driver(drv, THIS_MODULE)
-int __scsi_register_driver(struct device_driver *, struct module *);
+int __scsi_register_driver(struct scsi_driver *, struct module *);
#define scsi_unregister_driver(drv) \
- driver_unregister(drv);
+ driver_unregister(&(drv)->gendrv);
extern int scsi_register_interface(struct class_interface *);
#define scsi_unregister_interface(intf) \
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0977/1376] scsi: core: sysfs: Make use of bus callbacks
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (975 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0976/1376] scsi: core: Pass a struct scsi_driver to scsi_{,un}register_driver() Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0978/1376] scsi: sd: Convert to SCSI bus methods Greg Kroah-Hartman
` (21 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Uwe Kleine-König, Peter Wang,
Bart Van Assche, Martin K. Petersen, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
[ Upstream commit f7d4f1bf5724e52de049c619beddd53c62206624 ]
Introduce a bus-specific probe, remove and shutdown function. For now
this only allows to get rid of a cast of the generic device to a SCSI
device in the drivers and changes the remove prototype to return
void---a non-zero return value is ignored anyhow.
The objective is to get rid of users of struct device_driver callbacks
.probe(), .remove() and .shutdown() to eventually remove these. Until
all SCSI drivers are converted, this results in a runtime warning about
the drivers needing an update because there is a bus probe function and
a driver probe function. The in-tree drivers are fixed by the following
commits.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
Reviewed-by: Peter Wang <peter.wang@mediatek.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/a54e363a3fd2054fb924afd7df44bca7f444b5f1.1766133330.git.u.kleine-koenig@baylibre.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Stable-dep-of: bb31844d88b7 ("scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/scsi_sysfs.c | 73 ++++++++++++++++++++++++++++++++++++--
include/scsi/scsi_driver.h | 3 ++
2 files changed, 74 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index 7f69f0613c08c..0b29cbcbd7e1f 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -554,10 +554,48 @@ static int scsi_bus_uevent(const struct device *dev, struct kobj_uevent_env *env
return 0;
}
+static int scsi_bus_probe(struct device *dev)
+{
+ struct scsi_device *sdp = to_scsi_device(dev);
+ struct scsi_driver *drv = to_scsi_driver(dev->driver);
+
+ if (drv->probe)
+ return drv->probe(sdp);
+ else
+ return 0;
+}
+
+static void scsi_bus_remove(struct device *dev)
+{
+ struct scsi_device *sdp = to_scsi_device(dev);
+ struct scsi_driver *drv = to_scsi_driver(dev->driver);
+
+ if (drv->remove)
+ drv->remove(sdp);
+}
+
+static void scsi_bus_shutdown(struct device *dev)
+{
+ struct scsi_device *sdp = to_scsi_device(dev);
+ struct scsi_driver *drv;
+
+ if (!dev->driver)
+ return;
+
+ drv = to_scsi_driver(dev->driver);
+
+ if (drv->shutdown)
+ drv->shutdown(sdp);
+}
+
+
const struct bus_type scsi_bus_type = {
- .name = "scsi",
- .match = scsi_bus_match,
+ .name = "scsi",
+ .match = scsi_bus_match,
.uevent = scsi_bus_uevent,
+ .probe = scsi_bus_probe,
+ .remove = scsi_bus_remove,
+ .shutdown = scsi_bus_shutdown,
#ifdef CONFIG_PM
.pm = &scsi_bus_pm_ops,
#endif
@@ -1609,6 +1647,30 @@ void scsi_remove_target(struct device *dev)
}
EXPORT_SYMBOL(scsi_remove_target);
+static int scsi_legacy_probe(struct scsi_device *sdp)
+{
+ struct device *dev = &sdp->sdev_gendev;
+ struct device_driver *driver = dev->driver;
+
+ return driver->probe(dev);
+}
+
+static void scsi_legacy_remove(struct scsi_device *sdp)
+{
+ struct device *dev = &sdp->sdev_gendev;
+ struct device_driver *driver = dev->driver;
+
+ driver->remove(dev);
+}
+
+static void scsi_legacy_shutdown(struct scsi_device *sdp)
+{
+ struct device *dev = &sdp->sdev_gendev;
+ struct device_driver *driver = dev->driver;
+
+ driver->shutdown(dev);
+}
+
int __scsi_register_driver(struct scsi_driver *sdrv, struct module *owner)
{
struct device_driver *drv = &sdrv->gendrv;
@@ -1616,6 +1678,13 @@ int __scsi_register_driver(struct scsi_driver *sdrv, struct module *owner)
drv->bus = &scsi_bus_type;
drv->owner = owner;
+ if (!sdrv->probe && drv->probe)
+ sdrv->probe = scsi_legacy_probe;
+ if (!sdrv->remove && drv->remove)
+ sdrv->remove = scsi_legacy_remove;
+ if (!sdrv->shutdown && drv->shutdown)
+ sdrv->shutdown = scsi_legacy_shutdown;
+
return driver_register(drv);
}
EXPORT_SYMBOL(__scsi_register_driver);
diff --git a/include/scsi/scsi_driver.h b/include/scsi/scsi_driver.h
index 40aba9a9349a6..249cea724abd1 100644
--- a/include/scsi/scsi_driver.h
+++ b/include/scsi/scsi_driver.h
@@ -12,6 +12,9 @@ struct request;
struct scsi_driver {
struct device_driver gendrv;
+ int (*probe)(struct scsi_device *);
+ void (*remove)(struct scsi_device *);
+ void (*shutdown)(struct scsi_device *);
int (*resume)(struct device *);
void (*rescan)(struct device *);
blk_status_t (*init_command)(struct scsi_cmnd *);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0978/1376] scsi: sd: Convert to SCSI bus methods
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (976 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0977/1376] scsi: core: sysfs: Make use of bus callbacks Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0979/1376] scsi: sd: Move the sd_remove() function definition Greg Kroah-Hartman
` (20 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Uwe Kleine-König,
Bart Van Assche, Martin K. Petersen, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
[ Upstream commit 63b541f054e7147f5a19fcd964677c189bad7cff ]
The SCSI subsystem has implemented dedicated callbacks for probe, remove
and shutdown. Make use of them. This fixes a runtime warning about the
driver needing to be converted to the bus probe method.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/8ad5a00c2ad2a64b81350ae3fab02fbe430f306d.1766133330.git.u.kleine-koenig@baylibre.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Stable-dep-of: bb31844d88b7 ("scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/sd.c | 25 +++++++++++++------------
1 file changed, 13 insertions(+), 12 deletions(-)
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 929d3c37879e5..7c15f36c218c3 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -108,7 +108,7 @@ static void sd_config_write_same(struct scsi_disk *sdkp,
struct queue_limits *lim);
static int sd_revalidate_disk(struct gendisk *);
static void sd_unlock_native_capacity(struct gendisk *disk);
-static void sd_shutdown(struct device *);
+static void sd_shutdown(struct scsi_device *);
static void scsi_disk_release(struct device *cdev);
static DEFINE_IDA(sd_index_ida);
@@ -3897,7 +3897,7 @@ static int sd_format_disk_name(char *prefix, int index, char *buf, int buflen)
* sd_probe - called during driver initialization and whenever a
* new scsi device is attached to the system. It is called once
* for each scsi device (not just disks) present.
- * @dev: pointer to device object
+ * @sdp: pointer to device object
*
* Returns 0 if successful (or not interested in this scsi device
* (e.g. scanner)); 1 when there is an error.
@@ -3911,9 +3911,9 @@ static int sd_format_disk_name(char *prefix, int index, char *buf, int buflen)
* Assume sd_probe is not re-entrant (for time being)
* Also think about sd_probe() and sd_remove() running coincidentally.
**/
-static int sd_probe(struct device *dev)
+static int sd_probe(struct scsi_device *sdp)
{
- struct scsi_device *sdp = to_scsi_device(dev);
+ struct device *dev = &sdp->sdev_gendev;
struct scsi_disk *sdkp;
struct gendisk *gd;
int index;
@@ -4054,15 +4054,16 @@ static int sd_probe(struct device *dev)
* sd_remove - called whenever a scsi disk (previously recognized by
* sd_probe) is detached from the system. It is called (potentially
* multiple times) during sd module unload.
- * @dev: pointer to device object
+ * @sdp: pointer to device object
*
* Note: this function is invoked from the scsi mid-level.
* This function potentially frees up a device name (e.g. /dev/sdc)
* that could be re-used by a subsequent sd_probe().
* This function is not called when the built-in sd driver is "exit-ed".
**/
-static int sd_remove(struct device *dev)
+static void sd_remove(struct scsi_device *sdp)
{
+ struct device *dev = &sdp->sdev_gendev;
struct scsi_disk *sdkp = dev_get_drvdata(dev);
scsi_autopm_get_device(sdkp->device);
@@ -4070,10 +4071,9 @@ static int sd_remove(struct device *dev)
device_del(&sdkp->disk_dev);
del_gendisk(sdkp->disk);
if (!sdkp->suspended)
- sd_shutdown(dev);
+ sd_shutdown(sdp);
put_disk(sdkp->disk);
- return 0;
}
static void scsi_disk_release(struct device *dev)
@@ -4160,8 +4160,9 @@ static int sd_start_stop_device(struct scsi_disk *sdkp, int start)
* the normal SCSI command structure. Wait for the command to
* complete.
*/
-static void sd_shutdown(struct device *dev)
+static void sd_shutdown(struct scsi_device *sdp)
{
+ struct device *dev = &sdp->sdev_gendev;
struct scsi_disk *sdkp = dev_get_drvdata(dev);
if (!sdkp)
@@ -4329,12 +4330,12 @@ static const struct dev_pm_ops sd_pm_ops = {
};
static struct scsi_driver sd_template = {
+ .probe = sd_probe,
+ .remove = sd_remove,
+ .shutdown = sd_shutdown,
.gendrv = {
.name = "sd",
- .probe = sd_probe,
.probe_type = PROBE_PREFER_ASYNCHRONOUS,
- .remove = sd_remove,
- .shutdown = sd_shutdown,
.pm = &sd_pm_ops,
},
.rescan = sd_rescan,
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0979/1376] scsi: sd: Move the sd_remove() function definition
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (977 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0978/1376] scsi: sd: Convert to SCSI bus methods Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0980/1376] scsi: sd: Move the sd_config_discard() " Greg Kroah-Hartman
` (19 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Himanshu Madhani,
Johannes Thumshirn, Bart Van Assche, Martin K. Petersen,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bvanassche@acm.org>
[ Upstream commit 4f39a4870a59971797be86fed72423b83b6b4e00 ]
Move the sd_remove() function definition such that the sd_shutdown()
forward declaration can be removed.
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20260114175054.4118163-2-bvanassche@acm.org
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Stable-dep-of: bb31844d88b7 ("scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/sd.c | 53 +++++++++++++++++++++++------------------------
1 file changed, 26 insertions(+), 27 deletions(-)
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 7c15f36c218c3..01e8d71c02547 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -108,7 +108,6 @@ static void sd_config_write_same(struct scsi_disk *sdkp,
struct queue_limits *lim);
static int sd_revalidate_disk(struct gendisk *);
static void sd_unlock_native_capacity(struct gendisk *disk);
-static void sd_shutdown(struct scsi_device *);
static void scsi_disk_release(struct device *cdev);
static DEFINE_IDA(sd_index_ida);
@@ -4050,32 +4049,6 @@ static int sd_probe(struct scsi_device *sdp)
return error;
}
-/**
- * sd_remove - called whenever a scsi disk (previously recognized by
- * sd_probe) is detached from the system. It is called (potentially
- * multiple times) during sd module unload.
- * @sdp: pointer to device object
- *
- * Note: this function is invoked from the scsi mid-level.
- * This function potentially frees up a device name (e.g. /dev/sdc)
- * that could be re-used by a subsequent sd_probe().
- * This function is not called when the built-in sd driver is "exit-ed".
- **/
-static void sd_remove(struct scsi_device *sdp)
-{
- struct device *dev = &sdp->sdev_gendev;
- struct scsi_disk *sdkp = dev_get_drvdata(dev);
-
- scsi_autopm_get_device(sdkp->device);
-
- device_del(&sdkp->disk_dev);
- del_gendisk(sdkp->disk);
- if (!sdkp->suspended)
- sd_shutdown(sdp);
-
- put_disk(sdkp->disk);
-}
-
static void scsi_disk_release(struct device *dev)
{
struct scsi_disk *sdkp = to_scsi_disk(dev);
@@ -4187,6 +4160,32 @@ static void sd_shutdown(struct scsi_device *sdp)
}
}
+/**
+ * sd_remove - called whenever a scsi disk (previously recognized by
+ * sd_probe) is detached from the system. It is called (potentially
+ * multiple times) during sd module unload.
+ * @sdp: pointer to device object
+ *
+ * Note: this function is invoked from the scsi mid-level.
+ * This function potentially frees up a device name (e.g. /dev/sdc)
+ * that could be re-used by a subsequent sd_probe().
+ * This function is not called when the built-in sd driver is "exit-ed".
+ **/
+static void sd_remove(struct scsi_device *sdp)
+{
+ struct device *dev = &sdp->sdev_gendev;
+ struct scsi_disk *sdkp = dev_get_drvdata(dev);
+
+ scsi_autopm_get_device(sdkp->device);
+
+ device_del(&sdkp->disk_dev);
+ del_gendisk(sdkp->disk);
+ if (!sdkp->suspended)
+ sd_shutdown(sdp);
+
+ put_disk(sdkp->disk);
+}
+
static inline bool sd_do_start_stop(struct scsi_device *sdev, bool runtime)
{
return (sdev->manage_system_start_stop && !runtime) ||
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0980/1376] scsi: sd: Move the sd_config_discard() function definition
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (978 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0979/1376] scsi: sd: Move the sd_remove() function definition Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0981/1376] scsi: sd: Enable sector size > PAGE_SIZE in SCSI sd driver Greg Kroah-Hartman
` (18 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Himanshu Madhani,
Johannes Thumshirn, Bart Van Assche, Martin K. Petersen,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bvanassche@acm.org>
[ Upstream commit c0daf4836114fcbdf64bf817cab00b75ce712945 ]
Move the sd_config_discard() function definition such that its
forward declaration can be removed.
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20260114175054.4118163-3-bvanassche@acm.org
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Stable-dep-of: bb31844d88b7 ("scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/sd.c | 114 +++++++++++++++++++++++-----------------------
1 file changed, 56 insertions(+), 58 deletions(-)
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 01e8d71c02547..d5f8701659a5a 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -102,8 +102,6 @@ MODULE_ALIAS_SCSI_DEVICE(TYPE_ZBC);
#define SD_MINORS 16
-static void sd_config_discard(struct scsi_disk *sdkp, struct queue_limits *lim,
- unsigned int mode);
static void sd_config_write_same(struct scsi_disk *sdkp,
struct queue_limits *lim);
static int sd_revalidate_disk(struct gendisk *);
@@ -120,6 +118,62 @@ static const char *sd_cache_types[] = {
"write back, no read (daft)"
};
+static void sd_disable_discard(struct scsi_disk *sdkp)
+{
+ sdkp->provisioning_mode = SD_LBP_DISABLE;
+ blk_queue_disable_discard(sdkp->disk->queue);
+}
+
+static void sd_config_discard(struct scsi_disk *sdkp, struct queue_limits *lim,
+ unsigned int mode)
+{
+ unsigned int logical_block_size = sdkp->device->sector_size;
+ unsigned int max_blocks = 0;
+
+ lim->discard_alignment = sdkp->unmap_alignment * logical_block_size;
+ lim->discard_granularity = max(sdkp->physical_block_size,
+ sdkp->unmap_granularity * logical_block_size);
+ sdkp->provisioning_mode = mode;
+
+ switch (mode) {
+
+ case SD_LBP_FULL:
+ case SD_LBP_DISABLE:
+ break;
+
+ case SD_LBP_UNMAP:
+ max_blocks = min_not_zero(sdkp->max_unmap_blocks,
+ (u32)SD_MAX_WS16_BLOCKS);
+ break;
+
+ case SD_LBP_WS16:
+ if (sdkp->device->unmap_limit_for_ws)
+ max_blocks = sdkp->max_unmap_blocks;
+ else
+ max_blocks = sdkp->max_ws_blocks;
+
+ max_blocks = min_not_zero(max_blocks, (u32)SD_MAX_WS16_BLOCKS);
+ break;
+
+ case SD_LBP_WS10:
+ if (sdkp->device->unmap_limit_for_ws)
+ max_blocks = sdkp->max_unmap_blocks;
+ else
+ max_blocks = sdkp->max_ws_blocks;
+
+ max_blocks = min_not_zero(max_blocks, (u32)SD_MAX_WS10_BLOCKS);
+ break;
+
+ case SD_LBP_ZERO:
+ max_blocks = min_not_zero(sdkp->max_ws_blocks,
+ (u32)SD_MAX_WS10_BLOCKS);
+ break;
+ }
+
+ lim->max_hw_discard_sectors = max_blocks *
+ (logical_block_size >> SECTOR_SHIFT);
+}
+
static void sd_set_flush_flag(struct scsi_disk *sdkp,
struct queue_limits *lim)
{
@@ -835,62 +889,6 @@ static unsigned char sd_setup_protect_cmnd(struct scsi_cmnd *scmd,
return protect;
}
-static void sd_disable_discard(struct scsi_disk *sdkp)
-{
- sdkp->provisioning_mode = SD_LBP_DISABLE;
- blk_queue_disable_discard(sdkp->disk->queue);
-}
-
-static void sd_config_discard(struct scsi_disk *sdkp, struct queue_limits *lim,
- unsigned int mode)
-{
- unsigned int logical_block_size = sdkp->device->sector_size;
- unsigned int max_blocks = 0;
-
- lim->discard_alignment = sdkp->unmap_alignment * logical_block_size;
- lim->discard_granularity = max(sdkp->physical_block_size,
- sdkp->unmap_granularity * logical_block_size);
- sdkp->provisioning_mode = mode;
-
- switch (mode) {
-
- case SD_LBP_FULL:
- case SD_LBP_DISABLE:
- break;
-
- case SD_LBP_UNMAP:
- max_blocks = min_not_zero(sdkp->max_unmap_blocks,
- (u32)SD_MAX_WS16_BLOCKS);
- break;
-
- case SD_LBP_WS16:
- if (sdkp->device->unmap_limit_for_ws)
- max_blocks = sdkp->max_unmap_blocks;
- else
- max_blocks = sdkp->max_ws_blocks;
-
- max_blocks = min_not_zero(max_blocks, (u32)SD_MAX_WS16_BLOCKS);
- break;
-
- case SD_LBP_WS10:
- if (sdkp->device->unmap_limit_for_ws)
- max_blocks = sdkp->max_unmap_blocks;
- else
- max_blocks = sdkp->max_ws_blocks;
-
- max_blocks = min_not_zero(max_blocks, (u32)SD_MAX_WS10_BLOCKS);
- break;
-
- case SD_LBP_ZERO:
- max_blocks = min_not_zero(sdkp->max_ws_blocks,
- (u32)SD_MAX_WS10_BLOCKS);
- break;
- }
-
- lim->max_hw_discard_sectors = max_blocks *
- (logical_block_size >> SECTOR_SHIFT);
-}
-
static void *sd_set_special_bvec(struct request *rq, unsigned int data_len)
{
struct page *page;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0981/1376] scsi: sd: Enable sector size > PAGE_SIZE in SCSI sd driver
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (979 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0980/1376] scsi: sd: Move the sd_config_discard() " Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0982/1376] scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails Greg Kroah-Hartman
` (17 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Swarna Prabhu,
Pankaj Raghav, Martin K. Petersen, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Swarna Prabhu <sw.prabhu6@gmail.com>
[ Upstream commit 7179e626b76eb42f2529c6f6dd6ba88ea2445372 ]
The WRITE SAME(16) and WRITE SAME(10) SCSI commands use a page from a
dedicated mempool (sd_page_pool) for their payload. This pool was
initialized to allocate single pages, which was sufficient as long as the
device sector size did not exceed the PAGE_SIZE.
Given that block layer now supports block size upto 64KB, i.e. beyond
PAGE_SIZE, initialize a large page pool in sd_probe() if a higher sector
device is attached, ensuring atomicity. Adapt sd_set_special_bvec() to use
large page pool when a higher sector size device is attached. Hence enable
sector sizes > PAGE_SIZE in SCSI sd driver.
