* [PATCH 6.1 000/982] 6.1.189-rc1 review
@ 2026-09-30 15:12 Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 001/982] drm/gem: Consider GEM object reclaimable if shrinking fails Greg Kroah-Hartman
` (988 more replies)
0 siblings, 989 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
This is the start of the stable review cycle for the 6.1.189 release.
There are 982 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 02 Oct 2026 15:23:04 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.189-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 6.1.189-rc1
Denis Arefev <arefev@swemel.ru>
ALSA: hda: Fix missing pointer check in hda_component_manager_init function
Guangshuo Li <lgs201920130244@gmail.com>
drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked()
Rengarajan S <rengarajan.s@microchip.com>
lan78xx: Enable Auto Speed and Auto Duplex configuration for LAN7801 if NO EEPROM is detected
Rengarajan S <rengarajan.s@microchip.com>
lan78xx: Enable 125 MHz CLK configuration for LAN7801 if NO EEPROM is detected
Florian Eckert <fe@dev.tdt.de>
tools/thermal/tmon: Fix compilation warning for wrong format
James Clark <james.clark@linaro.org>
perf test: Change all remaining #!/bin/sh to #!/bin/bash
Jakub Kicinski <kuba@kernel.org>
net: tls: fix silent data drop under pipe back-pressure
Darrick J. Wong <djwong@kernel.org>
xfs: fix blockgc group quota scanning when usrquota isn't enforced
Zihan Xi <zihanx@nebusec.ai>
smb: client: validate POSIX create context length
Hui Peng <benquike@gmail.com>
Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Bluetooth: L2CAP: validate frame length before control and FCS access
Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Bluetooth: hci_sock: reject out-of-range OCF values
Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Bluetooth: hci_sock: validate event length before filtering
Myeonghun Pak <mhun512@gmail.com>
RISC-V: KVM: Synchronize hrtimer callback during teardown
Vineeth Vijayan <vneethv@linux.ibm.com>
s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()
Myeonghun Pak <mhun512@gmail.com>
pinctrl: single: free the IRQ on domain creation failure
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
scsi: libiscsi_tcp: Check the data direction of a Data-In PDU
Doruk Tan Ozturk <doruk@0sec.ai>
nfc: port100: reject frames whose declared length exceeds the received data
Aamir Ahmed <elb12345@hotmail.co.uk>
nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
Luxiao Xu <rakukuip@gmail.com>
nfc: fix use-after-free in nfc_get_local_general_bytes
Luxiao Xu <rakukuip@gmail.com>
netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read
Weiming Shi <bestswngs@gmail.com>
netfilter: ip6t_rpfilter: reject routes without inet6_dev
Wentao Liang <vulab@iscas.ac.cn>
net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs()
Ming Wang <wangming01@loongson.cn>
net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist
Gajdos Tamás <tamas@rimpianto.com>
net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read
Gajdos Tamás <tamas@rimpianto.com>
net: atl1c: fix soft lockup on out-of-range tpd_cons read
Ilya Maximets <i.maximets@ovn.org>
net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry
Wentao Liang <vulab@iscas.ac.cn>
net: hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy()
Gajdos Tamás <tamas@rimpianto.com>
net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read
Zijie Huang <milkory@outlook.com>
net: arp: terminate device name before lookup
Weiming Shi <bestswngs@gmail.com>
net/sched: reject IDR error pointers when deleting actions
Wentao Liang <vulab@iscas.ac.cn>
net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()
Wei Jie LAW <98lawweijie@gmail.com>
HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
Junjie Cao <junjie.cao@intel.com>
HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard
Chen Changcheng <chenchangcheng@kylinos.cn>
HID: alps: fix use-after-free on input2 registration failure
Peiyang He <peiyang_he@smail.nju.edu.cn>
drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()
Wentao Liang <vulab@iscas.ac.cn>
drm/nouveau: Fix gem reference leak in validate_init()
Peiyang He <peiyang_he@smail.nju.edu.cn>
drm/nouveau: fix double-free in nvif_vmm_dtor
Wentao Liang <vulab@iscas.ac.cn>
drm/nouveau: Fix bridge reference leak in nv1a_ram_new()
Guangshuo Li <lgs201920130244@gmail.com>
drm/nouveau: fix autosuspend cleanup during teardown
Wentao Liang <vulab@iscas.ac.cn>
drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init()
Wentao Liang <vulab@iscas.ac.cn>
drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()
Wentao Liang <vulab@iscas.ac.cn>
drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init()
Christian König <ckoenig.leichtzumerken@gmail.com>
drm/i915: fix incorrect RCU teardown order
Dongliang Qin <cccccccccccc777777@gmail.com>
rds: ib: Clear the sg list when mapping an MR fails
Zixuan Chai <petalzu987@gmail.com>
llc: reserve device headroom for allocated frames
Ridham Khurana <khurana.ridham222@gmail.com>
gpio: zynq: fix runtime PM leak on request error path
Wentao Liang <vulab@iscas.ac.cn>
gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()
Hui Peng <benquike@gmail.com>
ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
Norbert Szetei <norbert@doyensec.com>
ipv6: do not let ipv6_find_hdr() return an offset past the packet end
Wentao Liang <vulab@iscas.ac.cn>
fsl/fman: Fix clk reference leak in read_dts_node()
Josef Bacik <josef@toxicpanda.com>
writeback: report a Tasks-RCU quiescent state per cgwb drain pass
Pavankumar Kondeti <pavan.kondeti@oss.qualcomm.com>
workqueue: Fix NULL current_pwq deref in flush dependency check
Patrick Lu (Anthropic) <perf.patrick.lu@gmail.com>
writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes
Hui Peng <benquike@gmail.com>
fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT
Dairui Zhang <zhangdairui@gmail.com>
af_packet: fix integer overflow in prb_calc_retire_blk_tmo()
Aohan Mei <henrymei@tencent.com>
sctp: discard the rest of the packet on a stale-cookie error
Eric Dumazet <edumazet@google.com>
tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow
Mario Limonciello <mario.limonciello@amd.com>
x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11
Guanglei Zhu <zhugl3@xiaopeng.com>
net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()
Kuniyuki Iwashima <kuniyu@google.com>
af_unix: Drop all SCM attributes for SOCKMAP.
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase
Pablo Neira Ayuso <pablo@netfilter.org>
rculist: add list_splice_rcu() for private lists
Mark Amirkan <markdamirkan@gmail.com>
mptcp: return sk_wait_data() errors from recvmsg()
Sean Christopherson <seanjc@google.com>
perf/x86/intel: Don't write PEBS_ENABLED on host<=>guest xfers if CPU has PEBS isolation, to fix stuck PEBS_ENABLED
Sean Christopherson <seanjc@google.com>
perf/x86/intel: Ensure KVM guest PEBS path doesn't set unwanted PERF_GLOBAL_CTRL bits
Hui Peng <benquike@gmail.com>
autofs: fix sbi->pipe file reference leak in autofs_kill_sb()
Eric Dumazet <edumazet@google.com>
vlan: ensure sufficient headroom in vlan_dev_hard_header()
Eric Dumazet <edumazet@google.com>
net/sched: sch_teql: fix shadowed err in __teql_resolve()
Eric Dumazet <edumazet@google.com>
bridge: check llc_mac_hdr_init() return value in br_send_bpdu()
Eric Dumazet <edumazet@google.com>
llc: fix skb UAF and leaks on llc_mac_hdr_init() failure
Coia Prant <coiaprant@gmail.com>
net: ethernet: stmmac: dwmac-rk: fix bulk clock leak when the PHY clock fails
Ginger Li <ginger.jzllee@gmail.com>
tipc: Fix a data race on mon->peer_cnt in mon_timeout()
Sidraya Jayagond <sidraya@linux.ibm.com>
net/smc: fix UAF on lgr list traversal in smcr_port_err()
Yilin Zhang <yilinzhang@moonshot.ai>
tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()
Norbert Szetei <norbert@doyensec.com>
net: xps: reject an out of range traffic class
Sanghyun Park <sanghyun.park.cnu@gmail.com>
vxlan: use one headroom snapshot for neighbour replies
Xuanqiang Luo <luoxuanqiang@kylinos.cn>
ip_gre: Reject enabling collect metadata through changelink
Florian Fainelli <florian.fainelli@broadcom.com>
net: bcmgenet: mask DMA_TIMEOUT_MASK when reading DMA_RING0_TIMEOUT
Florian Fainelli <florian.fainelli@broadcom.com>
net: bcmgenet: validate Ethernet address in bcmgenet_set_mac_addr
Florian Fainelli <florian.fainelli@broadcom.com>
net: bcmgenet: do not skip WoL power up on GENET V1
Doug Berger <opendmb@gmail.com>
net: bcmgenet: allow return of power up status
Doug Berger <opendmb@gmail.com>
net: bcmgenet: move bcmgenet_power_up into resume_noirq
Florian Fainelli <florian.fainelli@broadcom.com>
net: bcmgenet: initialize u64 stats seq counter for all queues
Florian Fainelli <florian.fainelli@broadcom.com>
net: bcmgenet: fix 64-bit RTNL stats reading in ethtool on 32-bit systems
Ivan Delalande <colona@arista.com>
tg3: use random MAC address when tg3_get_device_address fails
Dragan Simic <dsimic@manjaro.org>
driver core: Add device probe log helper dev_warn_probe()
Uwe Kleine-König <u.kleine-koenig@baylibre.com>
driver core: Make dev_err_probe() silent for -ENOMEM
Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
driver core: Better advertise dev_err_probe()
Johan Almbladh <johan.almbladh@anyfinetworks.com>
bpf: Fix BSWAP 32 and 16 on MIPS64
Johan Almbladh <johan.almbladh@anyfinetworks.com>
bpf: Fix immediate JMP JEQ/JNE on MIPS32
Ido Schimmel <idosch@nvidia.com>
vrf: Stop corrupting skb->csum when capturing CHECKSUM_COMPLETE packets
Shihuang Liu <shlomojune6@gmail.com>
net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()
Jakub Kicinski <kuba@kernel.org>
veth: manage XDP program pointers during channel resize
Victor Nogueira <victor@mojatatu.com>
net/sched: act_gate: budget the per-entry list in get_fill_size
Deepanshu Kartikey <kartikey406@gmail.com>
nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()
Ömer Mete Kaya <omermetekaya0@gmail.com>
nfc: llcp: fix slab-out-of-bounds reads when logging service names
Ömer Mete Kaya <omermetekaya0@gmail.com>
nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()
Ömer Mete Kaya <omermetekaya0@gmail.com>
nfc: llcp: fix -ENOMEM on connect with zero-length service name
Pengpeng Hou <pengpeng@iscas.ac.cn>
nfc: st21nfca: validate ISO15693 inventory length
Cong Nguyen <congnt264@gmail.com>
nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure
Chris Gellermann <christian.gellermann@codasip.com>
nfc: virtual_ncidev: Add missing ioctl compat handler
Chris Gellermann <christian.gellermann@codasip.com>
selftests/nci: Fix out-of-bounds store on thread join
Chaithanya Lagisetty <nagachaithanya9911@gmail.com>
selftests: nci: Fix uninitialized family ID on missing attribute
Lee Jones <lee@kernel.org>
nfc: llcp: Fix race condition in accept_queue lifecycle
Lei Zhu <zhulei@kylinos.cn>
selftests: nci: Correct pthread_create return value check
Aldo Ariel Panzardo <qwe.aldo@gmail.com>
nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()
Pengpeng Hou <pengpeng@iscas.ac.cn>
nfc: st21nfca: validate received frame size
Pengpeng Hou <pengpeng@iscas.ac.cn>
nfc: nfcmrvl: validate helper command length before pull
Maxime Chevallier <maxime.chevallier@bootlin.com>
net: stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K
Maxime Chevallier <maxime.chevallier@bootlin.com>
net: stmmac: selftests: Capture all packets for vlan checks
Maxime Chevallier <maxime.chevallier@bootlin.com>
net: stmmac: selftests: Check the dev->features for S-TAG offload testing
Maxime Chevallier <maxime.chevallier@bootlin.com>
net: stmmac: selftests: Support running selftests on DSA conduits
Xin Long <lucien.xin@gmail.com>
sctp: hold asoc or transport before mod_timer() in timer handlers
Bernardo Soares <bsoares.it@gmail.com>
net/mlx5: Bridge, don't fail unlink of untracked/unsupported peer ports
Vlad Buslov <vladbu@nvidia.com>
net/mlx5: Bridge, pass net device when linking vport to bridge
Bernardo Soares <bsoares.it@gmail.com>
net/mlx5: Bridge, don't fail switchdev events of sibling eswitch ports
Vlad Buslov <vladbu@nvidia.com>
net/mlx5: Bridge, snoop igmp/mld packets
Vlad Buslov <vladbu@nvidia.com>
net/mlx5: Bridge, extract code to lookup parent bridge of port
Vlad Buslov <vladbu@nvidia.com>
net/mlx5: Bridge, move additional data structures to priv header
Vlad Buslov <vladbu@nvidia.com>
net/mlx5: Bridge, increase bridge tables sizes
Vlad Buslov <vladbu@nvidia.com>
net/mlx5: Add mlx5_ifc definitions for bridge multicast support
Zhao Gongyi <zhaogongyi@BYTEDANCE.COM>
bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc
Emil Tsalapatis <emil@etsalapatis.com>
bpf: Fix bpf_sock context code generation
bui duc phuc <phucduc.bui@gmail.com>
net: ethernet: ti: netcp: fix pm_runtime usage counter leak on error
Mikhail Zaslonko <zaslonko@linux.ibm.com>
s390/debug: Fix NULL pointer dereference in debug_info_copy()
Mikhail Zaslonko <zaslonko@linux.ibm.com>
s390/debug: Do not register views for failed static debug areas
Myeonghun Pak <mhun512@gmail.com>
tg3: clean up PHYLIB resources on probe failure
Pengpeng Hou <hppiscas@163.com>
net: usb: sr9700: include receive overhead in the length check
Hui Peng <benquike@gmail.com>
Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()
Hui Peng <benquike@gmail.com>
Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough
Junrui Luo <moonafterrain@outlook.com>
drm/virtio: release the GEM object on virtio_gpu_vram_create() errors
Junrui Luo <moonafterrain@outlook.com>
drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()
Junrui Luo <moonafterrain@outlook.com>
drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()
Junrui Luo <moonafterrain@outlook.com>
drm/virtio: fix object leak when drm_gem_handle_create() fails
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget
Aamir Ahmed <elb12345@hotmail.co.uk>
net: usb: catc: bound the RX packet length in catc_rx_done()
Yiqi Sun <sunyiqixm@gmail.com>
sctp: avoid livelock while updating retransmit path
Kuniyuki Iwashima <kuniyu@google.com>
ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink().
Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
net: gue: reject invalid REMCSUM offsets
Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure
Francesco Magazzu <postadelmaga@gmail.com>
drm/nouveau/clk: don't clobber reclock status when restoring volt/fan
Dan Carpenter <error27@gmail.com>
drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update
Joseph Qi <joseph.qi@linux.alibaba.com>
ocfs2: make ocfs2_calc_xattr_init() return void
Naman Gulati <namangulati@google.com>
netfilter: ctnetlink: fix suspicious RCU usage in expect_iter_name
Julian Anastasov <ja@ssi.bg>
ipvs: revalidate ihl before icmp_send
Karl Mehltretter <kmehltretter@gmail.com>
netfilter: nft_synproxy: use the family-aware checksum helper
Florian Westphal <fw@strlen.de>
netfilter: nfnetlink_queue: hold nfnl mutex in event notifier
Scott Mitchell <scott.k.mitch1@gmail.com>
netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation
Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
netfilter: flowtable: publish HW_DEAD after worker is done
Kumar Kartikeya Dwivedi <memxor@gmail.com>
libbpf: Reject truncated ldimm64 CO-RE relocations
Kumar Kartikeya Dwivedi <memxor@gmail.com>
bpf: Restrict CO-RE poisoning to relocatable instructions
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: cls_u32: fix manual hash table handle IDR aliasing
Weiming Shi <bestswngs@gmail.com>
bpf: Skip unsettled links in link iterator
Zhiling Zou <zhilinz@nebusec.ai>
xsk: Use a 32-bit compare in xsk_map_gen_lookup
Julian Sun <sunjunchao@bytedance.com>
fs: avoid repeated scans in evict_inodes()
Vineeth Vijayan <vneethv@linux.ibm.com>
s390/cio: Check pmcw.dnv before pmcw.ena in I/O entry points
Vineeth Vijayan <vneethv@linux.ibm.com>
s390/cio: Fix cio_update_schib() to not cache invalid schib
Karl Mehltretter <kmehltretter@gmail.com>
s390/pci/docs: Fix sriov_numvfs attribute name
Niklas Schnelle <schnelle@linux.ibm.com>
docs: s390/pci: Improve and update PCI documentation
Randy Dunlap <rdunlap@infradead.org>
Documentation: s390: correct spelling
Bart Van Assche <bvanassche@acm.org>
scsi: megaraid_sas: Protect megasas_get_ctrl_info() in megasas_resume()
Lee Jones <lee@kernel.org>
Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel
Christiano Amora <christiano.amora@gmail.com>
Bluetooth: SMP: reject Security Request over BR/EDR
Ran Hongyun <ranhongyun1@huawei.com>
squashfs: Add dictionary size range check to prevent shift-out-of-bounds
Slawomir Stepien <sst@poczta.fm>
HID: amd_sfh: Validate PCI BAR size before mapping
Sean Anderson <sanderson@brivo.com>
pinctrl: meson: Fix typo in s4 group name
Geliang Tang <tanggeliang@kylinos.cn>
bpf, sockmap: Fix self-redirect copied_seq double-counting
Jiayuan Chen <jiayuan.chen@linux.dev>
bpf: Fix out-of-bounds read of rtt_min in sock_ops
Jose Fernandez (Anthropic) <jose.fernandez@linux.dev>
bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch()
Oscar Priego Verdugo <oscar.priegov@gmail.com>
HID: elecom: fix bus type for M-XGL20DLBK
Jiayuan Chen <jiayuan.chen@linux.dev>
bpf: Fix divide-by-zero in btf_struct_walk()
Feng Zhou <zhoufeng.zf@bytedance.com>
bpf: support access variable length array of integer type
Sven Schnelle <svens@linux.ibm.com>
selftests/ftrace: Fix unique symbol check in kprobe_non_uniq_symbol.tc
Weiming Shi <bestswngs@gmail.com>
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
Daniel Borkmann <daniel@iogearbox.net>
bpf: Fix bpf_skb_change_tail wrt csum partial skbs
Claudio Imbrenda <imbrenda@linux.ibm.com>
KVM: s390: Fix IRQ injection with SIGP Stop and Store Status
Xingui Yang <yangxingui@huawei.com>
scsi: hisi_sas: Grab sas_dev lock when traversing the members of sas_dev.list
Boris Burkov <boris@bur.io>
btrfs: insert tree mod log move in push_node_left
Dmitry Antipov <dmantipov@yandex.ru>
wifi: rtw88: delete timer and free skb queue when unloading
Duoming Zhou <duoming@zju.edu.cn>
sh: push-switch: Reorder cleanup operations to avoid use-after-free bug
Jianbo Liu <jianbol@nvidia.com>
net/mlx5e: TC, Fix internal port memory leak
Hans de Goede <hdegoede@redhat.com>
media: ipu-bridge: Fix null pointer deref on SSDB/PLD parsing warnings
ndesaulniers@google.com <ndesaulniers@google.com>
start_kernel: Add __no_stack_protector function attribute
Vitaly Kuznetsov <vkuznets@redhat.com>
HID: hyperv: streamline driver probe to avoid devres issues
Martin KaFai Lau <martin.lau@kernel.org>
bpf: bpf_sk_storage: Fix the missing uncharge in sk_omem_alloc
Jinjie Ruan <ruanjinjie@huawei.com>
spi: zynqmp-gqspi: Use devm_spi_alloc_host()
Junli Liu <liujunli@lixiang.com>
erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC
Mickaël Salaün <mic@digikod.net>
selftests/landlock: Add layout1.refer_mount_root
Sandeep Dhavale <dhavale@google.com>
erofs: Fix detection of atomic context
Bjorn Andersson <quic_bjorande@quicinc.com>
drm/msm/dp: Drop aux devices together with DP controller
Martin KaFai Lau <martin.lau@kernel.org>
bpf: bpf_sk_storage: Fix invalid wait context lockdep report
Itai Handler <itai.handler@gmail.com>
spi: spi-zynqmp-gqspi: stop the controller on shutdown
Chen Xiaokun <shinnkka1@gmail.com>
io_uring/io-wq: Fix memory leak in io_wq_create() on success path
Christoph Hellwig <hch@lst.de>
btrfs: don't check PageError in __extent_writepage
Pauli Virtanen <pav@iki.fi>
Bluetooth: hci_sync: always check if connection is alive before deleting
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync
Chengming Zhou <zhouchengming@bytedance.com>
blk-mq: fix tags UAF when shrinking q->nr_hw_queues
Chengming Zhou <zhouchengming@bytedance.com>
blk-mq: fix tags leak when shrink nr_hw_queues
Benoît Sevens <bsevens@google.com>
HID: logitech-hidpp: fix race condition when accessing stale stack pointer
Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
ASoC: SOF: ipc4-topology: Clarify bind failure caused by missing fw_module
Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
ASoC: SOF: avoid a NULL dereference with unsupported widgets
Frank Sorenson <sorenson@redhat.com>
smb: client: fix missing lower-bound check on DFS referral string offsets
Frank Sorenson <sorenson@redhat.com>
smb: client: fix server->total_read for compound encrypted PDUs
Frank Sorenson <sorenson@redhat.com>
smb: client: fix potential OOB read in smb3_enum_snapshots()
Frank Sorenson <sorenson@redhat.com>
smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
Paulo Alcantara <pc@manguebit.org>
smb: client: fix smbd_connection leak on cifs_get_tcp_session() error
Frank Sorenson <sorenson@redhat.com>
smb: client: reject short Next offsets in parse_server_interfaces()
Guangshuo Li <lgs201920130244@gmail.com>
drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure
Guangshuo Li <lgs201920130244@gmail.com>
drm/msm/adreno: fix autosuspend cleanup during teardown
Sajal Gupta <sajal2005gupta@gmail.com>
drm/gud: fix out-of-bounds write in gud_plane_atomic_check()
Rik van Riel <riel@surriel.com>
wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver
Zhao Li <enderaoelyther@gmail.com>
wifi: mwifiex: validate action frame fixed fields
Pengpeng Hou <pengpeng@iscas.ac.cn>
wifi: mwifiex: validate scan response extents
Doruk Tan Ozturk <doruk@0sec.ai>
wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length
Shengzhuo Wei <me@cherr.cc>
wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST
Shengzhuo Wei <me@cherr.cc>
wifi: p54: validate curve data length in the calibration curve converters
Tianchu Chen <flynnnchen@tencent.com>
wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()
Ali Ahmet Memis <ali@iusegentoo.com>
wifi: wilc1000: fix out-of-bounds read in P2P public action frames
Runyu Xiao <runyu.xiao@seu.edu.cn>
wifi: wlcore: release runtime PM ref on regdomain config failure
Tianchu Chen <flynnnchen@tencent.com>
wifi: rsi: fix heap OOB write on key removal
Jiangshan Yi <yijiangshan@kylinos.cn>
wifi: libertas_tf: fix UAF in lbtf_free_adapter()
Stanislaw Gruszka <stf_xl@wp.pl>
wifi: iwlegacy: fix broadcast stations deallocation
Jiangshan Yi <yijiangshan@kylinos.cn>
wifi: brcmsmac: fix UAF in brcms_free_timer()
Wentao Liang <vulab@iscas.ac.cn>
watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init()
Tzung-Bi Shih <tzungbi@kernel.org>
watchdog: msc313e: Propagate error code in resume()
Tzung-Bi Shih <tzungbi@kernel.org>
watchdog: msc313e: Fix premature reset during timeout update
Tzung-Bi Shih <tzungbi@kernel.org>
watchdog: digicolor: Avoid division by zero
Li Jun <lijun01@kylinos.cn>
watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog
Guangshuo Li <lgs201920130244@gmail.com>
hwmon: (w83793) release probe data through kref
Guangshuo Li <lgs201920130244@gmail.com>
hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove
Sanman Pradhan <psanman@juniper.net>
hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676
Sanman Pradhan <psanman@juniper.net>
hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding
Nuno Sá <nuno.sa@analog.com>
hwmon: (pmbus/core) increase number of phases and add new mask
Iván Ezequiel Rodriguez <ivanrwcm25@gmail.com>
Input: zero ff_effect before compat copy in input_ff_effect_from_user
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound
Raphaël Larocque <rlarocque@disroot.org>
Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722)
Hans de Goede <johannes.goede@oss.qualcomm.com>
Input: soc_button_array - check btns_desc->package.count
Hans de Goede <johannes.goede@oss.qualcomm.com>
Input: soc_button_array - fix MS Surface Pro 11 probe failure
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()
Chris Sommers <chris.sommers@icloud.com>
Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P
Iván Ezequiel Rodriguez <ivanrwcm25@gmail.com>
Input: evdev - zero absinfo before partial copy in EVIOCSABS
Alexei Turtanov <9alexei9@gmail.com>
Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026
Alvin Šipraga <alvin.sipraga@analog.com>
Input: adp5588-keys - cache GPIO state before registering the gpiochip
Diogo Ivo (Schneider Electric) <diogo.ivo@bootlin.com>
mmc: sdhci_am654: Reset command and data lines on failed tuning
Xu Rao <raoxu@uniontech.com>
mmc: spi: reset bytes_xfered before retrying CRC failures
Runyu Xiao <runyu.xiao@seu.edu.cn>
mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt
Felix Gu <ustc.gu@gmail.com>
mmc: sdio_uart: fix xmit_fifo leak when the port table is full
Myeonghun Pak <mhun512@gmail.com>
mmc: sdhci-of-aspeed: Remove children before releasing SDC resources
Florian Maillard <florian.maillard@mailoo.org>
mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260
Fan Wu <fanwu01@zju.edu.cn>
mmc: mxcmmc: cancel data work and watchdog on remove
Zhu Ling <zhuling0805@qq.com>
mmc: core: Fix OF node reference leak on card add failure
Fan Wu <fanwu01@zju.edu.cn>
mmc: core: Cancel SDIO IRQ work before freeing host
Christian Göttsche <cgzones@googlemail.com>
selinux: always fill AVC decision in avc_has_perm_noaudit()
Shuangpeng Bai <shuangpeng.kernel@gmail.com>
IB/mlx4: Fix use-after-free on pkey sysfs registration failure
Shengzhuo Wei <me@cherr.cc>
i2c: imx: release DMA channels on probe error
Shengzhuo Wei <me@cherr.cc>
i2c: at91: release DMA channels on remove and probe error
Jarkko Sakkinen <jarkko@kernel.org>
KEYS: trusted: Fix tpm2_load_cmd() boundary check
Maoyi Xie <maoyixie.tju@gmail.com>
keys: translate request_key_auth pid for the reading procfs instance
Yifei Gao <gyf161023@gmail.com>
memstick: ms_block: destroy io_queue workqueue on removal
Mark Amirkan <markdamirkan@gmail.com>
net/packet: avoid truncating TPACKET_V3 private size
Mark Amirkan <markdamirkan@gmail.com>
net/packet: clear RX owner on VNET header error
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: hhf: cap hh_flows_limit at change time
Guanglei Zhu <zhugl3@xiaopeng.com>
net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value
Guanglei Zhu <zhugl3@xiaopeng.com>
net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain
Mark Amirkan <markdamirkan@gmail.com>
net: lan743x: fix RX checksum use-after-free
Zhiling Zou <zhilinz@nebusec.ai>
ipv6: xfrm: use full sockets in local error paths
Alexander Chesnokov <Alexander.Chesnokov@kaspersky.com>
dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()
Christian Lugnberg <christian.lugnberg@soundtrack.io>
dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status
Christian Lugnberg <christian.lugnberg@soundtrack.io>
dmaengine: sun6i: fix non-atomic read of DMA position registers
Chengfeng Ye <nicoyip.dev@gmail.com>
Bluetooth: hci_sync: Serialize local codec list cleanup
Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
Bluetooth: hci_codec: validate vendor codec count length
Aamir Ahmed <elb12345@hotmail.co.uk>
Bluetooth: eir: validate service data length before reading UUID
Nicolas Thibert <nithibert@gmail.com>
Bluetooth: btusb: fix NXP IW610 composite device handling
Mark Rutland <mark.rutland@arm.com>
arm64: percpu: Fix this_cpu_and() mask generation
Mark Rutland <mark.rutland@arm.com>
arm64: percpu: Fix this_cpu_write() casting
Koichiro Den <den@valinux.co.jp>
arm64: dts: renesas: r8a779f0: Set UFS lane count
Bradley Morgan <include@grrlz.net>
arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc
Thomas Huth <thuth@redhat.com>
kselftest/arm64: Fix size of thread_data values for pthread_join()
Wyatt Feng <wf.kernel.dev@gmail.com>
net: xfrm: reject unrepresentable espintcp transport headers
Zhiling Zou <zhilinz@nebusec.ai>
openvswitch: avoid reallocating confirmed conntrack labels
Jeffin Philip <jeffinphilip14@gmail.com>
RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()
Quanye Yang <quanyeyang@proton.me>
RDMA/ucma: Serialize join and leave on copy_to_user failure
Inbal Schussheim <inbal.lipshtat@mail.huji.ac.il>
tcp: exclude old ACKs from tcp fast path
Aohan Mei <henrymei@tencent.com>
rds: ib: use rds_conn_drop() on protocol version mismatch
Niklas Cassel <cassel@kernel.org>
ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY
Yuho Choi <oss.patchbox@gmail.com>
ALSA: virtio: reset device before deleting virtqueues
Jeremy Nyberg <slickstretch3.0@gmail.com>
Input: xpad - fix PDP Marvel Xbox 360 controller
Roberts Kursitis <roberts.kursitis@azeron.eu>
Input: xpad - add support for Azeron devices
Erich Sartison <byt.es@mailbox.org>
Input: xpad - add support for Victrix Pro BFG Controller
Andrea Righi <arighi@nvidia.com>
sched/fair: Reject misfit pulls onto busy SMT siblings on asym-capacity
Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
sched/fair: Move is_core_idle() out of CONFIG_NUMA
Tomer Tayar <ttayar@habana.ai>
accel/habanalabs: postpone mem_mgr IDR destruction to hpriv_release()
Dmitriy Okunev <dokunevdmitriy@gmail.com>
net: mvpp2: prevent buffer overflow in page_pool allocation
James Clark <jjc@jclark.com>
net: macb: fix ordering around PTP timestamp read
Linus Walleij <linusw@kernel.org>
net: ethernet: cortina: Ack RX overrun interrupt correctly
Eric Dumazet <edumazet@google.com>
net: lock the socket in sock_gettstamp()
Yige Jiang <yigejiang86@gmail.com>
net: netsec: fix device_node reference leak on phy_np
HyeongJun An <sammiee5311@gmail.com>
ASoC: hdmi-codec: Report a change when the channel status moves
Sasha Levin <sashal@kernel.org>
ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments
Shivaprasad G Bhat <sbhat@linux.ibm.com>
powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba
Amit Machhiwal <amachhiw@linux.ibm.com>
KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure
Amit Machhiwal <amachhiw@linux.ibm.com>
KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()
Eric Dumazet <edumazet@google.com>
drop_monitor: fix out-of-bounds write in reset_per_cpu_data()
Eric Dumazet <edumazet@google.com>
drop_monitor: synchronize tracepoint unregistration on error path
Eric Dumazet <edumazet@google.com>
pppoatm: ensure a writable skb header and linear data
Juan Perdomo <jcperdomo100@gmail.com>
Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup
Tzung-Bi Shih <tzungbi@kernel.org>
Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown
Baineng Shou <shoubaineng@gmail.com>
dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()
Eric Dumazet <edumazet@google.com>
tcp: do not let tcp_rmem be set below 4096
Kuniyuki Iwashima <kuniyu@google.com>
tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().
Nikolay Aleksandrov <razor@blackwall.org>
net: bridge: mst: move switchdev call outside rcu
Karl Mehltretter <kmehltretter@gmail.com>
wifi: brcmfmac: fix lost 802.1x TX completion wakeup
Hohyun Sim <tlaghgus0425@korea.ac.kr>
net: fddi: skfp: fix NULL deref when setting the MAC address while down
Dong Chenchen <dongchenchen2@huawei.com>
ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup
Andrea Mayer <andrea.mayer@uniroma2.it>
seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation
Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL
Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
drm/msm/dsi: correct byte intf clock rate for 14nm DSI PHY
Filipe Manana <fdmanana@suse.com>
btrfs: tree-checker: print dev extent offset in error message
Slavin Liu <bolin.liu@seu.edu.cn>
ALSA: hda: trace PCM open only after assigning a stream
Thomas Zimmermann <tzimmermann@suse.de>
drm/ast: Rework definition of I/O read and write helpers
Thomas Zimmermann <tzimmermann@suse.de>
drm/ast: Remove little-endianism from I/O helpers
Thomas Zimmermann <tzimmermann@suse.de>
drm/atomic-helper: Add atomic_enable plane-helper callback
Zihan Xi <zihanx@nebusec.ai>
wifi: virt_wifi: don't transfer operstate before register
Xiang Mei <xmei5@asu.edu>
ALSA: 6fire: fix OOB write from device-reported iso length
Takashi Iwai <tiwai@suse.de>
ALSA: usb: 6fire: Avoid embedded URBs
Takashi Iwai <tiwai@suse.de>
ALSA: 6fire: Clean ups with guard()
Karl Mehltretter <kmehltretter@gmail.com>
Input: trackpoint - fix the inertia attribute name in the ABI document
Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
ALSA: pcm: set timer->private_data before registering the PCM timer
Takashi Iwai <tiwai@suse.de>
ALSA: bcd2000: Fix race between rawmidi and disconnect
Karl Mehltretter <kmehltretter@gmail.com>
keys: fix lost wakeup when reaping a dead key type
Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr
Shouping Wang <allen.wang@hj-micro.com>
perf/arm-cmn: Fix wp_dev_sel2 setting for multi-DTM configurations
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: flowtable: hold reference on ct until flow is released
Theodor Arsenij Larionov Trichkine <theodorlarionov@gmail.com>
netfilter: nft_nat: fully initialise new_addr in netmap setup
Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
RDMA/siw: Bound fragmented header copies by the remaining length
Leon Romanovsky <leon@kernel.org>
RDMA/efa: Keep EQ resources alive while IRQ is registered
Leon Romanovsky <leon@kernel.org>
RDMA/efa: Keep admin queues alive while IRQ is registered
Alex Bereza <alex@bereza.email>
dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA
Alex Bereza <alex@bereza.email>
dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order
Karl Mehltretter <kmehltretter@gmail.com>
scsi: qla2xxx: Fix the ql2xfc2target parameter description
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: set up the TX info early to fix failure paths
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: rework ack_frame_id handling a bit
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: mesh: release the channel if start fails
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: add HE 6 GHz capability in the scan elems len
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: don't access the TSF of a down interface
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: don't allow link changes when iface is down
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: require a peer station for TDLS setup confirm
Mukesh Sisodiya <mukesh.sisodiya@intel.com>
wifi: mac80211: handle TDLS negotiation with MLO
Mukesh Sisodiya <mukesh.sisodiya@intel.com>
wifi: cfg80211: make TDLS management link-aware
Johannes Berg <johannes.berg@intel.com>
wifi: cfg80211: trace: remove MAC_PR_{FMT,ARG}
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: unlist vifs when their netdev is unregistered
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: suppress chanctx warning for debugfs reset
Johannes Berg <johannes.berg@intel.com>
wifi: cfg80211: don't filter by BSS type when removing stale entries
Johannes Berg <johannes.berg@intel.com>
wifi: cfg80211: only group hidden BSSes with beacon entries
Shivank Garg <shivankg@amd.com>
dmaengine: wait for RCU readers before releasing dma_device
Shivank Garg <shivankg@amd.com>
dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()
Shivank Garg <shivankg@amd.com>
dmaengine: Fix device kref underflow in dma_chan_put()
Donggeun Yoo <donggeunyoo.kernel@gmail.com>
dma-coherent: report a failed reserved memory assignment
Chen-Yu Tsai <wenst@chromium.org>
dma-coherent: Warn if OF reserved memory is beyond current coherent DMA mask
Orgad Shaneh <orgads@gmail.com>
MIPS: Octeon: apply USB FDT fixups also when USB is modular
Bard Liao <yung-chuan.liao@linux.intel.com>
soundwire: cadence_master: wait and cancel cdns->work before clock stop
Johannes Berg <johannes.berg@intel.com>
wifi: cfg80211: check IP header size in cfg80211_classify8021d()
Carolina Jubran <cjubran@nvidia.com>
IB/IPoIB: Avoid restoring OPER_UP after multicast flush
Shmulik Cohen <anuk909@gmail.com>
wifi: libipw: reject too-short association responses
Shmulik Cohen <anuk909@gmail.com>
wifi: libipw: reject too-short beacon and probe responses
Peng Hao <flyingpenghao@gmail.com>
wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path
Mariano Baragiola <mbaragiola@linux.com>
wifi: virt_wifi: free skb when disconnected
Ruoyu Wang <ruoyuw560@gmail.com>
dmaengine: sprd: Fix runtime PM reference leak in probe
Quanye Yang <quanyeyang@proton.me>
RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted
Jacob Moroni <jmoroni@google.com>
RDMA/irdma: Enforce local fence for IB_WR_REG_MR
Li RongQing <lirongqing@baidu.com>
RDMA/mad: Fix receive buffer leak when PKey enforcement fails
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
IB/isert: wait for deferred control PDU completions before releasing the connection
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
IB/iser: reject a remote invalidation of an unregistered direction
Krystian Kaniewski <krystianmkaniewski@gmail.com>
RDMA/core: Reject unregistering netdevs in ib_get_eth_speed
Eric Dumazet <edumazet@google.com>
net: convert dev->reg_state to u8
Jiri Pirko <jiri@nvidia.com>
net: devlink: take RTNL in port_fill() function only if it is not held
Jiri Pirko <jiri@nvidia.com>
net: devlink: move port_type_netdev_checks() call to __devlink_port_type_set()
Jiri Pirko <jiri@nvidia.com>
net: devlink: move port_type_warn_schedule() call to __devlink_port_type_set()
Jiri Pirko <jiri@nvidia.com>
net: devlink: convert devlink port type-specific pointers to union
Michael Bommarito <michael.bommarito@gmail.com>
RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds
Xixin Liu <liuxixin@kylinos.cn>
clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate
Xixin Liu <liuxixin@kylinos.cn>
firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS
Guoqing Jiang <guoqing.jiang@linux.dev>
RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept
Guoqing Jiang <guoqing.jiang@linux.dev>
RDMA/siw: Cleanup siw_accept
Guoqing Jiang <guoqing.jiang@linux.dev>
RDMA/siw: Introduce siw_cep_set_free_and_put
Pengpeng Hou <pengpeng@iscas.ac.cn>
ARM: socfpga: select the PL310 erratum 753970 workaround
Maher Azzouzi <maherazz04@gmail.com>
esp: downgrade zerocopy managed frags before mutating skb frags
Eric Dumazet <edumazet@google.com>
xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()
Kyle Zeng <kylebot@openai.com>
xfrm: fix compat ALLOCSPI request use-after-free
Sabrina Dubroca <sd@queasysnail.net>
xfrm: avoid RCU warnings around the per-netns netlink socket
Ido Schimmel <idosch@nvidia.com>
ipv6: Honor oif when choosing nexthop for locally generated traffic
Ido Schimmel <idosch@nvidia.com>
ipv6: Select best matching nexthop object in fib6_table_lookup()
Arash Golgol <arash.golgol@gmail.com>
media: video-i2c: fix buffer queue ordering
Sasha Levin <sashal@kernel.org>
Revert "perf cs-etm: Flush thread stacks after decoder reset"
Sasha Levin <sashal@kernel.org>
Revert "perf cs-etm: Avoid truncating AUX buffer sizes to int"
Jens Axboe <axboe@kernel.dk>
sunvdc: fix -EIO issue due to lack of retries
Günther Noack <gnoack@google.com>
selftests/landlock: Add tests for whiteout object creation
Guangguan Wang <guangguan.wang@linux.alibaba.com>
net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg
Sasha Levin <sashal@kernel.org>
Revert "alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally"
Sasha Levin <sashal@kernel.org>
Revert "alpha: don't leak hardware-fabricated FP exception bits to user space"
Mickaël Salaün <mic@digikod.net>
selftests/landlock: Add disconnected leafs and branch test suites
Tingmao Wang <m@maowtm.org>
selftests/landlock: Add tests for access through disconnected paths
Mickaël Salaün <mic@digikod.net>
landlock: Fix handling of disconnected directories
Paolo Abeni <pabeni@redhat.com>
mptcp: close race between scheduler and state change
Paolo Abeni <pabeni@redhat.com>
mptcp: avoid unneeded actions on subflow reset
Paolo Abeni <pabeni@redhat.com>
mptcp: consolidate subflow cleanup
Eric Biggers <ebiggers@kernel.org>
netfilter: nft_set_pipapo_avx2: add missing vzeroupper
Eric Biggers <ebiggers@kernel.org>
crypto: sun8i-ss - Remove crypto_rng interface
Eric Biggers <ebiggers@kernel.org>
crypto: sun8i-ce - Remove crypto_rng interface
Xuanqiang Luo <luoxuanqiang@kylinos.cn>
fou: Fix use-after-free in fou_create()
Weiming Shi <bestswngs@gmail.com>
net: appletalk: fix NULL pointer dereference in aarp_send_ddp()
Weiming Shi <bestswngs@gmail.com>
i2c: smbus: reject oversized block transfers in the common path
Kazuki Hanai <hnkz.64@gmail.com>
ALSA: us122l: Prevent write upgrades for read mappings
Gary Guo <gary@garyguo.net>
net: usb: pegasus: don't rely on id table pointer arithmetic
Gary Guo <gary@garyguo.net>
media: as102: do not rely on id table address comparison
Gary Guo <gary@garyguo.net>
usb: usbtmc: don't store usb_device_id
Gary Guo <gary@garyguo.net>
wifi: ath9k_htc: don't store usb_device_id
Gary Guo <gary@garyguo.net>
usb: xusbatm: don't rely on id table pointer arithmetic
Sasha Levin <sashal@kernel.org>
Revert "perf tests: Fix flakiness in BPF counters test on hybrid systems"
Sasha Levin <sashal@kernel.org>
Revert "nvme: apple: Add Apple A11 support"
Sasha Levin <sashal@kernel.org>
Revert "nvme-apple: Drop the PRP null check chicken bit"
Sasha Levin <sashal@kernel.org>
Revert "nvme-apple: Prevent shared tags across queues on Apple A11"
Sasha Levin <sashal@kernel.org>
Revert "nvme-apple: Reset q->sq_tail during queue init"
Eric Dumazet <edumazet@google.com>
ipv6: mcast: extend RCU protection in igmp6_send()
Sasha Levin <sashal@kernel.org>
Revert "arm64: dts: qcom: sdm845: Fix the PCIe iommu-map entries"
Sasha Levin <sashal@kernel.org>
Revert "arm64: dts: qcom: sm8150: Fix the PCIe iommu-map entries"
Sasha Levin <sashal@kernel.org>
Revert "arm64: dts: qcom: sm8250: Fix the PCIe iommu-map entries"
Sasha Levin <sashal@kernel.org>
Revert "arm64: dts: qcom: sm8350: Fix the PCIe iommu-map entries"
Sasha Levin <sashal@kernel.org>
Revert "arm64: dts: qcom: sm8450: Fix the PCIe iommu-map entries"
Sasha Levin <sashal@kernel.org>
Revert "arm64: dts: qcom: sm8550: Fix the PCIe iommu-map entries"
Suraj Jitindar Singh <surajjs@amazon.com>
bpftool: remove duplicate free_btf_vmlinux() definition
Bjoern Doebel <doebel@amazon.de>
smb: client: avoid leaking refcount when cifs_sb_tlink() fails
Bjoern Doebel <doebel@amazon.de>
smb: client: avoid leaking refcount in cifs_queue_oplock_break()
Aohan Mei <henrymei@tencent.com>
smb: client: reject userspace cifs.idmap descriptions
Gang Yan <yangang@kylinos.cn>
selftests: mptcp: fix an UAF in mptcp_connect.c
Matthieu Baerts (NGI0) <matttbe@kernel.org>
mptcp: syncookies: remember the request backup flag
Matthieu Baerts (NGI0) <matttbe@kernel.org>
mptcp: subflow: no need to copy thmac during ulp_clone
Matthieu Baerts (NGI0) <matttbe@kernel.org>
mptcp: options: handle MPC data + csum reqd + no csum
Joe Damato <joe@dama.to>
bnxt_en: Propagate RX ring init failures in bnxt_init_nic()
Joe Damato <joe@dama.to>
bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()
Joe Damato <joe@dama.to>
bnxt_en: Only restore LRO if the device supports TPA
Michael Bommarito <michael.bommarito@gmail.com>
media: v4l2-ctrls: validate HEVC tile counts
Haotian Zhang <vulab@iscas.ac.cn>
media: v4l2-h264: Fix memcmp() size in B1 reference list comparison
Michael Bommarito <michael.bommarito@gmail.com>
media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity
Michael Bommarito <michael.bommarito@gmail.com>
media: hevc: add bounded tile-count helpers
Vishnu Razdan <vrazdan@openai.com>
hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS
Fan Wu <fanwu01@zju.edu.cn>
hwmon: (gpio-fan) Fix use-after-free in alarm work
Cong Nguyen <congnt264@gmail.com>
hwmon: (applesmc) fix key backlight workqueue leak on register failure
Harald Freudenberger <freude@linux.ibm.com>
s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm
Nagamani PV <nagamani@linux.ibm.com>
s390/qeth: allow bridgeport queries despite OS_MISMATCH
leixiang <leixiang@kylinos.cn>
KVM: PPC: Book3S HV: Set irqfd->producer only on success
Kyle Zeng <kylebot@openai.com>
ipvs: reject invalid states in connection template sync records
Zihan Xi <zihanx@nebusec.ai>
ipv4: fib: bound automatic table ID allocation
Zhiling Zou <zhilinz@nebusec.ai>
ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink
Weiming Shi <bestswngs@gmail.com>
fbdev: vfb: defer cleanup until the last reference
Ilya Maximets <i.maximets@ovn.org>
netfilter: report NLM_F_DUMP_FILTERED when all is filtered out
Chengfeng Ye <nicoyip.dev@gmail.com>
netfilter: nf_log: unregister loggers before per-net teardown
Norbert Szetei <norbert@doyensec.com>
net: openvswitch: fix use-after-free of the flow table mask array
Fourie Zhang <littleddfu@gmail.com>
net: mpls: clear inner_protocol when the last label is popped
Johan Hovold <johan@kernel.org>
net: hso: fix TIOCMIWAIT race
Sebastian Andrzej Siewior <bigeasy@linutronix.de>
ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters()
Thorsten Blum <thorsten.blum@linux.dev>
drm/i915: Fix memory leak in query_perf_config_list()
Jann Horn <jannh@google.com>
exec: do_close_on_exec() before taking exec_update_lock
Runyu Xiao <runyu.xiao@seu.edu.cn>
cpufreq: initialize policy rwsem before sysfs publication
Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
cpufreq: zero-initialize policy cpumask before sysfs publication
Runyu Xiao <runyu.xiao@seu.edu.cn>
ASoC: sti: initialize IRQ lock before requesting IRQ
Tianchu Chen <flynnnchen@tencent.com>
ASoC: sprd: validate compress buffer sizes against fixed allocations
Donggeun Yoo <donggeunyoo.kernel@gmail.com>
tracing: Keep the entry count when the histogram stats allocation fails
Donggeun Yoo <donggeunyoo.kernel@gmail.com>
tracing: Let histogram values keep the percent and graph modifiers
Donggeun Yoo <donggeunyoo.kernel@gmail.com>
tracing: Free histogram the field rejected for a bad modifier
Donggeun Yoo <donggeunyoo.kernel@gmail.com>
tracing: Free histogram var refs regardless of how often they are referenced
Donggeun Yoo <donggeunyoo.kernel@gmail.com>
tracing: Free histogram the var ref when its initialization fails
Thomas Gleixner <tglx@linutronix.de>
tick/broadcast: Plug clockevents replacement race
Ido Schimmel <idosch@nvidia.com>
tunnels: Drop stale dst when building an ICMP error for PMTUD
Ali Ahmet Memis <ali@iusegentoo.com>
ufs: validate cylinder group metadata before caching it
Ali Ahmet Memis <ali@iusegentoo.com>
ufs: create the root dentry after loading cylinder metadata
James Hilliard <james.hilliard1@gmail.com>
watchdog: sunxi_wdt: preserve boot-enabled watchdog
Harry Wentland <harry.wentland@amd.com>
dm/amdgpu: fix malformed link_settings debugfs output
Tristan Madani <tristan@talencesecurity.com>
ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf
Roman Prucha <zorgan.roman@gmail.com>
ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough
Zihan Xi <zihanx@nebusec.ai>
ipv6: fix fib6 walker UAF on seq stop
Shivaprasad G Bhat <sbhat@linux.ibm.com>
powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver
Eric Dumazet <edumazet@google.com>
ipv4: start using dst_dev_rcu()
Eric Dumazet <edumazet@google.com>
net: dst: introduce dst->dev_rcu
Eric Dumazet <edumazet@google.com>
ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu]
Eric Dumazet <edumazet@google.com>
net: dst: add four helpers to annotate data-races around dst->dev
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: prevent out-of-bounds reads in share config responses
Maurizio Lombardi <mlombard@redhat.com>
scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands
Dmitry Bogdanov <d.bogdanov@yadro.com>
scsi: target: iscsi: Handle abort for WRITE_PENDING cmds
WenTao Liang <vulab@iscas.ac.cn>
drm/amd/display: set new_stream to NULL after release
Stian Halseth <stian@itx.no>
sunvdc: unmap LDC cookies when the descriptor send fails
Eelco Chaudron <echaudro@redhat.com>
openvswitch: fix wrong flag value in get_ipv6_ext_hdrs()
Greg Marsden <greg.marsden@oracle.com>
net/rds: fix tcp stream corruption with large pages
Ratheesh Kannoth <rkannoth@marvell.com>
octeontx2-af: fix PF/CGX debugfs PCI bus lookup
Aamir Ahmed <elb12345@hotmail.co.uk>
net: hinic: fix mailbox segment buffer overflow
Li Youhong <liyouhong@kylinos.cn>
net: sun4i-emac: fix missing of_node_put() for phy_node
Kuniyuki Iwashima <kuniyu@google.com>
net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain().
Victor Nogueira <victor@mojatatu.com>
net/sched: cls_route: free emptied bucket on filter move
Thibault Ferrante <thibault.ferrante@canonical.com>
selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value
Lorenzo Bianconi <lorenzo.bianconi@oss.qualcomm.com>
net: stmmac: initialize ptp_lock at probe time
Qingfang Deng <qingfang.deng@linux.dev>
ppp_synctty: ensure a writeable skb header
Eric Dumazet <edumazet@google.com>
vxlan: initialize _md in vxlan_xmit_one()
Guillaume Nault <gnault@redhat.com>
vxlan: Pull inner IP header in vxlan_xmit_one().