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Swarna Prabhu <s.prabhu@samsung.com>
Co-developed-by: Pankaj Raghav <p.raghav@samsung.com>
Signed-off-by: Pankaj Raghav <p.raghav@samsung.com>
Link: https://patch.msgid.link/20260219043741.276729-2-sw.prabhu6@gmail.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Stable-dep-of: bb31844d88b7 ("scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/sd.c | 80 ++++++++++++++++++++++++++++++++++++++++-------
1 file changed, 68 insertions(+), 12 deletions(-)
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index d5f8701659a5a..f963b9374e0af 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -109,8 +109,11 @@ static void sd_unlock_native_capacity(struct gendisk *disk);
static void scsi_disk_release(struct device *cdev);
static DEFINE_IDA(sd_index_ida);
+static DEFINE_MUTEX(sd_mutex_lock);
static mempool_t *sd_page_pool;
+static mempool_t *sd_large_page_pool;
+static atomic_t sd_large_page_pool_users = ATOMIC_INIT(0);
static struct lock_class_key sd_bio_compl_lkclass;
static const char *sd_cache_types[] = {
@@ -118,6 +121,33 @@ static const char *sd_cache_types[] = {
"write back, no read (daft)"
};
+static int sd_large_pool_create(void)
+{
+ mutex_lock(&sd_mutex_lock);
+ if (!sd_large_page_pool) {
+ sd_large_page_pool = mempool_create_page_pool(
+ SD_MEMPOOL_SIZE, get_order(BLK_MAX_BLOCK_SIZE));
+ if (!sd_large_page_pool) {
+ printk(KERN_ERR "sd: can't create large page mempool\n");
+ mutex_unlock(&sd_mutex_lock);
+ return -ENOMEM;
+ }
+ }
+ atomic_inc(&sd_large_page_pool_users);
+ mutex_unlock(&sd_mutex_lock);
+ return 0;
+}
+
+static void sd_large_pool_destroy(void)
+{
+ mutex_lock(&sd_mutex_lock);
+ if (atomic_dec_and_test(&sd_large_page_pool_users)) {
+ mempool_destroy(sd_large_page_pool);
+ sd_large_page_pool = NULL;
+ }
+ mutex_unlock(&sd_mutex_lock);
+}
+
static void sd_disable_discard(struct scsi_disk *sdkp)
{
sdkp->provisioning_mode = SD_LBP_DISABLE;
@@ -889,14 +919,24 @@ static unsigned char sd_setup_protect_cmnd(struct scsi_cmnd *scmd,
return protect;
}
-static void *sd_set_special_bvec(struct request *rq, unsigned int data_len)
+static void *sd_set_special_bvec(struct scsi_cmnd *cmd, unsigned int data_len)
{
struct page *page;
+ struct request *rq = scsi_cmd_to_rq(cmd);
+ struct scsi_device *sdp = cmd->device;
+ unsigned sector_size = sdp->sector_size;
+ unsigned int nr_pages = DIV_ROUND_UP(sector_size, PAGE_SIZE);
+ int n;
- page = mempool_alloc(sd_page_pool, GFP_ATOMIC);
+ if (sector_size > PAGE_SIZE)
+ page = mempool_alloc(sd_large_page_pool, GFP_ATOMIC);
+ else
+ page = mempool_alloc(sd_page_pool, GFP_ATOMIC);
if (!page)
return NULL;
- clear_highpage(page);
+
+ for (n = 0; n < nr_pages; n++)
+ clear_highpage(page + n);
bvec_set_page(&rq->special_vec, page, data_len, 0);
rq->rq_flags |= RQF_SPECIAL_PAYLOAD;
return bvec_virt(&rq->special_vec);
@@ -912,7 +952,7 @@ static blk_status_t sd_setup_unmap_cmnd(struct scsi_cmnd *cmd)
unsigned int data_len = 24;
char *buf;
- buf = sd_set_special_bvec(rq, data_len);
+ buf = sd_set_special_bvec(cmd, data_len);
if (!buf)
return BLK_STS_RESOURCE;
@@ -1000,7 +1040,7 @@ static blk_status_t sd_setup_write_same16_cmnd(struct scsi_cmnd *cmd,
u32 nr_blocks = sectors_to_logical(sdp, blk_rq_sectors(rq));
u32 data_len = sdp->sector_size;
- if (!sd_set_special_bvec(rq, data_len))
+ if (!sd_set_special_bvec(cmd, data_len))
return BLK_STS_RESOURCE;
cmd->cmd_len = 16;
@@ -1027,7 +1067,7 @@ static blk_status_t sd_setup_write_same10_cmnd(struct scsi_cmnd *cmd,
u32 nr_blocks = sectors_to_logical(sdp, blk_rq_sectors(rq));
u32 data_len = sdp->sector_size;
- if (!sd_set_special_bvec(rq, data_len))
+ if (!sd_set_special_bvec(cmd, data_len))
return BLK_STS_RESOURCE;
cmd->cmd_len = 10;
@@ -1468,9 +1508,15 @@ static blk_status_t sd_init_command(struct scsi_cmnd *cmd)
static void sd_uninit_command(struct scsi_cmnd *SCpnt)
{
struct request *rq = scsi_cmd_to_rq(SCpnt);
+ struct scsi_device *sdp = SCpnt->device;
+ unsigned sector_size = sdp->sector_size;
- if (rq->rq_flags & RQF_SPECIAL_PAYLOAD)
- mempool_free(rq->special_vec.bv_page, sd_page_pool);
+ if (rq->rq_flags & RQF_SPECIAL_PAYLOAD) {
+ if (sector_size > PAGE_SIZE)
+ mempool_free(rq->special_vec.bv_page, sd_large_page_pool);
+ else
+ mempool_free(rq->special_vec.bv_page, sd_page_pool);
+ }
}
static bool sd_need_revalidate(struct gendisk *disk, struct scsi_disk *sdkp)
@@ -2870,10 +2916,7 @@ sd_read_capacity(struct scsi_disk *sdkp, struct queue_limits *lim,
"assuming 512.\n");
}
- if (sector_size != 512 &&
- sector_size != 1024 &&
- sector_size != 2048 &&
- sector_size != 4096) {
+ if (blk_validate_block_size(sector_size)) {
sd_printk(KERN_NOTICE, sdkp, "Unsupported sector size %d.\n",
sector_size);
/*
@@ -4004,6 +4047,12 @@ static int sd_probe(struct scsi_device *sdp)
sdkp->max_medium_access_timeouts = SD_MAX_MEDIUM_TIMEOUTS;
sd_revalidate_disk(gd);
+ if (sdp->sector_size > PAGE_SIZE) {
+ if (sd_large_pool_create()) {
+ error = -ENOMEM;
+ goto out_free_index;
+ }
+ }
if (sdp->removable) {
gd->flags |= GENHD_FL_REMOVABLE;
@@ -4021,6 +4070,8 @@ static int sd_probe(struct scsi_device *sdp)
if (error) {
device_unregister(&sdkp->disk_dev);
put_disk(gd);
+ if (sdp->sector_size > PAGE_SIZE)
+ sd_large_pool_destroy();
goto out;
}
@@ -4182,6 +4233,9 @@ static void sd_remove(struct scsi_device *sdp)
sd_shutdown(sdp);
put_disk(sdkp->disk);
+
+ if (sdp->sector_size > PAGE_SIZE)
+ sd_large_pool_destroy();
}
static inline bool sd_do_start_stop(struct scsi_device *sdev, bool runtime)
@@ -4405,6 +4459,8 @@ static void __exit exit_sd(void)
scsi_unregister_driver(&sd_template);
mempool_destroy(sd_page_pool);
+ if (sd_large_page_pool)
+ mempool_destroy(sd_large_page_pool);
class_unregister(&sd_disk_class);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0982/1376] scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (980 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0981/1376] scsi: sd: Enable sector size > PAGE_SIZE in SCSI sd driver Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0983/1376] scsi: sd: Fix sd_done() sense handling condition Greg Kroah-Hartman
` (16 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Yang Xiuwei,
John Garry, Martin K. Petersen (Oracle), Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Xiuwei <yangxiuwei@kylinos.cn>
[ Upstream commit bb31844d88b77138b67aa20c3600203baff40140 ]
sd_set_special_bvec() allocates a special payload page for UNMAP and
WRITE SAME commands. If scsi_alloc_sgtables() fails afterward in
sd_setup_unmap_cmnd() or sd_setup_write_same{10,16}_cmnd(), the SCSI
midlayer does not call uninit_command() because RQF_DONTPREP is not set
yet, leaking the page.
Call sd_uninit_command() on error, and clear RQF_SPECIAL_PAYLOAD after
freeing the page.
Fixes: 81d926e8b552 ("sd: split sd_setup_discard_cmnd")
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn>
Reviewed-by: John Garry <john.g.garry@oracle.com>
Link: https://patch.msgid.link/20260707030333.22245-3-yangxiuwei@kylinos.cn
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/sd.c | 47 ++++++++++++++++++++++++++++++-----------------
1 file changed, 30 insertions(+), 17 deletions(-)
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index f963b9374e0af..3edb2518a1852 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -919,6 +919,21 @@ static unsigned char sd_setup_protect_cmnd(struct scsi_cmnd *scmd,
return protect;
}
+static void sd_uninit_command(struct scsi_cmnd *cmd)
+{
+ struct request *rq = scsi_cmd_to_rq(cmd);
+ struct scsi_device *sdp = cmd->device;
+
+ if (!(rq->rq_flags & RQF_SPECIAL_PAYLOAD))
+ return;
+
+ if (sdp->sector_size > PAGE_SIZE)
+ mempool_free(rq->special_vec.bv_page, sd_large_page_pool);
+ else
+ mempool_free(rq->special_vec.bv_page, sd_page_pool);
+ rq->rq_flags &= ~RQF_SPECIAL_PAYLOAD;
+}
+
static void *sd_set_special_bvec(struct scsi_cmnd *cmd, unsigned int data_len)
{
struct page *page;
@@ -951,6 +966,7 @@ static blk_status_t sd_setup_unmap_cmnd(struct scsi_cmnd *cmd)
u32 nr_blocks = sectors_to_logical(sdp, blk_rq_sectors(rq));
unsigned int data_len = 24;
char *buf;
+ blk_status_t ret;
buf = sd_set_special_bvec(cmd, data_len);
if (!buf)
@@ -969,7 +985,10 @@ static blk_status_t sd_setup_unmap_cmnd(struct scsi_cmnd *cmd)
cmd->transfersize = data_len;
rq->timeout = SD_TIMEOUT;
- return scsi_alloc_sgtables(cmd);
+ ret = scsi_alloc_sgtables(cmd);
+ if (ret != BLK_STS_OK)
+ sd_uninit_command(cmd);
+ return ret;
}
static void sd_config_atomic(struct scsi_disk *sdkp, struct queue_limits *lim)
@@ -1039,6 +1058,7 @@ static blk_status_t sd_setup_write_same16_cmnd(struct scsi_cmnd *cmd,
u64 lba = sectors_to_logical(sdp, blk_rq_pos(rq));
u32 nr_blocks = sectors_to_logical(sdp, blk_rq_sectors(rq));
u32 data_len = sdp->sector_size;
+ blk_status_t ret;
if (!sd_set_special_bvec(cmd, data_len))
return BLK_STS_RESOURCE;
@@ -1054,7 +1074,10 @@ static blk_status_t sd_setup_write_same16_cmnd(struct scsi_cmnd *cmd,
cmd->transfersize = data_len;
rq->timeout = unmap ? SD_TIMEOUT : SD_WRITE_SAME_TIMEOUT;
- return scsi_alloc_sgtables(cmd);
+ ret = scsi_alloc_sgtables(cmd);
+ if (ret != BLK_STS_OK)
+ sd_uninit_command(cmd);
+ return ret;
}
static blk_status_t sd_setup_write_same10_cmnd(struct scsi_cmnd *cmd,
@@ -1066,6 +1089,7 @@ static blk_status_t sd_setup_write_same10_cmnd(struct scsi_cmnd *cmd,
u64 lba = sectors_to_logical(sdp, blk_rq_pos(rq));
u32 nr_blocks = sectors_to_logical(sdp, blk_rq_sectors(rq));
u32 data_len = sdp->sector_size;
+ blk_status_t ret;
if (!sd_set_special_bvec(cmd, data_len))
return BLK_STS_RESOURCE;
@@ -1081,7 +1105,10 @@ static blk_status_t sd_setup_write_same10_cmnd(struct scsi_cmnd *cmd,
cmd->transfersize = data_len;
rq->timeout = unmap ? SD_TIMEOUT : SD_WRITE_SAME_TIMEOUT;
- return scsi_alloc_sgtables(cmd);
+ ret = scsi_alloc_sgtables(cmd);
+ if (ret != BLK_STS_OK)
+ sd_uninit_command(cmd);
+ return ret;
}
static blk_status_t sd_setup_write_zeroes_cmnd(struct scsi_cmnd *cmd)
@@ -1505,20 +1532,6 @@ static blk_status_t sd_init_command(struct scsi_cmnd *cmd)
}
}
-static void sd_uninit_command(struct scsi_cmnd *SCpnt)
-{
- struct request *rq = scsi_cmd_to_rq(SCpnt);
- struct scsi_device *sdp = SCpnt->device;
- unsigned sector_size = sdp->sector_size;
-
- if (rq->rq_flags & RQF_SPECIAL_PAYLOAD) {
- if (sector_size > PAGE_SIZE)
- mempool_free(rq->special_vec.bv_page, sd_large_page_pool);
- else
- mempool_free(rq->special_vec.bv_page, sd_page_pool);
- }
-}
-
static bool sd_need_revalidate(struct gendisk *disk, struct scsi_disk *sdkp)
{
if (sdkp->device->removable || sdkp->write_prot) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0983/1376] scsi: sd: Fix sd_done() sense handling condition
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (981 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0982/1376] scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0984/1376] btrfs: retry verity reads for not-uptodate Merkle folios Greg Kroah-Hartman
` (15 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Yang Xiuwei,
Bart Van Assche, Martin K. Petersen (Oracle), Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Xiuwei <yangxiuwei@kylinos.cn>
[ Upstream commit a640d4546b11be5709a82bdc63d7dafd8ddc6c9e ]
Only enter the sense_key switch when the command returned CHECK
CONDITION with valid, non-deferred sense. The old condition let deferred
or invalid sense fall through and mis-handle the I/O.
Fixes: 03aba2f79594 ("[SCSI] sd/scsi_lib simplify sd_rw_intr and scsi_io_completion")
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20260707030333.22245-4-yangxiuwei@kylinos.cn
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/sd.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 3edb2518a1852..3b32d9356b204 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -2378,8 +2378,8 @@ static int sd_done(struct scsi_cmnd *SCpnt)
}
sdkp->medium_access_timed_out = 0;
- if (!scsi_status_is_check_condition(result) &&
- (!sense_valid || sense_deferred))
+ if (!scsi_status_is_check_condition(result) ||
+ !sense_valid || sense_deferred)
goto out;
switch (sshdr.sense_key) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0984/1376] btrfs: retry verity reads for not-uptodate Merkle folios
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (982 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0983/1376] scsi: sd: Fix sd_done() sense handling condition Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0985/1376] Bluetooth: virtio_bt: avoid OOB read of build info string Greg Kroah-Hartman
` (14 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Boris Burkov, Yichong Chen,
David Sterba, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yichong Chen <chenyichong@uniontech.com>
[ Upstream commit 8cc569696dac51fc62bb39b3b8f530582b916d29 ]
btrfs_read_merkle_tree_page() can find a folio in the mapping that is not
uptodate. After taking the folio lock, the current code treats that state
as a read error and returns -EIO.
That can make a previous transient read failure sticky. If the failed read
left a not-uptodate folio in the mapping, later callers find that folio and
fail instead of retrying the read.
Keep the existing page-cache insertion and locking order, but retry the
Merkle item read when a not-uptodate folio is found in the mapping. Also
unlock the folio when read_key_bytes() fails so that a later caller can
lock it and retry the read.
Fixes: 06ed09351b67 ("btrfs: convert btrfs_read_merkle_tree_page() to use a folio")
Reviewed-by: Boris Burkov <boris@bur.io>
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/verity.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/fs/btrfs/verity.c b/fs/btrfs/verity.c
index e97ad824ae16d..2e301f06c5731 100644
--- a/fs/btrfs/verity.c
+++ b/fs/btrfs/verity.c
@@ -731,14 +731,18 @@ static struct page *btrfs_read_merkle_tree_page(struct inode *inode,
goto out;
folio_lock(folio);
- /* If it's not uptodate after we have the lock, we got a read error. */
- if (!folio_test_uptodate(folio)) {
+ /* Folio was truncated from mapping. */
+ if (!folio->mapping) {
folio_unlock(folio);
folio_put(folio);
- return ERR_PTR(-EIO);
+ goto again;
}
- folio_unlock(folio);
- goto out;
+ /* Another reader may have filled the folio while we waited. */
+ if (folio_test_uptodate(folio)) {
+ folio_unlock(folio);
+ goto out;
+ }
+ goto read_folio;
}
folio = filemap_alloc_folio(mapping_gfp_constraint(inode->i_mapping, ~__GFP_FS),
@@ -755,6 +759,7 @@ static struct page *btrfs_read_merkle_tree_page(struct inode *inode,
return ERR_PTR(ret);
}
+read_folio:
/*
* Merkle item keys are indexed from byte 0 in the merkle tree.
* They have the form:
@@ -764,6 +769,7 @@ static struct page *btrfs_read_merkle_tree_page(struct inode *inode,
ret = read_key_bytes(BTRFS_I(inode), BTRFS_VERITY_MERKLE_ITEM_KEY, off,
folio_address(folio), PAGE_SIZE, folio);
if (ret < 0) {
+ folio_unlock(folio);
folio_put(folio);
return ERR_PTR(ret);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0985/1376] Bluetooth: virtio_bt: avoid OOB read of build info string
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (983 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0984/1376] btrfs: retry verity reads for not-uptodate Merkle folios Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0986/1376] Bluetooth: btintel: Fix diagnostics event detection Greg Kroah-Hartman
` (13 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, HyeongJun An, Luiz Augusto von Dentz,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: HyeongJun An <sammiee5311@gmail.com>
[ Upstream commit 502adc06ba76dee19c292ae4a07d74d202fe734d ]
The virtbt_setup_zephyr() sends the Zephyr vendor command 0xfc08 (Read
Build Information) and hands the response to bt_dev_info() and
hci_set_fw_info() as a "%s" string starting at skb->data + 1, without
checking the length. A backend that answers with status only leaves that
pointer past the end of the received data, so the walk reads adjacent
slab memory until it meets a NUL. Those bytes reach the kernel log and
the firmware-info debugfs file.
To fix this, print the string with a bounded "%.*s" limited to
skb->len - 1. A short or unterminated response then prints as much as
arrived instead of failing setup.
This mirrors commit dd068ef04412 ("Bluetooth: bpa10x: avoid OOB read of
revision string in bpa10x_setup()"), which fixed the identical pattern.
Fixes: afd2daa26c7a ("Bluetooth: Add support for virtio transport driver")
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/virtio_bt.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/bluetooth/virtio_bt.c b/drivers/bluetooth/virtio_bt.c
index 0a602f4cbccc0..f9b124fe109ba 100644
--- a/drivers/bluetooth/virtio_bt.c
+++ b/drivers/bluetooth/virtio_bt.c
@@ -120,9 +120,13 @@ static int virtbt_setup_zephyr(struct hci_dev *hdev)
if (IS_ERR(skb))
return PTR_ERR(skb);
- bt_dev_info(hdev, "%s", (char *)(skb->data + 1));
+ /* Bounded print: the backend controls skb->len. */
+ if (skb->len > 1) {
+ int len = skb->len - 1;
- hci_set_fw_info(hdev, "%s", skb->data + 1);
+ bt_dev_info(hdev, "%.*s", len, (char *)(skb->data + 1));
+ hci_set_fw_info(hdev, "%.*s", len, skb->data + 1);
+ }
kfree_skb(skb);
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0986/1376] Bluetooth: btintel: Fix diagnostics event detection
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (984 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0985/1376] Bluetooth: virtio_bt: avoid OOB read of build info string Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0987/1376] Bluetooth: hci_conn: fix the SCO setup context lifetime Greg Kroah-Hartman
` (12 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zijun Hu, Luiz Augusto von Dentz,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <zijun.hu@oss.qualcomm.com>
[ Upstream commit ad0e7ac7da9a9a0095570bd6add3e27f259de104 ]
For a diagnostics VSE, diagnostics_hdr[] sits at the start of the event
payload, skb->data[2], but btintel_recv_event() wrongly guards its
memcmp with @len, which is measured from skb->data[3] for the earlier
INTEL_BOOTLOADER check.