Beniamino Galvani <b.galvani@gmail.com>
vxlan: use generic function for tunnel IPv6 route lookup
Beniamino Galvani <b.galvani@gmail.com>
ipv6: add new arguments to udp_tunnel6_dst_lookup()
Beniamino Galvani <b.galvani@gmail.com>
ipv6: remove "proto" argument from udp_tunnel6_dst_lookup()
Beniamino Galvani <b.galvani@gmail.com>
vxlan: use generic function for tunnel IPv4 route lookup
Pengpeng Hou <pengpeng@iscas.ac.cn>
hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors
Cong Nguyen <congnt264@gmail.com>
hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown()
Marek Vasut <marex@nabladev.com>
net: ks8851: Fix receiver error in 100BASE-TX mode following software power-down
Yicong Hui <yiconghui@gmail.com>
net/micrel: Fix typos in micrel driver code comments
Tzung-Bi Shih <tzungbi@kernel.org>
watchdog: msc313e: Sync timeout value if WDT was running at boot
Tzung-Bi Shih <tzungbi@kernel.org>
watchdog: msc313e: Fix undefined behavior
Tzung-Bi Shih <tzungbi@kernel.org>
watchdog: msc313e: Fix spurious reset on suspend
Tzung-Bi Shih <tzungbi@kernel.org>
watchdog: msc313e: Enable clock before accessing hardware registers
Tzung-Bi Shih <tzungbi@kernel.org>
watchdog: msc313e: Fix clock leak and spurious timer in settimeout()
Tzung-Bi Shih <tzungbi@kernel.org>
watchdog: msc313e: Avoid division by zero
David Arcari <darcari@redhat.com>
watchdog: fix hrtimer start when pretimeout is zero
Nicolai Buchwitz <nb@tipi-net.de>
net: macb: destroy the phylink instance on the probe error path
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: btusb: Fix UAF of btusb_data by rx_work
Jacob Keller <jacob.e.keller@intel.com>
ice: add missing xa_destroy for sched_node_ids
HyeongJun An <sammiee5311@gmail.com>
ALSA: hda: Report a change when only the channel status bytes move
Takashi Iwai <tiwai@suse.de>
ALSA: hda/common: Use guard() for mutex locks
Takashi Iwai <tiwai@suse.de>
ALSA: hda/common: Use cleanup macros for PM controls
Takashi Iwai <tiwai@suse.de>
ALSA: hda: Introduce auto cleanup macros for PM
Karl Mehltretter <kmehltretter@gmail.com>
drm/logicvc: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER
Linus Walleij <linusw@kernel.org>
net: ethernet: cortina: Count RX descriptors for freeq refill
Linus Walleij <linusw@kernel.org>
net: ethernet: cortina: Count RX drops once per frame
Linus Walleij <linusw@kernel.org>
net: ethernet: cortina: No mapping is a dropped rx
Linus Walleij <linusw@kernel.org>
net: ethernet: cortina: Count dropped frames as NAPI work
Linus Walleij <linusw@kernel.org>
net: ethernet: cortina: Finish RX updates before NAPI completion
Linus Walleij <linusw@kernel.org>
net: ethernet: cortina: Fix budget accounting
Alice Mikityanska <alice@isovalent.com>
net: ipv6: Clamp to IP6_MAX_MTU in ip6_dst_mtu_maybe_forward
Karl Mehltretter <kmehltretter@gmail.com>
virtio_input: stop callbacks before unregistering input device
Xiong Weimin <xiongweimin@kylinos.cn>
virtio_input: reset device if input_register_device() fails
Andrew Stellman <astellman@stellman-greene.com>
virtio-pci: return IRQ_HANDLED after non-zero ISR
Linfeng Sun <linfeng.sun.dev@gmail.com>
vdpa_sim_blk: reject out-of-range sector starts
Yu Zhang <yuz08559@gmail.com>
vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx
Jia Jia <physicalmtea@gmail.com>
virtio_console: do not free control-out buffers on remove
Xianting Tian <xianting.tian@linux.alibaba.com>
virtio-console: call scheduler when we free unused buffs
hpp.iscas <hppiscas@163.com>
ASoC: mt6351: Publish the OF module alias
Florian Westphal <fw@strlen.de>
netfilter: ip6_tables: set F_PROTO when proto value is nonzero
Florian Westphal <fw@strlen.de>
netfilter: nfnetlink_log: cope with concurrent instance destruction
hpp.iscas <hppiscas@163.com>
ASoC: Intel: SST: Publish the PCI module aliases
hpp.iscas <hppiscas@163.com>
ASoC: bcm: bcm63xx: Publish the OF module aliases
Edward Adam Davis <eadavis@sina.com>
ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev
Vineeth Karumanchi <vineeth.karumanchi@amd.com>
net: macb: fix NULL pointer dereference on unbind with fixed-link
Théo Lebrun <theo.lebrun@bootlin.com>
net: macb: rename bp->sgmii_phy field to bp->phy
Allen Pais <apais@linux.microsoft.com>
workqueue: Introduce from_work() helper for cleaner callback declarations
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: ets: clamp quantum in parse and fallback paths
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: drr: clamp quantum in change class
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: pie: clamp psched_mtu in pie_drop_early
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: hhf: clamp quantum in change and init paths
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: sfq: clamp quantum in change path
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: fq_pie: clamp quantum in change path
Eric Dumazet <edumazet@google.com>
net_sched: sch_fq_pie: implement lockless fq_pie_dump()
Lama Kayal <lkayal@nvidia.com>
net/mlx5: E-Switch, prevent mc_list repopulation during vport disable
Yael Chemla <ychemla@nvidia.com>
net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put
Carolina Jubran <cjubran@nvidia.com>
net/mlx5e: Fix use-after-free race in sample_restore_put()
Carolina Jubran <cjubran@nvidia.com>
net/mlx5e: Fix ETS zero BW reporting when one TC holds 100%
Shahar Shitrit <shshitrit@nvidia.com>
net/mlx5e: Fix setting RS FEC after remapping
Weiming Shi <bestswngs@gmail.com>
net/sched: defer qdisc freeing after failed creation
Thorsten Blum <thorsten.blum@linux.dev>
powerpc/kexec_file: Use inclusive range checks in add_usable_mem()
Jamal Hadi Salim <jhs@mojatatu.com>
net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations
Seungwon Bae <qotmddnjs@ajou.ac.kr>
vxlan: reject dynamic fdb entries that reference a nexthop id
Jason Winter <jjx@live.nl>
net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow
Viswajith Murali <viswajithm@marvell.com>
octeontx2-af: mcs: Clear stale X2P calibration state before calibration
Jakub Kicinski <kuba@kernel.org>
net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size
Jakub Kicinski <kuba@kernel.org>
net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size
Eric Dumazet <edumazet@google.com>
bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit()
Ido Schimmel <idosch@nvidia.com>
nexthop: Initialize extack in remove_nh_grp_entry()
Jiayuan Chen <jiayuan.chen@linux.dev>
selftests/bpf: Fix flaky bpf_nf test when random NAT port is 0
Brad Cowie <brad@faucet.nz>
selftests/bpf: Update tests for new ct zone opts for nf_conntrack kfuncs
Kumar Kartikeya Dwivedi <memxor@gmail.com>
bpf: Mark bpf_btf_find_by_name_kind() as sleepable
Yonghong Song <yhs@fb.com>
bpf: Introduce might_sleep field in bpf_func_proto
Cezary Rojewski <cezary.rojewski@intel.com>
ASoC: Intel: avs: Clean up the bus when fetching ML caps fails
Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
ALSA/ASoC: hda: ext: add 'ext' prefix to snd_hdac_link_free_all
Jiayuan Chen <jiayuan.chen@linux.dev>
bpf: Fix NULL-ptr-deref in btf_var_show()
Jiayuan Chen <jiayuan.chen@linux.dev>
bpf: Fix NULL-ptr-deref when showing a void BTF type
Takashi Iwai <tiwai@suse.de>
ALSA: caiaq: Fix potential double-free at error path
HyeongJun An <sammiee5311@gmail.com>
selftests/alsa: Fix the step check for INTEGER controls
Lorenzo Bianconi <lorenzo.bianconi@oss.qualcomm.com>
net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset
Allison Henderson <achender@kernel.org>
net/rds: don't let rds_conn_shutdown() consume a concurrent drop
Håkon Bugge <haakon.bugge@oracle.com>
net/rds: acquire the fastpath locks in rds_conn_shutdown()
Allison Henderson <achender@kernel.org>
net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()
Gerd Rausch <gerd.rausch@oracle.com>
net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown
Allison Henderson <achender@kernel.org>
net/rds: clear cp_flags bits individually in rds_conn_path_reset()
Allison Henderson <achender@kernel.org>
net/rds: use clear_bit_unlock() in release_refill()
Allison Henderson <achender@kernel.org>
net/rds: use wq_has_sleeper() in release_in_xmit()
Eric Dumazet <edumazet@google.com>
bonding: do not clear curr_active_slave prematurely when releasing all slaves
Eduard Zingerman <eddyz87@gmail.com>
bpf: reject BPF_PSEUDO_FUNC reference to the main program
Henry Martin <bsdhenrymartin@gmail.com>
tracing/probes: Fix use-after-free on field name/type of events with multiple probes
Joas Antonio dos Santos <joasantonio108@gmail.com>
netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()
Kyle Zeng <kylebot@openai.com>
ipvs: fix reversed sequence option serialization
Qu Wenruo <wqu@suse.com>
btrfs: do not force reloc root creation during qgroup_account_snapshot()
Linus Walleij <linusw@kernel.org>
ASoC: ux500: Program the MSP FIFO watermarks
Linus Walleij <linusw@kernel.org>
ASoC: ux500: Request the MSP MMIO resource
Arnd Bergmann <arnd@arndb.de>
ASoC: ux500: remove stedma40 references
Linus Walleij <linusw@kernel.org>
mfd: db8500-prcmu: Fold dbx500 header into db8500
Kees Cook <kees@kernel.org>
arm: Handle KCOV __init vs inline mismatches
Zijun Hu <quic_zijuhu@quicinc.com>
mfd: db8500-prcmu: Remove needless return in three void APIs
YueHaibing <yuehaibing@huawei.com>
mfd: db8500-prcmu: Remove unused inline functions
Linus Walleij <linusw@kernel.org>
ASoC: ux500: Validate MSP DAI configuration
Linus Walleij <linusw@kernel.org>
ASoC: ux500: Correct MSP frame and bit clock setup
Linus Walleij <linusw@kernel.org>
ASoC: ux500: Propagate MSP setup errors
Arnd Bergmann <arnd@arndb.de>
ASoC: ux500: remove platform_data support
Linus Walleij <linusw@kernel.org>
ASoC: ux500: Fix MSP stream lifecycle handling
Eric Dumazet <edumazet@google.com>
locking/lockdep: Invalidate stale class_cache entries for zapped classes
Kent Overstreet <kent.overstreet@linux.dev>
lockdep: Add lock_set_cmp_fn() annotation
Boqun Feng <boqun.feng@gmail.com>
locking/lockdep: Improve the deadlock scenario print for sync and read lock
Boqun Feng <boqun.feng@gmail.com>
locking/lockdep: Introduce lock_sync()
Leo Yan <leo.yan@arm.com>
perf/core: Skip empty AUX records with only format flags
Ivy Lopez <skunkolee@gmail.com>
scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()
Eric Dumazet <edumazet@google.com>
bonding: alb: fix uninitialized transport header access in alb_determine_nd()
Guanghui Yang <3497809730@qq.com>
btrfs: restore active device pointers after failed sprout
Guanghui Yang <3497809730@qq.com>
btrfs: detach failed sprout device from transaction update list
wangdicheng <wangdicheng@kylinos.cn>
ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close()
wangdicheng <wangdicheng@kylinos.cn>
ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits
Hui Su <sh_def@163.com>
staging: fbtft: make dirty_lock IRQ-safe
Kuniyuki Iwashima <kuniyu@google.com>
af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header().
Eric Dumazet <edumazet@google.com>
ipv6: sr: restore network header before routing and forwarding
Tung Nguyen <tung.quang.nguyen@est.tech>
tipc: fix NULL deref in tipc_named_node_up() on empty publication list
Eric Dumazet <edumazet@google.com>
ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit
Eric Dumazet <edumazet@google.com>
ipv6: tunnels: use DEV_STATS_INC()
Qingfang Deng <qingfang.deng@linux.dev>
ppp: ppp_async: simplify tty disc_data access
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted
Linus Walleij <linusw@kernel.org>
ASoC: ab8500: Validate and program TDM slots correctly
Linus Walleij <linusw@kernel.org>
ASoC: ab8500: Correct digital interface format setup
Linus Walleij <linusw@kernel.org>
ASoC: ab8500: Repair the DAPM capture graph
Linus Walleij <linusw@kernel.org>
ASoC: ab8500: Reset the audio block before configuring it
Gongwei Li <ligongwei@kylinos.cn>
Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout()
Pauli Virtanen <pav@iki.fi>
Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM
Pauli Virtanen <pav@iki.fi>
Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: rate limit unmapped SID errors
Yilin Zhang <yilinzhang@moonshot.ai>
ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF
Colin Ian King <colin.i.king@gmail.com>
OPP: of: Fix potential multiplication overflow when calculating freq
Tzung-Bi Shih <tzungbi@kernel.org>
watchdog: msc313e: Fix NULL pointer dereference in PM callbacks
James Nugraha <aslan.jnn@gmail.com>
net: amd-xgbe: discard rx packets with bad FCS
Xuanqiang Luo <luoxuanqiang@kylinos.cn>
raw: annotate disconnect-side IPv4 match writers
Henry Martin <bsdhenrymartin@gmail.com>
sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
smb: client: transport: Fix debug printing in __release_mid()
Huiwen He <hehuiwen@kylinos.cn>
smb/client: mark file sparse before emulating insert range
Milan P. Gandhi <mgandhi@redhat.com>
scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()
Milan P. Gandhi <mgandhi@redhat.com>
scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add()
Xin Long <lucien.xin@gmail.com>
sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START
Victor Nogueira <victor@mojatatu.com>
net/sched: act_api: fix skb sizing and action leak on reoffload delete
Pedro Tammela <pctammela@mojatatu.com>
net/sched: act_api: conditional notification of events
Pedro Tammela <pctammela@mojatatu.com>
net/sched: act_api: don't open code max()
Pedro Tammela <pctammela@mojatatu.com>
rtnl: add helper to send if skb is not null
Victor Nogueira <victor@mojatatu.com>
net/sched: act_api: size the RTM_GETACTION reply from the actions
Victor Nogueira <victor@mojatatu.com>
net/sched: act_api: budget all shared attributes in notify skbs
Eric Dumazet <edumazet@google.com>
net: icmp: avoid invalid transport header access in icmp_send tracepoint
Hongfu Li <lihongfu@kylinos.cn>
selftests/cgroup: Fix cg_run_in_subcgroups ignoring arg parameter
Xixin Liu <liuxixin@kylinos.cn>
nvme-rdma: fix -EIO cleanup order in queue_rq
Dan Carpenter <error27@gmail.com>
drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()
Jad Keskes <inasj268@gmail.com>
EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation
Qiuxu Zhuo <qiuxu.zhuo@intel.com>
EDAC/igen6: Fix channel address decode for non-hash mode
Qiuxu Zhuo <qiuxu.zhuo@intel.com>
EDAC/igen6: Fix channel selection hash
Qiuxu Zhuo <qiuxu.zhuo@intel.com>
EDAC/igen6: Fix interleave boundary condition
Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
ARM: ensure interrupts are enabled in __do_user_fault()
Xie Yuanbin <xieyuanbin1@huawei.com>
ARM: 9484/1: enable interrupts when unhandled user faults are triggered
Sasha Levin <sashal@kernel.org>
Revert "Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU"
Sasha Levin <sashal@kernel.org>
Revert "Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU"
SJ Park <sj@kernel.org>
mm/damon/core: avoid infinite kdamond_merge_regions() internal loop
Kuniyuki Iwashima <kuniyu@google.com>
af_unix: Unlink scc_entry in unix_del_edge().
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: use memcmp() to compare ClientGUIDs
HyeongJun An <sammiee5311@gmail.com>
ASoC: meson: aiu: Validate written enum values
Kuniyuki Iwashima <kuniyu@google.com>
ipv4: fib: Don't dump dying fib_info in fib_leaf_notify().
Xin Long <lucien.xin@gmail.com>
sctp: fix err_chunk memory leaks in INIT handling
Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
bpf: Mask pseudo pointer values in verifier logs
Pauli Virtanen <pav@iki.fi>
Bluetooth: ISO: fix malformed ISO_END/CONT handling
Pauli Virtanen <pav@iki.fi>
Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds
Cen Zhang (Microsoft) <blbllhy@gmail.com>
tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD
Eric Dumazet <edumazet@google.com>
drop_monitor: fix size calculations for 64-bit attributes
Eric Dumazet <edumazet@google.com>
drop_monitor: perform u64_stats updates under IRQ-disabled section
Zhiling Zou <roxy520tt@gmail.com>
sctp: close UDP tunnel sockets during netns teardown
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: validate ACE size against SID sub-authorities
Vlatko Kosturjak <kost@linux.hr>
ppp_async: drop the errored frame instead of resetting its headroom
Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
wifi: mt76: mt7921: skip unknown CLC firmware records
Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
wifi: mt76: mt7921: validate CLC firmware records
Geert Uytterhoeven <geert+renesas@glider.be>
clk: at91: pmc: #undef field_{get,prep}() before definition
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
tracing/histograms: Simplify last_cmd_set()
Gil Portnoy <dddhkts1@gmail.com>
ksmbd: remove stale channels from all sessions on teardown
Genevieve Chan <genevieve.chan@altera.com>
firmware: stratix10-svc: fix FCS SMC call kernel-doc
Florian Westphal <fw@strlen.de>
netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state
Zizhi Wo <wozizhi@huawei.com>
scsi: core: Do not block on tag allocation in scsi_eh_lock_door()
Rudi Heitbaum <rudi@heitbaum.com>
ASoC: rt5645: Perform the initial jack detect at probe
Jisheng Zhang <jszhang@kernel.org>
spi: dw: fix wrong RX_SAMPLE_DLY setting after resume
Jia Jia <physicalmtea@gmail.com>
vhost-scsi: flush backend after device ioctls
Robert Abrahamse <denobyte2@gmail.com>
ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision)
Jiale Yao <yaojiale02@163.com>
Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame
Deepanshu Kartikey <kartikey406@gmail.com>
wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()
Li Qiang <liqiang01@kylinos.cn>
cifs: validate idmap key payload length
Vaibhav Jain <vaibhav@linux.ibm.com>
powerpc/pseries: Ensure vpa,slb_shadow & dtl are unregistered during crash
Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
ice: pass the return value of skb_checksum_help()
Madhavender Singh <madhav@disroot.org>
ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx
Markus Lindner <lindner.markus@outlook.at>
ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4
Minhong He <heminhong@kylinos.cn>
phonet: check register_netdevice_notifier() error in phonet_device_init()
Pengpeng Hou <pengpeng@iscas.ac.cn>
drm/gma500: return errors from Oaktrail HDMI I2C reads
Ibrahim Hashimov <security@auditcode.ai>
wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO
Kamal Wadhwa <kamal.wadhwa@oss.qualcomm.com>
regulator: core: clamp voltage constraints before applying apply_uV
Jay Vadayath <jay@artiphishell.com>
smb: client: bound dirent name against end of SMB response in cifs_filldir
Georgi Valkov <gvalkov@gmail.com>
wifi: mwifiex: replace one-element arrays with flexible array members
Emmanuel Grumbach <emmanuel.grumbach@intel.com>
wifi: iwlwifi: acpi: validate WGDS table revision index
Daniel C. Ribeiro <dcoutinho.96@gmail.com>
ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless
Emmanuel Grumbach <emmanuel.grumbach@intel.com>
wifi: iwlwifi: bound aligned TLV advance in FW parser
Timur Kristóf <timur.kristof@gmail.com>
drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized
Pu Hu <hupu@transsion.com>
arm64: kprobes: Allow reentering kprobes while single-stepping
Yu Peng <pengyu@kylinos.cn>
arm64: fixmap: Allow 256K early_ioremap() at any offset
Tao Cui <cuitao@kylinos.cn>
blk-cgroup: fix leaks and online flag on radix_tree_insert failure
Marcel Kłos <marcel@marmak.net.pl>
ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs
Emmanuel Grumbach <emmanuel.grumbach@intel.com>
wifi: iwlwifi: mvm: fix sched scan IE sizing
Emmanuel Grumbach <emmanuel.grumbach@intel.com>
wifi: iwlwifi: mvm: fix an off-by-1 boundary check
Filipe Manana <fdmanana@suse.com>
btrfs: fix reloc root cleanup in merge_reloc_roots()
Wang YuWei <1973615295@qq.com>
spi: dw-dma: Wait for controller idle before completing Tx
Filipe Manana <fdmanana@suse.com>
btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol()
Dave Chen <davechen@synology.com>
btrfs: only account delalloc bytes for regular file inodes in btrfs_getattr()
Chen Bowen <hicbowen@gmail.com>
ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series
Pengpeng Hou <pengpeng@iscas.ac.cn>
wifi: rsi: validate beacon length before fixed buffer copy
Jozsef Kadlecsik <kadlec@netfilter.org>
netfilter: ipset: mark the rcu locked areas properly
Pengpeng Hou <pengpeng@iscas.ac.cn>
wifi: libipw: fix key index receive bound checks
Liang Hao <haohlliang@gmail.com>
gpio: dwapb: Mask interrupts at hardware initialization
Zhao Li <enderaoelyther@gmail.com>
wifi: cfg80211: validate rx/tx MLME callback frame lengths before access
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: validate SID namespace before mapping IDs
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: mark invalid session responses as signed
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: find bound sessions during reauthentication
Zhao Li <enderaoelyther@gmail.com>
wifi: cfg80211: validate assoc response length before status and IE access
Pengpeng Hou <pengpeng@iscas.ac.cn>
wifi: libertas: reject short monitor TX frames
Pengpeng Hou <pengpeng@iscas.ac.cn>
wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers
Zhao Li <enderaoelyther@gmail.com>
wifi: mac80211: validate deauth frame length before reason access
Corentin Labbe <clabbe@baylibre.com>
wifi: ralink: RT2X00: init EEPROM properly
Pengpeng Hou <pengpeng@iscas.ac.cn>
ALSA: usb-audio: caiaq: validate EP1 reply lengths
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: fix credit charge calculation for SMB2 QUERY_INFO
Jetha Chan <jethachan@gmail.com>
ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table
David Howells <dhowells@redhat.com>
cachefiles: Fix double fput
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: fix outstanding credit leak on abort and error paths
Yousef Alhouseen <alhouseenyousef@gmail.com>
xen/gntalloc: validate grant count before allocation
Farhad Alemi <farhad.alemi@berkeley.edu>
freevxfs: don't BUG() on unknown typed-extent type
Yousef Alhouseen <alhouseenyousef@gmail.com>
xen/front-pgdir-shbuf: free grant reference head on errors
Qiang Liu <liuqiang@kylinos.cn>
ksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling
Qiang Liu <liuqiang@kylinos.cn>
ksmbd: fix n.data memory leak in ksmbd_vfs_set_dos_attrib_xattr
Gustavo Kenji Mendonça Kaneko <kaneko.dev@pm.me>
drm/arm/komeda: fix error handling for clk_prepare_enable() and callers
Qiang Liu <liuqiang@kylinos.cn>
ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr
Florian Westphal <fw@strlen.de>
netfilter: nf_conntrack_expect: zero at allocation time
Gustavo Kenji Mendonça Kaneko <kaneko.dev@pm.me>
drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend
Weiming Shi <bestswngs@gmail.com>
btrfs: tree-checker: validate INODE_REF's namelen
Praveen Talari <praveen.talari@oss.qualcomm.com>
spi: core: Abort active target transfer on controller suspend
Haoxiang Li <haoxiang_li2024@163.com>
fbdev: pm2fb: unwind WC setup on probe failure
Arnd Bergmann <arnd@arndb.de>
eth: mlx5: fix macsec dependency
Adriana Stancu <adriana@arista.com>
rtc: bq32000: add delay between RTC reads
Yu Kuai <yukuai@fygo.io>
blk-cgroup: protect iterating blkgs with blkcg->lock in blkcg_print_stat()
Runyu Xiao <runyu.xiao@seu.edu.cn>
net: au1000: move free_irq out of the close-time spinlocked section
Pengpeng Hou <pengpeng@iscas.ac.cn>
regulator: da9121: Use subvariant ids in the I2C table
Krzysztof Wilczyński <kwilczynski@kernel.org>
PCI/sysfs: Use kstrtobool() to parse the ROM attribute input
Krzysztof Wilczyński <kwilczynski@kernel.org>
PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device()
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: break RH leases before delete-on-close
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: start file id allocation at 1
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: apply create security descriptor first
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: treat unnamed DATA stream as base file
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: use connection ClientGUID for lease lookup
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: align SMB2 oplock break ack handling
Tommy Huang <tommy_huang@aspeedtech.com>
rtc: aspeed: add AST2700 compatible
Samuel Moelius <sam.moelius@trailofbits.com>
f2fs: validate inline dentry name lengths before conversion
Chen Cheng <chencheng@fnnas.com>
md/raid5: let stripe batch bm_seq comparison wrap-safe
Yu Kuai <yukuai@fygo.io>
md/raid5: account discard IO
Hans Zhang <18255117159@163.com>
PCI: mediatek: Protect root bus removal with rescan lock
Hans Zhang <18255117159@163.com>
PCI: rockchip: Protect root bus removal with rescan lock
Hans Zhang <18255117159@163.com>
PCI: altera: Protect root bus removal with rescan lock
Hans Zhang <18255117159@163.com>
PCI: iproc: Protect root bus removal with rescan lock
Jean-Louis Colaco <jean-louis.colaco@orange.fr>
ALSA: usb-audio: Add quirk for YAMAHA CDS3000
Matthew Bystrin <dev.mbstr@gmail.com>
mfd: rsmu: Add 8a34002 support
Tobias Deiminger <tobias.deiminger@linutronix.de>
leds: pca9532: Don't stop blinking for non-zero brightness
Yousef Alhouseen <alhouseenyousef@gmail.com>
leds: uleds: Return -EFAULT on copy_to_user() failure
Galen Hassen <rwekyes@gmail.com>
ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10
Jakub Kicinski <kuba@kernel.org>
tls: reject the combination of TLS and sockmap
Ai Chao <aichao@kylinos.cn>
ALSA: usb-audio: Add quirk flags for SC13A
guoqi0226 <guoqi0226@163.com>
spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data()
Rob Herring (Arm) <robh@kernel.org>
gpio: pisosr: Read "ngpios" as u32
Arnd Bergmann <arnd@arndb.de>
scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block()
Zhang Tianci <zhangtianci.1997@bytedance.com>
fuse: set ff->flock only on success
Jiri Kosina <jkosina@suse.com>
HID: hidpp: fix potential UAF in hidpp_connect_event()
Viktor Menshin <ripeeerr@gmail.com>
ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT
Rosen Penev <rosenp@gmail.com>
sparc: Disable compat support with LLD
Adrian Hunter <adrian.hunter@intel.com>
i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA
Alice Mikityanska <alice@isovalent.com>
net/sched: act_csum: don't mangle UDP tunnel GSO packets
Agalakov Daniil <ade@amicon.ru>
e1000e: limit endianness conversion to boundary words
Raf Dickson <rafdog35@gmail.com>
vsock: use sk_acceptq_is_full() helper in all transports
Vadim Fedorenko <vadim.fedorenko@linux.dev>
ptp: ocp: add shutdown callback
Nazim Amirul <muhammad.nazim.amirul.nazle.asmade@altera.com>
net: stmmac: xgmac2: disable RBUE in default RX interrupt mask
Rosen Penev <rosenp@gmail.com>
sparc64: uprobes: add missing break
bui duc phuc <phucduc.bui@gmail.com>
ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure
bui duc phuc <phucduc.bui@gmail.com>
ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence
bui duc phuc <phucduc.bui@gmail.com>
ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt
Samuel Moelius <sam.moelius@trailofbits.com>
Bluetooth: L2CAP: validate connectionless PSM length
Cris <cxs1494089474@gmail.com>
Bluetooth: btusb: Add support for TP-Link TL-UB250
Hrvoje Nuic <hrvoje.nuic@gmail.com>
Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV
Vadim Fedorenko <vadim.fedorenko@linux.dev>
spi: xilinx: let transfers timeout in case of no IRQ
Potin Lai <potin.lai.pt@gmail.com>
hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i
Tze Yee Ng <tze.yee.ng@altera.com>
dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc
Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems
Yuho Choi <dbgh9129@gmail.com>
sctp: Unwind address notifier registration on failure
Nikolay Metchev <nikolaymetchev@gmail.com>
platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table
Xu Rao <raoxu@uniontech.com>
ata: libata-pmp: add JMicron JMS562 quirk
Furst Blumier <seal@furst.blue>
ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC
Evgenii Burenchev <evg28bur@yandex.ru>
vdpa/ifcvf: handle dev_set_name() failure in ifcvf_vdpa_dev_add()
Kory Maincent <kory.maincent@bootlin.com>
hwmon: (adt7462) Add of_match_table to support devicetree
KangNing Liao <lkangn.kernel@gmail.com>
btrfs: protect sb_write_pointer() with invalidate lock
Jiajia Liu <liujiajia@kylinos.cn>
wifi: mt76: transform aspm_conf for pci_disable_link_state
Gleb Sonichev <sonichev555@gmail.com>
platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table
Rosen Penev <rosenp@gmail.com>
net: ibm: emac: mal: fix potential system hang in mal_remove()
Al Viro <viro@zeniv.linux.org.uk>
configfs_depend_prep(): pass configfs_dirent instead of dentry
Chuck Lever <chuck.lever@oracle.com>
xprtrdma: Add request-pool slack for delayed recycling
Aurelien DESBRIERES <aurelien@hackers.camp>
RDMA/rtrs-srv: Fix integer underflow in process_read and process_write
Dai Ngo <dai.ngo@oracle.com>
NFS: fix eof updates after NFSv4.2 fallocate/zero-range
Zhang Cen <rollkingzzc@gmail.com>
btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF
ZhengYuan Huang <gality369@gmail.com>
btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk()
Rosen Penev <rosenp@gmail.com>
netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()
Ruoyu Wang <ruoyuw560@gmail.com>
ALSA: es18xx: check control allocation before private data setup
Maoyi Xie <maoyixie.tju@gmail.com>
hsr: broadcast netlink notifications in the device's net namespace
Guangshuo Li <lgs201920130244@gmail.com>
net: cpsw_new: unregister devlink on port registration failure
Dawei Feng <dawei.feng@seu.edu.cn>
bpf: NUL-terminate replaced sysctl value
Li RongQing <lirongqing@baidu.com>
RDMA/mlx5: Fix state and counter desync on loopback enable failure
Jason Gunthorpe <jgg@ziepe.ca>
RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz()
Thiyagarajan Pandiyan <thiyagarajan@aerlync.com>
wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications
Rosen Penev <rosenp@gmail.com>
ipmi: si: Use platform_get_irq_optional() to retrieve interrupt
Andrei Faleichyk <andrei.faleichyk@noogadev.com>
ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP
Michael Walle <mwalle@kernel.org>
clk: keystone: don't cache clock rate
Cyrill Gorcunov <gorcunov@gmail.com>
RDMA/irdma: Fix typo in SQ completions generation
Asad Kamal <asad.kamal@amd.com>
drm/amd/pm: bound pp_dpm_set_pp_table() memcpy
Mathias Nyman <mathias.nyman@linux.intel.com>
xhci: Prevent queuing new commands if xhci is inaccessible
Ioana Ciornei <ioana.ciornei@nxp.com>
dpaa2-switch: fix handling of NAPI on the remove path
David Yang <mmyangfl@gmail.com>
net: dsa: sja1105: flower: reject cross-chip redirect
Ioana Ciornei <ioana.ciornei@nxp.com>
dpaa2-switch: fix the error path in dpaa2_switch_rx()
Ioana Ciornei <ioana.ciornei@nxp.com>
dpaa2-switch: rework FDB management on the bridge leave path
Cássio Gabriel <cassiogabrielcontato@gmail.com>
ALSA: seq: oss: Reject reads that cannot fit the next event
Cássio Gabriel <cassiogabrielcontato@gmail.com>
ASoC: codecs: rk3328: Use managed GPIO and clock helpers
Alessandro Schino <7991aleschino@gmail.com>
ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e()
ZhengYuan Huang <gality369@gmail.com>
fs/ntfs3: validate index entry key bounds
ZhengYuan Huang <gality369@gmail.com>
fs/ntfs3: preserve non-DOS attribute bits in system.dos_attrib
Simon Xue <xxm@rock-chips.com>
iommu/rockchip: disable fetch dte time limit
Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
net: wwan: t7xx: Add delay between MD and SAP suspend
Wentao Liang <vulab@iscas.ac.cn>
net: qrtr: fix node refcount leak on ctrl packet alloc failure
Chen Pei <cp0613@linux.alibaba.com>
ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach
liyouhong <liyouhong@kylinos.cn>
ata: ahci: fail probe if BAR too small for claimed ports
Cezary Rojewski <cezary.rojewski@intel.com>
ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive
Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
ASoC: qcom: q6apm: return error code to consumers on failures
Miaoqing Pan <miaoqing.pan@oss.qualcomm.com>
wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi
Rosen Penev <rosenp@gmail.com>
net: ibm: emac: Reserve VLAN header in MJS limit
Daniel Borkmann <daniel@iogearbox.net>
libbpf: Also reset {insn,data}_cur on realloc failure
Sanjay Chitroda <sanjayembeddedse@gmail.com>
iio: accel: mma8452: switch to non-devm request_threaded_irq()
Rik van Riel <riel@surriel.com>
perf/ftrace: Fix WARNING in __unregister_ftrace_function
Miao Li <limiao@kylinos.cn>
iio: light: stk3310: Deal with the ps interrupt issue in PM
Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC
Karl Mehltretter <kmehltretter@gmail.com>
tracing: Disable KCOV instrumentation for trace_irqsoff.o
Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC
Osama Abdelkader <osama.abdelkader@gmail.com>
mmc: davinci: fix mmc_add_host order in probe
Bard Liao <yung-chuan.liao@linux.intel.com>
soundwire: only handle alert events when the peripheral is attached
Charles Keepax <ckeepax@opensource.cirrus.com>
soundwire: dmi-quirks: Disable ghost Realtek devices
Tiezhu Yang <yangtiezhu@loongson.cn>
libbpf: Add __NR_bpf definition for LoongArch
Cezary Rojewski <cezary.rojewski@intel.com>
ASoC: Intel: catpt: Complete coredump handling
Alexandre Courbot <acourbot@nvidia.com>
scripts: modpost: detect and report truncated buf_printf() output
shayderrr <darknessshayder@gmail.com>
host1x: bus: Fix missing ops null check in error teardown
Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
pinctrl: renesas: rzv2m: Use -ENOTSUPP instead of -EOPNOTSUPP
Viacheslav Dubeyko <slava@dubeyko.com>
hfs: rework hfsplus_readdir() logic
ikaros <void0red@gmail.com>
ACPICA: add boundary checks in two places
ikaros <void0red@gmail.com>
ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources()
Weiming Shi <bestswngs@gmail.com>
ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package()
ikaros <void0red@gmail.com>
ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op()
ikaros <void0red@gmail.com>
ACPICA: Add validation for node in acpi_ns_build_normalized_path()
ikaros <void0red@gmail.com>
ACPICA: Add package limit checks in parser functions
ikaros <void0red@gmail.com>
ACPICA: validate handler object type in two places
ikaros <void0red@gmail.com>
ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg()
ikaros <void0red@gmail.com>
ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op)
ikaros <void0red@gmail.com>
ACPICA: Prevent adding invalid references
ikaros <void0red@gmail.com>
ACPICA: validate byte_count in acpi_ps_get_next_package_length()
ikaros <void0red@gmail.com>
ACPICA: add boundary checks in acpi_ps_get_next_field()
ikaros <void0red@gmail.com>
ACPICA: Fix use-after-free in acpi_ds_terminate_control_method()
ikaros <void0red@gmail.com>
ACPICA: Fix condition check in acpi_ps_parse_loop()
Jeremy Klarenbeek <jeremy.klarenbeek99@gmail.com>
drm/amd/pm/si: Fix updating clock limits from power states
Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
net: thunderx: fix PTP device ref leak in nicvf_probe()
Fernando Fernandez Mancera <fmancera@suse.de>
ipv6: addrconf: fix temp address generation after prefix deprecation
Luka Gejak <luka.gejak@linux.dev>
net: hsr: require valid EOT supervision TLV
Uwe Küchler <uwe@kuechler.org>
ALSA: usb-audio: Add quirk for Novation Mininova
Mostafa Saleh <smostafa@google.com>
irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed
Stepan Ionichev <sozdayvek@gmail.com>
iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind
Rosen Penev <rosenp@gmail.com>
mips: cps: Assemble jr.hb with an R2 ISA level
Dario Binacchi <dario.binacchi@amarulasolutions.com>
drm/panel: simple: Add AM-1280800W8TZQW-T00H
Daniel Lezcano <daniel.lezcano@oss.qualcomm.com>
thermal/drivers/tegra/soctherma: Switch to devm cooling device registration
Adrian Ng Ho Yin <adrian.ho.yin.ng@altera.com>
clk: socfpga: agilex: implement l3_main_free_clk
Heiko Carstens <hca@linux.ibm.com>
s390/zcore: Removed unused variables
Jiayuan Chen <jiayuan.chen@linux.dev>
rds: annotate data-race around rs_seen_congestion
Maoyi Xie <maoyixie.tju@gmail.com>
rds: filter RDS_INFO_* getsockopt by caller's netns
Chenguang Zhao <zhaochenguang@kylinos.cn>
netlabel: fix IPv6 unlabeled address add error handling
Dian-Syuan Yang <dian_syuan0116@realtek.com>
wifi: rtw89: pci: enable LTR based on pcie control register
Venkat Rao Bagalkote <venkat88@linux.ibm.com>
char/nvram: Remove redundant nvram_mutex
Christian Marangi <ansuelsmth@gmail.com>
usb: host: add ARCH_AIROHA in XHCI MTK dependency
Marco Felsch <m.felsch@pengutronix.de>
serial: 8250: fix possible ISR soft lockup
Maoyi Xie <maoyixie.tju@gmail.com>
usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue
Dave Carey <carvsdriver@gmail.com>
USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set
Stepan Ionichev <sozdayvek@gmail.com>
usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log
Oliver Neukum <oneukum@suse.com>
usb: core: hcd: fix possible deadlock in rh control transfers
Adrian Wowk <dev@adrianwowk.com>
usbip: vhci_hcd: fix NULL deref in status_show_vhci
Nikhil Chatterjee <nikhilc1527@gmail.com>
HID: bpf: Add Huion Inspiroy Frego M button quirk
Christoph Hellwig <hch@lst.de>
isofs: handle set_blocksize failures
Christoph Hellwig <hch@lst.de>
omfs: handle set_blocksize failures
Christoph Hellwig <hch@lst.de>
hpfs: handle set_blocksize failures
Christoph Hellwig <hch@lst.de>
jfs: handle set_blocksize failures
Christoph Hellwig <hch@lst.de>
qnx4: handle set_blocksize failures
Christoph Hellwig <hch@lst.de>
minix: handle set_blocksize failures
Christoph Hellwig <hch@lst.de>
bfs: handle set_blocksize failures
Christoph Hellwig <hch@lst.de>
affs: handle set_blocksize failures
Christoph Hellwig <hch@lst.de>
befs: handle set_blocksize failures
Allison Henderson <achender@kernel.org>
net/rds: Don't sleep inside rds_ib_conn_path_shutdown
Eric Dumazet <edumazet@google.com>
net/sched: sch_drr: make cl->quantum lockless
Eric Dumazet <edumazet@google.com>
net: bridge: remove stale rcu_barrier() in br_multicast_dev_del()
Jan Volckaert <janvolck@gmail.com>
net: usb: qmi_wwan: add MeiG SRM813Q
Maurizio Lombardi <mlombard@redhat.com>
nvme-core: align fabrics_q teardown with admin_q in nvme_free_ctrl
Yury Norov <ynorov@nvidia.com>
bitfield: wire __bf_shf to __builtin_ctzll
Miri Korenblit <miriam.rachel.korenblit@intel.com>
wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed
Sudeep Holla <sudeep.holla@kernel.org>
firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size
Sudeep Holla <sudeep.holla@kernel.org>
firmware: arm_scmi: Validate SENSOR_UPDATE payload size
Pierre Barre <pierre@barre.sh>
9p: use kvzalloc for readdir buffer
Leonardo Bras <leo.bras@arm.com>
arm64/daifflags: Make local_daif_*() helpers __always_inline
Pierre Barre <pierre@barre.sh>
9p: invalidate readdir buffer on seek
Cássio Gabriel <cassiogabrielcontato@gmail.com>
ALSA: usx2y: Drain pending US-428 pipe-4 output commands
David Francis <David.Francis@amd.com>
drm/amdkfd: Check bounds on allocate_doorbell
David Francis <David.Francis@amd.com>
drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id
Bjorn Helgaas <helgaas@kernel.org>
PCI: Wait for device readiness after D3hot -> D0uninitialized transition
Joonwon Kang <joonwonkang@google.com>
mailbox: Make mbox_send_message() return error code when tx fails
Chenguang Zhao <zhaochenguang@kylinos.cn>
RDMA/mlx5: Use QP port when decoding responder CQEs
Alessandro Baldi <baldovic@virgilio.it>
media: imon: Add iMON VFD HID OEM v1.2 key mappings
Thorsten Blum <thorsten.blum@linux.dev>
crypto: atmel-ecc - add support for atecc608b
Lukas Wunner <lukas@wunner.de>
crypto: ecc - Unbreak the build on arm with CONFIG_KASAN_STACK=y
Kumar Meiyappan <kumar.meiyappan@microchip.com>
scsi: pm8001: Reject non-fatal dump when controller is crashed
Kumar Meiyappan <kumar.meiyappan@microchip.com>
scsi: pm8001: Reject firmware update in fatal error state
Alexey Klimov <alexey.klimov@linaro.org>
clk: samsung: exynos850: mark APM I3C clocks as critical
Stefan Berger <stefanb@linux.ibm.com>
integrity: Check for NULL returned by asymmetric_key_public_key
Mieczyslaw Nalewaj <namiltd@yahoo.com>
net: dsa: realtek: rtl8365mb: add support for RTL8367SB
Arash Golgol <arash.golgol@gmail.com>
media: video-i2c: use vb2_video_unregister_device on driver removal
Sophie D <patches@scd31.com>
drm/gud: Add RCade Display Adapter VID/PID pair
Viacheslav Dubeyko <slava@dubeyko.com>
hfsplus: rework hfsplus_readdir() logic
Florian Eckert <fe@dev.tdt.de>
PCI: intel-gw: Enable clock before PHY init
Tom Chung <chiahsuan.chung@amd.com>
drm/amd/display: Fix CRC open failure during active rendering
Stepan Ionichev <sozdayvek@gmail.com>
mmc: davinci: avoid NULL deref of host->data in IRQ handler
Shawn Lin <shawn.lin@rock-chips.com>
mmc: core: Add validation for host-provided max_segs
Ethan Nelson-Moore <enelsonmoore@gmail.com>
ASoC: ti: omap3pandora: update board check to use DT compatible
Parth Pancholi <parth.pancholi@toradex.com>
drm/bridge: tc358768: Set pre_enable_prev_first for reverse order
Geert Uytterhoeven <geert+renesas@glider.be>
clk: renesas: cpg-mssr: Add number of clock cells check
Ruoyu Wang <ruoyuw560@gmail.com>
crypto: ixp4xx - fix buffer chain unwind on allocation failure
Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
media: em28xx-video: fix missing res_free() on init_usb_xfer failure
Marek Behún <kabel@kernel.org>
net: dsa: mv88e6xxx: enable .rmu_disable() for 6320 family
Marek Behún <kabel@kernel.org>
net: dsa: mv88e6xxx: define .pot_clear() for 6321
Ben Reed <Ben.Reed@microchip.com>
PCI: switchtec: Add Gen6 Device IDs
Marek Behún <kabel@kernel.org>
net: dsa: mv88e6xxx: fix number of g1 interrupts for 6320 family
Zhaoyang Yu <2426767509@qq.com>
media: dm1105: fix missing error check for dma_alloc_coherent
Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
thunderbolt: Don't create multiple DMA tunnels on firmware connection manager
Mika Westerberg <mika.westerberg@linux.intel.com>
thunderbolt: Set tb->root_switch to NULL when domain is stopped
Mika Westerberg <mika.westerberg@linux.intel.com>
thunderbolt: Keep the domain reference while processing hotplug