Fix by using (@len + 1) instead, which ==
(skb->len - HCI_EVENT_HDR_SIZE) exactly.
Fixes: af395330abed ("Bluetooth: btintel: Add Intel devcoredump support")
Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btintel.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c
index cb948423a9bd8..c63246a60c6be 100644
--- a/drivers/bluetooth/btintel.c
+++ b/drivers/bluetooth/btintel.c
@@ -3399,7 +3399,7 @@ int btintel_recv_event(struct hci_dev *hdev, struct sk_buff *skb)
/* Handle all diagnostics events separately. May still call
* hci_recv_frame.
*/
- if (len >= sizeof(diagnostics_hdr) &&
+ if (len + 1 >= sizeof(diagnostics_hdr) &&
memcmp(&skb->data[2], diagnostics_hdr,
sizeof(diagnostics_hdr)) == 0) {
return btintel_diagnostics(hdev, skb);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0987/1376] Bluetooth: hci_conn: fix the SCO setup context lifetime
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (985 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0986/1376] Bluetooth: btintel: Fix diagnostics event detection Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0988/1376] Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths Greg Kroah-Hartman
` (11 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linmao Li, Luiz Augusto von Dentz,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linmao Li <lilinmao@kylinos.cn>
[ Upstream commit 42de40abe25db9211107af8896d0fd741f10648d ]
hci_setup_sync() queues a conn_handle_t with a NULL destroy callback, so
the context is only freed if hci_enhanced_setup_sync() actually runs. An
entry that is cancelled instead is leaked, as
_hci_cmd_sync_cancel_entry() does not release entry->data when there is
no destroy callback, and hci_cmd_sync_clear() cancels every pending entry
when the controller is unregistered.
The context also stores a bare hci_conn pointer, so the connection can be
freed while the work is queued. The dequeue in hci_conn_del() does not
cover it either, as it matches on entry->data == conn and entry->data is
the wrapper here. Same problem as commit 2f5d635ad590 ("Bluetooth:
hci_sync: hold conn in hci_connect_acl/le_sync() callbacks").
Hold the connection and release both from a destroy callback. The
submission failure path drops both, since hci_cmd_sync_submit() does not
call the destroy callback when it fails to queue.
Fixes: e07a06b4eb41 ("Bluetooth: Convert SCO configure_datapath to hci_sync")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/hci_conn.c | 20 +++++++++++++++-----
1 file changed, 15 insertions(+), 5 deletions(-)
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 18aafaa896b2f..d2ad9a5dd1ac7 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -287,8 +287,6 @@ static int hci_enhanced_setup_sync(struct hci_dev *hdev, void *data)
struct hci_cp_enhanced_setup_sync_conn cp;
const struct sco_param *param;
- kfree(conn_handle);
-
if (!hci_conn_valid(hdev, conn))
return -ECANCELED;
@@ -457,6 +455,15 @@ static bool hci_setup_sync_conn(struct hci_conn *conn, __u16 handle)
return true;
}
+static void hci_enhanced_setup_sync_destroy(struct hci_dev *hdev, void *data,
+ int err)
+{
+ struct conn_handle_t *conn_handle = data;
+
+ hci_conn_put(conn_handle->conn);
+ kfree(conn_handle);
+}
+
bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
{
int result;
@@ -468,12 +475,15 @@ bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
if (!conn_handle)
return false;
- conn_handle->conn = conn;
+ conn_handle->conn = hci_conn_get(conn);
conn_handle->handle = handle;
result = hci_cmd_sync_queue(conn->hdev, hci_enhanced_setup_sync,
- conn_handle, NULL);
- if (result < 0)
+ conn_handle,
+ hci_enhanced_setup_sync_destroy);
+ if (result < 0) {
+ hci_conn_put(conn);
kfree(conn_handle);
+ }
return result == 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0988/1376] Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (986 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0987/1376] Bluetooth: hci_conn: fix the SCO setup context lifetime Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0989/1376] Bluetooth: MGMT: free the mesh send cancel command when it is cancelled Greg Kroah-Hartman
` (10 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linmao Li, Luiz Augusto von Dentz,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linmao Li <lilinmao@kylinos.cn>
[ Upstream commit 120d8dc042e3d45073bb6e50ee7b058a0b182627 ]
adv_timeout_expire() hands a kmalloc()ed instance byte to
hci_cmd_sync_queue() with a NULL destroy callback, and only
adv_timeout_expire_sync() frees it. That leaks on two paths:
- the return value is not checked, and hci_cmd_sync_queue() does not
take ownership when it fails (-ENETDOWN, -ENODEV, -ENOMEM);
- a cancelled entry is not released, as _hci_cmd_sync_cancel_entry()
does not free entry->data when there is no destroy callback.
hci_cmd_sync_clear() cancels every pending entry when the controller
is unregistered.
Free the buffer from a destroy callback, and in the caller when the entry
could not be queued at all.
Fixes: c249ea9b4309 ("Bluetooth: Move Adv Instance timer to hci_sync")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/hci_sync.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index cb6889ed9e0da..cc2b0b85426f3 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -540,8 +540,6 @@ static int adv_timeout_expire_sync(struct hci_dev *hdev, void *data)
{
u8 instance = *(u8 *)data;
- kfree(data);
-
hci_clear_adv_instance_sync(hdev, NULL, instance, false);
if (list_empty(&hdev->adv_instances))
@@ -550,6 +548,12 @@ static int adv_timeout_expire_sync(struct hci_dev *hdev, void *data)
return 0;
}
+static void adv_timeout_expire_destroy(struct hci_dev *hdev, void *data,
+ int err)
+{
+ kfree(data);
+}
+
static void adv_timeout_expire(struct work_struct *work)
{
u8 *inst_ptr;
@@ -570,7 +574,9 @@ static void adv_timeout_expire(struct work_struct *work)
goto unlock;
*inst_ptr = hdev->cur_adv_instance;
- hci_cmd_sync_queue(hdev, adv_timeout_expire_sync, inst_ptr, NULL);
+ if (hci_cmd_sync_queue(hdev, adv_timeout_expire_sync, inst_ptr,
+ adv_timeout_expire_destroy) < 0)
+ kfree(inst_ptr);
unlock:
hci_dev_unlock(hdev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0989/1376] Bluetooth: MGMT: free the mesh send cancel command when it is cancelled
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (987 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0988/1376] Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0990/1376] mmc: sdio: add MediaTek MT7902 SDIO device ID Greg Kroah-Hartman
` (9 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linmao Li, Luiz Augusto von Dentz,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linmao Li <lilinmao@kylinos.cn>
[ Upstream commit 3c742feda8fcabf741a17bcf668b63c8f606f9c5 ]
mesh_send_cancel() queues the pending command with a NULL destroy
callback, so it is only freed if send_cancel() runs. A cancelled entry is
leaked, as _hci_cmd_sync_cancel_entry() does not release entry->data when
there is no destroy callback, and hci_cmd_sync_clear() cancels every
pending entry when the controller is unregistered. Nothing else reclaims
it either: mgmt_pending_new() does not put the command on
hdev->mgmt_pending.
The leak also pins the socket reference taken by mgmt_pending_new(), so
the mgmt socket is never released.
Free the command from a destroy callback.
Fixes: b338d91703fa ("Bluetooth: Implement support for Mesh")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/mgmt.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 13b1ecb83e0e3..d92eb0d4c54da 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -2411,11 +2411,15 @@ static int send_cancel(struct hci_dev *hdev, void *data)
mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
0, NULL, 0);
- mgmt_pending_free(cmd);
return 0;
}
+static void send_cancel_destroy(struct hci_dev *hdev, void *data, int err)
+{
+ mgmt_pending_free(data);
+}
+
static int mesh_send_cancel(struct sock *sk, struct hci_dev *hdev,
void *data, u16 len)
{
@@ -2436,7 +2440,8 @@ static int mesh_send_cancel(struct sock *sk, struct hci_dev *hdev,
if (!cmd)
err = -ENOMEM;
else
- err = hci_cmd_sync_queue(hdev, send_cancel, cmd, NULL);
+ err = hci_cmd_sync_queue(hdev, send_cancel, cmd,
+ send_cancel_destroy);
if (err < 0) {
err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0990/1376] mmc: sdio: add MediaTek MT7902 SDIO device ID
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (988 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0989/1376] Bluetooth: MGMT: free the mesh send cancel command when it is cancelled Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0991/1376] Bluetooth: btmtk: add MT7902 MCU support Greg Kroah-Hartman
` (8 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ulf Hansson, Sean Wang,
Luiz Augusto von Dentz, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Wang <sean.wang@mediatek.com>
[ Upstream commit cde32a92d4562b686f730fc08d4d558ecc99d516 ]
Add SDIO device ID (0x790a) for MediaTek MT7902 to sdio_ids.h.
Acked-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Stable-dep-of: b0c0b3794011 ("Bluetooth: btmtksdio: fix usage_count leak when autosuspend_delay is negative")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/mmc/sdio_ids.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/include/linux/mmc/sdio_ids.h b/include/linux/mmc/sdio_ids.h
index 8fb8e7e87f6ef..77edf50083379 100644
--- a/include/linux/mmc/sdio_ids.h
+++ b/include/linux/mmc/sdio_ids.h
@@ -110,6 +110,7 @@
#define SDIO_VENDOR_ID_MEDIATEK 0x037a
#define SDIO_DEVICE_ID_MEDIATEK_MT7663 0x7663
#define SDIO_DEVICE_ID_MEDIATEK_MT7668 0x7668
+#define SDIO_DEVICE_ID_MEDIATEK_MT7902 0x790a
#define SDIO_DEVICE_ID_MEDIATEK_MT7961 0x7961
#define SDIO_VENDOR_ID_MICROCHIP_WILC 0x0296
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0991/1376] Bluetooth: btmtk: add MT7902 MCU support
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (989 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0990/1376] mmc: sdio: add MediaTek MT7902 SDIO device ID Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0992/1376] Bluetooth: btmtk: add MT7902 SDIO support Greg Kroah-Hartman
` (7 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Wang, Luiz Augusto von Dentz,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Wang <sean.wang@mediatek.com>
[ Upstream commit aab25984e55972e53f3e58821cb85a7101876056 ]
Add MT7902 device ID and firmware filename to enable MCU firmware
loading.
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Stable-dep-of: b0c0b3794011 ("Bluetooth: btmtksdio: fix usage_count leak when autosuspend_delay is negative")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btmtk.c | 1 +
drivers/bluetooth/btmtk.h | 1 +
2 files changed, 2 insertions(+)
diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c
index 22b05628e52e1..40ee12dc21792 100644
--- a/drivers/bluetooth/btmtk.c
+++ b/drivers/bluetooth/btmtk.c
@@ -1335,6 +1335,7 @@ int btmtk_usb_setup(struct hci_dev *hdev)
case 0x7922:
case 0x7925:
case 0x7961:
+ case 0x7902:
btmtk_fw_get_filename(fw_bin_name, sizeof(fw_bin_name), dev_id,
fw_version, fw_flavor);
diff --git a/drivers/bluetooth/btmtk.h b/drivers/bluetooth/btmtk.h
index 5df7c32966247..b4506186b2f70 100644
--- a/drivers/bluetooth/btmtk.h
+++ b/drivers/bluetooth/btmtk.h
@@ -5,6 +5,7 @@
#define FIRMWARE_MT7663 "mediatek/mt7663pr2h.bin"
#define FIRMWARE_MT7668 "mediatek/mt7668pr2h.bin"
#define FIRMWARE_MT7922 "mediatek/BT_RAM_CODE_MT7922_1_1_hdr.bin"
+#define FIRMWARE_MT7902 "mediatek/BT_RAM_CODE_MT7902_1_1_hdr.bin"
#define FIRMWARE_MT7961 "mediatek/BT_RAM_CODE_MT7961_1_2_hdr.bin"
#define FIRMWARE_MT7925 "mediatek/mt7925/BT_RAM_CODE_MT7925_1_1_hdr.bin"
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0992/1376] Bluetooth: btmtk: add MT7902 SDIO support
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (990 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0991/1376] Bluetooth: btmtk: add MT7902 MCU support Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0993/1376] Bluetooth: btmtksdio: fix usage_count leak when autosuspend_delay is negative Greg Kroah-Hartman
` (6 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Wang, Luiz Augusto von Dentz,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Wang <sean.wang@mediatek.com>
[ Upstream commit 7f2c3c49ba0d3fead557a8026a021ebe23f919d6 ]
Add MT7902 Bluetooth SDIO support by introducing chip data and
registering the device ID.
Runtime PM is not yet supported by the driver, but normal operation
is unaffected.
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Stable-dep-of: b0c0b3794011 ("Bluetooth: btmtksdio: fix usage_count leak when autosuspend_delay is negative")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btmtksdio.c | 42 ++++++++++++++++++++++++-----------
1 file changed, 29 insertions(+), 13 deletions(-)
diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c
index bd22a35c84eb6..fd55ad9308c8e 100644
--- a/drivers/bluetooth/btmtksdio.c
+++ b/drivers/bluetooth/btmtksdio.c
@@ -42,24 +42,35 @@ struct btmtksdio_data {
const char *fwname;
u16 chipid;
bool lp_mbox_supported;
+ bool pm_runtime_supported;
};
static const struct btmtksdio_data mt7663_data = {
.fwname = FIRMWARE_MT7663,
.chipid = 0x7663,
.lp_mbox_supported = false,
+ .pm_runtime_supported = true,
};
static const struct btmtksdio_data mt7668_data = {
.fwname = FIRMWARE_MT7668,
.chipid = 0x7668,
.lp_mbox_supported = false,
+ .pm_runtime_supported = true,
};
static const struct btmtksdio_data mt7921_data = {
.fwname = FIRMWARE_MT7961,
.chipid = 0x7921,
.lp_mbox_supported = true,
+ .pm_runtime_supported = true,
+};
+
+static const struct btmtksdio_data mt7902_data = {
+ .fwname = FIRMWARE_MT7902,
+ .chipid = 0x7902,
+ .lp_mbox_supported = false,
+ .pm_runtime_supported = false,
};
static const struct sdio_device_id btmtksdio_table[] = {
@@ -69,6 +80,8 @@ static const struct sdio_device_id btmtksdio_table[] = {
.driver_data = (kernel_ulong_t)&mt7668_data },
{SDIO_DEVICE(SDIO_VENDOR_ID_MEDIATEK, SDIO_DEVICE_ID_MEDIATEK_MT7961),
.driver_data = (kernel_ulong_t)&mt7921_data },
+ {SDIO_DEVICE(SDIO_VENDOR_ID_MEDIATEK, SDIO_DEVICE_ID_MEDIATEK_MT7902),
+ .driver_data = (kernel_ulong_t)&mt7902_data },
{ } /* Terminating entry */
};
MODULE_DEVICE_TABLE(sdio, btmtksdio_table);
@@ -1091,6 +1104,7 @@ static int btmtksdio_setup(struct hci_dev *hdev)
set_bit(BTMTKSDIO_HW_TX_READY, &bdev->tx_state);
switch (bdev->data->chipid) {
+ case 0x7902:
case 0x7921:
if (test_bit(BTMTKSDIO_HW_RESET_ACTIVE, &bdev->tx_state)) {
err = btmtksdio_mtk_reg_read(hdev, MT7921_DLSTATUS,
@@ -1168,22 +1182,24 @@ static int btmtksdio_setup(struct hci_dev *hdev)
delta = ktime_sub(rettime, calltime);
duration = (unsigned long long)ktime_to_ns(delta) >> 10;
- pm_runtime_set_autosuspend_delay(bdev->dev,
- MTKBTSDIO_AUTOSUSPEND_DELAY);
- pm_runtime_use_autosuspend(bdev->dev);
+ if (bdev->data->pm_runtime_supported) {
+ pm_runtime_set_autosuspend_delay(bdev->dev,
+ MTKBTSDIO_AUTOSUSPEND_DELAY);
+ pm_runtime_use_autosuspend(bdev->dev);
- err = pm_runtime_set_active(bdev->dev);
- if (err < 0)
- return err;
+ err = pm_runtime_set_active(bdev->dev);
+ if (err < 0)
+ return err;
- /* Default forbid runtime auto suspend, that can be allowed by
- * enable_autosuspend flag or the PM runtime entry under sysfs.
- */
- pm_runtime_forbid(bdev->dev);
- pm_runtime_enable(bdev->dev);
+ /* Default forbid runtime auto suspend, that can be allowed by
+ * enable_autosuspend flag or the PM runtime entry under sysfs.
+ */
+ pm_runtime_forbid(bdev->dev);
+ pm_runtime_enable(bdev->dev);
- if (enable_autosuspend)
- pm_runtime_allow(bdev->dev);
+ if (enable_autosuspend)
+ pm_runtime_allow(bdev->dev);
+ }
bt_dev_info(hdev, "Device setup in %llu usecs", duration);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0993/1376] Bluetooth: btmtksdio: fix usage_count leak when autosuspend_delay is negative
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (991 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0992/1376] Bluetooth: btmtk: add MT7902 SDIO support Greg Kroah-Hartman
@ 2026-09-12 6:56 ` Greg Kroah-Hartman
2026-09-12 6:57 ` [PATCH 6.12 0994/1376] Bluetooth: MSFT: validate evt_prefix_len against the response length Greg Kroah-Hartman
` (5 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Luiz Augusto von Dentz,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit b0c0b37940115383e7ea65d4d988f9b9e613ab92 ]
btmtksdio_setup() calls pm_runtime_use_autosuspend() when runtime PM
is supported, but btmtksdio_remove() does not call the matching
pm_runtime_dont_use_autosuspend() when removing the device.
If the autosuspend delay is set to a negative value while autosuspend
is enabled, the runtime PM core increments usage_count to prevent
runtime suspend. Without calling pm_runtime_dont_use_autosuspend()
during driver teardown, this reference is not dropped and usage_count
remains unbalanced.
Add the missing pm_runtime_dont_use_autosuspend() call in the remove
path before restoring the runtime PM usage reference.
This issue was found by manual code inspection.
Fixes: 7f3c563c575e ("Bluetooth: btmtksdio: Add runtime PM support to SDIO based Bluetooth")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btmtksdio.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c
index fd55ad9308c8e..1123428a1c245 100644
--- a/drivers/bluetooth/btmtksdio.c
+++ b/drivers/bluetooth/btmtksdio.c
@@ -1468,6 +1468,9 @@ static void btmtksdio_remove(struct sdio_func *func)
if (test_bit(BTMTKSDIO_FUNC_ENABLED, &bdev->tx_state))
btmtksdio_close(hdev);
+ if (bdev->data->pm_runtime_supported)
+ pm_runtime_dont_use_autosuspend(bdev->dev);
+
/* Be consistent the state in btmtksdio_probe */
pm_runtime_get_noresume(bdev->dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0994/1376] Bluetooth: MSFT: validate evt_prefix_len against the response length
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (992 preceding siblings ...)
2026-09-12 6:56 ` [PATCH 6.12 0993/1376] Bluetooth: btmtksdio: fix usage_count leak when autosuspend_delay is negative Greg Kroah-Hartman
@ 2026-09-12 6:57 ` Greg Kroah-Hartman
2026-09-12 6:57 ` [PATCH 6.12 0995/1376] cgroup: Add bpf prog revisions to struct cgroup_bpf Greg Kroah-Hartman
` (4 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ali Ahmet Memis,
Luiz Augusto von Dentz, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ali Ahmet Memis <ali@iusegentoo.com>
[ Upstream commit 0079e1a944634ab2dc1c7cdec1144486d096407e ]
read_supported_features() only checks that the response covers the fixed
part of struct msft_rp_read_supported_features, which is 11 bytes:
if (skb->len < sizeof(*rp)) {
bt_dev_err(hdev, "MSFT supported features length mismatch");
goto failed;
}
evt_prefix[] is a flexible array member and rp->evt_prefix_len is an
unvalidated u8 taken straight out of that response, so
msft->evt_prefix = kmemdup(rp->evt_prefix, rp->evt_prefix_len,
GFP_KERNEL);
copies up to 255 bytes from a reply that may have carried none of them.