Mika Westerberg <mika.westerberg@linux.intel.com>
thunderbolt: Keep XDomain reference during the lifetime of a service
Mika Westerberg <mika.westerberg@linux.intel.com>
thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response()
Vineeth Vijayan <vneethv@linux.ibm.com>
s390/cio: Purge based on the cdev's online status
Riccardo Boninsegna <rboninsegna2@gmail.com>
media: rc: mceusb: Add support for 04eb:e033
Pengpeng Hou <pengpeng@iscas.ac.cn>
soundwire: validate DT compatible before parsing it
Danielle Ratson <danieller@nvidia.com>
bridge: Do not suppress ARP probes and DAD NS unconditionally
Siew Chin Lim <elly.siew.chin.lim@intel.com>
firmware: stratix10-svc: change get provision data to async SMC call
Marco Elver <elver@google.com>
kcsan: Silence -Wmaybe-uninitialized when calling __kcsan_check_access()
Panagiotis Petrakopoulos <npetrakopoulos2003@gmail.com>
wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result()
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: always allow transmitting null-data on TXQs
Johannes Berg <johannes.berg@intel.com>
wifi: nl80211: reject beacons with bad HE operation
Viacheslav Dubeyko <slava@dubeyko.com>
hfsplus: fix issue of direct writes beyond end-of-file
Lukas Wunner <lukas@wunner.de>
PCI: Stop setting cached power state to 'unknown' on unbind
Hirokazu Honda <hiroh@chromium.org>
tee: optee: Allow MT_NORMAL_TAGGED shared memory
Xu Yang <xu.yang_2@nxp.com>
usb: gadget: udc: skip pullup() if already connected
Goldwyn Rodrigues <rgoldwyn@suse.de>
ima: return error early if file xattr cannot be changed
Cássio Gabriel <cassiogabrielcontato@gmail.com>
ALSA: usb-audio: Propagate write errors in generic mixer put callbacks
Ioana Ciornei <ioana.ciornei@nxp.com>
bus: fsl-mc: wait for the MC firmware to complete its boot
Boris Brezillon <boris.brezillon@collabora.com>
drm/gem: Consider GEM object reclaimable if shrinking fails
-------------
Diffstat:
.../ABI/testing/sysfs-devices-platform-trackpoint | 2 +-
Documentation/networking/ip-sysctl.rst | 2 +
Documentation/s390/pci.rst | 144 +-
Documentation/s390/vfio-ccw.rst | 2 +-
Makefile | 4 +-
arch/alpha/include/uapi/asm/fpu.h | 8 +-
arch/alpha/kernel/traps.c | 6 +-
arch/alpha/math-emu/math.c | 88 +-
arch/arm/mach-socfpga/Kconfig | 2 +-
arch/arm/mach-ux500/cpu-db8500.c | 6 +-
arch/arm/mm/cache-feroceon-l2.c | 2 +-
arch/arm/mm/cache-tauros2.c | 2 +-
arch/arm/mm/fault.c | 12 +-
arch/arm64/boot/dts/qcom/sdm845.dtsi | 64 +-
arch/arm64/boot/dts/qcom/sm8150.dtsi | 8 +-
arch/arm64/boot/dts/qcom/sm8250.dtsi | 12 +-
arch/arm64/boot/dts/qcom/sm8350.dtsi | 8 +-
arch/arm64/boot/dts/qcom/sm8450.dtsi | 8 +-
arch/arm64/boot/dts/qcom/sm8550.dtsi | 8 +-
arch/arm64/boot/dts/renesas/r8a779f0.dtsi | 1 +
arch/arm64/include/asm/daifflags.h | 10 +-
arch/arm64/include/asm/fixmap.h | 6 +-
arch/arm64/include/asm/kprobes.h | 6 +
arch/arm64/include/asm/percpu.h | 16 +-
arch/arm64/kernel/hibernate-asm.S | 2 +
arch/arm64/kernel/probes/kprobes.c | 23 +-
arch/mips/cavium-octeon/octeon-platform.c | 4 +-
arch/mips/kernel/cps-vec.S | 6 +
arch/mips/net/bpf_jit_comp32.c | 2 +-
arch/mips/net/bpf_jit_comp64.c | 3 +-
arch/powerpc/kernel/eeh_driver.c | 2 -
arch/powerpc/kernel/iommu.c | 2 +-
arch/powerpc/kernel/smp.c | 1 +
arch/powerpc/kexec/file_load_64.c | 2 +-
arch/powerpc/kvm/book3s_hv.c | 4 +-
arch/powerpc/kvm/book3s_hv_nested.c | 2 +
arch/powerpc/kvm/book3s_hv_uvmem.c | 5 +-
arch/powerpc/platforms/pseries/kexec.c | 13 +-
arch/riscv/kvm/vcpu_timer.c | 5 +-
arch/s390/crypto/aes_s390.c | 16 +-
arch/s390/include/asm/debug.h | 8 +-
arch/s390/kernel/debug.c | 15 +-
arch/s390/kvm/interrupt.c | 72 +-
arch/sh/drivers/push-switch.c | 2 +-
arch/sparc/Kconfig | 1 +
arch/sparc/kernel/uprobes.c | 1 +
arch/x86/events/intel/core.c | 55 +-
arch/x86/pci/fixup.c | 99 ++
block/blk-cgroup.c | 13 +-
block/blk-mq.c | 8 +-
crypto/Makefile | 5 +
drivers/acpi/acpica/dsmethod.c | 43 +
drivers/acpi/acpica/evhandler.c | 11 +
drivers/acpi/acpica/exconfig.c | 26 +-
drivers/acpi/acpica/exoparg3.c | 2 +-
drivers/acpi/acpica/nsnames.c | 6 +
drivers/acpi/acpica/nsprepkg.c | 7 +
drivers/acpi/acpica/nsxfname.c | 4 +
drivers/acpi/acpica/psargs.c | 134 +-
drivers/acpi/acpica/psloop.c | 30 +-
drivers/acpi/acpica/psparse.c | 14 +
drivers/acpi/acpica/utcopy.c | 10 +-
drivers/acpi/acpica/utresrc.c | 30 +
drivers/acpi/pci_root.c | 4 +
drivers/ata/ahci.c | 22 +
drivers/ata/libahci.c | 15 +-
drivers/ata/libata-pmp.c | 7 +-
drivers/base/core.c | 119 +-
drivers/block/sunvdc.c | 26 +-
drivers/bluetooth/btmtksdio.c | 4 +-
drivers/bluetooth/btusb.c | 41 +-
drivers/bluetooth/hci_mrvl.c | 3 +-
drivers/bus/fsl-mc/fsl-mc-bus.c | 46 +
drivers/char/ipmi/ipmi_si_platform.c | 5 +-
drivers/char/nvram.c | 16 +-
drivers/char/virtio_console.c | 22 +-
drivers/clk/at91/pmc.h | 2 +
drivers/clk/clk-scpi.c | 2 +-
drivers/clk/keystone/sci-clk.c | 8 +
drivers/clk/renesas/renesas-cpg-mssr.c | 3 +
drivers/clk/samsung/clk-exynos850.c | 5 +-
drivers/clk/socfpga/clk-agilex.c | 2 +
drivers/clk/ux500/clk-prcmu.c | 20 +-
drivers/clk/ux500/u8500_of_clk.c | 2 +-
drivers/clocksource/timer-orion.c | 2 +-
drivers/cpufreq/cpufreq.c | 6 +-
drivers/cpuidle/cpuidle-ux500.c | 6 +-
drivers/crypto/allwinner/Kconfig | 16 -
drivers/crypto/allwinner/sun8i-ce/Makefile | 1 -
drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c | 55 -
drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c | 160 --
drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h | 29 -
drivers/crypto/allwinner/sun8i-ss/Makefile | 1 -
drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 39 -
drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c | 170 --
drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h | 23 -
drivers/crypto/atmel-ecc.c | 3 +
drivers/crypto/ixp4xx_crypto.c | 25 +-
drivers/dma/dmaengine.c | 10 +-
drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 11 +-
drivers/dma/mmp_pdma.c | 2 +-
drivers/dma/sprd-dma.c | 3 +-
drivers/dma/sun6i-dma.c | 9 +-
drivers/dma/ti/k3-udma-glue.c | 5 +-
drivers/dma/xilinx/xilinx_dma.c | 26 +-
drivers/edac/edac_device_sysfs.c | 11 +-
drivers/edac/igen6_edac.c | 27 +-
drivers/firmware/arm_scmi/base.c | 15 +-
drivers/firmware/arm_scmi/sensors.c | 10 +-
drivers/firmware/arm_scpi.c | 4 +-
drivers/firmware/stratix10-svc.c | 4 +-
drivers/gpio/gpio-arizona.c | 8 +-
drivers/gpio/gpio-dwapb.c | 17 +
drivers/gpio/gpio-pisosr.c | 4 +-
drivers/gpio/gpio-zynq.c | 10 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 4 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 1 +
drivers/gpu/drm/amd/amdgpu/atom.c | 9 +-
.../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 9 +
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 +
.../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c | 7 +-
.../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 20 +-
drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 31 +-
drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c | 3 +
drivers/gpu/drm/arm/display/komeda/komeda_dev.c | 6 +-
drivers/gpu/drm/arm/display/komeda/komeda_drv.c | 14 +-
drivers/gpu/drm/arm/malidp_drv.c | 22 +-
drivers/gpu/drm/ast/ast_drv.h | 52 +-
drivers/gpu/drm/bridge/tc358768.c | 2 +
drivers/gpu/drm/drm_atomic_helper.c | 20 +-
drivers/gpu/drm/drm_atomic_uapi.c | 13 +-
drivers/gpu/drm/drm_gem.c | 10 +
drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c | 21 +-
drivers/gpu/drm/gud/gud_drv.c | 1 +
drivers/gpu/drm/gud/gud_pipe.c | 4 +-
drivers/gpu/drm/i915/gem/i915_gem_object.c | 2 +-
drivers/gpu/drm/i915/i915_query.c | 4 +-
drivers/gpu/drm/logicvc/Kconfig | 1 -
drivers/gpu/drm/msm/adreno/adreno_gpu.c | 2 +
drivers/gpu/drm/msm/dp/dp_display.c | 14 +-
drivers/gpu/drm/msm/dsi/dsi.h | 1 +
drivers/gpu/drm/msm/dsi/dsi_host.c | 38 +-
drivers/gpu/drm/msm/dsi/phy/dsi_phy.c | 4 +
drivers/gpu/drm/msm/hdmi/hdmi_phy.c | 8 +-
drivers/gpu/drm/nouveau/nouveau_bo.c | 3 +-
drivers/gpu/drm/nouveau/nouveau_drm.c | 5 +-
drivers/gpu/drm/nouveau/nouveau_gem.c | 2 +
drivers/gpu/drm/nouveau/nvif/vmm.c | 1 +
drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c | 23 +-
drivers/gpu/drm/nouveau/nvkm/subdev/fb/ramnv1a.c | 2 +
drivers/gpu/drm/panel/panel-simple.c | 28 +
drivers/gpu/drm/virtio/virtgpu_display.c | 2 +-
drivers/gpu/drm/virtio/virtgpu_gem.c | 2 +-
drivers/gpu/drm/virtio/virtgpu_ioctl.c | 6 +-
drivers/gpu/drm/virtio/virtgpu_vram.c | 17 +-
drivers/gpu/host1x/bus.c | 4 +-
drivers/hid/amd-sfh-hid/amd_sfh_common.h | 4 +
drivers/hid/amd-sfh-hid/amd_sfh_pcie.c | 10 +
.../hid/bpf/progs/Huion__Inspiroy-Frego-M.bpf.c | 87 +
drivers/hid/hid-alps.c | 6 +-
drivers/hid/hid-hyperv.c | 58 +-
drivers/hid/hid-ids.h | 3 +
drivers/hid/hid-logitech-hidpp.c | 11 +-
drivers/hid/hid-quirks.c | 3 +-
drivers/hid/wacom_sys.c | 5 +-
drivers/hwmon/adt7462.c | 8 +
drivers/hwmon/applesmc.c | 7 +-
drivers/hwmon/aspeed-pwm-tacho.c | 4 +-
drivers/hwmon/gpio-fan.c | 13 +-
drivers/hwmon/pmbus/lm25066.c | 60 +-
drivers/hwmon/pmbus/pmbus.h | 3 +-
drivers/hwmon/pmbus/pmbus_core.c | 4 +-
drivers/hwmon/pmbus/tps53679.c | 11 +-
drivers/hwmon/w83791d.c | 1 +
drivers/hwmon/w83793.c | 4 +-
drivers/i2c/busses/i2c-at91-core.c | 3 +
drivers/i2c/busses/i2c-at91-master.c | 12 +-
drivers/i2c/busses/i2c-at91.h | 1 +
drivers/i2c/busses/i2c-imx.c | 2 +
drivers/i2c/i2c-core-smbus.c | 12 +
drivers/i3c/master/mipi-i3c-hci/cmd_v1.c | 4 +-
drivers/i3c/master/mipi-i3c-hci/cmd_v2.c | 4 +-
drivers/iio/accel/mma8452.c | 19 +-
drivers/iio/adc/qcom-spmi-iadc.c | 18 +-
drivers/iio/light/stk3310.c | 76 +-
drivers/infiniband/core/iwpm_util.c | 9 +-
drivers/infiniband/core/mad.c | 3 +-
drivers/infiniband/core/ucma.c | 7 +-
drivers/infiniband/core/umem.c | 18 +-
drivers/infiniband/core/verbs.c | 12 +-
drivers/infiniband/hw/efa/efa_com.c | 7 +-
drivers/infiniband/hw/efa/efa_com.h | 1 +
drivers/infiniband/hw/efa/efa_main.c | 35 +-
drivers/infiniband/hw/irdma/utils.c | 2 +-
drivers/infiniband/hw/irdma/verbs.c | 2 +-
drivers/infiniband/hw/mlx4/sysfs.c | 4 +
drivers/infiniband/hw/mlx5/cq.c | 3 +-
drivers/infiniband/hw/mlx5/main.c | 11 +
drivers/infiniband/sw/rxe/rxe_mcast.c | 50 +-
drivers/infiniband/sw/siw/siw_cm.c | 75 +-
drivers/infiniband/sw/siw/siw_qp_rx.c | 2 +-
drivers/infiniband/ulp/ipoib/ipoib.h | 7 +
drivers/infiniband/ulp/ipoib/ipoib_ib.c | 12 +-
drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 16 +-
drivers/infiniband/ulp/iser/iser_initiator.c | 16 +-
drivers/infiniband/ulp/isert/ib_isert.c | 22 +
drivers/infiniband/ulp/isert/ib_isert.h | 2 +
drivers/infiniband/ulp/rtrs/rtrs-clt.c | 8 +
drivers/infiniband/ulp/rtrs/rtrs-clt.h | 2 +
drivers/infiniband/ulp/rtrs/rtrs-srv.c | 12 +-
drivers/input/evdev.c | 2 +
drivers/input/input-compat.c | 2 +
drivers/input/joystick/xpad.c | 10 +-
drivers/input/keyboard/adp5588-keys.c | 12 +-
drivers/input/keyboard/atkbd.c | 8 +
drivers/input/misc/soc_button_array.c | 16 +-
drivers/input/mouse/synaptics.c | 8 +
drivers/input/rmi4/rmi_driver.c | 13 +
drivers/input/rmi4/rmi_smbus.c | 10 +-
drivers/input/serio/i8042-acpipnpio.h | 7 +
drivers/iommu/rockchip-iommu.c | 8 +
drivers/irqchip/irq-gic-v3-its.c | 1 +
drivers/leds/leds-pca9532.c | 8 +-
drivers/leds/uleds.c | 11 +-
drivers/mailbox/mailbox.c | 6 +-
drivers/md/raid5.c | 35 +-
drivers/media/i2c/video-i2c.c | 7 +-
drivers/media/pci/dm1105/dm1105.c | 7 +-
drivers/media/pci/intel/ipu3/cio2-bridge.c | 5 +
.../platform/verisilicon/hantro_g2_hevc_dec.c | 6 +-
drivers/media/rc/imon.c | 4 +
drivers/media/rc/mceusb.c | 2 +
drivers/media/usb/as102/as102_usb_drv.c | 75 +-
drivers/media/usb/em28xx/em28xx-video.c | 4 +-
drivers/media/v4l2-core/v4l2-ctrls-core.c | 12 +
drivers/media/v4l2-core/v4l2-h264.c | 3 +-
drivers/memstick/core/ms_block.c | 2 +
drivers/mfd/ab8500-core.c | 2 +-
drivers/mfd/db8500-prcmu.c | 6 +-
drivers/mfd/rsmu_i2c.c | 2 +
drivers/mfd/rsmu_spi.c | 2 +
drivers/misc/habanalabs/common/device.c | 9 +
drivers/misc/habanalabs/common/habanalabs.h | 1 +
drivers/misc/habanalabs/common/habanalabs_drv.c | 1 +
drivers/misc/habanalabs/common/memory_mgr.c | 13 +-
drivers/mmc/core/bus.c | 2 +-
drivers/mmc/core/host.c | 1 +
drivers/mmc/core/queue.c | 8 +-
drivers/mmc/core/sdio_uart.c | 3 +
drivers/mmc/host/davinci_mmc.c | 16 +-
drivers/mmc/host/mmc_spi.c | 1 +
drivers/mmc/host/mxcmmc.c | 4 +
drivers/mmc/host/renesas_sdhi_internal_dmac.c | 2 +
drivers/mmc/host/rtsx_pci_sdmmc.c | 5 +
drivers/mmc/host/sdhci-of-aspeed.c | 5 +-
drivers/mmc/host/sdhci_am654.c | 4 +-
drivers/mmc/host/sh_mmcif.c | 3 +-
drivers/net/bareudp.c | 11 +-
drivers/net/bonding/bond_alb.c | 32 +-
drivers/net/bonding/bond_main.c | 4 +-
drivers/net/dsa/bcm_sf2_cfp.c | 2 +
drivers/net/dsa/mv88e6xxx/chip.c | 23 +-
drivers/net/dsa/realtek/rtl8365mb.c | 14 +
drivers/net/dsa/sja1105/sja1105_flower.c | 4 +-
drivers/net/ethernet/allwinner/sun4i-emac.c | 2 +
drivers/net/ethernet/amd/au1000_eth.c | 3 +-
drivers/net/ethernet/amd/xgbe/xgbe-dev.c | 3 +-
drivers/net/ethernet/atheros/atl1c/atl1c_main.c | 3 +
drivers/net/ethernet/atheros/atl1e/atl1e_main.c | 3 +
drivers/net/ethernet/atheros/atlx/atl1.c | 3 +
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 19 +-
drivers/net/ethernet/broadcom/genet/bcmgenet.c | 63 +-
drivers/net/ethernet/broadcom/genet/bcmgenet.h | 5 +-
drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c | 20 +-
drivers/net/ethernet/broadcom/tg3.c | 15 +-
drivers/net/ethernet/cadence/macb.h | 2 +-
drivers/net/ethernet/cadence/macb_main.c | 39 +-
drivers/net/ethernet/cadence/macb_ptp.c | 9 +
drivers/net/ethernet/cavium/thunder/nicvf_main.c | 8 +-
drivers/net/ethernet/cortina/gemini.c | 79 +-
.../net/ethernet/freescale/dpaa2/dpaa2-switch.c | 69 +-
drivers/net/ethernet/freescale/fman/fman.c | 1 +
drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c | 3 +
drivers/net/ethernet/huawei/hinic/hinic_hw_mbox.c | 4 +-
drivers/net/ethernet/ibm/emac/core.c | 3 +-
drivers/net/ethernet/ibm/emac/mal.c | 6 +-
drivers/net/ethernet/intel/e1000e/ethtool.c | 19 +-
drivers/net/ethernet/intel/ice/ice_common.c | 9 +-
drivers/net/ethernet/intel/ice/ice_sched.c | 4 +-
drivers/net/ethernet/intel/ice/ice_txrx.c | 20 +-
drivers/net/ethernet/intel/ice/ice_type.h | 2 +-
drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 3 +-
drivers/net/ethernet/marvell/octeontx2/af/mcs.c | 10 +
.../ethernet/marvell/octeontx2/af/rvu_debugfs.c | 10 +-
drivers/net/ethernet/mellanox/mlx5/core/Kconfig | 2 +-
drivers/net/ethernet/mellanox/mlx5/core/Makefile | 2 +-
drivers/net/ethernet/mellanox/mlx5/core/en/port.c | 15 +-
.../ethernet/mellanox/mlx5/core/en/rep/bridge.c | 58 +-
.../net/ethernet/mellanox/mlx5/core/en/tc/sample.c | 7 +-
drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c | 3 +
drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 2 +-
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 11 +
.../net/ethernet/mellanox/mlx5/core/esw/bridge.c | 213 +--
.../net/ethernet/mellanox/mlx5/core/esw/bridge.h | 21 +-
.../ethernet/mellanox/mlx5/core/esw/bridge_mcast.c | 316 ++++
.../ethernet/mellanox/mlx5/core/esw/bridge_priv.h | 104 ++
drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 8 +-
.../mellanox/mlx5/core/eswitch_offloads_termtbl.c | 7 +-
drivers/net/ethernet/micrel/ks8842.c | 4 +-
drivers/net/ethernet/micrel/ks8851_common.c | 10 +-
drivers/net/ethernet/micrel/ks8851_spi.c | 4 +-
drivers/net/ethernet/micrel/ksz884x.c | 4 +-
drivers/net/ethernet/microchip/lan743x_main.c | 2 +-
drivers/net/ethernet/socionext/netsec.c | 2 +
drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c | 5 +-
drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c | 4 +-
drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h | 4 +-
drivers/net/ethernet/stmicro/stmmac/hwif.h | 2 +-
drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 4 +-
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 9 +
drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c | 1 -
.../net/ethernet/stmicro/stmmac/stmmac_selftests.c | 106 +-
drivers/net/ethernet/ti/cpsw_new.c | 4 +-
drivers/net/ethernet/ti/netcp_core.c | 2 +-
drivers/net/fddi/skfp/skfddi.c | 3 +-
drivers/net/ppp/ppp_async.c | 89 +-
drivers/net/ppp/ppp_synctty.c | 14 +-
drivers/net/usb/catc.c | 15 +-
drivers/net/usb/cdc_mbim.c | 5 +
drivers/net/usb/cx82310_eth.c | 1 +
drivers/net/usb/hso.c | 2 +-
drivers/net/usb/lan78xx.c | 9 +-
drivers/net/usb/pegasus.c | 54 +-
drivers/net/usb/pegasus.h | 3 -
drivers/net/usb/qmi_wwan.c | 2 +
drivers/net/usb/sr9700.c | 3 +-
drivers/net/veth.c | 2 +
drivers/net/vrf.c | 2 -
drivers/net/vxlan/vxlan_core.c | 266 +--
drivers/net/wireless/ath/ath11k/dp_rx.c | 50 +-
drivers/net/wireless/ath/ath9k/hif_usb.c | 12 +-
drivers/net/wireless/ath/ath9k/hif_usb.h | 2 +-
.../wireless/broadcom/brcm80211/brcmfmac/core.c | 2 +
.../broadcom/brcm80211/brcmsmac/mac80211_if.c | 4 +
drivers/net/wireless/intel/ipw2x00/libipw_rx.c | 10 +-
drivers/net/wireless/intel/iwlegacy/common.c | 2 +-
drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 5 +
drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 13 +-
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 6 +-
drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 4 +-
drivers/net/wireless/intersil/p54/eeprom.c | 22 +-
drivers/net/wireless/mac80211_hwsim.c | 45 +-
drivers/net/wireless/marvell/libertas/tx.c | 7 +
drivers/net/wireless/marvell/libertas_tf/main.c | 2 +-
drivers/net/wireless/marvell/mwifiex/cfg80211.c | 8 +-
drivers/net/wireless/marvell/mwifiex/fw.h | 18 +-
drivers/net/wireless/marvell/mwifiex/join.c | 8 +-
drivers/net/wireless/marvell/mwifiex/pcie.c | 2 +-
drivers/net/wireless/marvell/mwifiex/scan.c | 54 +-
drivers/net/wireless/marvell/mwifiex/sta_cmd.c | 2 +-
drivers/net/wireless/marvell/mwifiex/util.c | 10 +-
drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 33 +-
drivers/net/wireless/mediatek/mt76/pci.c | 8 +-
drivers/net/wireless/microchip/wilc1000/cfg80211.c | 14 +
drivers/net/wireless/microchip/wilc1000/wlan.c | 9 +
drivers/net/wireless/ralink/rt2x00/rt2400pci.c | 2 +-
drivers/net/wireless/ralink/rt2x00/rt2500pci.c | 2 +-
drivers/net/wireless/ralink/rt2x00/rt2800pci.c | 2 +-
drivers/net/wireless/ralink/rt2x00/rt61pci.c | 2 +-
drivers/net/wireless/realtek/rtw88/fw.c | 3 +
drivers/net/wireless/realtek/rtw88/main.c | 4 +-
drivers/net/wireless/realtek/rtw89/pci.c | 16 +-
drivers/net/wireless/rsi/rsi_91x_hal.c | 8 +
drivers/net/wireless/rsi/rsi_91x_mgmt.c | 8 +-
drivers/net/wireless/ti/wlcore/main.c | 4 +-
drivers/net/wireless/virt_wifi.c | 4 +-
drivers/net/wwan/mhi_wwan_mbim.c | 28 +-
drivers/net/wwan/t7xx/t7xx_netdev.c | 4 +
drivers/net/wwan/t7xx/t7xx_pci.c | 3 +
drivers/nfc/microread/microread.c | 6 +-
drivers/nfc/nfcmrvl/fw_dnld.c | 11 +-
drivers/nfc/pn533/pn533.c | 14 +-
drivers/nfc/pn533/pn533.h | 4 +-
drivers/nfc/pn533/usb.c | 4 +-
drivers/nfc/pn544/pn544.c | 7 +-
drivers/nfc/port100.c | 7 +
drivers/nfc/st21nfca/core.c | 12 +-
drivers/nfc/st21nfca/i2c.c | 29 +-
drivers/nfc/virtual_ncidev.c | 3 +-
drivers/nvme/host/apple.c | 182 +-
drivers/nvme/host/core.c | 6 +-
drivers/nvme/host/rdma.c | 18 +-
drivers/opp/of.c | 2 +-
drivers/pci/controller/dwc/pcie-intel-gw.c | 19 +-
drivers/pci/controller/pcie-altera.c | 2 +
drivers/pci/controller/pcie-iproc.c | 2 +
drivers/pci/controller/pcie-mediatek.c | 2 +
drivers/pci/controller/pcie-rockchip-host.c | 2 +
drivers/pci/pci-driver.c | 10 +-
drivers/pci/pci-sysfs.c | 11 +-
drivers/pci/pci.c | 24 +-
drivers/pci/proc.c | 79 +-
drivers/pci/quirks.c | 3 +
drivers/pci/switch/switchtec.c | 16 +
drivers/perf/arm-cmn.c | 10 +-
drivers/pinctrl/meson/pinctrl-meson-s4.c | 2 +-
drivers/pinctrl/pinctrl-single.c | 3 +-
drivers/pinctrl/renesas/pinctrl-rzv2m.c | 4 +-
drivers/platform/x86/dell/dell-laptop.c | 9 +
drivers/platform/x86/intel/hid.c | 7 +
drivers/ptp/ptp_ocp.c | 1 +
drivers/regulator/core.c | 163 +-
drivers/regulator/da9121-regulator.c | 18 +-
drivers/regulator/db8500-prcmu.c | 12 +-
drivers/rtc/rtc-aspeed.c | 1 +
drivers/rtc/rtc-bq32k.c | 9 +
drivers/s390/char/zcore.c | 8 +-
drivers/s390/cio/cio.c | 11 +-
drivers/s390/cio/device.c | 2 +-
drivers/s390/cio/device_ops.c | 14 +
drivers/s390/net/qeth_l2.h | 3 +-
drivers/s390/net/qeth_l2_main.c | 26 +-
drivers/s390/net/qeth_l2_sys.c | 7 +-
drivers/scsi/bfa/bfa_fcs_lport.c | 2 +-
drivers/scsi/hisi_sas/hisi_sas.h | 3 +-
drivers/scsi/hisi_sas/hisi_sas_main.c | 23 +-
drivers/scsi/hisi_sas/hisi_sas_v1_hw.c | 2 +-
drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 2 +-
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 4 +-
drivers/scsi/libiscsi_tcp.c | 3 +
drivers/scsi/megaraid/megaraid_sas_base.c | 4 +-
drivers/scsi/mpi3mr/mpi3mr_transport.c | 8 +
drivers/scsi/mpt3sas/mpt3sas_base.c | 5 +-
drivers/scsi/pm8001/pm8001_ctl.c | 8 +
drivers/scsi/pm8001/pm80xx_hwi.c | 7 +
drivers/scsi/qla2xxx/qla_os.c | 2 +-
drivers/scsi/scsi_error.c | 2 +-
drivers/soc/ti/pm33xx.c | 2 +-
drivers/soundwire/bus.c | 4 +
drivers/soundwire/cadence_master.c | 7 +
drivers/soundwire/dmi-quirks.c | 35 +
drivers/soundwire/slave.c | 4 +-
drivers/spi/spi-dw-dma.c | 3 +-
drivers/spi/spi-dw.h | 1 +
drivers/spi/spi-xilinx.c | 6 +-
drivers/spi/spi-zynqmp-gqspi.c | 52 +-
drivers/spi/spi.c | 9 +-
drivers/staging/fbtft/fbtft-core.c | 9 +-
drivers/target/iscsi/iscsi_target.c | 15 +-
drivers/tee/optee/call.c | 3 +-
drivers/thermal/db8500_thermal.c | 10 +-
drivers/thermal/tegra/soctherm.c | 6 +-
drivers/thunderbolt/icm.c | 10 +
drivers/thunderbolt/tb.c | 6 +-
drivers/thunderbolt/xdomain.c | 41 +-
drivers/tty/serial/8250/8250_port.c | 7 +
drivers/usb/atm/xusbatm.c | 6 +-
drivers/usb/class/cdc-acm.c | 6 +
drivers/usb/class/usbtmc.c | 2 -
drivers/usb/core/hcd.c | 14 +-
drivers/usb/gadget/udc/aspeed_udc.c | 7 +-
drivers/usb/gadget/udc/core.c | 7 +-
drivers/usb/gadget/udc/goku_udc.c | 3 +-
drivers/usb/host/Kconfig | 2 +-
drivers/usb/host/xhci-ring.c | 6 +
drivers/usb/host/xhci.c | 4 +
drivers/usb/usbip/vhci_sysfs.c | 52 +-
drivers/vdpa/ifcvf/ifcvf_main.c | 11 +-
drivers/vdpa/vdpa_sim/vdpa_sim_blk.c | 3 +-
drivers/vhost/scsi.c | 3 +-
drivers/vhost/vdpa.c | 12 +-
drivers/video/fbdev/pm2fb.c | 1 +
drivers/video/fbdev/vfb.c | 11 +-
drivers/virtio/virtio_input.c | 9 +-
drivers/virtio/virtio_pci_common.c | 4 +-
drivers/watchdog/da9063_wdt.c | 4 +-
drivers/watchdog/db8500_wdt.c | 22 +-
drivers/watchdog/digicolor_wdt.c | 13 +-
drivers/watchdog/msc313e_wdt.c | 88 +-
drivers/watchdog/sp5100_tco.c | 6 +-
drivers/watchdog/sunxi_wdt.c | 45 +-
drivers/watchdog/watchdog_hrtimer_pretimeout.c | 1 +
drivers/xen/gntalloc.c | 13 +-
drivers/xen/xen-front-pgdir-shbuf.c | 12 +-
fs/9p/vfs_dir.c | 14 +-
fs/affs/affs.h | 5 -
fs/affs/super.c | 6 +-
fs/autofs/inode.c | 4 +
fs/befs/linuxvfs.c | 3 +-
fs/bfs/inode.c | 3 +-
fs/btrfs/ctree.c | 10 +-
fs/btrfs/extent_io.c | 33 +-
fs/btrfs/inode.c | 3 +-
fs/btrfs/ioctl.c | 11 +-
fs/btrfs/relocation.c | 47 +-
fs/btrfs/transaction.c | 13 +-
fs/btrfs/tree-checker.c | 43 +-
fs/btrfs/tree-mod-log.c | 73 +-
fs/btrfs/volumes.c | 10 +-
fs/btrfs/zoned.c | 2 +
fs/cachefiles/namei.c | 1 -
fs/configfs/dir.c | 12 +-
fs/erofs/zdata.c | 13 +-
fs/exec.c | 22 +-
fs/f2fs/inline.c | 7 +
fs/freevxfs/vxfs_bmap.c | 3 +-
fs/fs-writeback.c | 25 +-
fs/fuse/file.c | 3 +-
fs/hfs/catalog.c | 9 -
fs/hfs/dir.c | 28 +-
fs/hfs/hfs.h | 3 +-
fs/hfs/hfs_fs.h | 2 -
fs/hfs/inode.c | 4 -
fs/hfsplus/catalog.c | 11 -
fs/hfsplus/dir.c | 28 +-
fs/hfsplus/hfsplus_fs.h | 5 +-
fs/hfsplus/inode.c | 40 +-
fs/hfsplus/super.c | 2 -
fs/hpfs/super.c | 3 +-
fs/inode.c | 11 +-
fs/isofs/inode.c | 3 +-
fs/jfs/super.c | 3 +-
fs/minix/inode.c | 3 +-
fs/nfs/nfs42proc.c | 15 +-
fs/ntfs3/dir.c | 4 +-
fs/ntfs3/fslog.c | 28 +-
fs/ntfs3/index.c | 41 +-
fs/ntfs3/xattr.c | 4 +-
fs/ocfs2/namei.c | 9 +-
fs/ocfs2/xattr.c | 13 +-
fs/ocfs2/xattr.h | 8 +-
fs/omfs/inode.c | 6 +-
fs/qnx4/inode.c | 3 +-
fs/smb/client/cifsacl.c | 18 +
fs/smb/client/connect.c | 1 +
fs/smb/client/file.c | 5 +-
fs/smb/client/misc.c | 19 +-
fs/smb/client/readdir.c | 9 +-
fs/smb/client/smb2ops.c | 31 +-
fs/smb/client/smb2pdu.c | 7 +-
fs/smb/client/transport.c | 11 +-
fs/smb/server/ksmbd_work.h | 7 +
fs/smb/server/mgmt/share_config.c | 36 +-
fs/smb/server/mgmt/user_session.c | 25 +-
fs/smb/server/misc.c | 14 +-
fs/smb/server/oplock.c | 16 +-
fs/smb/server/oplock.h | 2 +-
fs/smb/server/server.c | 20 +
fs/smb/server/smb2misc.c | 18 +-
fs/smb/server/smb2pdu.c | 148 +-
fs/smb/server/smbacl.c | 38 +-
fs/smb/server/transport_ipc.c | 24 +-
fs/smb/server/vfs.c | 14 +-
fs/smb/server/vfs_cache.c | 3 +-
fs/smb/server/vfs_cache.h | 7 +-
fs/squashfs/xz_wrapper.c | 6 +-
fs/ufs/cylinder.c | 10 +
fs/ufs/super.c | 17 +-
fs/xfs/xfs_icache.c | 2 +-
include/drm/drm_atomic_helper.h | 26 +
include/drm/drm_modeset_helper_vtables.h | 29 +-
include/keys/request_key_auth-type.h | 2 +-
include/linux/bitfield.h | 2 +-
include/linux/bpf.h | 1 +
include/linux/compiler_attributes.h | 12 +
include/linux/dev_printk.h | 1 +
include/linux/firmware/intel/stratix10-smc.h | 18 +-
include/linux/kcsan-checks.h | 6 +-
include/linux/lockdep.h | 16 +-
include/linux/lockdep_types.h | 8 +
include/linux/mailbox_controller.h | 2 +
include/linux/mfd/db8500-prcmu.h | 252 ++-
include/linux/mfd/dbx500-prcmu.h | 596 -------
include/linux/mlx5/mlx5_ifc.h | 7 +-
include/linux/netdevice.h | 23 +-
include/linux/platform_data/asoc-ux500-msp.h | 20 -
include/linux/rculist.h | 29 +
include/linux/rtnetlink.h | 7 +
include/linux/switchtec.h | 1 +
include/linux/thunderbolt.h | 2 +
include/linux/workqueue.h | 3 +
include/media/v4l2-hevc.h | 41 +
include/net/cfg80211.h | 9 +-
include/net/devlink.h | 13 +-
include/net/dst.h | 34 +-
include/net/gue.h | 19 +-
include/net/inet_hashtables.h | 2 +-
include/net/ip.h | 14 +-
include/net/ip6_route.h | 2 +
include/net/ip_fib.h | 5 +
include/net/mac80211.h | 9 +-
include/net/netfilter/nf_conntrack.h | 5 +
include/net/netns/xfrm.h | 2 +-
include/net/nfc/hci.h | 2 +-
include/net/nfc/nfc.h | 3 +-
include/net/route.h | 2 +-
include/net/sch_generic.h | 2 +-
include/net/udp_tunnel.h | 7 +-
include/rdma/ib_umem.h | 4 +-
include/sound/hda_codec.h | 30 +
include/sound/hdaudio_ext.h | 2 +-
include/trace/events/icmp.h | 13 +-
init/main.c | 3 +-
io_uring/io-wq.c | 1 +
kernel/bpf/bpf_local_storage.c | 49 +-
kernel/bpf/bpf_lsm.c | 6 +-
kernel/bpf/btf.c | 30 +-
kernel/bpf/cgroup.c | 1 +
kernel/bpf/disasm.c | 5 +-
kernel/bpf/hashtab.c | 24 +-
kernel/bpf/helpers.c | 2 +
kernel/bpf/syscall.c | 5 +-
kernel/bpf/verifier.c | 14 +
kernel/dma/coherent.c | 13 +-
kernel/events/ring_buffer.c | 9 +-
kernel/locking/lockdep.c | 230 ++-
kernel/sched/fair.c | 45 +-
kernel/time/clockevents.c | 35 +-
kernel/time/tick-broadcast.c | 36 +-
kernel/time/tick-internal.h | 2 +
kernel/trace/Makefile | 5 +-
kernel/trace/bpf_trace.c | 4 +-
kernel/trace/ring_buffer.c | 13 +-
kernel/trace/trace_event_perf.c | 12 +-
kernel/trace/trace_events_hist.c | 41 +-
kernel/trace/trace_probe.c | 48 +-
kernel/trace/trace_probe.h | 2 +
kernel/workqueue.c | 2 +-
mm/backing-dev.c | 5 +-
mm/damon/core.c | 13 +-
net/8021q/vlan_dev.c | 5 +
net/9p/client.c | 2 +-
net/appletalk/aarp.c | 5 +
net/atm/pppoatm.c | 42 +-
net/bluetooth/bnep/core.c | 17 +-
net/bluetooth/bnep/netdev.c | 8 +-
net/bluetooth/eir.c | 10 +-
net/bluetooth/hci_codec.c | 36 +-
net/bluetooth/hci_sock.c | 20 +-
net/bluetooth/hci_sync.c | 60 +-
net/bluetooth/iso.c | 31 +-
net/bluetooth/l2cap_core.c | 28 +-
net/bluetooth/mgmt.c | 45 +-
net/bluetooth/rfcomm/core.c | 6 +
net/bluetooth/rfcomm/sock.c | 19 +-
net/bluetooth/smp.c | 17 +
net/bridge/br_arp_nd_proxy.c | 16 +-
net/bridge/br_mst.c | 20 +-
net/bridge/br_multicast.c | 2 -
net/bridge/br_stp_bpdu.c | 5 +-
net/core/dev.c | 12 +-
net/core/drop_monitor.c | 22 +-
net/core/dst.c | 4 +-
net/core/filter.c | 33 +-
net/core/skbuff.c | 16 +-
net/core/skmsg.c | 4 +
net/core/sock.c | 15 +-
net/core/sock_map.c | 1 +
net/devlink/leftover.c | 99 +-
net/hsr/hsr_forward.c | 2 +-
net/hsr/hsr_netlink.c | 9 +-
net/ieee802154/6lowpan/core.c | 2 +-
net/ipv4/arp.c | 1 +
net/ipv4/esp4.c | 6 +
net/ipv4/fib_rules.c | 4 +-
net/ipv4/fib_trie.c | 4 +
net/ipv4/fou_core.c | 6 +-
net/ipv4/icmp.c | 45 +-
net/ipv4/igmp.c | 2 +-
net/ipv4/ip_fragment.c | 9 +-
net/ipv4/ip_gre.c | 12 +
net/ipv4/ip_output.c | 4 +-
net/ipv4/ip_tunnel_core.c | 6 +
net/ipv4/ip_vti.c | 4 +-
net/ipv4/ipmr.c | 2 +-
net/ipv4/netfilter.c | 4 +-
net/ipv4/nexthop.c | 2 +-
net/ipv4/route.c | 10 +-
net/ipv4/sysctl_net_ipv4.c | 4 +-
net/ipv4/tcp_fastopen.c | 4 +-
net/ipv4/tcp_input.c | 3 +-
net/ipv4/tcp_ipv4.c | 3 +-
net/ipv4/tcp_metrics.c | 8 +-
net/ipv4/tcp_output.c | 3 +
net/ipv4/udp.c | 4 +-
net/ipv4/xfrm4_output.c | 2 +-
net/ipv6/addrconf.c | 10 +-
net/ipv6/esp6.c | 6 +
net/ipv6/exthdrs.c | 4 +-
net/ipv6/exthdrs_core.c | 3 +
net/ipv6/ip6_fib.c | 4 +-
net/ipv6/ip6_gre.c | 19 +-
net/ipv6/ip6_tunnel.c | 26 +-
net/ipv6/ip6_udp_tunnel.c | 37 +-
net/ipv6/ip6_vti.c | 16 +-
net/ipv6/ip6mr.c | 10 +-
net/ipv6/mcast.c | 32 +-
net/ipv6/netfilter/ip6_tables.c | 5 +
net/ipv6/netfilter/ip6t_rpfilter.c | 2 +-
net/ipv6/netfilter/ip6t_rt.c | 11 +-
net/ipv6/route.c | 22 +-
net/ipv6/seg6.c | 4 +-
net/ipv6/seg6_local.c | 3 +
net/ipv6/tcp_ipv6.c | 3 +-
net/ipv6/xfrm6_output.c | 10 +-
net/llc/llc_c_ac.c | 2 +-
net/llc/llc_s_ac.c | 4 +
net/llc/llc_sap.c | 8 +-
net/mac80211/cfg.c | 14 +-
net/mac80211/debugfs.c | 2 +-
net/mac80211/debugfs_netdev.c | 9 +
net/mac80211/ieee80211_i.h | 15 +-
net/mac80211/iface.c | 28 +-
net/mac80211/main.c | 4 +
net/mac80211/mesh.c | 1 -
net/mac80211/mlme.c | 6 +-
net/mac80211/pm.c | 8 +-
net/mac80211/status.c | 4 +-
net/mac80211/tdls.c | 194 ++-
net/mac80211/tx.c | 46 +-
net/mac80211/util.c | 6 +-
net/mptcp/options.c | 3 +-
net/mptcp/protocol.c | 12 +-
net/mptcp/protocol.h | 3 +-
net/mptcp/subflow.c | 47 +-
net/mptcp/syncookies.c | 5 +-
net/netfilter/ipset/ip_set_hash_gen.h | 13 +-
net/netfilter/ipvs/ip_vs_core.c | 6 +
net/netfilter/ipvs/ip_vs_sync.c | 20 +-
net/netfilter/nf_conntrack_expect.c | 3 +-
net/netfilter/nf_conntrack_netlink.c | 16 +-
net/netfilter/nf_conntrack_proto_tcp.c | 10 +-
net/netfilter/nf_conntrack_sip.c | 2 +-
net/netfilter/nf_flow_table_core.c | 12 +-
net/netfilter/nf_flow_table_offload.c | 7 +-
net/netfilter/nf_log_syslog.c | 6 +-
net/netfilter/nf_tables_api.c | 4 +-
net/netfilter/nfnetlink_log.c | 28 +-
net/netfilter/nfnetlink_queue.c | 77 +-
net/netfilter/nft_nat.c | 2 +-
net/netfilter/nft_set_pipapo_avx2.c | 1 +
net/netfilter/nft_synproxy.c | 3 +-
net/netlabel/netlabel_unlabeled.c | 2 +-
net/nfc/core.c | 15 +-
net/nfc/digital_dep.c | 8 +-
net/nfc/llcp.h | 1 +
net/nfc/llcp_commands.c | 2 +-
net/nfc/llcp_core.c | 173 +-
net/nfc/llcp_sock.c | 67 +-
net/nfc/nci/core.c | 10 +-
net/nfc/netlink.c | 7 +-
net/nfc/nfc.h | 3 +-
net/openvswitch/conntrack.c | 14 +-
net/openvswitch/flow.c | 4 +-
net/openvswitch/flow_table.c | 4 +-
net/packet/af_packet.c | 11 +-
net/packet/internal.h | 2 +-
net/phonet/pn_dev.c | 30 +-
net/qrtr/af_qrtr.c | 4 +-
net/rds/af_rds.c | 63 +-
net/rds/connection.c | 102 +-
net/rds/ib_cm.c | 27 +-
net/rds/ib_frmr.c | 11 +-
net/rds/ib_recv.c | 9 +-
net/rds/message.c | 4 +-
net/rds/send.c | 16 +-
net/rds/tcp.c | 164 +-
net/rds/tcp_listen.c | 6 +-
net/sched/act_api.c | 136 +-
net/sched/act_csum.c | 8 +-
net/sched/act_ct.c | 5 +-
net/sched/act_gate.c | 30 +-
net/sched/cls_api.c | 2 +-
net/sched/cls_route.c | 45 +-
net/sched/cls_u32.c | 44 +-
net/sched/sch_api.c | 2 +-
net/sched/sch_drr.c | 13 +-
net/sched/sch_ets.c | 12 +-
net/sched/sch_fq_pie.c | 62 +-
net/sched/sch_generic.c | 24 +-
net/sched/sch_hfsc.c | 22 +
net/sched/sch_hhf.c | 15 +-
net/sched/sch_pie.c | 2 +-
net/sched/sch_sfq.c | 7 +-
net/sched/sch_teql.c | 7 +-
net/sctp/associola.c | 15 +-
net/sctp/input.c | 7 +-
net/sctp/ipv6.c | 12 +-
net/sctp/protocol.c | 11 +-
net/sctp/sm_make_chunk.c | 14 +-
net/sctp/sm_sideeffect.c | 48 +-
net/sctp/sm_statefuns.c | 7 +
net/smc/af_smc.c | 3 +-
net/smc/smc_clc.c | 8 +-
net/smc/smc_clc.h | 8 +-
net/smc/smc_core.c | 2 +
net/smc/smc_ib.c | 10 +-
net/sunrpc/xprtrdma/verbs.c | 21 +-
net/tipc/group.c | 4 +-
net/tipc/monitor.c | 3 +-
net/tipc/name_table.c | 32 +-
net/tipc/socket.c | 4 +-
net/tls/tls_main.c | 11 +
net/tls/tls_sw.c | 6 +-
net/unix/af_unix.c | 42 +-
net/unix/garbage.c | 1 +
net/vmw_vsock/hyperv_transport.c | 2 +-
net/vmw_vsock/vmci_transport.c | 2 +-
net/wireless/mlme.c | 105 +-
net/wireless/nl80211.c | 15 +-
net/wireless/rdev-ops.h | 15 +-
net/wireless/scan.c | 12 +-
net/wireless/trace.h | 255 ++-
net/wireless/util.c | 26 +-
net/wireless/wext-sme.c | 9 +
net/xdp/xskmap.c | 2 +-
net/xfrm/espintcp.c | 6 +-
net/xfrm/xfrm_input.c | 11 +
net/xfrm/xfrm_user.c | 37 +-
scripts/mod/modpost.c | 11 +-
security/integrity/digsig_asymmetric.c | 4 +
security/integrity/ima/ima_appraise.c | 5 +
security/keys/gc.c | 4 +-
security/keys/request_key_auth.c | 12 +-
security/keys/trusted-keys/trusted_tpm2.c | 12 +-
security/landlock/errata/abi-1.h | 15 +
security/landlock/fs.c | 40 +-
security/selinux/avc.c | 5 +-
sound/core/pcm_native.c | 35 +-
sound/core/pcm_timer.c | 7 +-
sound/core/seq/oss/seq_oss_rw.c | 3 +-
sound/hda/ext/hdac_ext_controller.c | 6 +-
sound/isa/es18xx.c | 4 +
sound/pci/ctxfi/cthw20k2.c | 1 +
sound/pci/hda/hda_codec.c | 119 +-
sound/pci/hda/hda_controller.c | 26 +-
sound/pci/hda/hda_proc.c | 4 +-
sound/pci/hda/hda_sysfs.c | 77 +-
sound/pci/hda/patch_conexant.c | 12 +
sound/pci/hda/patch_realtek.c | 19 +
sound/soc/amd/renoir/acp3x-pdm-dma.c | 2 +-
sound/soc/amd/yc/acp6x-mach.c | 7 +
sound/soc/amd/yc/acp6x-pdm-dma.c | 2 +
sound/soc/bcm/bcm63xx-i2s-whistler.c | 1 +
sound/soc/codecs/ab8500-codec.c | 543 +++---
sound/soc/codecs/hdmi-codec.c | 6 +-
sound/soc/codecs/mt6351.c | 1 +
sound/soc/codecs/pcm3168a.c | 20 +-
sound/soc/codecs/rk3328_codec.c | 54 +-
sound/soc/codecs/rt5645.c | 4 +
sound/soc/intel/atom/sst/sst_pci.c | 1 +
sound/soc/intel/avs/core.c | 13 +-
sound/soc/intel/catpt/ipc.c | 8 +
sound/soc/intel/catpt/loader.c | 3 +
sound/soc/intel/catpt/registers.h | 12 +
sound/soc/intel/skylake/skl.c | 2 +-
sound/soc/meson/aiu-acodec-ctrl.c | 3 +
sound/soc/meson/aiu-codec-ctrl.c | 3 +
sound/soc/qcom/qdsp6/q6apm.c | 10 +-
sound/soc/rockchip/rockchip_pdm.c | 16 +-
sound/soc/rockchip/rockchip_spdif.c | 1 +
sound/soc/sof/intel/hda.c | 2 +-
sound/soc/sof/ipc4-topology.c | 10 +
sound/soc/sprd/sprd-pcm-compress.c | 15 +-
sound/soc/sti/uniperif_reader.c | 4 +-
sound/soc/ti/omap3pandora.c | 5 +-
sound/soc/ux500/mop500.c | 8 +-
sound/soc/ux500/ux500_msp_dai.c | 169 +-
sound/soc/ux500/ux500_msp_dai.h | 11 -
sound/soc/ux500/ux500_msp_i2s.c | 326 ++--
sound/soc/ux500/ux500_msp_i2s.h | 30 +-
sound/soc/ux500/ux500_pcm.c | 83 +-
sound/usb/6fire/chip.c | 40 +-
sound/usb/6fire/comm.c | 42 +-
sound/usb/6fire/comm.h | 2 +-
sound/usb/6fire/midi.c | 64 +-
sound/usb/6fire/midi.h | 2 +-
sound/usb/6fire/pcm.c | 221 +--
sound/usb/6fire/pcm.h | 5 +-
sound/usb/bcd2000/bcd2000.c | 33 +-
sound/usb/caiaq/audio.c | 10 +-
sound/usb/caiaq/device.c | 53 +-
sound/usb/caiaq/device.h | 4 +-
sound/usb/caiaq/input.c | 6 +
sound/usb/caiaq/midi.c | 6 +-
sound/usb/mixer.c | 17 +-
sound/usb/mixer_maps.c | 25 +
sound/usb/quirks-table.h | 22 +
sound/usb/quirks.c | 4 +
sound/usb/usx2y/us122l.c | 9 +-
sound/usb/usx2y/usbusx2y.c | 45 +-
sound/usb/usx2y/usbusx2y.h | 4 +-
sound/virtio/virtio_card.c | 4 +-
tools/bpf/bpftool/map.c | 5 -
tools/build/feature/test-bpf.c | 2 +
tools/lib/bpf/bpf.c | 2 +
tools/lib/bpf/gen_loader.c | 2 +
tools/lib/bpf/libbpf.c | 7 +
tools/lib/bpf/relo_core.c | 58 +-
tools/perf/tests/shell/stat_bpf_counters.sh | 30 +-
tools/perf/util/cs-etm.c | 81 +-
tools/testing/selftests/alsa/mixer-test.c | 4 +-
.../selftests/arm64/mte/check_gcr_el1_cswitch.c | 2 +-
tools/testing/selftests/bpf/config | 1 +
tools/testing/selftests/bpf/prog_tests/bpf_nf.c | 7 +
tools/testing/selftests/bpf/progs/test_bpf_nf.c | 112 +-
tools/testing/selftests/cgroup/test_kmem.c | 2 +-
.../ftrace/test.d/kprobe/kprobe_non_uniq_symbol.tc | 2 +-
tools/testing/selftests/landlock/fs_test.c | 1746 +++++++++++++++++++-
tools/testing/selftests/nci/nci_dev.c | 45 +-
tools/testing/selftests/net/fib_nexthops.sh | 28 +
tools/testing/selftests/net/mptcp/mptcp_connect.c | 4 +-
tools/testing/selftests/net/pmtu.sh | 2 +-
tools/testing/selftests/powerpc/tm/tm.h | 8 +-
tools/thermal/tmon/tui.c | 2 +-
916 files changed, 12377 insertions(+), 6492 deletions(-)
^ permalink raw reply [flat|nested] 990+ messages in thread
* [PATCH 6.1 001/982] drm/gem: Consider GEM object reclaimable if shrinking fails
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 002/982] bus: fsl-mc: wait for the MC firmware to complete its boot Greg Kroah-Hartman
` (987 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Liviu Dudau, Steven Price,
Boris Brezillon, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Brezillon <boris.brezillon@collabora.com>
[ Upstream commit 71c8224a18825102ee1e5e70498f96f6c2d2a81d ]
If the object wasn't moved to a different LRU after the shrink callback
returns, it means the buffer is still reclaimable. Update the remaining
counter to reflect that.
v2:
- Collect R-b
v3:
- Collect R-b
v4:
- No changes
v5:
- No changes
v6:
- No changes
v7:
- No changes
Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Link: https://patch.msgid.link/20260401134854.2275433-2-boris.brezillon@collabora.com
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_gem.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index ebf60c8d98ed8..e9be1d590f4ac 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -1419,6 +1419,16 @@ drm_gem_lru_scan(struct drm_gem_lru *lru,
*/
WARN_ON(obj->lru == &still_in_lru);
WARN_ON(obj->lru == lru);
+ } else if (obj->lru == &still_in_lru) {
+ /*
+ * If the object wasn't moved and wasn't shrunk either,
+ * it's still remaining as reclaimable. Note that
+ * obj->lru is supposed to be checked with the LRU lock
+ * held for an accurate result, but we don't care about
+ * accuracy here. Worst thing that could happen is an
+ * extra scan.
+ */
+ *remaining += obj->size >> PAGE_SHIFT;
}
dma_resv_unlock(obj->resv);
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 002/982] bus: fsl-mc: wait for the MC firmware to complete its boot
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 001/982] drm/gem: Consider GEM object reclaimable if shrinking fails Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 003/982] ALSA: usb-audio: Propagate write errors in generic mixer put callbacks Greg Kroah-Hartman
` (986 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ioana Ciornei,
Christophe Leroy (CS GROUP), Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ioana Ciornei <ioana.ciornei@nxp.com>
[ Upstream commit 208858b1b48eba83d073542372329cf8ed606526 ]
There are use cases in which the Management Complex firmware boot
process is started by the bootloader which does not wait for the boot to
complete. This is mainly done in order to reduce the overall boot time
of a DPAA2 based SoC.
In this kind of circumstance, the fsl-mc bus driver needs to make sure
that the MC firmware boot process is finished before proceeding to the
usual operations such as interrogating the firmware to gather all
existent DPAA2 objects, creating the fsl-mc devices on the bus etc.
Add this kind of check early in the boot process of the fsl-mc bus and
defer the probe in case the firmware is still in its boot process.
Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Link: https://lore.kernel.org/r/20260401144508.3062019-1-ioana.ciornei@nxp.com
Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bus/fsl-mc/fsl-mc-bus.c | 46 +++++++++++++++++++++++++++++++++
1 file changed, 46 insertions(+)
diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c
index 6f8e9b40371a2..512026036c578 100644
--- a/drivers/bus/fsl-mc/fsl-mc-bus.c
+++ b/drivers/bus/fsl-mc/fsl-mc-bus.c
@@ -66,6 +66,13 @@ struct fsl_mc_addr_translation_range {
#define GCR1_P1_STOP BIT(31)
#define GCR1_P2_STOP BIT(30)
+#define FSL_MC_GSR 0x8
+#define FSL_MC_GSR_BOOT_DONE BIT(0)
+#define FSL_MC_GSR_MCS_MASK GENMASK(7, 0)
+#define FSL_MC_GSR_MCS_ERR_MASK GENMASK(7, 1)
+#define FSL_MC_GSR_BC_MASK GENMASK(15, 8)
+#define FSL_MC_GSR_BC_SHIFT 8
+
#define FSL_MC_FAPR 0x28
#define MC_FAPR_PL BIT(18)
#define MC_FAPR_BMT BIT(17)
@@ -1104,6 +1111,41 @@ static int get_mc_addr_translation_ranges(struct device *dev,
return 0;
}
+static u32 fsl_mc_read_gsr(struct fsl_mc *mc)
+{
+ return readl(mc->fsl_mc_regs + FSL_MC_GSR);
+}
+
+static int fsl_mc_firmware_check(struct platform_device *pdev)
+{
+ struct fsl_mc *mc = platform_get_drvdata(pdev);
+ u32 gsr, boot_done, boot_code, mcs;
+
+ gsr = fsl_mc_read_gsr(mc);
+ boot_code = (gsr & FSL_MC_GSR_BC_MASK) >> FSL_MC_GSR_BC_SHIFT;
+ if (boot_code == 0xDD) {
+ dev_err(&pdev->dev,
+ "fsl-mc: DPL processing was not started, DPAA2 will not work!\n");
+ return -EOPNOTSUPP;
+ }
+
+ boot_done = gsr & FSL_MC_GSR_BOOT_DONE;
+ if (!boot_done) {
+ dev_dbg(&pdev->dev,
+ "fsl-mc: DPL processing in progress, defer probe\n");
+ return -EPROBE_DEFER;
+ }
+
+ mcs = gsr & FSL_MC_GSR_MCS_MASK;
+ if (mcs & FSL_MC_GSR_MCS_ERR_MASK) {
+ dev_err(&pdev->dev,
+ "fsl-mc: MC boot completed with error 0x%x\n", mcs);
+ return -EINVAL;
+ }
+
+ return 0;
+}
+
/*
* fsl_mc_bus_probe - callback invoked when the root MC bus is being
* added
@@ -1168,6 +1210,10 @@ static int fsl_mc_bus_probe(struct platform_device *pdev)
mc->fsl_mc_regs + FSL_MC_GCR1);
}
+ error = fsl_mc_firmware_check(pdev);
+ if (error)
+ return error;
+
/*
* Get physical address of MC portal for the root DPRC:
*/
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 003/982] ALSA: usb-audio: Propagate write errors in generic mixer put callbacks
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 001/982] drm/gem: Consider GEM object reclaimable if shrinking fails Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 002/982] bus: fsl-mc: wait for the MC firmware to complete its boot Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 004/982] ima: return error early if file xattr cannot be changed Greg Kroah-Hartman
` (985 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cássio Gabriel, Takashi Iwai,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
[ Upstream commit 87a6f2fa6e6c69bb649fa327635a0bd977724603 ]
mixer_ctl_feature_put(), mixer_ctl_procunit_put(), and
mixer_ctl_selector_put() ignore failures from their SET_CUR helper
routines and report the control as changed whenever the requested
value differs from the current one.