What is copied is data the controller never sent, and it is then used to
match incoming vendor events in msft_vendor_evt().
This is not an out-of-bounds access. An skb data allocation always has
at least SKB_DATA_ALIGN(sizeof(struct skb_shared_info)) bytes past the
payload, which is more than the 255 byte maximum, so the read stays
inside the allocation and KASAN does not report it. It is still a read
of bytes the host was never given, with the length fully controlled by
the controller.
Reject a response that is too short for the prefix it declares.
Verified with an emulated controller over /dev/vhci on a KASAN kernel,
with vhci made to advertise an MSFT opcode the way btintel, btqca, btmtk
and btrtl do unconditionally. A reply of exactly 11 bytes declaring
evt_prefix_len = 255 reaches kmemdup and copies 255 bytes
("skb->len=11 evt_prefix_len=255", with the copied buffer dumped); since
the reply ends at the fixed part, all 255 come from past the end of the
response. No KASAN report is produced, as expected from the allocation
slack described above. With this patch the response is rejected with
"MSFT event prefix length mismatch" and msft->evt_prefix is left unset.
Fixes: 145373cb1b1f ("Bluetooth: Add framework for Microsoft vendor extension")
Signed-off-by: Ali Ahmet Memis <ali@iusegentoo.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/msft.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/net/bluetooth/msft.c b/net/bluetooth/msft.c
index 0da28910d00b8..bb2cd4ea059b6 100644
--- a/net/bluetooth/msft.c
+++ b/net/bluetooth/msft.c
@@ -165,6 +165,11 @@ static bool read_supported_features(struct hci_dev *hdev,
if (rp->sub_opcode != MSFT_OP_READ_SUPPORTED_FEATURES)
goto failed;
+ if (skb->len < sizeof(*rp) + rp->evt_prefix_len) {
+ bt_dev_err(hdev, "MSFT event prefix length mismatch");
+ goto failed;
+ }
+
if (rp->evt_prefix_len > 0) {
msft->evt_prefix = kmemdup(rp->evt_prefix, rp->evt_prefix_len,
GFP_KERNEL);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0995/1376] cgroup: Add bpf prog revisions to struct cgroup_bpf
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (993 preceding siblings ...)
2026-09-12 6:57 ` [PATCH 6.12 0994/1376] Bluetooth: MSFT: validate evt_prefix_len against the response length Greg Kroah-Hartman
@ 2026-09-12 6:57 ` Greg Kroah-Hartman
2026-09-12 6:57 ` [PATCH 6.12 0996/1376] bpf: Implement mprog API on top of existing cgroup progs Greg Kroah-Hartman
` (3 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yonghong Song, Andrii Nakryiko,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonghong Song <yonghong.song@linux.dev>
[ Upstream commit 9b8367b604c739947ec308874f087fe0eb80f412 ]
One of key items in mprog API is revision for prog list. The revision
number will be increased if the prog list changed, e.g., attach, detach
or replace.
Add 'revisions' field to struct cgroup_bpf, representing revisions for
all cgroup related attachment types. The initial revision value is
set to 1, the same as kernel mprog implementations.
Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20250606163136.2428732-1-yonghong.song@linux.dev
Stable-dep-of: 3f562c537e9e ("bpf, cgroup: Fix storage null-ptr-deref after replacing prog")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/bpf-cgroup-defs.h | 1 +
kernel/cgroup/cgroup.c | 5 +++++
2 files changed, 6 insertions(+)
diff --git a/include/linux/bpf-cgroup-defs.h b/include/linux/bpf-cgroup-defs.h
index 0985221d54788..c9e6b26abab6d 100644
--- a/include/linux/bpf-cgroup-defs.h
+++ b/include/linux/bpf-cgroup-defs.h
@@ -63,6 +63,7 @@ struct cgroup_bpf {
*/
struct hlist_head progs[MAX_CGROUP_BPF_ATTACH_TYPE];
u8 flags[MAX_CGROUP_BPF_ATTACH_TYPE];
+ u64 revisions[MAX_CGROUP_BPF_ATTACH_TYPE];
/* list of cgroup shared storages */
struct list_head storages;
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 3c7d466f13df7..ce012aca272a5 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -2081,6 +2081,11 @@ static void init_cgroup_housekeeping(struct cgroup *cgrp)
for_each_subsys(ss, ssid)
INIT_LIST_HEAD(&cgrp->e_csets[ssid]);
+#ifdef CONFIG_CGROUP_BPF
+ for (int i = 0; i < ARRAY_SIZE(cgrp->bpf.revisions); i++)
+ cgrp->bpf.revisions[i] = 1;
+#endif
+
init_waitqueue_head(&cgrp->offline_waitq);
INIT_WORK(&cgrp->release_agent_work, cgroup1_release_agent);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0996/1376] bpf: Implement mprog API on top of existing cgroup progs
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (994 preceding siblings ...)
2026-09-12 6:57 ` [PATCH 6.12 0995/1376] cgroup: Add bpf prog revisions to struct cgroup_bpf Greg Kroah-Hartman
@ 2026-09-12 6:57 ` Greg Kroah-Hartman
2026-09-12 6:57 ` [PATCH 6.12 0997/1376] bpf, cgroup: Fix storage null-ptr-deref after replacing prog Greg Kroah-Hartman
` (2 subsequent siblings)
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yonghong Song, Andrii Nakryiko,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonghong Song <yonghong.song@linux.dev>
[ Upstream commit 1209339844601ec1766f4ff430673fbcfe42bb51 ]
Current cgroup prog ordering is appending at attachment time. This is not
ideal. In some cases, users want specific ordering at a particular cgroup
level. To address this, the existing mprog API seems an ideal solution with
supporting BPF_F_BEFORE and BPF_F_AFTER flags.
But there are a few obstacles to directly use kernel mprog interface.
Currently cgroup bpf progs already support prog attach/detach/replace
and link-based attach/detach/replace. For example, in struct
bpf_prog_array_item, the cgroup_storage field needs to be together
with bpf prog. But the mprog API struct bpf_mprog_fp only has bpf_prog
as the member, which makes it difficult to use kernel mprog interface.
In another case, the current cgroup prog detach tries to use the
same flag as in attach. This is different from mprog kernel interface
which uses flags passed from user space.
So to avoid modifying existing behavior, I made the following changes to
support mprog API for cgroup progs:
- The support is for prog list at cgroup level. Cross-level prog list
(a.k.a. effective prog list) is not supported.
- Previously, BPF_F_PREORDER is supported only for prog attach, now
BPF_F_PREORDER is also supported by link-based attach.
- For attach, BPF_F_BEFORE/BPF_F_AFTER/BPF_F_ID/BPF_F_LINK is supported
similar to kernel mprog but with different implementation.
- For detach and replace, use the existing implementation.
- For attach, detach and replace, the revision for a particular prog
list, associated with a particular attach type, will be updated
by increasing count by 1.
Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20250606163141.2428937-1-yonghong.song@linux.dev
Stable-dep-of: 3f562c537e9e ("bpf, cgroup: Fix storage null-ptr-deref after replacing prog")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/uapi/linux/bpf.h | 7 ++
kernel/bpf/cgroup.c | 182 +++++++++++++++++++++++++++++----
kernel/bpf/syscall.c | 46 ++++++---
tools/include/uapi/linux/bpf.h | 7 ++
4 files changed, 205 insertions(+), 37 deletions(-)
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index c8fb6abfeca98..1d6dc90b2345c 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -1779,6 +1779,13 @@ union bpf_attr {
};
__u64 expected_revision;
} netkit;
+ struct {
+ union {
+ __u32 relative_fd;
+ __u32 relative_id;
+ };
+ __u64 expected_revision;
+ } cgroup;
};
} link_create;
diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
index 7b8b4e09131dd..a888ae8d27223 100644
--- a/kernel/bpf/cgroup.c
+++ b/kernel/bpf/cgroup.c
@@ -624,6 +624,116 @@ static struct bpf_prog_list *find_attach_entry(struct hlist_head *progs,
return NULL;
}
+static struct bpf_link *bpf_get_anchor_link(u32 flags, u32 id_or_fd)
+{
+ struct bpf_link *link = ERR_PTR(-EINVAL);
+
+ if (flags & BPF_F_ID)
+ link = bpf_link_by_id(id_or_fd);
+ else if (id_or_fd)
+ link = bpf_link_get_from_fd(id_or_fd);
+ return link;
+}
+
+static struct bpf_prog *bpf_get_anchor_prog(u32 flags, u32 id_or_fd)
+{
+ struct bpf_prog *prog = ERR_PTR(-EINVAL);
+
+ if (flags & BPF_F_ID)
+ prog = bpf_prog_by_id(id_or_fd);
+ else if (id_or_fd)
+ prog = bpf_prog_get(id_or_fd);
+ return prog;
+}
+
+static struct bpf_prog_list *get_prog_list(struct hlist_head *progs, struct bpf_prog *prog,
+ struct bpf_cgroup_link *link, u32 flags, u32 id_or_fd)
+{
+ bool is_link = flags & BPF_F_LINK, is_id = flags & BPF_F_ID;
+ struct bpf_prog_list *pltmp, *pl = ERR_PTR(-EINVAL);
+ bool preorder = flags & BPF_F_PREORDER;
+ struct bpf_link *anchor_link = NULL;
+ struct bpf_prog *anchor_prog = NULL;
+ bool is_before, is_after;
+
+ is_before = flags & BPF_F_BEFORE;
+ is_after = flags & BPF_F_AFTER;
+ if (is_link || is_id || id_or_fd) {
+ /* flags must have either BPF_F_BEFORE or BPF_F_AFTER */
+ if (is_before == is_after)
+ return ERR_PTR(-EINVAL);
+ if ((is_link && !link) || (!is_link && !prog))
+ return ERR_PTR(-EINVAL);
+ } else if (!hlist_empty(progs)) {
+ /* flags cannot have both BPF_F_BEFORE and BPF_F_AFTER */
+ if (is_before && is_after)
+ return ERR_PTR(-EINVAL);
+ }
+
+ if (is_link) {
+ anchor_link = bpf_get_anchor_link(flags, id_or_fd);
+ if (IS_ERR(anchor_link))
+ return ERR_PTR(PTR_ERR(anchor_link));
+ } else if (is_id || id_or_fd) {
+ anchor_prog = bpf_get_anchor_prog(flags, id_or_fd);
+ if (IS_ERR(anchor_prog))
+ return ERR_PTR(PTR_ERR(anchor_prog));
+ }
+
+ if (!anchor_prog && !anchor_link) {
+ /* if there is no anchor_prog/anchor_link, then BPF_F_PREORDER
+ * doesn't matter since either prepend or append to a combined
+ * list of progs will end up with correct result.
+ */
+ hlist_for_each_entry(pltmp, progs, node) {
+ if (is_before)
+ return pltmp;
+ if (pltmp->node.next)
+ continue;
+ return pltmp;
+ }
+ return NULL;
+ }
+
+ hlist_for_each_entry(pltmp, progs, node) {
+ if ((anchor_prog && anchor_prog == pltmp->prog) ||
+ (anchor_link && anchor_link == &pltmp->link->link)) {
+ if (!!(pltmp->flags & BPF_F_PREORDER) != preorder)
+ goto out;
+ pl = pltmp;
+ goto out;
+ }
+ }
+
+ pl = ERR_PTR(-ENOENT);
+out:
+ if (anchor_link)
+ bpf_link_put(anchor_link);
+ else
+ bpf_prog_put(anchor_prog);
+ return pl;
+}
+
+static int insert_pl_to_hlist(struct bpf_prog_list *pl, struct hlist_head *progs,
+ struct bpf_prog *prog, struct bpf_cgroup_link *link,
+ u32 flags, u32 id_or_fd)
+{
+ struct bpf_prog_list *pltmp;
+
+ pltmp = get_prog_list(progs, prog, link, flags, id_or_fd);
+ if (IS_ERR(pltmp))
+ return PTR_ERR(pltmp);
+
+ if (!pltmp)
+ hlist_add_head(&pl->node, progs);
+ else if (flags & BPF_F_BEFORE)
+ hlist_add_before(&pl->node, &pltmp->node);
+ else
+ hlist_add_behind(&pl->node, &pltmp->node);
+
+ return 0;
+}
+
/**
* __cgroup_bpf_attach() - Attach the program or the link to a cgroup, and
* propagate the change to descendants
@@ -633,6 +743,8 @@ static struct bpf_prog_list *find_attach_entry(struct hlist_head *progs,
* @replace_prog: Previously attached program to replace if BPF_F_REPLACE is set
* @type: Type of attach operation
* @flags: Option flags
+ * @id_or_fd: Relative prog id or fd
+ * @revision: bpf_prog_list revision
*
* Exactly one of @prog or @link can be non-null.
* Must be called with cgroup_mutex held.
@@ -640,7 +752,8 @@ static struct bpf_prog_list *find_attach_entry(struct hlist_head *progs,
static int __cgroup_bpf_attach(struct cgroup *cgrp,
struct bpf_prog *prog, struct bpf_prog *replace_prog,
struct bpf_cgroup_link *link,
- enum bpf_attach_type type, u32 flags)
+ enum bpf_attach_type type, u32 flags, u32 id_or_fd,
+ u64 revision)
{
u32 saved_flags = (flags & (BPF_F_ALLOW_OVERRIDE | BPF_F_ALLOW_MULTI));
struct bpf_prog *old_prog = NULL;
@@ -658,6 +771,9 @@ static int __cgroup_bpf_attach(struct cgroup *cgrp,
((flags & BPF_F_REPLACE) && !(flags & BPF_F_ALLOW_MULTI)))
/* invalid combination */
return -EINVAL;
+ if ((flags & BPF_F_REPLACE) && (flags & (BPF_F_BEFORE | BPF_F_AFTER)))
+ /* only either replace or insertion with before/after */
+ return -EINVAL;
if (link && (prog || replace_prog))
/* only either link or prog/replace_prog can be specified */
return -EINVAL;
@@ -668,6 +784,8 @@ static int __cgroup_bpf_attach(struct cgroup *cgrp,
atype = bpf_cgroup_atype_find(type, new_prog->aux->attach_btf_id);
if (atype < 0)
return -EINVAL;
+ if (revision && revision != cgrp->bpf.revisions[atype])
+ return -ESTALE;
progs = &cgrp->bpf.progs[atype];
@@ -698,22 +816,18 @@ static int __cgroup_bpf_attach(struct cgroup *cgrp,
old_pl_flags = pl->flags;
bpf_cgroup_storages_assign(old_storage, pl->storage);
} else {
- struct hlist_node *last = NULL;
-
pl = kmalloc(sizeof(*pl), GFP_KERNEL);
if (!pl) {
bpf_cgroup_storages_free(new_storage);
return -ENOMEM;
}
- if (hlist_empty(progs))
- hlist_add_head(&pl->node, progs);
- else
- hlist_for_each(last, progs) {
- if (last->next)
- continue;
- hlist_add_behind(&pl->node, last);
- break;
- }
+
+ err = insert_pl_to_hlist(pl, progs, prog, link, flags, id_or_fd);
+ if (err) {
+ kfree(pl);
+ bpf_cgroup_storages_free(new_storage);
+ return err;
+ }
}
pl->prog = prog;
@@ -733,6 +847,7 @@ static int __cgroup_bpf_attach(struct cgroup *cgrp,
if (err)
goto cleanup_trampoline;
+ cgrp->bpf.revisions[atype] += 1;
if (old_prog) {
if (type == BPF_LSM_CGROUP)
bpf_trampoline_unlink_cgroup_shim(old_prog);
@@ -767,12 +882,13 @@ static int cgroup_bpf_attach(struct cgroup *cgrp,
struct bpf_prog *prog, struct bpf_prog *replace_prog,
struct bpf_cgroup_link *link,
enum bpf_attach_type type,
- u32 flags)
+ u32 flags, u32 id_or_fd, u64 revision)
{
int ret;
cgroup_lock();
- ret = __cgroup_bpf_attach(cgrp, prog, replace_prog, link, type, flags);
+ ret = __cgroup_bpf_attach(cgrp, prog, replace_prog, link, type, flags,
+ id_or_fd, revision);
cgroup_unlock();
return ret;
}
@@ -894,6 +1010,7 @@ static int __cgroup_bpf_replace(struct cgroup *cgrp,
if (!found)
return -ENOENT;
+ cgrp->bpf.revisions[atype] += 1;
old_prog = xchg(&link->link.prog, new_prog);
replace_effective_prog(cgrp, atype, pl);
bpf_prog_put(old_prog);
@@ -1001,12 +1118,14 @@ static void purge_effective_progs(struct cgroup *cgrp, struct bpf_prog_list *pl,
* @prog: A program to detach or NULL
* @link: A link to detach or NULL
* @type: Type of detach operation
+ * @revision: bpf_prog_list revision
*
* At most one of @prog or @link can be non-NULL.
* Must be called with cgroup_mutex held.
*/
static int __cgroup_bpf_detach(struct cgroup *cgrp, struct bpf_prog *prog,
- struct bpf_cgroup_link *link, enum bpf_attach_type type)
+ struct bpf_cgroup_link *link, enum bpf_attach_type type,
+ u64 revision)
{
enum cgroup_bpf_attach_type atype;
struct bpf_prog *old_prog;
@@ -1024,6 +1143,9 @@ static int __cgroup_bpf_detach(struct cgroup *cgrp, struct bpf_prog *prog,
if (atype < 0)
return -EINVAL;
+ if (revision && revision != cgrp->bpf.revisions[atype])
+ return -ESTALE;
+
progs = &cgrp->bpf.progs[atype];
flags = cgrp->bpf.flags[atype];
@@ -1049,6 +1171,7 @@ static int __cgroup_bpf_detach(struct cgroup *cgrp, struct bpf_prog *prog,
/* now can actually delete it from this cgroup list */
hlist_del(&pl->node);
+ cgrp->bpf.revisions[atype] += 1;
kfree(pl);
if (hlist_empty(progs))
@@ -1064,12 +1187,12 @@ static int __cgroup_bpf_detach(struct cgroup *cgrp, struct bpf_prog *prog,
}
static int cgroup_bpf_detach(struct cgroup *cgrp, struct bpf_prog *prog,
- enum bpf_attach_type type)
+ enum bpf_attach_type type, u64 revision)
{
int ret;
cgroup_lock();
- ret = __cgroup_bpf_detach(cgrp, prog, NULL, type);
+ ret = __cgroup_bpf_detach(cgrp, prog, NULL, type, revision);
cgroup_unlock();
return ret;
}
@@ -1087,6 +1210,7 @@ static int __cgroup_bpf_query(struct cgroup *cgrp, const union bpf_attr *attr,
struct bpf_prog_array *effective;
int cnt, ret = 0, i;
int total_cnt = 0;
+ u64 revision = 0;
u32 flags;
if (effective_query && prog_attach_flags)
@@ -1124,6 +1248,10 @@ static int __cgroup_bpf_query(struct cgroup *cgrp, const union bpf_attr *attr,
return -EFAULT;
if (copy_to_user(&uattr->query.prog_cnt, &total_cnt, sizeof(total_cnt)))
return -EFAULT;
+ if (!effective_query && from_atype == to_atype)
+ revision = cgrp->bpf.revisions[from_atype];
+ if (copy_to_user(&uattr->query.revision, &revision, sizeof(revision)))
+ return -EFAULT;
if (attr->query.prog_cnt == 0 || !prog_ids || !total_cnt)
/* return early if user requested only program count + flags */
return 0;
@@ -1206,7 +1334,8 @@ int cgroup_bpf_prog_attach(const union bpf_attr *attr,
}
ret = cgroup_bpf_attach(cgrp, prog, replace_prog, NULL,
- attr->attach_type, attr->attach_flags);
+ attr->attach_type, attr->attach_flags,
+ attr->relative_fd, attr->expected_revision);
if (replace_prog)
bpf_prog_put(replace_prog);
@@ -1228,7 +1357,7 @@ int cgroup_bpf_prog_detach(const union bpf_attr *attr, enum bpf_prog_type ptype)
if (IS_ERR(prog))
prog = NULL;
- ret = cgroup_bpf_detach(cgrp, prog, attr->attach_type);
+ ret = cgroup_bpf_detach(cgrp, prog, attr->attach_type, attr->expected_revision);
if (prog)
bpf_prog_put(prog);
@@ -1257,7 +1386,7 @@ static void bpf_cgroup_link_release(struct bpf_link *link)
}
WARN_ON(__cgroup_bpf_detach(cg_link->cgroup, NULL, cg_link,
- cg_link->type));
+ cg_link->type, 0));
if (cg_link->type == BPF_LSM_CGROUP)
bpf_trampoline_unlink_cgroup_shim(cg_link->link.prog);
@@ -1329,6 +1458,13 @@ static const struct bpf_link_ops bpf_cgroup_link_lops = {
.fill_link_info = bpf_cgroup_link_fill_link_info,
};
+#define BPF_F_LINK_ATTACH_MASK \
+ (BPF_F_ID | \
+ BPF_F_BEFORE | \
+ BPF_F_AFTER | \
+ BPF_F_PREORDER | \
+ BPF_F_LINK)
+
int cgroup_bpf_link_attach(const union bpf_attr *attr, struct bpf_prog *prog)
{
struct bpf_link_primer link_primer;
@@ -1336,7 +1472,7 @@ int cgroup_bpf_link_attach(const union bpf_attr *attr, struct bpf_prog *prog)
struct cgroup *cgrp;
int err;
- if (attr->link_create.flags)
+ if (attr->link_create.flags & (~BPF_F_LINK_ATTACH_MASK))
return -EINVAL;
cgrp = cgroup_get_from_fd(attr->link_create.target_fd);
@@ -1360,7 +1496,9 @@ int cgroup_bpf_link_attach(const union bpf_attr *attr, struct bpf_prog *prog)
}
err = cgroup_bpf_attach(cgrp, NULL, NULL, link,
- link->type, BPF_F_ALLOW_MULTI);
+ link->type, BPF_F_ALLOW_MULTI | attr->link_create.flags,
+ attr->link_create.cgroup.relative_fd,
+ attr->link_create.cgroup.expected_revision);
if (err) {
bpf_link_cleanup(&link_primer);
goto out_put_cgroup;
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index fc41d87263aac..ac5500541c7d2 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -4055,6 +4055,25 @@ static int bpf_prog_attach_check_attach_type(const struct bpf_prog *prog,
}
}
+static bool is_cgroup_prog_type(enum bpf_prog_type ptype, enum bpf_attach_type atype,
+ bool check_atype)
+{
+ switch (ptype) {
+ case BPF_PROG_TYPE_CGROUP_DEVICE:
+ case BPF_PROG_TYPE_CGROUP_SKB:
+ case BPF_PROG_TYPE_CGROUP_SOCK:
+ case BPF_PROG_TYPE_CGROUP_SOCK_ADDR:
+ case BPF_PROG_TYPE_CGROUP_SOCKOPT:
+ case BPF_PROG_TYPE_CGROUP_SYSCTL:
+ case BPF_PROG_TYPE_SOCK_OPS:
+ return true;
+ case BPF_PROG_TYPE_LSM:
+ return check_atype ? atype == BPF_LSM_CGROUP : true;
+ default:
+ return false;
+ }
+}
+
#define BPF_PROG_ATTACH_LAST_FIELD expected_revision
#define BPF_F_ATTACH_MASK_BASE \
@@ -4085,6 +4104,9 @@ static int bpf_prog_attach(const union bpf_attr *attr)
if (bpf_mprog_supported(ptype)) {
if (attr->attach_flags & ~BPF_F_ATTACH_MASK_MPROG)
return -EINVAL;
+ } else if (is_cgroup_prog_type(ptype, 0, false)) {
+ if (attr->attach_flags & ~(BPF_F_ATTACH_MASK_BASE | BPF_F_ATTACH_MASK_MPROG))
+ return -EINVAL;
} else {
if (attr->attach_flags & ~BPF_F_ATTACH_MASK_BASE)
return -EINVAL;
@@ -4102,6 +4124,11 @@ static int bpf_prog_attach(const union bpf_attr *attr)
return -EINVAL;
}
+ if (is_cgroup_prog_type(ptype, prog->expected_attach_type, true)) {
+ ret = cgroup_bpf_prog_attach(attr, ptype, prog);
+ goto out;
+ }
+
switch (ptype) {
case BPF_PROG_TYPE_SK_SKB:
case BPF_PROG_TYPE_SK_MSG:
@@ -4113,20 +4140,6 @@ static int bpf_prog_attach(const union bpf_attr *attr)
case BPF_PROG_TYPE_FLOW_DISSECTOR:
ret = netns_bpf_prog_attach(attr, prog);
break;
- case BPF_PROG_TYPE_CGROUP_DEVICE:
- case BPF_PROG_TYPE_CGROUP_SKB:
- case BPF_PROG_TYPE_CGROUP_SOCK:
- case BPF_PROG_TYPE_CGROUP_SOCK_ADDR:
- case BPF_PROG_TYPE_CGROUP_SOCKOPT:
- case BPF_PROG_TYPE_CGROUP_SYSCTL:
- case BPF_PROG_TYPE_SOCK_OPS:
- case BPF_PROG_TYPE_LSM:
- if (ptype == BPF_PROG_TYPE_LSM &&
- prog->expected_attach_type != BPF_LSM_CGROUP)
- ret = -EINVAL;
- else
- ret = cgroup_bpf_prog_attach(attr, ptype, prog);
- break;
case BPF_PROG_TYPE_SCHED_CLS:
if (attr->attach_type == BPF_TCX_INGRESS ||
attr->attach_type == BPF_TCX_EGRESS)
@@ -4137,7 +4150,7 @@ static int bpf_prog_attach(const union bpf_attr *attr)
default:
ret = -EINVAL;
}
-
+out:
if (ret)
bpf_prog_put(prog);
return ret;
@@ -4165,6 +4178,9 @@ static int bpf_prog_detach(const union bpf_attr *attr)
if (IS_ERR(prog))
return PTR_ERR(prog);
}
+ } else if (is_cgroup_prog_type(ptype, 0, false)) {
+ if (attr->attach_flags || attr->relative_fd)
+ return -EINVAL;
} else if (attr->attach_flags ||
attr->relative_fd ||
attr->expected_revision) {
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index c8fb6abfeca98..1d6dc90b2345c 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -1779,6 +1779,13 @@ union bpf_attr {
};
__u64 expected_revision;
} netkit;
+ struct {
+ union {
+ __u32 relative_fd;
+ __u32 relative_id;
+ };
+ __u64 expected_revision;
+ } cgroup;
};
} link_create;
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0997/1376] bpf, cgroup: Fix storage null-ptr-deref after replacing prog
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (995 preceding siblings ...)
2026-09-12 6:57 ` [PATCH 6.12 0996/1376] bpf: Implement mprog API on top of existing cgroup progs Greg Kroah-Hartman
@ 2026-09-12 6:57 ` Greg Kroah-Hartman
2026-09-12 6:57 ` [PATCH 6.12 0998/1376] iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes Greg Kroah-Hartman
2026-09-12 6:57 ` [PATCH 6.12 0999/1376] iio: light: gp2ap002: re-enable irq if runtime suspend fails Greg Kroah-Hartman
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pu Lehui, Andrii Nakryiko,
Amery Hung, Leon Hwang, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pu Lehui <pulehui@huawei.com>
[ Upstream commit 3f562c537e9ecf4bc5e206cfffc2cc047f1b7e94 ]
Syzkaller reported a storage null-ptr-deref issue after replacing prog.
This occurs in the following scenario:
1. prog A, an empty prog, is attached to a cgrp.
2. prog B uses BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE and calls the
bpf_get_local_storage helper.
3. link_update is called to replace prog A with prog B.
The reason is that __cgroup_bpf_replace fails to alloc and assign the
required cgrp storage for the incoming replacement prog. Consequently,
the new prog inherits an uninit storage, leading to null-ptr-deref panic
when kick the new prog.
Fix this by rejecting a link update if new_prog's cgroup storage is
incompatible with link->prog.
Fixes: 0c991ebc8c69 ("bpf: Implement bpf_prog replacement for an active bpf_cgroup_link")
Signed-off-by: Pu Lehui <pulehui@huawei.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Reviewed-by: Amery Hung <ameryhung@gmail.com>
Acked-by: Leon Hwang <leon.hwang@linux.dev>
Link: https://lore.kernel.org/bpf/20260728132336.2857800-1-pulehui@huaweicloud.com [0]
Link: https://lore.kernel.org/bpf/f87b53c0-8f00-45a6-82db-8242fa9b143f@huaweicloud.com [1]
Link: https://lore.kernel.org/bpf/20260807104403.1013064-1-pulehui@huaweicloud.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/cgroup.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
index a888ae8d27223..e2d352251bb71 100644
--- a/kernel/bpf/cgroup.c
+++ b/kernel/bpf/cgroup.c
@@ -972,6 +972,20 @@ static void replace_effective_prog(struct cgroup *cgrp,
}
}
+static bool cgroup_bpf_storages_compatible(struct bpf_prog *old_prog,
+ struct bpf_prog *new_prog)
+{
+ enum bpf_cgroup_storage_type stype;
+
+ for_each_cgroup_storage_type(stype) {
+ if (old_prog->aux->cgroup_storage[stype] !=
+ new_prog->aux->cgroup_storage[stype])
+ return false;
+ }
+
+ return true;
+}
+
/**
* __cgroup_bpf_replace() - Replace link's program and propagate the change
* to descendants
@@ -1010,6 +1024,9 @@ static int __cgroup_bpf_replace(struct cgroup *cgrp,
if (!found)
return -ENOENT;
+ if (!cgroup_bpf_storages_compatible(link->link.prog, new_prog))
+ return -EINVAL;
+
cgrp->bpf.revisions[atype] += 1;
old_prog = xchg(&link->link.prog, new_prog);
replace_effective_prog(cgrp, atype, pl);
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0998/1376] iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (996 preceding siblings ...)
2026-09-12 6:57 ` [PATCH 6.12 0997/1376] bpf, cgroup: Fix storage null-ptr-deref after replacing prog Greg Kroah-Hartman
@ 2026-09-12 6:57 ` Greg Kroah-Hartman
2026-09-12 6:57 ` [PATCH 6.12 0999/1376] iio: light: gp2ap002: re-enable irq if runtime suspend fails Greg Kroah-Hartman
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nikhil Gautam, Jonathan Cameron,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikhil Gautam <nikhilgtr@gmail.com>
[ Upstream commit 579c049b4cb6fc72ce2c505fc5334540be0efcd3 ]
The IIO core does not filter duplicate writes to the event enable
attribute, so writing the same value twice invokes
write_event_config() twice. Enabling twice leaks a runtime PM
reference, preventing the device from ever suspending again;
disabling twice underflows the usage count and triggers a
"Runtime PM usage count underflow" warning.
Bail out early when the requested state matches the current state.
While at it, switch to pm_runtime_resume_and_get() so a failed
resume is propagated to userspace instead of silently marking the
event enabled.
Fixes: 97d642e23037c ("iio: light: Add a driver for Sharp GP2AP002x00F")
Signed-off-by: Nikhil Gautam <nikhilgtr@gmail.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/light/gp2ap002.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/drivers/iio/light/gp2ap002.c b/drivers/iio/light/gp2ap002.c
index be31505a87fa0..d82a4c93c9d16 100644
--- a/drivers/iio/light/gp2ap002.c
+++ b/drivers/iio/light/gp2ap002.c
@@ -343,6 +343,10 @@ static int gp2ap002_write_event_config(struct iio_dev *indio_dev,
int state)
{
struct gp2ap002 *gp2ap002 = iio_priv(indio_dev);
+ int ret;
+
+ if (state == gp2ap002->enabled)
+ return 0;
if (state) {
/*
@@ -350,14 +354,17 @@ static int gp2ap002_write_event_config(struct iio_dev *indio_dev,
* already) and reintialize the sensor by using runtime_pm
* callbacks.
*/
- pm_runtime_get_sync(gp2ap002->dev);
- gp2ap002->enabled = true;
+ ret = pm_runtime_resume_and_get(gp2ap002->dev);
+ if (ret)
+ return ret;
+
} else {
pm_runtime_mark_last_busy(gp2ap002->dev);
pm_runtime_put_autosuspend(gp2ap002->dev);
- gp2ap002->enabled = false;
}
+ gp2ap002->enabled = state;
+
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
* [PATCH 6.12 0999/1376] iio: light: gp2ap002: re-enable irq if runtime suspend fails
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
` (997 preceding siblings ...)
2026-09-12 6:57 ` [PATCH 6.12 0998/1376] iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes Greg Kroah-Hartman
@ 2026-09-12 6:57 ` Greg Kroah-Hartman
998 siblings, 0 replies; 1464+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nikhil Gautam, Jonathan Cameron,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikhil Gautam <nikhilgtr@gmail.com>
[ Upstream commit 5d89e7cbac40057f5241a0832a86ce0fe97e4818 ]
gp2ap002_runtime_suspend() disables the irq before writing OPMOD. If
the write fails, the callback returns an error with the irq still
disabled while the PM core marks the device active again.
re-enable the irq before returning the error so the irq state matches
the active state the PM core restores.
Fixes: 97d642e23037c ("iio: light: Add a driver for Sharp GP2AP002x00F")
Signed-off-by: Nikhil Gautam <nikhilgtr@gmail.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/light/gp2ap002.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/iio/light/gp2ap002.c b/drivers/iio/light/gp2ap002.c
index d82a4c93c9d16..e11aa1c7acf44 100644
--- a/drivers/iio/light/gp2ap002.c
+++ b/drivers/iio/light/gp2ap002.c
@@ -651,6 +651,7 @@ static int gp2ap002_runtime_suspend(struct device *dev)
/* Disable chip and IRQ, everything off */
ret = regmap_write(gp2ap002->map, GP2AP002_OPMOD, 0x00);
if (ret) {
+ enable_irq(gp2ap002->irq);
dev_err(gp2ap002->dev, "error setting up operation mode\n");
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1464+ messages in thread
end of thread, other threads:[~2026-09-12 12:57 UTC | newest]
Thread overview: 1464+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-12 6:40 [PATCH 6.12 0000/1376] 6.12.110-rc1 review Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0001/1376] net: skbuff: dont skb_tx_error() the source skb in skb_zerocopy() Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0002/1376] net: openvswitch: fix kernel-doc warnings in internal headers Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0003/1376] openvswitch: Fix CT limit teardown use-after-free Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0004/1376] landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0005/1376] xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0006/1376] netfs: Fix netfs_read_folio() to wait on writeback Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0007/1376] mm/page_vma_mapped: use huge_ptep_get() for hugetlb Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0008/1376] wifi: mt76: mt7996: validate default EEPROM firmware size Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0009/1376] hugetlb: only adjust reservation during unmapping if mapcount is 0 Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0010/1376] fsnotify: Fix stale object mask after concurrent mark updates Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0011/1376] tcp: fix potential race in tcp_v6_syn_recv_sock() Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0012/1376] entry: Fix seccomp bypass after ptrace with TSYNC Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0013/1376] objtool/rust: add one more `noreturn` Rust function Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0014/1376] fsnotify: inotify: pass mark connector to fsnotify_recalc_mask() Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0015/1376] net: ntb_netdev: Fix TX busy and drop handling Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0016/1376] drm/amd/display: fix division by zero in get_estimated_bw() Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0017/1376] usb: image: mdc800: change kmalloc() to kzalloc() Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0018/1376] ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0019/1376] clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0020/1376] media: usbtv: keep device alive while ALSA card exists Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0021/1376] usb-storage: ene_ub6250: fix race between scan work and probe Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0022/1376] usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0023/1376] usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0024/1376] usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0025/1376] usb: typec: qcom-pmic: cancel reset_work on stop Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0026/1376] usb: typec: ucsi: displayport: Fix OOB altmode array index Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0027/1376] usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0028/1376] usb: gadget: f_midi2: fix use-after-free in string attribute show path Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0029/1376] usb: gadget: f_midi: initialize work in f_midi_alloc() Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0030/1376] USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0031/1376] usb: gadget: fix null pointer dereference in usb_put_function_instance() Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0032/1376] staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() Greg Kroah-Hartman
2026-09-12 6:40 ` [PATCH 6.12 0033/1376] staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0034/1376] thermal/drivers/imx: Disable clock on runtime resume failure Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0035/1376] thermal/drivers/qoriq: Disable clock on " Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0036/1376] ublk: clear VM_MAYWRITE on read-only ublk char device mmap Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0037/1376] spi: bcm63xx-hsspi: disable clocks on resume failure Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0038/1376] spi: bcm63xx: disable clock " Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0039/1376] spi: bcmbca-hsspi: disable clocks " Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0040/1376] spi: Fix DMA mapping ownership on partial map failure Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0041/1376] scsi: target: iscsi: Reserve a terminator byte for the login payload Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0042/1376] scsi: pm8001: Use rollback index when freeing MSI-X vectors Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0043/1376] mm/damon/sysfs-schemes: kobject_del() scheme dirs Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0044/1376] mm/damon/sysfs-schemes: kobject_del() scheme filter dirs Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0045/1376] mm/damon/sysfs-schemes: kobject_del() scheme quota goal dirs Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0046/1376] mm/damon/sysfs-schemes: kobject_del() scheme region dirs Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0047/1376] mm/damon/sysfs: kobject_del() region and target (error) dirs Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0048/1376] mm/damon/sysfs: kobject_del() target (normal), context and kdamond dirs Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0049/1376] mm/damon/core-kunit: check region count before testing in split_at() Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0050/1376] futex: Prevent rcuwait use-after-free during requeue PI Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0051/1376] ftrace: Synchronize the initialization of ftrace_ops Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0052/1376] HID: bpf: serialize device reference release in struct_ops destroy path Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0053/1376] HID: rmi: fix OOB access with undersized RMI reports Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0054/1376] HID: wacom: validate report length in wacom_intuos_pro2_bt_irq Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0055/1376] dm: fix race when loading and unloading a table Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0056/1376] dm: fix resume-vs-remove race Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0057/1376] dma-direct: return struct page from dma_direct_alloc_from_pool() Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0058/1376] dmaengine: fsl-edma: tracing: no ptr dereference during log output Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0059/1376] dmaengine: dw-edma: Fix HDMA channel status register access Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0060/1376] dmaengine: dw-edma: Complete descriptors before pausing Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0061/1376] dmaengine: dw-edma: Initialize IRQ data before requesting IRQs Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0062/1376] cpuidle: dt_idle_genpd: kfree() the original name allocation Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0063/1376] block: flag zoned disks with GENHD_FL_NO_PART Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0064/1376] ceph: lock mutex in ceph_mds_check_access() Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0065/1376] ata: ahci: work around lost interrupts on Marvell 88SE61xx Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0066/1376] ima: Check for ERR_PTR from dentry_path() in validate_hash_algo() Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0067/1376] irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0068/1376] kprobes: Protect kprobe_blacklist with RCU Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0069/1376] mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave() Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0070/1376] tcp: clear sock_ops cb flags before force-closing a child socket Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0071/1376] Input: aiptek - validate raw macro indices before updating state Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0072/1376] memcg: make the v1 soft limit knob inert Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0073/1376] rtc: rzn1: Fix weekday underflow when alarm crosses month boundary Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0074/1376] rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0075/1376] perf/x86/intel: Fix kernel address leakages in LBR stack Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0076/1376] perf trace: Factor out BPF loop body Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0077/1376] perf trace: Refactor augmented_raw_syscalls using bpf_for Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0078/1376] perf hisi-ptt: Fix PTT trace TLP header parsing Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0079/1376] i2c: core: fix debugfs UAF on adapter removal Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0080/1376] i2c: mux: Fix channel node leak on adapter add failure Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0081/1376] arm64: mm: Fix the lockless page-table walk in show_pte() Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0082/1376] ALSA: rawmidi: Return the error from snd_rawmidi_input_params() Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0083/1376] ALSA: harmony: initialize locks before requesting IRQ Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0084/1376] ALSA: pcm: Fix race between non-atomic ops and trigger-start Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0085/1376] nvme-fabrics: fix DHCHAP secret leak on parse failure Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0086/1376] nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0087/1376] nvme-tcp: check the data direction of a C2HData PDU Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0088/1376] nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0089/1376] nvmet-tcp: reject unsolicited H2CData PDUs Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0090/1376] Revert "irqchip/mbigen: Fix mbigen node address layout" Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0091/1376] mm/hugetlb: fix missing migratable flag on same-node hugetlb migration Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0092/1376] nvdimm/btt: reject an arena whose nfree is below the lane count Greg Kroah-Hartman
2026-09-12 6:41 ` [PATCH 6.12 0093/1376] parisc: eisa: Fix infinite loop when parsing invalid IRQ value Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0094/1376] parisc: Fix alignment of asm statements in head.S Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0095/1376] powerpc/kexec_file: Fix null-ptr-def in extra size calculation Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0096/1376] powerpc/kexec_file: Prevent kexec range truncation Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0097/1376] powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0098/1376] powerpc/pseries: Handle and log pseries-wdt registration failures Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0099/1376] powerpc/pseries: Move H_WATCHDOG definitions to a common header Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0100/1376] powerpc/crash: stop watchdogs before booting kdump kernel Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0101/1376] s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm() Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0102/1376] s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0103/1376] s390/vfio-ap: Fix control domain removal " Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0104/1376] s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0105/1376] s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0106/1376] s390/vfio-ap: Fix NULL deref in status_show() during queue probe Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0107/1376] s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0108/1376] s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0109/1376] mtd: afs: validate v2 image info bounds Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0110/1376] mtd: mtdoops: free page bitmap when the backing MTD is removed Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0111/1376] mtd: rawnand: validate ONFI extended parameter page sections Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0112/1376] batman-adv: fix stale receive device on merged fragments Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0113/1376] batman-adv: mcast: ensure unshared skb for multicast packets Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0114/1376] batman-adv: mcast: linearize skbuff for packet generation Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0115/1376] batman-adv: dat: avoid unaligned fault in IP extraction Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0116/1376] batman-adv: bla: fix freeing of claims on meshif deletion Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0117/1376] batman-adv: bla: prevent CRC corruptions after claim flush Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0118/1376] clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0119/1376] clk: qcom: gcc-msm8939: " Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0120/1376] clk: rockchip: rk3588: Dont change PLL rates when setting dclk_vop2_src Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0121/1376] clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0122/1376] clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0123/1376] clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0124/1376] clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0125/1376] clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0126/1376] i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0127/1376] ASoC: cs35l33: drain threaded IRQ before runtime suspend Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0128/1376] ASoC: cs35l34: " Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0129/1376] ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0130/1376] ASoC: hdac_hda: Fix hlink refcount leak on component registration failure Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0131/1376] AsoC: intel: sst: fix PCI device reference leak on probe failure Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0132/1376] ASoC: loongson: Fix error handling in ACPI property parsing Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0133/1376] ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0134/1376] iio: adc: max34408: add missing select REGMAP_I2C to Kconfig Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0135/1376] iio: adc: pac1921: fix wrong channel used in trigger handler read Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0136/1376] iio: buffer: Fix potential use-after-free in anonymous buffer release Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0137/1376] iio: buffer: Make IIO DMA fence release RCU-safe Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0138/1376] iio: buffer: Tie IIO dma fence lock lifetime to the fence Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0139/1376] iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0140/1376] iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0141/1376] iio: chemical: sgp30: Handle IAQ thread creation failure Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0142/1376] iio: dac: m62332: Fix regulator reference count imbalance Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0143/1376] iio: gyro: mpu3050: fix sign of raw angular velocity readings Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0144/1376] iio: light: cm32181: return zero after writing calibscale Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0145/1376] iio: light: gp2ap002: Disable regulators on resume failure Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0146/1376] iio: light: ltrf216a: fix runtime PM reference leak in error path Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0147/1376] iio: pressure: dps310: fix NULL pointer dereference on ACPI probe Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0148/1376] iio: pressure: mpl115: Fix runtime PM cleanup Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0149/1376] iio: srf04: fix pm_runtime handling on probe error path Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0150/1376] iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0151/1376] iio: light: opt4001: Fix power down clearing bits of the wrong register Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0152/1376] iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem() Greg Kroah-Hartman