If the device rejects the write, userspace still sees success although
the hardware state did not change. Propagate write failures instead,
using filter_error() so ignore_ctl_error keeps the same semantics as
the existing get paths.
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260419-usb-write-error-propagation-v1-1-5a3bd4a673ae@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/mixer.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 21543ed58453b..45a4a8c7a697d 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -1463,7 +1463,10 @@ static int mixer_ctl_feature_put(struct snd_kcontrol *kcontrol,
return -EINVAL;
val = get_abs_value(cval, val);
if (oval != val) {
- snd_usb_set_cur_mix_value(cval, c + 1, cnt, val);
+ err = snd_usb_set_cur_mix_value(cval, c + 1,
+ cnt, val);
+ if (err < 0)
+ return filter_error(cval, err);
changed = 1;
}
cnt++;
@@ -1478,7 +1481,9 @@ static int mixer_ctl_feature_put(struct snd_kcontrol *kcontrol,
return -EINVAL;
val = get_abs_value(cval, val);
if (val != oval) {
- snd_usb_set_cur_mix_value(cval, 0, 0, val);
+ err = snd_usb_set_cur_mix_value(cval, 0, 0, val);
+ if (err < 0)
+ return filter_error(cval, err);
changed = 1;
}
}
@@ -2345,7 +2350,9 @@ static int mixer_ctl_procunit_put(struct snd_kcontrol *kcontrol,
return -EINVAL;
val = get_abs_value(cval, val);
if (val != oval) {
- set_cur_ctl_value(cval, cval->control << 8, val);
+ err = set_cur_ctl_value(cval, cval->control << 8, val);
+ if (err < 0)
+ return filter_error(cval, err);
return 1;
}
return 0;
@@ -2709,7 +2716,9 @@ static int mixer_ctl_selector_put(struct snd_kcontrol *kcontrol,
return -EINVAL;
val = get_abs_value(cval, val);
if (val != oval) {
- set_cur_ctl_value(cval, cval->control << 8, val);
+ err = set_cur_ctl_value(cval, cval->control << 8, val);
+ if (err < 0)
+ return filter_error(cval, err);
return 1;
}
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 004/982] ima: return error early if file xattr cannot be changed
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 003/982] ALSA: usb-audio: Propagate write errors in generic mixer put callbacks Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 005/982] usb: gadget: udc: skip pullup() if already connected Greg Kroah-Hartman
` (984 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Goldwyn Rodrigues, Mimi Zohar,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Goldwyn Rodrigues <rgoldwyn@suse.de>
[ Upstream commit 69fc6474236d9edda6983623e4282f2bdfd8e3d8 ]
During early boot, the filesystem is read-only and any changes
to xattrs are not allowed. This fails in case of ext4 because
changing xattr starts an ext4 transaction which fails with the
following warning.
WARNING: fs/ext4/ext4_jbd2.c:75 at ext4_journal_check_start+0x63/0xa0 [ext4], CPU#1: systemd-sysroot/561
CPU: 1 UID: 0 PID: 561 Comm: systemd-sysroot Not tainted 6.19.12-1-default #1 PREEMPT(voluntary) openSUSE Tumbleweed c2dfc3c9d9f6f1233251c5d4410574fe82a348ee
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022
RIP: 0010:ext4_journal_check_start+0x63/0xa0 [ext4]
Call Trace:
__ext4_journal_start_sb+0x3e/0x180 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1]
ext4_xattr_set+0x104/0x150 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1]
__vfs_setxattr+0x9a/0xd0
__vfs_setxattr_noperm+0x76/0x1f0
ima_appraise_measurement+0x23e/0xe40
ima_d_path+0x5a/0xd0
process_measurement+0xb29/0xc40
? copy_from_kernel_nofault+0x21/0xe0
? fscrypt_file_open+0xc0/0xe0
? ext4_file_open+0x60/0x490 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1]
? bpf_prog_31efb7c56239148b_restrict_filesystems+0xab/0x126
? __bpf_prog_exit+0x23/0xd0
? __bpf_tramp_exit+0xd/0x50
? bpf_trampoline_6442530367+0x9f/0xea
ima_file_check+0x57/0x80
security_file_post_open+0x50/0xf0
path_openat+0x493/0x1650
do_filp_open+0xc7/0x170
Detect the state of the file early and return the error.
Signed-off-by: Goldwyn Rodrigues <rgoldwyn@suse.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/integrity/ima/ima_appraise.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index 1b45873ae4844..f9d0bd4d3613b 100644
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -90,6 +90,11 @@ static int ima_fix_xattr(struct dentry *dentry,
int rc, offset;
u8 algo = iint->ima_hash->algo;
+ if (IS_RDONLY(d_inode(dentry)))
+ return -EROFS;
+ if (IS_IMMUTABLE(d_inode(dentry)))
+ return -EPERM;
+
if (algo <= HASH_ALGO_SHA1) {
offset = 1;
iint->ima_hash->xattr.sha1.type = IMA_XATTR_DIGEST;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 005/982] usb: gadget: udc: skip pullup() if already connected
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 004/982] ima: return error early if file xattr cannot be changed Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 006/982] tee: optee: Allow MT_NORMAL_TAGGED shared memory Greg Kroah-Hartman
` (983 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xu Yang, Alan Stern, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <xu.yang_2@nxp.com>
[ Upstream commit 62911bc82b0332aee7546156800d3516500fa1e1 ]
The device controller may update vbus status via usb_udc_vbus_handler(),
which tries to connect the gadget even though gadget_bind_driver() has
already called usb_udc_connect_control_locked(). This causes pullup() to
be called twice. Avoid this by checking if gadget->connected is true.
This also set gadget->connected as false in usb_gadget_activate() if it
became connected while it was being deactivated. Otherwise,
usb_gadget_connect_locked will return early and pullup() won't be called.
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://patch.msgid.link/20260423095355.2673035-1-xu.yang_2@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/udc/core.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
index 577f7945cc303..addcff2f77110 100644
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -714,6 +714,9 @@ static int usb_gadget_connect_locked(struct usb_gadget *gadget)
goto out;
}
+ if (gadget->connected)
+ goto out;
+
if (gadget->deactivated || !gadget->udc->allow_connect || !gadget->udc->started) {
/*
* If the gadget isn't usable (because it is deactivated,
@@ -887,8 +890,10 @@ int usb_gadget_activate(struct usb_gadget *gadget)
* If gadget has been connected before deactivation, or became connected
* while it was being deactivated, we call usb_gadget_connect().
*/
- if (gadget->connected)
+ if (gadget->connected) {
+ gadget->connected = false;
ret = usb_gadget_connect_locked(gadget);
+ }
unlock:
mutex_unlock(&gadget->udc->connect_lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 006/982] tee: optee: Allow MT_NORMAL_TAGGED shared memory
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 005/982] usb: gadget: udc: skip pullup() if already connected Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 007/982] PCI: Stop setting cached power state to unknown on unbind Greg Kroah-Hartman
` (982 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hirokazu Honda, Sumit Garg,
Jens Wiklander, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hirokazu Honda <hiroh@chromium.org>
[ Upstream commit 1a6e94a8ff32e7879effd1e4a45bf112e506edc1 ]
On ARM64, shared memory can have MT_NORMAL_TAGGED attribute when using
the Memory Tagging Extension (MTE). The OP-TEE driver needs to
recognize this as normal memory to allow sharing such buffers with the
Secure World.
Signed-off-by: Hirokazu Honda <hiroh@chromium.org>
Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tee/optee/call.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/tee/optee/call.c b/drivers/tee/optee/call.c
index 290b1bb0e9cd7..5d4b8d75305f6 100644
--- a/drivers/tee/optee/call.c
+++ b/drivers/tee/optee/call.c
@@ -486,7 +486,8 @@ static bool is_normal_memory(pgprot_t p)
return (((pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEALLOC) ||
((pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEBACK));
#elif defined(CONFIG_ARM64)
- return (pgprot_val(p) & PTE_ATTRINDX_MASK) == PTE_ATTRINDX(MT_NORMAL);
+ return ((pgprot_val(p) & PTE_ATTRINDX_MASK) == PTE_ATTRINDX(MT_NORMAL)) ||
+ ((pgprot_val(p) & PTE_ATTRINDX_MASK) == PTE_ATTRINDX(MT_NORMAL_TAGGED));
#else
#error "Unuspported architecture"
#endif
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 007/982] PCI: Stop setting cached power state to unknown on unbind
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 006/982] tee: optee: Allow MT_NORMAL_TAGGED shared memory Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 008/982] hfsplus: fix issue of direct writes beyond end-of-file Greg Kroah-Hartman
` (981 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lukas Wunner, Bjorn Helgaas,
Mario Limonciello (AMD), Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <lukas@wunner.de>
[ Upstream commit d462c8e89e84bfb6417e6b4c88e0cb7cc747ba41 ]
When a PCI device is unbound from its driver, pci_device_remove() sets the
cached power state in pci_dev->current_state to PCI_UNKNOWN. This was
introduced by commit 2449e06a5696 ("PCI: reset pci device state to unknown
state for resume") to invalidate the cached power state in case the system
is subsequently put to sleep.
For bound devices, the cached power state is set to PCI_UNKNOWN in
pci_pm_suspend_noirq(), immediately before entering system sleep.
Extend to unbound devices for consistency.
This obviates the need to change the cached power state on unbind, so stop
doing so.
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Link: https://patch.msgid.link/af7d11d3ceb231acc90829f7a5c8400c2446744f.1776415510.git.lukas@wunner.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/pci-driver.c | 10 ++--------
1 file changed, 2 insertions(+), 8 deletions(-)
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index fe6e5f716543a..fa3165e5b921b 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -490,13 +490,6 @@ static void pci_device_remove(struct device *dev)
/* Undo the runtime PM settings in local_pci_probe() */
pm_runtime_put_sync(dev);
- /*
- * If the device is still on, set the power state as "unknown",
- * since it might change by the next time we load the driver.
- */
- if (pci_dev->current_state == PCI_D0)
- pci_dev->current_state = PCI_UNKNOWN;
-
/*
* We would love to complain here if pci_dev->is_enabled is set, that
* the driver should have called pci_disable_device(), but the
@@ -874,7 +867,7 @@ static int pci_pm_suspend_noirq(struct device *dev)
if (!pm) {
pci_save_state(pci_dev);
- goto Fixup;
+ goto set_unknown;
}
if (pm->suspend_noirq) {
@@ -926,6 +919,7 @@ static int pci_pm_suspend_noirq(struct device *dev)
goto Fixup;
}
+set_unknown:
pci_pm_set_unknown_state(pci_dev);
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 008/982] hfsplus: fix issue of direct writes beyond end-of-file
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 007/982] PCI: Stop setting cached power state to unknown on unbind Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 009/982] wifi: nl80211: reject beacons with bad HE operation Greg Kroah-Hartman
` (980 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, John Paul Adrian Glaubitz,
Yangtao Li, linux-fsdevel, Viacheslav Dubeyko, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <slava@dubeyko.com>
[ Upstream commit 5f63ac80aef2ee6bb58eab62e98c264774872da6 ]
The xfstests' test-case generic/729 fails with error:
sudo ./check generic/729
FSTYP -- hfsplus
PLATFORM -- Linux/x86_64 hfsplus-testing-0001 7.0.0-rc1+ #36 SMP PREEMPT_DYNAMIC Fri Apr 17 12:40:51 PDT 2026
MKFS_OPTIONS -- /dev/loop51
MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
generic/729 23s ... [failed, exit status 1]- output mismatch
mmap-rw-fault: /mnt/test/mmap-rw-fault.tmp: Input/output error
The hfsplus_get_block() only allows creating the next
sequential block. It returns -EIO for direct writes
beyond EOF. This patch waits for any in-flight DIO on the inode
to finish. Then, it extends the file by calling
generic_cont_expand_simple() with the goal to guarantee
that blockdev_direct_IO() finds all needed blocks
already reachable sequentially. And, finally, it flushes and
invalidates the DIO range again so the page cache is clean
before the direct write begins.
sudo ./check generic/729
FSTYP -- hfsplus
PLATFORM -- Linux/x86_64 hfsplus-testing-0001 7.0.0-rc1+ #40 SMP PREEMPT_DYNAMIC Thu Apr 16 15:41:03 PDT 2026
MKFS_OPTIONS -- /dev/loop51
MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
generic/729 23s ... 32s
Ran: generic/729
Passed all 1 tests
Closes: https://github.com/hfs-linux-kernel/hfs-linux-kernel/issues/210
cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
cc: Yangtao Li <frank.li@vivo.com>
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Link: https://lore.kernel.org/r/20260417214940.2735557-2-slava@dubeyko.com
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/hfsplus/inode.c | 38 ++++++++++++++++++++++++++++++++++++--
1 file changed, 36 insertions(+), 2 deletions(-)
diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
index f065015f237c4..caf36ed7f590a 100644
--- a/fs/hfsplus/inode.c
+++ b/fs/hfsplus/inode.c
@@ -129,9 +129,44 @@ static ssize_t hfsplus_direct_IO(struct kiocb *iocb, struct iov_iter *iter)
struct file *file = iocb->ki_filp;
struct address_space *mapping = file->f_mapping;
struct inode *inode = mapping->host;
+ loff_t isize;
size_t count = iov_iter_count(iter);
+ loff_t end = iocb->ki_pos + count;
ssize_t ret;
+ /*
+ * The hfsplus_get_block() only allows creating the next sequential block.
+ * For direct writes beyond EOF, expand the file first.
+ */
+ if (iov_iter_rw(iter) == WRITE && iocb->ki_pos > i_size_read(inode)) {
+ loff_t start_off, end_off;
+ loff_t start_page, end_page;
+
+ isize = i_size_read(inode);
+
+ /*
+ * Wait for any in-flight DIO on this inode to finish before
+ * calling generic_cont_expand_simple().
+ */
+ inode_dio_wait(inode);
+
+ ret = generic_cont_expand_simple(inode, iocb->ki_pos);
+ if (ret)
+ return ret;
+
+ start_off = isize;
+ end_off = (end > 0) ? end - 1 : end;
+
+ ret = filemap_write_and_wait_range(mapping, start_off, end_off);
+ if (ret)
+ return ret;
+
+ start_page = start_off >> PAGE_SHIFT;
+ end_page = end_off >> PAGE_SHIFT;
+
+ invalidate_inode_pages2_range(mapping, start_page, end_page);
+ }
+
ret = blockdev_direct_IO(iocb, inode, iter, hfsplus_get_block);
/*
@@ -139,8 +174,7 @@ static ssize_t hfsplus_direct_IO(struct kiocb *iocb, struct iov_iter *iter)
* blocks outside i_size. Trim these off again.
*/
if (unlikely(iov_iter_rw(iter) == WRITE && ret < 0)) {
- loff_t isize = i_size_read(inode);
- loff_t end = iocb->ki_pos + count;
+ isize = i_size_read(inode);
if (end > isize)
hfsplus_write_failed(mapping, end);
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 009/982] wifi: nl80211: reject beacons with bad HE operation
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 008/982] hfsplus: fix issue of direct writes beyond end-of-file Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 010/982] wifi: mac80211: always allow transmitting null-data on TXQs Greg Kroah-Hartman
` (979 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Miriam Rachel Korenblit,
Johannes Berg, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 8b9a100e1a76c52988b31099b349fd95a58c8768 ]
The HE operation element not only needs to be longer than
the fixed part, but also have an appropriate size for the
variable part inside of it. Check this.
Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260415144514.6217f5974fb5.Iff7ff6bcb159584e756d0f825c65860cdd53c6ea@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/wireless/nl80211.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index bb2d19057480b..069b04c29b64e 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -5805,8 +5805,12 @@ static int nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
if (cap && cap->datalen >= sizeof(*params->he_cap) + 1)
params->he_cap = (void *)(cap->data + 1);
cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ies, ies_len);
- if (cap && cap->datalen >= sizeof(*params->he_oper) + 1)
+ if (cap && cap->datalen >= sizeof(*params->he_oper) + 1) {
params->he_oper = (void *)(cap->data + 1);
+ /* takes extension ID into account */
+ if (cap->datalen < ieee80211_he_oper_size((void *)params->he_oper))
+ return -EINVAL;
+ }
cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_CAPABILITY, ies, ies_len);
if (cap) {
if (!cap->datalen)
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 010/982] wifi: mac80211: always allow transmitting null-data on TXQs
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 009/982] wifi: nl80211: reject beacons with bad HE operation Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 011/982] wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result() Greg Kroah-Hartman
` (978 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jouni Malinen, Johannes Berg,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 51129a2ca0482b006d0e12a0aa025ff1e1cad2cb ]
Jouni reported that certain sequences of tests caused some
WDS tests to fail after applying the upcoming hwsim changes
for NAN. I bisected that down to converting hwsim to TXQs,
and after a long debug session found that the 4-addr NDP was
getting dropped, because it goes out via a (management) TXQ
and is a data frame.
It's unclear to me now why this only happens in some test
sequences (e.g. "sigma_dut_sae_h2e_ap_loop ap_wds_sta" and
"sigma_dut_eap_ttls_all_akm_suites ap_wds_sta_open"), maybe
that affects timing and the frame is otherwise delayed in
some way.
Correct the check to only drop frames that actually carry
data, not NDPs.
Reported-by: Jouni Malinen <j@w1.fi>
Link: https://patch.msgid.link/20260417141601.851ddf4adb59.I3d668c0e1bdca9cd98f2fc46f84a066e68cc7a62@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/tx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 31f000aa22309..0cd02bd3fae30 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -3805,7 +3805,7 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,
* injected frames or EAPOL frames from the local station.
*/
if (unlikely(!(info->flags & IEEE80211_TX_CTL_INJECTED) &&
- ieee80211_is_data(hdr->frame_control) &&
+ ieee80211_is_data_present(hdr->frame_control) &&
!ieee80211_vif_is_mesh(&tx.sdata->vif) &&
tx.sdata->vif.type != NL80211_IFTYPE_OCB &&
!is_multicast_ether_addr(hdr->addr1) &&
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 011/982] wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result()
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 010/982] wifi: mac80211: always allow transmitting null-data on TXQs Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 012/982] kcsan: Silence -Wmaybe-uninitialized when calling __kcsan_check_access() Greg Kroah-Hartman
` (977 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ping-Ke Shih, Oleksandr Havrylov,
Panagiotis Petrakopoulos, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Panagiotis Petrakopoulos <npetrakopoulos2003@gmail.com>
[ Upstream commit d5e6f353ce1e1c25b8458ea390ed09d2377412c5 ]
It was recently reported that rtw_fw_adaptivity_result()
in fw.c dereferences rtwdev->chip->edcca_th without
a NULL check. The issue is that devices with the
8821CE chip don't define edcca_th in their chip
info. As a result, when rtw_fw_adaptivity_result()
tries to dereference it, the kernel triggers an oops.
Add a NULL check for edcca_th before dereferencing
it in rtw_fw_adaptivity_result() in fw.c. Placing
the check at the function entry avoids logging any
garbage values.
This change does not address the root cause for
this behavior, but it prevents the NULL dereference
and the resulting oops while a more permanent solution
is developed.
Tested on a 8822CE chip which defines edcca_th, so
this issue is not present on it, but it still uses
this driver and I can verify there are no regressions.
Suggested-by: Ping-Ke Shih <pkshih@realtek.com>
Reported-by: Oleksandr Havrylov <goainwo@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221286
Signed-off-by: Panagiotis Petrakopoulos <npetrakopoulos2003@gmail.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Tested-by: Oleksandr Havrylov <goainwo@gmail.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260415052959.14844-1-npetrakopoulos2003@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw88/fw.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/wireless/realtek/rtw88/fw.c b/drivers/net/wireless/realtek/rtw88/fw.c
index 0b5f903c0f366..28a37dcba223f 100644
--- a/drivers/net/wireless/realtek/rtw88/fw.c
+++ b/drivers/net/wireless/realtek/rtw88/fw.c
@@ -197,6 +197,9 @@ static void rtw_fw_adaptivity_result(struct rtw_dev *rtwdev, u8 *payload,
struct rtw_hw_reg_offset *edcca_th = rtwdev->chip->edcca_th;
struct rtw_c2h_adaptivity *result = (struct rtw_c2h_adaptivity *)payload;
+ if (!edcca_th)
+ return;
+
rtw_dbg(rtwdev, RTW_DBG_ADAPTIVITY,
"Adaptivity: density %x igi %x l2h_th_init %x l2h %x h2l %x option %x\n",
result->density, result->igi, result->l2h_th_init, result->l2h,
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 012/982] kcsan: Silence -Wmaybe-uninitialized when calling __kcsan_check_access()
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 011/982] wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result() Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 013/982] firmware: stratix10-svc: change get provision data to async SMC call Greg Kroah-Hartman
` (976 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Marco Elver,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Elver <elver@google.com>
[ Upstream commit 07a1a6562ce29e2e0c134a57882d6e52e8758492 ]
Some subsystems enable -Wmaybe-uninitialized [1], which can trigger
false positives when KCSAN is enabled. Specifically, passing an
uninitialized variable to functions that instrument accesses (e.g.,
copy_from_user()) results in calls to __kcsan_check_access().
Because __kcsan_check_access() takes a `const volatile void *ptr`, GCC
infers that the function may only read the memory location, and thus
warns if the passed variable is uninitialized.
However, KCSAN is a dynamic analysis tool for data race detection; while
it does read the memory location to detect concurrent modifications, the
"initialized'ness" of the memory location is irrelevant for its analysis.
Use absolute_pointer() in __kcsan_check_write(), kcsan_check_write(),
and kcsan_check_atomic_write() to hide the pointer from the compiler,
preventing it from concluding that the pointer passed points to
uninitialized memory.
This fixes warnings like:
| CC fs/ntfs3/file.o
| In file included from include/asm-generic/rwonce.h:27,
| from arch/arm64/include/asm/rwonce.h:81,
| from include/linux/compiler.h:369,
| from include/linux/array_size.h:5,
| from include/linux/kernel.h:16,
| from include/linux/backing-dev.h:12,
| from fs/ntfs3/file.c:10:
| In function 'instrument_copy_from_user_before',
| inlined from '_inline_copy_from_user' at include/linux/uaccess.h:184:2,
| inlined from 'copy_from_user' at include/linux/uaccess.h:221:9,
| inlined from 'ntfs_ioctl_fitrim' at fs/ntfs3/file.c:77:6,
| inlined from 'ntfs_ioctl' at fs/ntfs3/file.c:164:10:
| include/linux/kcsan-checks.h:220:28: error: 'range' may be used uninitialized [-Werror=maybe-uninitialized]
| 220 | #define kcsan_check_access __kcsan_check_access
| | ^
| include/linux/kcsan-checks.h:311:9: note: in expansion of macro 'kcsan_check_access'
| 311 | kcsan_check_access(ptr, size, KCSAN_ACCESS_WRITE)
| | ^~~~~~~~~~~~~~~~~~
| include/linux/instrumented.h:147:9: note: in expansion of macro 'kcsan_check_write'
| 147 | kcsan_check_write(to, n);
| | ^~~~~~~~~~~~~~~~~
| include/linux/kcsan-checks.h: In function 'ntfs_ioctl':
| include/linux/kcsan-checks.h:37:6: note: by argument 1 of type 'const volatile void *' to '__kcsan_check_access' declared here
| 37 | void __kcsan_check_access(const volatile void *ptr, size_t size, int type);
| | ^~~~~~~~~~~~~~~~~~~~
| fs/ntfs3/file.c:65:29: note: 'range' declared here
| 65 | struct fstrim_range range;
| | ^~~~~
Link: https://lore.kernel.org/all/5da10cca-875b-418d-b54e-6be3ea32c266@app.fastmail.com/ [1]
Reported-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Tested-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Marco Elver <elver@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/kcsan-checks.h | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/include/linux/kcsan-checks.h b/include/linux/kcsan-checks.h
index 92f3843d9ebb8..e135dacaa90f3 100644
--- a/include/linux/kcsan-checks.h
+++ b/include/linux/kcsan-checks.h
@@ -282,7 +282,7 @@ static inline void __kcsan_disable_current(void) { }
* @size: size of access
*/
#define __kcsan_check_write(ptr, size) \
- __kcsan_check_access(ptr, size, KCSAN_ACCESS_WRITE)
+ __kcsan_check_access(absolute_pointer(ptr), size, KCSAN_ACCESS_WRITE)
/**
* __kcsan_check_read_write - check regular read-write access for races
@@ -308,7 +308,7 @@ static inline void __kcsan_disable_current(void) { }
* @size: size of access
*/
#define kcsan_check_write(ptr, size) \
- kcsan_check_access(ptr, size, KCSAN_ACCESS_WRITE)
+ kcsan_check_access(absolute_pointer(ptr), size, KCSAN_ACCESS_WRITE)
/**
* kcsan_check_read_write - check regular read-write access for races
@@ -331,7 +331,7 @@ static inline void __kcsan_disable_current(void) { }
#define kcsan_check_atomic_read(ptr, size) \
kcsan_check_access(ptr, size, KCSAN_ACCESS_ATOMIC)
#define kcsan_check_atomic_write(ptr, size) \
- kcsan_check_access(ptr, size, KCSAN_ACCESS_ATOMIC | KCSAN_ACCESS_WRITE)
+ kcsan_check_access(absolute_pointer(ptr), size, KCSAN_ACCESS_ATOMIC | KCSAN_ACCESS_WRITE)
#define kcsan_check_atomic_read_write(ptr, size) \
kcsan_check_access(ptr, size, KCSAN_ACCESS_ATOMIC | KCSAN_ACCESS_WRITE | KCSAN_ACCESS_COMPOUND)
#endif
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 013/982] firmware: stratix10-svc: change get provision data to async SMC call
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 012/982] kcsan: Silence -Wmaybe-uninitialized when calling __kcsan_check_access() Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 014/982] bridge: Do not suppress ARP probes and DAD NS unconditionally Greg Kroah-Hartman
` (975 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Richard Gong, Siew Chin Lim,
Dinh Nguyen, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siew Chin Lim <elly.siew.chin.lim@intel.com>
[ Upstream commit 4b0a32016347bfd6ae9849f21b1b767905f68d14 ]
Change INTEL_SIP_SMC_FCS_GET_PROVISION_DATA's SMC call to async from sync
to avoid long runtime which may cause the watchdog timeout issue.