2026-09-12 6:42 ` [PATCH 6.12 0153/1376] iio: light: opt4001: Reject integration times with a non-zero seconds part Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0154/1376] iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0155/1376] KVM: nVMX: Always flush vpid02 on first use Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0156/1376] KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0157/1376] KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0158/1376] KVM: nVMX: Service local TLB flushes on failed nested VM-Enter Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0159/1376] KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0160/1376] KVM: x86/mmu: Fold kvm_mmu_zap_memslot() into kvm_arch_flush_shadow_memslot() Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0161/1376] KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0162/1376] KVM: x86: Serialize writes to disabled_quirks using kvm->lock Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0163/1376] KVM: x86: Ensure runtime reads of disabled_quirks are resolved once Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0164/1376] KVM: s390: Fix length check __import_wp_info() Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0165/1376] KVM: s390: Fix memory leak in guest debug handling Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0166/1376] KVM: s390: Fix old_data leak in guest debug error path Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0167/1376] KVM: s390: Free guest debug data on vcpu destroy Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0168/1376] KVM: s390: Take srcu when importing watchpoint data Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0169/1376] KVM: s390: Zero initialize irq in reinject_machine_check Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0170/1376] KVM: s390: pv: Fix rc/rrc offset for PVM_DUMP Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0171/1376] KVM: s390: Restore sigset on error path Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0172/1376] LoongArch: KVM: Fix TOCTOU race on pv_features Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0173/1376] LoongArch: KVM: Free init resources if kvm_init() fails Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0174/1376] LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0175/1376] LoongArch: Fix acpi_package_ids[] array overflow Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0176/1376] LoongArch: Do not select HAVE_RUST when KASAN is enabled Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0177/1376] LoongArch: Do not save/restore percpu base register in rethook trampoline Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0178/1376] LoongArch: Avoid preempt count underflow without probe Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0179/1376] media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0180/1376] media: amphion: Remove obsolete frame_count check in venc_start_session Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0181/1376] media: cec: core: Fix kmemleak due to missed rc_free_device() call Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0182/1376] media: cec: disable delayed work before freeing an interrupted transmit Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0183/1376] media: cec: extron-da-hd-4k-plus: add sanity check Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0184/1376] media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0185/1376] media: cec: Serialize exclusive follower delivery Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0186/1376] media: cedrus: fix memory leak in cedrus_init_ctrls() Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0187/1376] media: cobalt: Avoid freeing ALSA private data twice Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0188/1376] media: cx231xx: reject geometry changes while the VBI queue is busy Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0189/1376] media: cx23885: cancel NetUP CI work before teardown Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0190/1376] media: em28xx: defer audio-only extension registration Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0191/1376] media: em28xx: fix use-after-free of dev_next->devlist on disconnect Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0192/1376] media: go7007: defer the ALSA v4l2 put until card release Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0193/1376] media: i2c: alvium: Fix: Correct name of register in alvium_set_ctrl_auto_exposure Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0194/1376] media: i2c: imx415: Return test pattern write errors Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0195/1376] media: i2c: ov02a10: fix endpoint parsing use-after-free Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0196/1376] media: i2c: ov7740: fix use-after-destroy in remove Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0197/1376] media: intel/ipu6: fix async notifier cleanup leak on parse error Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0198/1376] media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0199/1376] media: platform: mtk-mdp3: Fix SCP device refcounting Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0200/1376] media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0201/1376] media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0202/1376] media: nxp: imx8-isi: Correct color map between V4L2 and ISI Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0203/1376] media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0204/1376] media: rc: sunxi-cir: Unregister rc device on probe failure Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0205/1376] media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0206/1376] media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0207/1376] media: s2255: bound JPEG frame size before copying into the buffer Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0208/1376] media: s2255: check firmware size before reading trailing marker Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0209/1376] media: saa7164: fix cleanup on resource allocation failure Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0210/1376] media: tda18250: fix possible integer overflow Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0211/1376] media: v4l2-async: avoid deleting unlinked ASC entry on link error Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0212/1376] media: v4l2-ctrls: Allow unknown HDR10 white point and luminance Greg Kroah-Hartman
2026-09-12 6:43 ` [PATCH 6.12 0213/1376] media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0214/1376] media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0215/1376] media: venus: fix payload size calculation in parse_raw_formats() Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0216/1376] media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0217/1376] media: vimc: fix pixel format lookup in enum_framesizes Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0218/1376] media: zoran: Avoid freeing a registered video_device twice Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0219/1376] media: chips-media: wave5: Guard bit depth check with initial_info_obtained Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0220/1376] scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0221/1376] scsi: qla2xxx: Bound i2c->length in I2C " Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0222/1376] scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0223/1376] scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0224/1376] scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0225/1376] scsi: qla2xxx: Initialize NVMe abort_work once at submission Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0226/1376] scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config() Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0227/1376] scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0228/1376] scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0229/1376] scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0230/1376] scsi: qla2xxx: Serialize flash version read in reset handler Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0231/1376] scsi: qla2xxx: Fix cs84xx use-after-free on host teardown Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0232/1376] scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0233/1376] scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0234/1376] scsi: qla2xxx: Fix FCE trace enable parsing in debugfs Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0235/1376] scsi: qla2xxx: Dont query firmware state while chip is down Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0236/1376] scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0237/1376] scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb() Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0238/1376] scsi: qla2xxx: Quiesce response IRQ before freeing request queue Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0239/1376] scsi: qla2xxx: Avoid double completion in async IOCB timeout Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0240/1376] scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0241/1376] scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0242/1376] scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0243/1376] scsi: qla2xxx: Drop vport reference under lock in report ID acquisition Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0244/1376] scsi: qla2xxx: Hold vport_slock for host map update " Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0245/1376] scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0246/1376] scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0247/1376] scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0248/1376] f2fs: return symlink writeback errors Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0249/1376] f2fs: reject overlapping move range after len expansion Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0250/1376] f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set() Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0251/1376] f2fs: return writeback error from collapse range Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0252/1376] f2fs: avoid NULL checkpoint thread access in sysfs Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0253/1376] f2fs: fix to migrate all curseg types during free_segment_range Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0254/1376] f2fs: fix i_size when pinned fallocate partially fails Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0255/1376] f2fs: fix to off-by-one issue in f2fs_zero_post_eof_page() Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0256/1376] f2fs: fix valid block count leak on data block allocation failure Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0257/1376] f2fs: fix to zero post-EOF data when extending file size Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0258/1376] drm/panthor: fix firmware control interface bounds checks Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0259/1376] drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0260/1376] drm/panel-edp: " Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0261/1376] drm: fix race between partial drm_dev_register() failure and ioctl Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0262/1376] drm/i915: Guard against NULL driver_data in i915_pci_probe() Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0263/1376] drm/ssd130x: fix column and row end address in partial updates for ssd132x Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0264/1376] drm/sun4i: fix refcount leak in sun4i_backend_init_sat() Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0265/1376] drm/ssd130x: fix column and row end address in partial updates in ssd133x Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0266/1376] drm/hibmc: Fix list of formats on the primary plane Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0267/1376] drm/hibmc: Use drm_atomic_helper_check_plane_state() Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0268/1376] drm/amd/display: avoid divide-by-zero in __is_lut_linear() Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0269/1376] drm/amd/display: validate plane degamma LUT size for private color prop Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0270/1376] drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0271/1376] drm/gud: NUL-terminate TV mode names read from the device Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0272/1376] drm/gud: validate TV mode names before creating enum property Greg Kroah-Hartman
2026-09-12 6:44 ` [PATCH 6.12 0273/1376] drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0274/1376] drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0275/1376] drm/amdgpu: check thunderbolt before switcheroo registration Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0276/1376] drm/amdgpu: fix autosuspend cleanup during removal Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0277/1376] drm/amdgpu: Skip accessing psp rum time db for APUs Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0278/1376] drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0279/1376] drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0280/1376] drm/amdkfd: Reject zero-sized AQL queue allocations after size halving Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0281/1376] drm/nouveau: unsubscribe the channel-kill event before the fence context Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0282/1376] drm/nouveau: Use write-combined maps for coherent Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0283/1376] drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0284/1376] drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0285/1376] drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0286/1376] afs: Fix leak of ungot volume Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0287/1376] xhci: fix lost bounce buffers on TDs spanning several ring segments Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0288/1376] ksmbd: zero pipe read compound padding Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0289/1376] net/mlx5e: xsk: Fix unlocked writing to ICOSQ Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0290/1376] nvmet-auth: Synchronize timeout work during SQ teardown Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0291/1376] mm/damon/vaddr: drop last same folio access check optimization Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0292/1376] mm/damon/ops-common: use nr_accesses moving sum for quota score Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0293/1376] mm/damon/paddr: drop last same folio access check reuse optimization Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0294/1376] mm/damon/vaddr-kunit: check region count in three_regions test Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0295/1376] mm/damon/core-kunit: handle region split failure in filter_out() Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0296/1376] mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of() Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0297/1376] of: unittest: Fix memory leak in unittest_data_add() Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0298/1376] ksmbd: fix use-after-free in smb2_open during durable reconnect Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0299/1376] ksmbd: fix durable reconnect error path file lifetime Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0300/1376] ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0301/1376] batman-adv: dat: atomically update mac addresses Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0302/1376] batman-adv: bla: avoid CRC corruption due to parallel claim add Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0303/1376] perf sched: Fix register_pid() overflow, strcpy, and BUG_ON Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0304/1376] clk: meson: align gxbb_32k_clk_sel number of parents with actual count Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0305/1376] batman-adv: fix TX priority extraction for BATADV_FORW_MCAST Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0306/1376] mm/damon/core: skip aging from repeated aggressive merging Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0307/1376] Smack: Fix error in capability bypass Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0308/1376] drm: Remove unused header in drm_dumb_buffers.c Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0309/1376] drm: lcdif: Wait for vblank before disabling DMA Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0310/1376] drm/v3d: Replace a global spinlock with a per-queue spinlock Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0311/1376] drm/v3d: Clear queue->active_job when v3d_fence_create() fails Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0312/1376] drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0313/1376] drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0314/1376] smack: fix incorrect task context in smack_msg_queue_msgrcv Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0315/1376] smack: simplify write handlers of sysfs entries Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0316/1376] smack: deduplicate smackfs/{direct,mapped} file_operations Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0317/1376] smack: restrict smackfs/{direct,mapped} values to 0-255 Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0318/1376] sched_ext/scx_flatcg: Fix cvtime_delta race and add hweight scaling to bypass charging Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0319/1376] x86/cfi: Use symmetric SYM_START and SYM_END in __CFI_TYPE() Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0320/1376] platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0321/1376] HID: core: quiesce input in hid_hw_stop() to prevent use-after-free Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0322/1376] HID: nintendo: Fix imu_timestamp_us double increment per report Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0323/1376] HID: roccat: bound device-supplied profile index Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0324/1376] soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0325/1376] media: cec-pin: Fix event FIFO ordering Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0326/1376] cxl: Refactor user ioctl command path from mds to mailbox Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0327/1376] cxl/mbox: Clamp mailbox output allocation to the payload size Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0328/1376] cxl/pci: Remove incorrect mbox.valid check in cxl_pci_type3_init_mailbox() Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0329/1376] clk: versaclock7: Fix APLL clock leak on probe failure Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0330/1376] clk: moxart: remove unused variables, fix refcount leak Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0331/1376] clk: nuvoton: ma35d1: fix ignored div_u64 return values in PLL freq calculation Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0332/1376] clk: nuvoton: ma35d1: fix PLL_CTL1_FRAC bit field width and fractional calc Greg Kroah-Hartman
2026-09-12 6:45 ` [PATCH 6.12 0333/1376] clk: nuvoton: ma35d1-pll: convert from round_rate() to determine_rate() Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0334/1376] clk: nuvoton: ma35d1: fix ma35d1_clk_pll_determine_rate logic Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0335/1376] ASoC: rt700-sdw: always drain jack work on remove Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0336/1376] ASoC: fsl_audmix: rework runtime PM handling in probe Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0337/1376] clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0338/1376] ARM: imx: fix device_node refcount leak in imx_src_init() Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0339/1376] ARM: imx: fix device_node refcount leaks in imx7_src_init() Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0340/1376] arm64: dts: imx93-kontron: set memory node to 0x80000000/1GiB Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0341/1376] clk: imx: scu: drop redundant init.ops variable assignment Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0342/1376] drm/lima: call drm_mm_init() with a valid allocation range Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0343/1376] mm/mm_init: fix incorrect node_spanned_pages Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0344/1376] sched/fair: Fix overflow in update_tg_cfs_runnable() Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0345/1376] perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0346/1376] pinctrl: bcm2835: Dont remove an unregistered GPIO chip Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0347/1376] riscv: kexec_file: Split the loading of kernel and others Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0348/1376] riscv: kexec_file: Fix crashk_low_res not exclude bug Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0349/1376] media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0350/1376] media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW " Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0351/1376] perf test: Update all metrics test like metricgroups test Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0352/1376] perf test stat_all_metrics: Ensure missing events fail test Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0353/1376] perf tests metrics: Permission related fixes Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0354/1376] perf test metrics: Update all metrics for possibly failing default metrics Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0355/1376] perf test all metrics: Fully ignore Default metric failures Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0356/1376] perf test: Do not skip when some metrics tests succeeded Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0357/1376] perf tests: Skip metrics validation if system-wide recording lacks permission Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0358/1376] perf test: Use sqrtloop workload to test bperf event Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0359/1376] perf test: Fix perf stat --bpf-counters on hybrid machines Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0360/1376] perf tests: Fix flakiness in BPF counters test on hybrid systems Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0361/1376] perf test brstack: Speed up running test by using tr -s instead of xargs Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0362/1376] perf tests: Harden branch stack sampling test Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0363/1376] perf test: Refactor brstack test Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0364/1376] perf test: Add syscall and address tests to " Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0365/1376] perf test: Extend branch stack sampling test for Arm64 BRBE Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0366/1376] perf test: Fixes for check branch stack sampling Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0367/1376] perf tests: Fix flakiness in branch stack sampling tests Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0368/1376] regulator: tps6594-regulator: Constify struct tps6594_regulator_irq_type Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0369/1376] regulator: tps6594-regulator: remove interrupt_count Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0370/1376] regulator: tps6594-regulator: remove hardcoded buck config Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0371/1376] regulator: tps6594-regulator: refactor variant descriptions Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0372/1376] regulator: tps6594: Fix device node reference leaks in multiphase loop Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0373/1376] drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0374/1376] drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0375/1376] tools/bpf/bpftool: Reset vmlinux BTF after map commands Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0376/1376] tools/bpf/bpftool: Reset vmlinux BTF after struct_ops commands Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0377/1376] bpf: Copy per-CPU map value padding in copy_map_value_long() Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0378/1376] selftests/bpf: Systematically add SO_REUSEADDR in start_server_addr Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0379/1376] selftests/bpf: Mask socket type flags in mptcpify prog Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0380/1376] bpf,lsm: Drop bpf_prog_free from sleepable_lsm_hooks Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0381/1376] mm: add build-time option for hotplug memory default online type Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0382/1376] mm: convert memory block states (MEM_*) macros to enum Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0383/1376] mm: change type of state in struct memory_block Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0384/1376] mm: name the anonymous MMOP enum as enum mmop Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0385/1376] mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0386/1376] dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0387/1376] dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0388/1376] dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0389/1376] soundwire: qcom: Fix port exhaustion check in stream_alloc_ports Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0390/1376] iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0391/1376] csky: Fix a4/a5 restoration in syscall trace path Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0392/1376] selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check Greg Kroah-Hartman
2026-09-12 6:46 ` [PATCH 6.12 0393/1376] platform/chrome: sensorhub: Fix memory overread in ring handler Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0394/1376] wifi: rtw89: fix HE extended capability length check Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0395/1376] perf cs-etm: Queue context packets for frontend Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0396/1376] perf cs-etm: Fix thread leaks on trace queue init failure Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0397/1376] perf/x86/amd/uncore: Add group validation Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0398/1376] perf vendor events amd: Update Zen 5 core events Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0399/1376] hwrng: core - fix rng list on registration error Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0400/1376] crypto: qat - cancel work on re-enable SR-IOV timeout Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0401/1376] crypto: qat - clear AES key schedule from stack Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0402/1376] crypto: atmel-ecc - replace min_t with min Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0403/1376] crypto: atmel-ecc - clean up and improve ECDH comments Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0404/1376] crypto: atmel-ecc - reject hardware ECDH without a public key Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0405/1376] crypto: atmel-sha204a - fix heap info leak on I2C transfer failure Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0406/1376] crypto: sa2ul - stop probe if context pool creation fails Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0407/1376] crypto: rk3288 - fail ahash requests on HASH idle timeout Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0408/1376] crypto: keembay - Fix AEAD unregister count in error path Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0409/1376] nvme-apple: Use acquire/release for queue enabled state Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0410/1376] nvmet-rdma: factor out response resource cleanup Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0411/1376] nvmet-rdma: fix response resource leak on queue teardown Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0412/1376] bus: ti-sysc: Fix /chosen node reference leak Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0413/1376] PM: sleep: Fix off-by-one in wakelocks number limit check Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0414/1376] cgroup/cpuset: Make nr_deadline_tasks an atomic_t Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0415/1376] arm64: dts: qcom: sm7225-fairphone-fp4: Fix address in fb node name Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0416/1376] arm64: dts: qcom: hamoa: Fix clocks for HSPHYs Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0417/1376] bus: qcom-ebi2: Simplify with scoped for each OF child loop Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0418/1376] bus: qcom-ebi2: Fix clock leak on probe failure Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0419/1376] wifi: mac80211_hwsim: avoid NULL skb in stop queue drain Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0420/1376] staging: greybus: audio: correct sscanf() return value check Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0421/1376] staging: sm750fb: gate dualview dataflow using g_dualview Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0422/1376] staging: sm750fb: Add missing Kconfig dependency Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0423/1376] greybus: audio: bound the topology section sizes against the fetched size Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0424/1376] staging: fbtft: Use sysfs_emit_at() to print to sysfs file Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0425/1376] staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0426/1376] staging: octeon: fix free_irq dev_id mismatch in cvm_oct_rx_shutdown Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0427/1376] staging: octeon: ethernet-mem: replace pr_warn with dev_warn in free functions Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0428/1376] staging: octeon: replace pr_warn with dev_warn in fill and rx paths Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0429/1376] staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0430/1376] staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0431/1376] ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0432/1376] selftests/bpf: Fix memory leak in msg_alloc_iov error path Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0433/1376] selftests/bpf: Fix memory leak in msg_alloc_iov Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0434/1376] selftests/lsm: Fix memory leak in attr_lsm_count Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0435/1376] irqchip/gic-v3-its: Fix memleak in its_probe_one() Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0436/1376] irqchip/gic-v3-its: Fix its node leak in gic_acpi_parse_madt_its() Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0437/1376] selftests: timers: leap-a-day: Fix -w option and update usage comment Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0438/1376] clocksource: Unregister subsystem on device registration failure Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0439/1376] y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32 Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0440/1376] timekeeping: Account for monotonicity adjustment in ntp_error Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0441/1376] clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0442/1376] clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0443/1376] clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister() Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0444/1376] arm64: dts: qcom: sc8180x-primus: Rename regulator nodes Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0445/1376] arm64: dts: qcom: sc8180x-primus: Describe the display power net Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0446/1376] arm64: dts: qcom: sc8180x-lenovo-flex-5g: Rename regulator nodes Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0447/1376] arm64: dts: qcom: sc8180x-lenovo-flex-5g: Describe the display power net Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0448/1376] perf data convert json: Fix trace_seq memory leak in process_sample_event() Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0449/1376] thermal/drivers/rcar: Fix error checking in probe() Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0450/1376] usb: typec: ucsi: unregister debugfs entries on teardown Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0451/1376] usb: gadget: r8a66597: avoid double free of ep0_req in probe error path Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0452/1376] udf: Mark LVID buffer as uptodate before marking it dirty Greg Kroah-Hartman
2026-09-12 6:47 ` [PATCH 6.12 0453/1376] perf vendor events amd: Reintroduce deprecated Zen 5 core events Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0454/1376] perf dso: Fix kallsyms DSO detection with fallback logic Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0455/1376] bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0456/1376] efi: fix stale reference to efi_recover_from_page_fault() Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0457/1376] bpf: Fix use-after-free on mm_struct in bpf_find_vma() Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0458/1376] bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0459/1376] iommu/mediatek-v1: Fix off-by-one in MT2701_LARB_NR_MAX Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0460/1376] iommu/msm: Return -ENOMEM on memory allocation failure in probe Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0461/1376] iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0462/1376] iommu/amd: Add support for Hygon family 18h model 4h IOAPIC Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0463/1376] iommu/amd: Fix false positive in SB IOAPIC IVRS validation Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0464/1376] leds: pca9532: Fix inverted GPIO output polarity Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0465/1376] printk/panic: Add option to allow non-panic CPUs to write to the ring buffer Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0466/1376] panic: introduce helper functions for panic state Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0467/1376] panic/printk: replace this_cpu_in_panic() with panic_on_this_cpu() Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0468/1376] panic/printk: replace other_cpu_in_panic() with panic_on_other_cpu() Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0469/1376] printk: Introduce console_flush_one_record Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0470/1376] printk: Fix possible console use-after-free Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0471/1376] ACPI: RISC-V: Fix riscv_acpi_irq_get_dep() loop termination Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0472/1376] ACPI: RISC-V: Check acpi_get_handle() status in riscv_acpi_add_prt_dep() Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0473/1376] ACPI: RISC-V: Fix riscv_acpi_add_prt_dep() loop handling Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0474/1376] platform/x86: dell-privacy: Fix race condition Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0475/1376] platform/x86: dell-wmi-base: Fix resource leak on module load failure Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0476/1376] platform/x86: lg-laptop: Drop debug-only ACPI notify handler Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0477/1376] platform/x86: lg-laptop: Convert ACPI driver to a platform one Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0478/1376] platform/x86: lg-laptop: Fix LED resource handling Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0479/1376] remoteproc: qcom_q6v5_adsp: Fix reference leak for device node Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0480/1376] hwspinlock: propagate errno when registering single lock Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0481/1376] selftests/sched_ext: Fix bpf_link leak on early return in prog_run Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0482/1376] serial: ma35d1: Fix OF node reference leaks in console init Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0483/1376] serial: qcom-geni: do not advance stale DMA completions Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0484/1376] usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0485/1376] usb: gadget: configfs: fix out-of-bounds read of qw_sign Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0486/1376] usb: ljca: bound bank_num in ljca_enumerate_gpio() Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0487/1376] usb: gadget: aspeed_udc: check endpoint DMA allocation Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0488/1376] USB: make single lock for all usb dynamic id lists Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0489/1376] USB: make to_usb_driver() use container_of_const() Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0490/1376] usb: fix UAF when probe runs concurrent to dyn ID removal Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0491/1376] platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0492/1376] platform/surface: acpi-notify: Check ACPI companion before use Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0493/1376] usb: mtu3: allow system suspend during active gadget connection Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0494/1376] usb: renesas_usbhs: Fix power-off ordering on unbind Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0495/1376] drm/panel: samsung-s6d16d0: Power off on prepare failure Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0496/1376] perf metricgroup: Fix metric expression copy leaks Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0497/1376] soc: qcom: rpmh-rsc: manage PM notifiers with devres Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0498/1376] bus: qcom-ebi2: use managed resources for clocks and children Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0499/1376] clk: qcom: camcc-sc8280xp: unregister CAMCC_GDSC_CLK Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0500/1376] iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0501/1376] RDMA/core: Wait for RCU callbacks before unloading ib_core Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0502/1376] RDMA/mlx5: Drain RCU callbacks during module teardown Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0503/1376] RDMA/ipoib: " Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0504/1376] RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0505/1376] crypto: ccp - Fix memory leak in SEV INIT_EX path Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0506/1376] hwrng: ks-sa - Fix runtime PM cleanup on registration failure Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0507/1376] xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0508/1376] ALSA: hpi: Check transport errors during HPI6000 adapter initialization Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0509/1376] pmdomain: bcm: bcm2835: handle genpd provider registration errors Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0510/1376] misc: rtsx_usb: avoid USB I/O in runtime autosuspend Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0511/1376] RDMA/hfi1: Preserve unit 0 on allocation failure Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0512/1376] RDMA/hfi1: Free RX data on late probe failure Greg Kroah-Hartman
2026-09-12 6:48 ` [PATCH 6.12 0513/1376] RDMA/hfi1: Remove redundant PCI device ID validation Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0514/1376] RDMA/hfi1: Create workqueues before device initialization Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0515/1376] RDMA/hfi1: Stop flushing the global IB workqueue Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0516/1376] RDMA/hfi1: Initialize debugfs after probe completes Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0517/1376] ASoC: apple: mca: increase SERDES reset delay Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0518/1376] isofs: fix out-of-bounds page array access on empty zisofs block Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0519/1376] iommufd/selftest: Avoid selftest dirty bitmap size wrap Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0520/1376] media: v4l2-async: Unregister sub-device if asc_list is empty Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0521/1376] rpmsg: glink: remove duplicate code for rpmsg device remove Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0522/1376] rpmsg: glink: fix deadlock in endpoint destroy during driver detach Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0523/1376] cxl/memdev: Fix firmware upload exact-fit handling Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0524/1376] cxl/mbox: Break poison list loop on an empty payload Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0525/1376] cxl/pci: Honor -EPROBE_DEFER from component register setup Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0526/1376] fs/ntfs3: Add more checks in mi_enum_attr (part 2) Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0527/1376] fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr() Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0528/1376] fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0529/1376] fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list() Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0530/1376] hfsplus: validate thread record before delete key rebuild Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0531/1376] wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0532/1376] x86/entry/fred: Encode frame pointer on entry Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0533/1376] firmware: arm_scmi: Publish channel state before callbacks Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0534/1376] firmware: arm_scmi: Unregister device notifier before IDR teardown Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0535/1376] firmware: arm_scmi: Quiesce notifications before teardown Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0536/1376] firmware: arm_scmi: Clean up channels on setup failure Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0537/1376] firmware: arm_scmi: Free transport channel on IDR failure Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0538/1376] firmware: arm_scmi: Avoid IDR updates while cleaning channels Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0539/1376] firmware: arm_scmi: Reject out of range DT protocol IDs Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0540/1376] firmware: arm_scmi: Use channel ID for transport teardown Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0541/1376] firmware: arm_scmi: Protect device request lookup with RCU Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0542/1376] firmware: arm_scmi: Drop handle on protocol bind failures Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0543/1376] firmware: arm_scmi: Unwind TX receiver mailbox setup failure Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0544/1376] firmware: arm_scmi: Unwind P2A " Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0545/1376] libnvdimm/labels: Bound the on-media label size before the shift Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0546/1376] dax: read holder_ops once in dax_holder_notify_failure() Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0547/1376] cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate() Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0548/1376] PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0549/1376] PCI: xgene: Drop unnecessary OF node reference Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0550/1376] irqchip/renesas-irqc: Fix generic interrupt chip leak on remove Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0551/1376] media: i2c: rdacm21: Fix missing media_entity_cleanup() Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0552/1376] media: bcm2835-unicam: Fix asc leaked in error/remove path Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0553/1376] media: ipu6: Do not free aux device pdata after init Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0554/1376] drm/amd/display: Remove unused-but-set variable hubp from Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0555/1376] cpufreq: intel_pstate: Fix setting minimum P-state at init time Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0556/1376] cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply() Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0557/1376] remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0558/1376] drm/bridge: tc358767: clamp the reported AUX read size to the request Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0559/1376] arm64: dts: qcom: msm8996-xiaomi-gemini: Fix up ti,drv2604 enable GPIO Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0560/1376] arm64: dts: qcom: sc8280xp-x13s: Fix the drive-strength of mclk pin Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0561/1376] arm64: dts: qcom: sm8250: sort out Iris power domains Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0562/1376] arm64: dts: qcom: sm8250: correct frequencies in the Iris OPP table Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0563/1376] perf jevents: Add more components to the metric sorting order Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0564/1376] wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0565/1376] wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0566/1376] wifi: iwlwifi: mei: check SAP message length before reading it Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0567/1376] wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0568/1376] wifi: iwlwifi: mei: pass correct argument to function Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0569/1376] gpu: host1x: Fix offset calculation in trace_write_gather Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0570/1376] gpu: host1x: Avoid stack over-read in debug output helpers Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0571/1376] drm/msm/a6xx: Fix stale rpmh votes after suspend Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0572/1376] bpf: Sync tail_call_reachable with callee state on entry Greg Kroah-Hartman
2026-09-12 6:49 ` [PATCH 6.12 0573/1376] crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0574/1376] ACPI: processor: idle: Expand _LPI package sanity checks Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0575/1376] usb: gadget: f_uac1_legacy: remove broken string configfs attributes Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0576/1376] tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0577/1376] UDF symlink pathComponent header OOB read Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0578/1376] uio: Fix stale info pointer in failed registration path Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0579/1376] accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0580/1376] speakup: keyhelp: guard letter_offsets possible out-of-range indexing Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0581/1376] misc: bcm-vk: Use acquire/release for msgq_inited Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0582/1376] misc: rtsx: add missing write register handling Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0583/1376] misc: ad525x_dpot: use driver core groups for sysfs files Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0584/1376] cacheinfo: dont propagate DT/ACPI error when arch supplies info (arm64) Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0585/1376] ppdev: prevent overflow when setting port timeout Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0586/1376] ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0587/1376] char: xilinx_hwicap: unregister class on init errors Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0588/1376] vfio/pci: clear vdev->msi_perm after freeing it on init failure Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0589/1376] soc: ti: knav_qmss_queue: Implement resource cleanup in remove() Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0590/1376] soc: ti: knav_qmss: Remove debugfs file on teardown Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0591/1376] mtd: mtdswap: Avoid freeing registered blktrans device twice Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0592/1376] mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0593/1376] perf ui hists: Fix uninitialized stack memory free on pstack allocation failure Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0594/1376] software node: Fix software_node_get_reference_args() with index -1 Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0595/1376] driver core: soc: Unregister bus on early device registration failure Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0596/1376] drm/msm/a6xx: Fix RBBM_CLOCK_CNTL3_TP0 value in a730_hwcg Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0597/1376] bpf: Reject arena frees below the arena base Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0598/1376] dmaengine: dw-edma: Terminate all descriptors without callbacks Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0599/1376] dmaengine: dw-edma: Serialize abort state updates Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0600/1376] dmaengine: dw-edma: Serialize channel state checks Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0601/1376] dmaengine: dw-edma: Clear stale requests on termination Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0602/1376] ASoC: meson: Keep link pointers valid on realloc failure Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0603/1376] phy: starfive: Fix runtime PM cleanup in JH7110 DPHY TX probe Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0604/1376] phy: starfive: Fix runtime PM cleanup in JH7110 DPHY RX probe Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0605/1376] arm64: dts: amlogic: meson-axg: Add missing nand_rb0 pin to nand_all_pins Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0606/1376] arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0607/1376] RDMA/hfi1: Propagate sdma_txinit_ahg() errors Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0608/1376] RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[] Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0609/1376] RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0610/1376] kcsan: avoid unintended access checking in NMIs Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0611/1376] arm64: dts: imx8-ss-audio: Fix LPCG clock indices for ASRC0 Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0612/1376] selftests/bpf: Silence array bounds warning in global_map_resize Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0613/1376] irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc() Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0614/1376] RDMA/nldev: validate dynamic counter attribute length Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0615/1376] ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0616/1376] ACPI: processor: validate MADT IOAPIC entry bounds Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0617/1376] ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0618/1376] ext4: fix circular lock dependency in ext4_ext_migrate Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0619/1376] ext4: fix out-of-bounds read in ext4_read_inline_dir() Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0620/1376] ext4: skip extra isize expansion during mount to prevent deadlock Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0621/1376] libbpf: Search /lib64 and /lib in resolve_full_path() Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0622/1376] riscv, bpf: Fix memory leak in bpf_jit_free Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0623/1376] ACPI: battery: Adjust charging status validation check Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0624/1376] bpf: Preserve unique-field state across nested structs Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0625/1376] RDMA/srpt: Pass the mapped task attribute to target_init_cmd() Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0626/1376] PCI: j721e: Fix incorrect max_lanes for J7200 Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0627/1376] RDMA/erdma: Fix CEQ tasklet use-after-free on removal Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0628/1376] RDMA/restrack: Fix typos in the comments Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0629/1376] RDMA/nldev: Fix locking when accessing mr->pd Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0630/1376] RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0631/1376] RDMA/core: Fix use after free in ib_query_qp() Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0632/1376] RDMA/core: Fix potential use after free in ib_destroy_cq_user() Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 6.12 0633/1376] RDMA/core: Fix potential use after free in ib_destroy_srq_user() Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0634/1376] RDMA/core: Fix potential use after free in counter_release() Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0635/1376] RDMA/core: Add driver APIs pre_destroy_cq() and post_destroy_cq() Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0636/1376] RDMA/core: Fix potential use after free in ib_free_cq() Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0637/1376] RDMA/core: Fix potential use after free in ib_dealloc_pd_user() Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0638/1376] firmware: arm_scmi: Fix requested device removal race Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0639/1376] iommu/qcom: Remove sysfs device on probe failure path Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0640/1376] iommu/qcom: Fix inverted fault report check in qcom_iommu_fault() Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0641/1376] thermal: intel: int3400: clean up ODVP on probe failures Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0642/1376] ext4: clear stale xarray tags on folios skipped during writeback Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0643/1376] ext4: drain in-flight DIO before buffered write fallback Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0644/1376] wifi: ath6kl: avoid buffer overreads in WMI event handlers Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0645/1376] wifi: ath12k: Correctly copy the hint BSSID in WMI scan request Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0646/1376] wifi: ath11k: " Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0647/1376] wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0648/1376] wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0649/1376] RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0650/1376] ext4: fix buffer_head leak in ext4_init_orphan_info Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0651/1376] ext4: check dir entry fits before reading the hash trailer in ext4_search_dir() Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0652/1376] ARM: dts: allwinner: a10: Fix PMU interrupt Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0653/1376] cpufreq/amd-pstate: Store the boost numerator as highest perf again Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0654/1376] ACPI: CPPC: Add IS_OPTIONAL_CPC_REG macro to judge if a cpc_reg is optional Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0655/1376] ACPI: CPPC: Optimize cppc_get_perf() Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0656/1376] ACPI: CPPC: Rename cppc_get_perf() to cppc_get_reg_val() Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0657/1376] ACPI: CPPC: Add cppc_set_reg_val() Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0658/1376] ACPI: CPPC: Refactor register value get and set ABIs Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0659/1376] ACPI: CPPC: Modify cppc_get_auto_sel_caps() to cppc_get_auto_sel() Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0660/1376] cpufreq/amd-pstate: Toggle auto_sel in active mode on shared memory systems Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0661/1376] firmware: arm_scmi: Roll back partial protocol table registration Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0662/1376] firmware: arm_scmi: Unrequest devices if driver registration fails Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0663/1376] perf cs-etm: Flush thread stacks after decoder reset Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0664/1376] perf cs-etm: Avoid truncating AUX buffer sizes to int Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0665/1376] xfrm: Fix skb double-free in xfrm_dev_direct_output() Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0666/1376] RDMA/erdma: Probe the erdma RoCEv2 device Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0667/1376] RDMA/erdma: Add GID table management interfaces Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0668/1376] RDMA/erdma: Add the erdma_query_pkey() interface Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0669/1376] RDMA/erdma: Add address handle implementation Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0670/1376] RDMA/erdma: Add erdma_modify_qp_rocev2() interface Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0671/1376] RDMA/erdma: Refactor the code of the modify_qp interface Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0672/1376] RDMA/erdma: Add the query_qp command to the cmdq Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0673/1376] RDMA/erdma: Fix incorrect response returned from query_qp Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0674/1376] RDMA/erdma: Support non-sleeping erdma_post_cmd_wait() Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0675/1376] RDMA/erdma: complete object teardown when the destroy command fails Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0676/1376] PM: hibernate: Fix memory leak in snapshot_write_next() error path Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0677/1376] leds: pca9532: Fix phantom device registration on missing hardware Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0678/1376] drm/tve200: add OF module alias for autoloading Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0679/1376] netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0680/1376] fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0681/1376] drm/panthor: return PTR_ERR() from devm_drm_dev_alloc() Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0682/1376] arm64: dts: rockchip: Fix Gru WLAN sideband interrupt Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0683/1376] ARM: lpc32xx: only run SoC init on LPC32xx hardware Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0684/1376] selftests/bpf: Fix incorrect error checking for pthread_create Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0685/1376] selftests/bpf: Fix memory leak on subtest_states reallocation Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0686/1376] cxl/region: Fix use-after-free in find_pos_and_ways() error path Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0687/1376] pinctrl: mediatek: Add EINT support for multiple addresses Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0688/1376] pinctrl: mediatek: Fix the invalid conditions Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0689/1376] pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0690/1376] pinctrl: mediatek: free EINT resources on unbind Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0691/1376] tools/build: Add bpftool-skeletons feature test Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0692/1376] tools/build: Allow versioning of all LLVM tools defined in Makefile.include Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 6.12 0693/1376] power: supply: sbs-battery: Use a per-device serial number buffer Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0694/1376] scsi: ufs: debugfs: Reserve space for a string terminator Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0695/1376] crypto: keembay - Initialize completion before requesting IRQ Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0696/1376] crypto: keembay - publish OF module alias for OCS AES/SM4 Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0697/1376] RDMA/mlx5: Fix integer overflow of user QP buffer size Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0698/1376] powercap: intel_rapl_tpmi: Handle PMU registration failure during probe Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0699/1376] isofs: release zisofs block pointer buffer head Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0700/1376] spi: oc-tiny: switch to managed controller allocation Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0701/1376] w1: ds2482: Fix signedness bug in ds2482_w1_triplet() Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0702/1376] remoteproc: core: Drop redundant initialization of ret in rproc_shutdown() Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0703/1376] remoteproc: Allow shutdown of crashed processors Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0704/1376] remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work() Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0705/1376] remoteproc: Prevent crash handling to race with rproc_del() Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0706/1376] staging: rtl8723bs: use kfree_sensitive() for key material Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0707/1376] fs/ntfs3: reject restart table growth beyond U16_MAX entries Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0708/1376] iommu/tegra241-cmdqv: Use request_threaded_irq Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0709/1376] iommu/tegra241-cmdqv: Dont run the error ISR before probe sets up vintfs Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0710/1376] iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0711/1376] RDMA/efa: Fix PBL chunk length computation Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0712/1376] wifi: mac80211: fix per-STA profile length in cross-link CSA parsing Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0713/1376] arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0714/1376] clk: tegra: tegra124-emc: put EMC node on register failure Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0715/1376] clk: palmas: Manage external-control prepare with devm Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0716/1376] clk/x86: pmc_atom: add kasprintf return value check Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0717/1376] clk: mediatek: mt8135: Fix inverted gate control for devapc_ck Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0718/1376] clk: rockchip: Fix the fractional part denominator on RK3588/RK3576 PLLs Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0719/1376] nilfs2: fix infinite loop in nilfs_clean_segments() Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0720/1376] nilfs2: prevent out-of-bounds read in super root block parsing Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0721/1376] nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0722/1376] scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0723/1376] RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0724/1376] RDMA/mlx5: Send cong param changes to the resolved port mdev Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0725/1376] RDMA/cxgb4: free STAG index when TPT entry write fails Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0726/1376] IB/isert: reject PDUs declaring more data than was received Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0727/1376] IB/isert: reject login " Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0728/1376] nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0729/1376] spi: davinci: switch to managed controller allocation Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0730/1376] wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0731/1376] PCI: starfive: Fix Runtime PM handling and teardown ordering Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0732/1376] PCI: starfive: Fix unchecked pm_runtime_get_sync() in probe Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0733/1376] platform/chrome: cros_ec_debugfs: Clean up console log on probe failure Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0734/1376] platform/chrome: cros_ec_debugfs: Unregister panic notifier Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0735/1376] wifi: rtlwifi: pci: fix error path in rtl_pci_probe() Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0736/1376] bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0737/1376] bus: mhi: host: Fix controller cleanup on EDL sysfs failure Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0738/1376] md/raid5: protect bitmap batch counters aka seq_flush/seq_write consistency Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0739/1376] md/raid5-ppl: fix use-after-free in ppl_do_flush() Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0740/1376] md: ensure resync is prioritized over recovery Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0741/1376] md: allow removing faulty rdev during resync Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0742/1376] md: rename recovery_cp to resync_offset Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0743/1376] md: add a new recovery_flag MD_RECOVERY_LAZY_RECOVER Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0744/1376] md/raid5: protect lockless recovery_offset accesses during reshape Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0745/1376] tools/nolibc/powerpc: mark ctr and xer as clobbered by system call Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0746/1376] md: recheck spare changes before starting sync Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0747/1376] selftests/zram: fix kernel_gte() for POSIX sh Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0748/1376] slab: simplify init_kmem_cache_nodes() error handling Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0749/1376] slab: Make slub local_(try)lock more precise for LOCKDEP Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0750/1376] slab: Reuse first bit for OBJEXTS_ALLOC_FAIL Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0751/1376] wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0752/1376] wifi: ath11k: " Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 6.12 0753/1376] rcu: Mark accesses to ->rcu_urgent_qs and ->rcu_need_heavy_qs Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0754/1376] arm64: dts: qcom: msm8998: Dont pull-up I2C pins by default in sleep Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0755/1376] arm64: dts: qcom: sdm632-motorola-ocean: Fix LED default trigger property Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0756/1376] arm64: dts: qcom: qcs404: Fix DTBS Check errors in usb controller nodes Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0757/1376] clk: qcom: gcc-qcm2290: dont park QUP RCGs upon registration Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0758/1376] arm64: dts: qcom: sc8280xp-crd: Fix the pin index for misc_3p3_reg_en Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0759/1376] firmware: qcom_scm: Add API to get waitqueue IRQ info Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0760/1376] firmware: qcom_scm: Support multiple waitq contexts Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0761/1376] firmware: qcom: scm: add trace events for the SMC call interface Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0762/1376] firmware: qcom: scm: instrument SMC call path with tracepoints Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0763/1376] firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0764/1376] firmware: qcom: scm: Fix tzmem state on probe retry Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0765/1376] arm64: dts: qcom: sm8250-xiaomi-elish: correct the board ID Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0766/1376] arm64: dts: qcom: sc8180x: Fix the PCIe iommu-map entries Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0767/1376] arm64: dts: qcom: sdm845: " Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0768/1376] arm64: dts: qcom: sm8150: " Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0769/1376] arm64: dts: qcom: sm8250: " Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0770/1376] arm64: dts: qcom: sm8350: " Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0771/1376] arm64: dts: qcom: sm8450: " Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0772/1376] arm64: dts: qcom: sm8550: " Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0773/1376] arm64: dts: qcom: sm8650: add OPP table support to PCIe Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0774/1376] arm64: dts: qcom: sm8650: Fix the PCIe iommu-map entries Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0775/1376] power: supply: isp1704_charger: cancel work on remove Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0776/1376] power: supply: sc2731_charger: " Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0777/1376] bpf: Fix potential UAF in bpf_netns_link_update_prog Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0778/1376] bpf: Fix potential UAF when reading bpf link info Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0779/1376] lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0780/1376] clk: qcom: gpucc-qcm2290: Park RCGs clk source at XO during disable Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0781/1376] clk: qcom: Return expected ENOMEM error on dynamic allocation failure Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0782/1376] md/bitmap: resume array on backlog_store() error path Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0783/1376] md: remove unused mddev argument from export_rdev Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0784/1376] md: skip redundant raid_disks update when value is unchanged Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0785/1376] md: scope memalloc_noio to allocation critical sections Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0786/1376] iommu/dma: Check atomic pool allocation result directly Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0787/1376] swiotlb: Preserve allocation virtual address for dynamic pools Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0788/1376] i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0789/1376] i3c: master: Fix device_register() error path Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0790/1376] md: merge mddev has_superblock into mddev_flags Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0791/1376] md: merge mddev faillast_dev " Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0792/1376] md: merge mddev serialize_policy " Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0793/1376] md/raid1: create serial pool adding rdev to array with serialize_policy=1 Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0794/1376] locking/lockdep: Fix NULL pointer dereference in __lock_set_class() Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0795/1376] powerpc/crash: Fix possible memory leak in update_crash_elfcorehdr() Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0796/1376] misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0797/1376] misc: sgi-gru: remove interrupt-context page-table walks Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0798/1376] fanotify: report full event length for FIONREAD Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0799/1376] wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0800/1376] wifi: mt76: mt7921: validate CLC firmware records Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0801/1376] wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0802/1376] wifi: mt76: add init_wiphy callback Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0803/1376] wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0804/1376] wifi: mt76: mt7925: fix msg len mismatch between driver and firmware Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0805/1376] wifi: mt76: mt792x: Fix memory leak in SDIO TX path Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0806/1376] wifi: mt76: mt7996: fix capability of EHT-MCS 15 in MRU Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0807/1376] wifi: mt76: fix non-AQL packet accounting for MLO stations Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0808/1376] wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[] Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0809/1376] wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0810/1376] wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0811/1376] wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0812/1376] wifi: mt76: mt7996: dont report a zero TX bitrate Greg Kroah-Hartman
2026-09-12 6:53 ` [PATCH 6.12 0813/1376] wifi: mt76: mt7915: write RX header translation bit to the correct register Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0814/1376] wifi: mt76: fix stranded frames in mt76_txq_schedule_pending Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0815/1376] wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0816/1376] wifi: mt76: check txfree done event on the WED hw path Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0817/1376] wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0818/1376] wifi: mt76: mt7915: unwind state on add_interface failure Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0819/1376] wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0820/1376] wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0821/1376] wifi: mt76: only consume the WO drop bit on WED v2 devices Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0822/1376] ACPI: processor: idle: Optimize ACPI idle driver registration Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0823/1376] ACPI: processor: Unregister cpufreq notifier on init failure Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0824/1376] perf: arm_spe: Make wakeup range check overflow safe Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0825/1376] drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0826/1376] drm/msm/dsi: Drop dev_pm_opp_set_rate(0) Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0827/1376] wifi: ath11k: fix leak in ath11k_service_ready_ext_event() Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0828/1376] regulator: core: use system_freezable_wq for init complete work Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0829/1376] perf machine: Fix NULL parent dereference in fork event processing Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0830/1376] perf machine: Guard against NULL strlist in machines__findnew() Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0831/1376] perf machine: Use snprintf() for guestmount path construction Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0832/1376] perf machine: Check snprintf truncation in machines__findnew() Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0833/1376] perf machine: Dont abort guest map creation on first inaccessible dir Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0834/1376] perf machine: Reset errno before strtol in guest kernel map creation Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0835/1376] perf machine: Free scandir entries " Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0836/1376] perf machine: Check snprintf truncation for guest kallsyms path Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0837/1376] bpf, x86: Fix trampoline stack size for 128-bit arguments Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0838/1376] wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0839/1376] wifi: mt76: mt7915: fix double hif2 init on the non-WED path Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0840/1376] wifi: mt76: mt7915: fix ext PHY use-after-free on register error path Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0841/1376] wifi: mt76: mt7915: release hif2 reference on probe IRQ failure Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0842/1376] wifi: mt76: mt7996: fix reg addr remap when addr is 0 Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0843/1376] wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1 Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0844/1376] wifi: mt76: mt7915: report RX chain signal for all RX paths Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0845/1376] wifi: mt76: mt7925: advertise EHT 320MHz capabilities for 6GHz band Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0846/1376] wifi: mt76: mt7925: Fix EHT Beamformee SS subfields to meet 802.11be minimum Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0847/1376] wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0848/1376] iommu/arm-smmu-v3: Convert to use atomic poll timeout Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0849/1376] perf/cxlpmu: Fix 64-bit write to 32-bit HDM filter register Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0850/1376] wifi: mac80211: send TWT teardown to peer after setup TX failure Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0851/1376] wifi: zd1211rw: reject secondary interfaces to prevent conflicts Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0852/1376] wifi: mac80211: skip unused probe response countdown offsets Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0853/1376] wifi: mac80211: disconnect on CSA to channel 0 Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0854/1376] firmware: google: Add bounds checks in coreboot_table_populate() Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0855/1376] firmware: coreboot: Validate table bounds Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0856/1376] powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0857/1376] powerpc/irq: Fix missing r2 clobber in PCREL inline assembly Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0858/1376] MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0859/1376] serial: amba-pl011: unprepare console clock on unregister Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0860/1376] tty: clear cdev pointer after cdev_add() failure Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0861/1376] HID: i2c-hid: Refactor _DSM helper and add i2c-hid-acpi-prp0001 driver Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0862/1376] HID: synchronize input before cleaning up a failed probe Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0863/1376] HID: i2c-hid: Fix "(null)" output when reading report descriptor fails Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0864/1376] HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0865/1376] HID: lg4ff: validate report length before fixed offsets Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0866/1376] perf thread-stack: Fix heap buffer overflow on branch stack wrap copy Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0867/1376] perf auxtrace: Fix queue grow overflow and old array leak Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0868/1376] perf intel-pt: Fix off-by-one in auxtrace_info minimum size check Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0869/1376] perf intel-bts: " Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0870/1376] iio: light: tsl2772: fix ALS calibscale readback Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0871/1376] iio: light: isl29028: return zero in write_raw() on success Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0872/1376] iio: light: tsl2583: " Greg Kroah-Hartman
2026-09-12 6:54 ` [PATCH 6.12 0873/1376] net: stmmac: Skip PHY attach if custom PCS is in use Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0874/1376] phonet: pep: do not write beyond optlen in getsockopt Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0875/1376] blk-cgroup: skip dying blkg in blkcg_activate_policy() Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0876/1376] block/blk-stat: drain per-cpu callback stats over possible CPUs Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0877/1376] block/blk-iocost: collect per-cpu latency " Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0878/1376] block/kyber-iosched: flush per-cpu latency buckets " Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0879/1376] ublk: check for ublk_unmap_io() returning 0 Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0880/1376] o2hb_region_dev_store(): avoid goto around fdget()/fdput() Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0881/1376] ocfs2/cluster: keep heartbeat local node stable Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0882/1376] lib/string: fix memchr_inv() for large ranges Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0883/1376] pps: dont try to wait for negative timeouts in PPS_FETCH Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0884/1376] pps: clients: gpio: Bypass edges direction check when not needed Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0885/1376] pps: pps-gpio: split IRQ handler into hardirq timestamper + threaded handler Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0886/1376] pps-gpio: remove dead capture_clear code Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0887/1376] rapidio: clear mport->net when rio_add_net() fails Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0888/1376] fat: release buffer head after rebuilding parent Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0889/1376] riscv: dts: sophgo: cv180x: Allow the DMA multiplexer to set channel number for DMA controller Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0890/1376] drm/omap: dsi: Do not copy isr table Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0891/1376] arm64: dts: qcom: agatti: Add missing CX power domain to DISPCC Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0892/1376] remoteproc: Move resource table data structure to its own header Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0893/1376] remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources() Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0894/1376] remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0895/1376] bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0896/1376] selftests/mm: add new test cases to the migration test Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0897/1376] ksm_tests: skip hugepage test when Transparent Hugepages are disabled Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0898/1376] selftests/mm: ksm_tests: use kselftest framework Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0899/1376] selftests/mm: fix ksm NUMA merge test for systems with memoryless NUMA nodes Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0900/1376] selftests/mm: fix ternary operator precedence in ksm_tests Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0901/1376] arm64: dts: qcom: qcs8550-aim300: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0902/1376] arm64: dts: qcom: sm7225-fairphone-fp4: " Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0903/1376] scripts/tags.sh: Prevent binary files appearing in cscope.files Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0904/1376] modpost: prevent leak when early return no suffix .o in read_symbols() Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0905/1376] RDMA/erdma: Hold CQ references when processing EQ events Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0906/1376] RDMA/erdma: Hold QP references for AE and CM processing Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0907/1376] RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0908/1376] ARM: 9481/2: breakpoint: CFI breakpoints only on demand Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0909/1376] ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0910/1376] ocfs2: synchronize heartbeat callbacks with o2net teardown Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0911/1376] clk: rockchip: rk3576: fix source muxes for SPI0..SPI4 Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0912/1376] drm/sun4i: vi scaler: Fix coefficient selection Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0913/1376] of: property: add of_graph_get_next_port() Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0914/1376] of: property: add of_graph_get_next_port_endpoint() Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0915/1376] drm/sun4i: tcon: Set output mux for DSI and LVDS Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0916/1376] drm/sun4i: tcon: Drop TCON TOP device reference Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0917/1376] drm/sun4i: hdmi: Dont leak sync polarity bits into packet control Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0918/1376] drm/sun4i: crtc: Propagate layer initialization error Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0919/1376] drm/sun4i: tcon: Drop remote endpoint reference Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0920/1376] drm/sun4i: dw-hdmi: Drop TCON TOP port reference Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0921/1376] drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0922/1376] cpufreq: imx6q: fix devres accumulation across driver rebind Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0923/1376] cpufreq: imx6q: fix out-of-bounds write when probed more than once Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0924/1376] IB/isert: delay the final Login Response until the session is registered Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0925/1376] IB/isert: post the full-feature receive buffers after session registration Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0926/1376] RDMA/siw: Fix use-after-free in siw_accept() Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0927/1376] module: replace use of system_wq with system_dfl_wq Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0928/1376] module: use strscpy() to copy module names in stats and dup tracking Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0929/1376] module/dups: Inform duplicate requests about the result directly Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0930/1376] module/dups: Fix use-after-free in kmod_dup_req lifetime handling Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0931/1376] RDMA/erdma: restrict the driver to little-endian systems Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0932/1376] wifi: mac80211: skip default WMM setup for AP_VLAN links Greg Kroah-Hartman
2026-09-12 6:55 ` [PATCH 6.12 0933/1376] arm64: hibernate: mask DAIF before restoring hibernated kernel Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0934/1376] arm64: hibernate: Restore DAIF state on error Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0935/1376] mfd: rave-sp: validate received frame payload lengths Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0936/1376] mfd: iqs62x: Reject zero-length firmware records Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0937/1376] drm/amdgpu/gfx6: Fixup emit_cntxcntl() Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0938/1376] ext4: fix spurious message about orphan cleanup on RO fs Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0939/1376] arm64: dts: ti: k3-am64: Fix MDIO clock reference for ICSSG0 node Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0940/1376] phy: sunplus: fix error handling in sp_uphy_init() Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0941/1376] phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0942/1376] perf trace-event: Fix buffer overflow in read_string() Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0943/1376] drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0944/1376] drm/amdgpu/gfx6: Use PFP on the compute queues too Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0945/1376] scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0946/1376] firmware_loader: do not queue completed sysfs fallback requests Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0947/1376] pinctrl: rockchip: Reset the pin count when recalculating SoC data Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0948/1376] hugetlbfs: release subpool on fill_super failure Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0949/1376] soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0950/1376] phy: qcom-sgmii-eth: relax order of .power_on() vs .set_mode*() Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0951/1376] phy: qcom: sgmii-eth: vote for both voltage rails with correct current loads Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0952/1376] phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0953/1376] phy: qcom: snps-femto-v2: " Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0954/1376] phy: qcom: qmp-usb: " Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0955/1376] md/raid5: round bitmap stripes with sector division Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0956/1376] md: avoid stale clone I/O accounting timestamps Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0957/1376] md/raid1: dont set array_frozen in raid1_takeover() Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0958/1376] coresight: etm4x: fix wrong check of etm4x_sspcicrn_present() Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0959/1376] coresight: Change syncfreq to be a u8 Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0960/1376] coresight: etm4x: fix underflow for usage of (nrseqstate - 1) Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0961/1376] coresight: etm4x: fix leaked trace id Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0962/1376] regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0963/1376] ACPI: video: Release PCI device reference after lookup Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0964/1376] perf/x86/intel/pt: Add support for pause / resume Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0965/1376] perf/x86/intel/pt: Factor out pt_config_enable() Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0966/1376] perf/x86/intel/pt: Use bitwise access for PERF_HES_STOPPED Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0967/1376] perf/x86/intel/pt: Fix stop/start with no update Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0968/1376] sched/fair: Check CPU capacity before comparing group types during load balance Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0969/1376] Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0970/1376] Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0971/1376] Bluetooth: btusb: refactor endpoint lookup Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0972/1376] Bluetooth: btusb: Record matched usb_device_id into btusb_data Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0973/1376] Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0974/1376] perf trace-event: Fix integer truncation in do_read() and skip() Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0975/1376] block/bdev: lift block size restrictions to 64k Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0976/1376] scsi: core: Pass a struct scsi_driver to scsi_{,un}register_driver() Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0977/1376] scsi: core: sysfs: Make use of bus callbacks Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0978/1376] scsi: sd: Convert to SCSI bus methods Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0979/1376] scsi: sd: Move the sd_remove() function definition Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0980/1376] scsi: sd: Move the sd_config_discard() " Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0981/1376] scsi: sd: Enable sector size > PAGE_SIZE in SCSI sd driver Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0982/1376] scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0983/1376] scsi: sd: Fix sd_done() sense handling condition Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0984/1376] btrfs: retry verity reads for not-uptodate Merkle folios Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0985/1376] Bluetooth: virtio_bt: avoid OOB read of build info string Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0986/1376] Bluetooth: btintel: Fix diagnostics event detection Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0987/1376] Bluetooth: hci_conn: fix the SCO setup context lifetime Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0988/1376] Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0989/1376] Bluetooth: MGMT: free the mesh send cancel command when it is cancelled Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0990/1376] mmc: sdio: add MediaTek MT7902 SDIO device ID Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0991/1376] Bluetooth: btmtk: add MT7902 MCU support Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0992/1376] Bluetooth: btmtk: add MT7902 SDIO support Greg Kroah-Hartman
2026-09-12 6:56 ` [PATCH 6.12 0993/1376] Bluetooth: btmtksdio: fix usage_count leak when autosuspend_delay is negative Greg Kroah-Hartman
2026-09-12 6:57 ` [PATCH 6.12 0994/1376] Bluetooth: MSFT: validate evt_prefix_len against the response length Greg Kroah-Hartman
2026-09-12 6:57 ` [PATCH 6.12 0995/1376] cgroup: Add bpf prog revisions to struct cgroup_bpf Greg Kroah-Hartman
2026-09-12 6:57 ` [PATCH 6.12 0996/1376] bpf: Implement mprog API on top of existing cgroup progs Greg Kroah-Hartman
2026-09-12 6:57 ` [PATCH 6.12 0997/1376] bpf, cgroup: Fix storage null-ptr-deref after replacing prog Greg Kroah-Hartman
2026-09-12 6:57 ` [PATCH 6.12 0998/1376] iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes Greg Kroah-Hartman
2026-09-12 6:57 ` [PATCH 6.12 0999/1376] iio: light: gp2ap002: re-enable irq if runtime suspend fails Greg Kroah-Hartman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).