Signed-off-by: Richard Gong <richard.gong@intel.com>
Signed-off-by: Siew Chin Lim <elly.siew.chin.lim@intel.com>
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/stratix10-svc.c | 4 ++--
include/linux/firmware/intel/stratix10-smc.h | 12 ++++--------
2 files changed, 6 insertions(+), 10 deletions(-)
diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c
index c4a709f2bbc7a..5966f09e73fc7 100644
--- a/drivers/firmware/stratix10-svc.c
+++ b/drivers/firmware/stratix10-svc.c
@@ -339,6 +339,7 @@ static void svc_thread_recv_status_ok(struct stratix10_svc_data *p_data,
case COMMAND_FCS_SEND_CERTIFICATE:
case COMMAND_FCS_DATA_ENCRYPTION:
case COMMAND_FCS_DATA_DECRYPTION:
+ case COMMAND_FCS_GET_PROVISION_DATA:
cb_data->status = BIT(SVC_STATUS_OK);
break;
case COMMAND_RECONFIG_DATA_SUBMIT:
@@ -365,7 +366,6 @@ static void svc_thread_recv_status_ok(struct stratix10_svc_data *p_data,
cb_data->kaddr2 = &res.a2;
break;
case COMMAND_FCS_RANDOM_NUMBER_GEN:
- case COMMAND_FCS_GET_PROVISION_DATA:
case COMMAND_POLL_SERVICE_STATUS:
cb_data->status = BIT(SVC_STATUS_OK);
cb_data->kaddr1 = &res.a1;
@@ -525,7 +525,7 @@ static int svc_normal_to_secure_thread(void *data)
break;
case COMMAND_FCS_GET_PROVISION_DATA:
a0 = INTEL_SIP_SMC_FCS_GET_PROVISION_DATA;
- a1 = (unsigned long)pdata->paddr;
+ a1 = 0;
a2 = 0;
break;
diff --git a/include/linux/firmware/intel/stratix10-smc.h b/include/linux/firmware/intel/stratix10-smc.h
index a718f853d4578..4ae295c4e9cc1 100644
--- a/include/linux/firmware/intel/stratix10-smc.h
+++ b/include/linux/firmware/intel/stratix10-smc.h
@@ -575,24 +575,20 @@ INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_FPGA_CONFIG_COMPLETED_WRITE)
/**
* Request INTEL_SIP_SMC_FCS_GET_PROVISION_DATA
- * Sync call to dump all the fuses and key hashes
+ * Async call to dump all the fuses and key hashes
*
* Call register usage:
* a0 INTEL_SIP_SMC_FCS_GET_PROVISION_DATA
- * a1 the physical address for firmware to write structure of fuse and
- * key hashes
- * a2-a7 not used
+ * a1-a7 not used
*
* Return status:
* a0 INTEL_SIP_SMC_STATUS_OK, INTEL_SIP_SMC_FCS_ERROR or
* INTEL_SIP_SMC_FCS_REJECTED
- * a1 mailbox error
- * a2 physical address for the structure of fuse and key hashes
- * a3 the size of structure
+ * a1-a3 not used
*
*/
#define INTEL_SIP_SMC_FUNCID_FCS_GET_PROVISION_DATA 94
#define INTEL_SIP_SMC_FCS_GET_PROVISION_DATA \
- INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_FCS_GET_PROVISION_DATA)
+ INTEL_SIP_SMC_STD_CALL_VAL(INTEL_SIP_SMC_FUNCID_FCS_GET_PROVISION_DATA)
#endif
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 014/982] bridge: Do not suppress ARP probes and DAD NS unconditionally
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 013/982] firmware: stratix10-svc: change get provision data to async SMC call Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 015/982] soundwire: validate DT compatible before parsing it Greg Kroah-Hartman
` (974 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ido Schimmel, Danielle Ratson,
Nikolay Aleksandrov, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danielle Ratson <danieller@nvidia.com>
[ Upstream commit fee1fc1d5a5475f5516d406a03e443348cd0f06c ]
When neighbor suppression is enabled on a VXLAN port, the bridge is
expected to reply to ARP/NS messages on behalf of remote hosts when both
FDB and neighbor entries exist. This allows the bridge to suppress
flooding of these messages to the VXLAN overlay.
According to RFC 9161 ("Operational Aspects of Proxy ARP/ND in Ethernet
Virtual Private Networks"):
"A PE SHOULD reply to broadcast/multicast address resolution messages,
i.e., ARP Requests, ARP probes, NS messages, as well as DAD NS messages.
An ARP probe is an ARP Request constructed with an all-zero sender IP
address that may be used by hosts for IPv4 Address Conflict Detection as
specified in [RFC5227]".
However, the current implementation unconditionally suppresses ARP probes
and DAD Neighbor Solicitations, which breaks Duplicate Address Detection
(DAD) over EVPN.
For DAD to work correctly over the VXLAN fabric:
- When the bridge does not know the answer:
flood the probe/DAD packet to allow remote VTEPs to respond.
- When the bridge knows the answer:
reply to indicate the address is in use.
Fix by adjusting the early suppression checks to exclude ARP probes and
DAD NS from unconditional suppression.
When replying to a DAD NS, br_nd_send() is adjusted to set the NA
destination to the all-nodes multicast address (ff02::1) and clear the
Solicited flag, in accordance with RFC 4861 section 7.2.4.
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: Danielle Ratson <danieller@nvidia.com>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://patch.msgid.link/20260429062405.1386417-2-danieller@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bridge/br_arp_nd_proxy.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/net/bridge/br_arp_nd_proxy.c b/net/bridge/br_arp_nd_proxy.c
index 1914027e8bb3c..97d0349189aaf 100644
--- a/net/bridge/br_arp_nd_proxy.c
+++ b/net/bridge/br_arp_nd_proxy.c
@@ -162,7 +162,7 @@ void br_do_proxy_suppress_arp(struct sk_buff *skb, struct net_bridge *br,
return;
if (parp->ar_op != htons(ARPOP_RREQUEST) &&
parp->ar_op != htons(ARPOP_RREPLY) &&
- (ipv4_is_zeronet(sip) || sip == tip)) {
+ sip == tip) {
/* prevent flooding to neigh suppress ports */
BR_INPUT_SKB_CB(skb)->proxyarp_replied = 1;
return;
@@ -260,6 +260,7 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p,
int ns_olen;
int i, len;
u8 *daddr;
+ bool dad;
u16 pvid;
if (!dev || skb_linearize(request))
@@ -298,8 +299,13 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p,
}
}
+ dad = ipv6_addr_any(&ipv6_hdr(request)->saddr);
+
/* Ethernet header */
- ether_addr_copy(eth_hdr(reply)->h_dest, daddr);
+ if (dad)
+ ipv6_eth_mc_map(&in6addr_linklocal_allnodes, eth_hdr(reply)->h_dest);
+ else
+ ether_addr_copy(eth_hdr(reply)->h_dest, daddr);
ether_addr_copy(eth_hdr(reply)->h_source, n->ha);
eth_hdr(reply)->h_proto = htons(ETH_P_IPV6);
reply->protocol = htons(ETH_P_IPV6);
@@ -315,7 +321,7 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p,
pip6->priority = ipv6_hdr(request)->priority;
pip6->nexthdr = IPPROTO_ICMPV6;
pip6->hop_limit = 255;
- pip6->daddr = ipv6_hdr(request)->saddr;
+ pip6->daddr = dad ? in6addr_linklocal_allnodes : ipv6_hdr(request)->saddr;
pip6->saddr = *(struct in6_addr *)n->primary_key;
skb_pull(reply, sizeof(struct ipv6hdr));
@@ -328,7 +334,7 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p,
na->icmph.icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT;
na->icmph.icmp6_router = (n->flags & NTF_ROUTER) ? 1 : 0;
na->icmph.icmp6_override = 1;
- na->icmph.icmp6_solicited = 1;
+ na->icmph.icmp6_solicited = dad ? 0 : 1;
na->target = ns->target;
ether_addr_copy(&na->opt[2], n->ha);
na->opt[0] = ND_OPT_TARGET_LL_ADDR;
@@ -429,7 +435,7 @@ void br_do_suppress_nd(struct sk_buff *skb, struct net_bridge *br,
saddr = &iphdr->saddr;
daddr = &iphdr->daddr;
- if (ipv6_addr_any(saddr) || !ipv6_addr_cmp(saddr, daddr)) {
+ if (!ipv6_addr_cmp(saddr, daddr)) {
/* prevent flooding to neigh suppress ports */
BR_INPUT_SKB_CB(skb)->proxyarp_replied = 1;
return;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 015/982] soundwire: validate DT compatible before parsing it
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 014/982] bridge: Do not suppress ARP probes and DAD NS unconditionally Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 016/982] media: rc: mceusb: Add support for 04eb:e033 Greg Kroah-Hartman
` (973 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Vinod Koul,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ Upstream commit 45c7bda7b7440183850012153988e40b300f40d0 ]
`sdw_of_find_slaves()` fetches raw `"compatible"` bytes with
`of_get_property()` and then immediately parses them with
`sscanf("sdw%01x%04hx%04hx%02hhx", ...)`.
Live-tree OF properties are stored as raw bytes plus a separate length;
they are not globally guaranteed to be NUL-terminated. Validate the
first compatible string before parsing it.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260403183504.4-soundwire-compatible-pengpeng@iscas.ac.cn
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soundwire/slave.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/soundwire/slave.c b/drivers/soundwire/slave.c
index 28b0d7b6d780c..60a80904e75bb 100644
--- a/drivers/soundwire/slave.c
+++ b/drivers/soundwire/slave.c
@@ -233,8 +233,8 @@ int sdw_of_find_slaves(struct sdw_bus *bus)
struct sdw_slave_id id;
const __be32 *addr;
- compat = of_get_property(node, "compatible", NULL);
- if (!compat)
+ ret = of_property_read_string(node, "compatible", &compat);
+ if (ret)
continue;
ret = sscanf(compat, "sdw%01x%04hx%04hx%02hhx", &sdw_version,
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 016/982] media: rc: mceusb: Add support for 04eb:e033
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 015/982] soundwire: validate DT compatible before parsing it Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 017/982] s390/cio: Purge based on the cdevs online status Greg Kroah-Hartman
` (972 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Riccardo Boninsegna, Sean Young,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Riccardo Boninsegna <rboninsegna2@gmail.com>
[ Upstream commit 0692c2602e4cd410aa045f8991bd1c142b2e56f9 ]
This is a Sonix SN8P2202XG microcontroller with firmware compatible with
the already supported Northstar 04eb:e004, implementing an MCE IR receiver
(PCB seems to be tracked for a transmitter too but missing related parts).
Found in a Skintek SK-CR-IN+IR ( http://www.skintek.it/SK-CR-IN+IR.php )
internal 3.5 inch USB card reader and MCE receiver combo
(implemented by, and wired as, separate USB devices)
PCB marking: AU6475 966816 STIR REV:A02 MCE
Signed-off-by: Riccardo Boninsegna <rboninsegna2@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/mceusb.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c
index c76ba24c1f559..e74ca24a149b8 100644
--- a/drivers/media/rc/mceusb.c
+++ b/drivers/media/rc/mceusb.c
@@ -398,6 +398,8 @@ static const struct usb_device_id mceusb_dev_table[] = {
{ USB_DEVICE(VENDOR_COMPRO, 0x3082) },
/* Northstar Systems, Inc. eHome Infrared Transceiver */
{ USB_DEVICE(VENDOR_NORTHSTAR, 0xe004) },
+ /* Northstar Systems, Inc. eHome Infrared Transceiver - variant */
+ { USB_DEVICE(VENDOR_NORTHSTAR, 0xe033) },
/* TiVo PC IR Receiver */
{ USB_DEVICE(VENDOR_TIVO, 0x2000),
.driver_info = TIVO_KIT },
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 017/982] s390/cio: Purge based on the cdevs online status
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 016/982] media: rc: mceusb: Add support for 04eb:e033 Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 018/982] thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() Greg Kroah-Hartman
` (971 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vineeth Vijayan, Peter Oberparleiter,
Alexander Gordeev, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vineeth Vijayan <vneethv@linux.ibm.com>
[ Upstream commit 58d50cad63e85daae032924ecc3d457fb1ec02fb ]
Ensure that all devices currently offline are purged correctly.
Previously, purging logic relied on the internal FSM state to
determine whether a device was offline. However, devices with a
target state of offline could be skipped if CIO internal
processing was still ongoing during the purge operation.
Update the purge decision logic to rely on the online variable
in the cdev structure instead of the internal FSM state,
providing a more reliable indication of actual device
availability.
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/s390/cio/device.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index 1873c865b4d6c..bfecf08aeb894 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -1322,7 +1322,7 @@ static int purge_fn(struct subchannel *sch, void *data)
cdev = sch_get_cdev(sch);
if (cdev) {
- if (cdev->private->state != DEV_STATE_OFFLINE)
+ if (cdev->online)
goto unlock;
if (atomic_cmpxchg(&cdev->private->onoff, 0, 1) != 0)
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 018/982] thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response()
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 017/982] s390/cio: Purge based on the cdevs online status Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 019/982] thunderbolt: Keep XDomain reference during the lifetime of a service Greg Kroah-Hartman
` (970 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mika Westerberg, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Westerberg <mika.westerberg@linux.intel.com>
[ Upstream commit 4c63f29872cb444b33665348bbd2f45cab06afcd ]
If tb_cfg_request() fails setting up the request (for example the
control channel is shut down already) it returns an error without
calling the callback. To avoid leaking that memory, call
tb_cfg_request_put() if tb_cfg_request() fails.
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/thunderbolt/xdomain.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/thunderbolt/xdomain.c b/drivers/thunderbolt/xdomain.c
index 371911e2ae428..6a003316b878b 100644
--- a/drivers/thunderbolt/xdomain.c
+++ b/drivers/thunderbolt/xdomain.c
@@ -138,6 +138,7 @@ static int __tb_xdomain_response(struct tb_ctl *ctl, const void *response,
size_t size, enum tb_cfg_pkg_type type)
{
struct tb_cfg_request *req;
+ int ret;
req = tb_cfg_request_alloc();
if (!req)
@@ -149,7 +150,11 @@ static int __tb_xdomain_response(struct tb_ctl *ctl, const void *response,
req->request_size = size;
req->request_type = type;
- return tb_cfg_request(ctl, req, response_ready, req);
+ ret = tb_cfg_request(ctl, req, response_ready, req);
+ if (ret)
+ tb_cfg_request_put(req);
+
+ return ret;
}
/**
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 019/982] thunderbolt: Keep XDomain reference during the lifetime of a service
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 018/982] thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 020/982] thunderbolt: Keep the domain reference while processing hotplug Greg Kroah-Hartman
` (969 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mika Westerberg, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Westerberg <mika.westerberg@linux.intel.com>
[ Upstream commit 8b4060998637f06975fceee9b73845d8672d411e ]
This is needed because we release the service ID in tb_service_release()
and the ID array is owned by the parent XDomain.
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/thunderbolt/xdomain.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/thunderbolt/xdomain.c b/drivers/thunderbolt/xdomain.c
index 6a003316b878b..58c91423e4f07 100644
--- a/drivers/thunderbolt/xdomain.c
+++ b/drivers/thunderbolt/xdomain.c
@@ -1026,6 +1026,7 @@ static void tb_service_release(struct device *dev)
ida_simple_remove(&xd->service_ids, svc->id);
kfree(svc->key);
kfree(svc);
+ tb_xdomain_put(xd);
}
struct device_type tb_service_type = {
@@ -1134,7 +1135,7 @@ static void enumerate_services(struct tb_xdomain *xd)
svc->id = id;
svc->dev.bus = &tb_bus_type;
svc->dev.type = &tb_service_type;
- svc->dev.parent = &xd->dev;
+ svc->dev.parent = get_device(&xd->dev);
dev_set_name(&svc->dev, "%s.%d", dev_name(&xd->dev), svc->id);
tb_service_debugfs_init(svc);
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 020/982] thunderbolt: Keep the domain reference while processing hotplug
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 019/982] thunderbolt: Keep XDomain reference during the lifetime of a service Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 021/982] thunderbolt: Set tb->root_switch to NULL when domain is stopped Greg Kroah-Hartman
` (968 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mika Westerberg, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Westerberg <mika.westerberg@linux.intel.com>
[ Upstream commit 138ec65b2c761f065b19d115aed2b8246fc272f5 ]
We process hotplug events in a workqueue that may run after the domain
has been removed by tb_domain_remove(). For example if user unloads the
driver while at the same time plugging a device router we may have
scheduled tb_handle_hotplug() to run. Avoid possible UAF in this case by
taking the domain reference before scheduling the hotplug handler in
tb_queue_hotplug().
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/thunderbolt/tb.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c
index f417ce477d4a0..3c993a40c2313 100644
--- a/drivers/thunderbolt/tb.c
+++ b/drivers/thunderbolt/tb.c
@@ -59,7 +59,7 @@ static void tb_queue_hotplug(struct tb *tb, u64 route, u8 port, bool unplug)
if (!ev)
return;
- ev->tb = tb;
+ ev->tb = tb_domain_get(tb);
ev->route = route;
ev->port = port;
ev->unplug = unplug;
@@ -1464,6 +1464,9 @@ static void tb_handle_hotplug(struct work_struct *work)
pm_runtime_mark_last_busy(&tb->dev);
pm_runtime_put_autosuspend(&tb->dev);
+ /* Undo the refcount increased in tb_queue_hotplug() */
+ tb_domain_put(tb);
+
kfree(ev);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 021/982] thunderbolt: Set tb->root_switch to NULL when domain is stopped
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 020/982] thunderbolt: Keep the domain reference while processing hotplug Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 022/982] thunderbolt: Dont create multiple DMA tunnels on firmware connection manager Greg Kroah-Hartman
` (967 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mika Westerberg, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Westerberg <mika.westerberg@linux.intel.com>
[ Upstream commit e56249d8a68e712f3b60e1f3fdbb5b4fea146468 ]
Similarly what we do with the firmware connection manager. This makes
tb_xdp_handle_request() return error to the remote host. However, we
need to make sure we keep the uuid alive so that we can reply until the
whole domain is released.
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/thunderbolt/tb.c | 1 +
drivers/thunderbolt/xdomain.c | 6 +++++-
2 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c
index 3c993a40c2313..00cedf7c24725 100644
--- a/drivers/thunderbolt/tb.c
+++ b/drivers/thunderbolt/tb.c
@@ -1515,6 +1515,7 @@ static void tb_stop(struct tb *tb)
tb_tunnel_free(tunnel);
}
tb_switch_remove(tb->root_switch);
+ tb->root_switch = NULL;
tcm->hotplug_active = false; /* signal tb_handle_hotplug to quit */
}
diff --git a/drivers/thunderbolt/xdomain.c b/drivers/thunderbolt/xdomain.c
index 58c91423e4f07..f0753a0d5b72e 100644
--- a/drivers/thunderbolt/xdomain.c
+++ b/drivers/thunderbolt/xdomain.c
@@ -755,7 +755,7 @@ static void tb_xdp_handle_request(struct work_struct *work)
mutex_lock(&tb->lock);
if (tb->root_switch)
- uuid = tb->root_switch->uuid;
+ uuid = kmemdup(tb->root_switch->uuid, sizeof(*uuid), GFP_KERNEL);
else
uuid = NULL;
mutex_unlock(&tb->lock);
@@ -869,6 +869,7 @@ static void tb_xdp_handle_request(struct work_struct *work)
}
out:
+ kfree(uuid);
kfree(xw->pkg);
kfree(xw);
@@ -2223,6 +2224,9 @@ static struct tb_xdomain *switch_find_xdomain(struct tb_switch *sw,
{
struct tb_port *port;
+ if (!sw)
+ return NULL;
+
tb_switch_for_each_port(sw, port) {
struct tb_xdomain *xd;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 022/982] thunderbolt: Dont create multiple DMA tunnels on firmware connection manager
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 021/982] thunderbolt: Set tb->root_switch to NULL when domain is stopped Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 023/982] media: dm1105: fix missing error check for dma_alloc_coherent Greg Kroah-Hartman
` (966 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alan Borzeszkowski, Mika Westerberg,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
[ Upstream commit cf0c38ee554c3e9062408cc3a38325483d52ecd0 ]
Firmware connection manager supports only one DMA tunnel per XDomain
connection. Firmware prior Intel Titan Ridge failed the operation
directly but the same does not happen anymore on Titan Ridge and
forward. For this reason add an explicit check, and fail the operation
accordingly in the driver.
Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/thunderbolt/icm.c | 10 ++++++++++
drivers/thunderbolt/xdomain.c | 25 +++++++++++++++++++------
include/linux/thunderbolt.h | 2 ++
3 files changed, 31 insertions(+), 6 deletions(-)
diff --git a/drivers/thunderbolt/icm.c b/drivers/thunderbolt/icm.c
index 6d354392fcbc4..090388d71f46f 100644
--- a/drivers/thunderbolt/icm.c
+++ b/drivers/thunderbolt/icm.c
@@ -565,6 +565,11 @@ static int icm_fr_approve_xdomain_paths(struct tb *tb, struct tb_xdomain *xd,
struct icm_fr_pkg_approve_xdomain request;
int ret;
+ if (atomic_read(&xd->ntunnels) >= 1) {
+ tb_warn(tb, "only one tunnel is supported by the firmware\n");
+ return -EOPNOTSUPP;
+ }
+
memset(&request, 0, sizeof(request));
request.hdr.code = ICM_APPROVE_XDOMAIN;
request.link_info = xd->depth << ICM_LINK_INFO_DEPTH_SHIFT | xd->link;
@@ -1134,6 +1139,11 @@ static int icm_tr_approve_xdomain_paths(struct tb *tb, struct tb_xdomain *xd,
struct icm_tr_pkg_approve_xdomain request;
int ret;
+ if (atomic_read(&xd->ntunnels) >= 1) {
+ tb_warn(tb, "only one tunnel is supported by the firmware\n");
+ return -EOPNOTSUPP;
+ }
+
memset(&request, 0, sizeof(request));
request.hdr.code = ICM_APPROVE_XDOMAIN;
request.route_hi = upper_32_bits(xd->route);
diff --git a/drivers/thunderbolt/xdomain.c b/drivers/thunderbolt/xdomain.c
index f0753a0d5b72e..6dac354de4bb8 100644
--- a/drivers/thunderbolt/xdomain.c
+++ b/drivers/thunderbolt/xdomain.c
@@ -1920,6 +1920,7 @@ struct tb_xdomain *tb_xdomain_alloc(struct tb *tb, struct device *parent,
INIT_DELAYED_WORK(&xd->state_work, tb_xdomain_state_work);
INIT_DELAYED_WORK(&xd->properties_changed_work,
tb_xdomain_properties_changed);
+ atomic_set(&xd->ntunnels, 0);
xd->local_uuid = kmemdup(local_uuid, sizeof(uuid_t), GFP_KERNEL);
if (!xd->local_uuid)
@@ -2181,9 +2182,15 @@ int tb_xdomain_enable_paths(struct tb_xdomain *xd, int transmit_path,
int transmit_ring, int receive_path,
int receive_ring)
{
- return tb_domain_approve_xdomain_paths(xd->tb, xd, transmit_path,
- transmit_ring, receive_path,
- receive_ring);
+ int ret;
+
+ ret = tb_domain_approve_xdomain_paths(xd->tb, xd, transmit_path,
+ transmit_ring, receive_path,
+ receive_ring);
+ if (ret)
+ return ret;
+ atomic_inc(&xd->ntunnels);
+ return 0;
}
EXPORT_SYMBOL_GPL(tb_xdomain_enable_paths);
@@ -2206,9 +2213,15 @@ int tb_xdomain_disable_paths(struct tb_xdomain *xd, int transmit_path,
int transmit_ring, int receive_path,
int receive_ring)
{
- return tb_domain_disconnect_xdomain_paths(xd->tb, xd, transmit_path,
- transmit_ring, receive_path,
- receive_ring);
+ int ret;
+
+ ret = tb_domain_disconnect_xdomain_paths(xd->tb, xd, transmit_path,
+ transmit_ring, receive_path,
+ receive_ring);
+ if (ret)
+ return ret;
+ atomic_dec(&xd->ntunnels);
+ return 0;
}
EXPORT_SYMBOL_GPL(tb_xdomain_disable_paths);
diff --git a/include/linux/thunderbolt.h b/include/linux/thunderbolt.h
index 98af9ad04cac1..fbeab0ec165ca 100644
--- a/include/linux/thunderbolt.h
+++ b/include/linux/thunderbolt.h
@@ -210,6 +210,7 @@ void tb_unregister_property_dir(const char *key, struct tb_property_dir *dir);
* changed notification
* @bonding_possible: True if lane bonding is possible on local side
* @target_link_width: Target link width from the remote host
+ * @ntunnels: Keeps track of how many tunnels go through this XDomain
* @link: Root switch link the remote domain is connected (ICM only)
* @depth: Depth in the chain the remote domain is connected (ICM only)
*
@@ -256,6 +257,7 @@ struct tb_xdomain {
int properties_changed_retries;
bool bonding_possible;
u8 target_link_width;
+ atomic_t ntunnels;
u8 link;
u8 depth;
};
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 023/982] media: dm1105: fix missing error check for dma_alloc_coherent
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 022/982] thunderbolt: Dont create multiple DMA tunnels on firmware connection manager Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 024/982] net: dsa: mv88e6xxx: fix number of g1 interrupts for 6320 family Greg Kroah-Hartman
` (965 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhaoyang Yu, Hans Verkuil,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhaoyang Yu <2426767509@qq.com>
[ Upstream commit 3eaac9e02d8591d3c790db572ef1c8fa5a841fdb ]
The return value of dm1105_dma_map(), which handles DMA memory allocation,
is ignored in dm1105_hw_init(). If dma_alloc_coherent() fails, the driver
will proceed using a NULL pointer for DMA transfers, leading to a kernel
oops or invalid hardware access.
Fix this by checking the return value and propagating -ENOMEM on failure.
Signed-off-by: Zhaoyang Yu <2426767509@qq.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/dm1105/dm1105.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/media/pci/dm1105/dm1105.c b/drivers/media/pci/dm1105/dm1105.c
index 57f7e4df41b22..f20bea8623af7 100644
--- a/drivers/media/pci/dm1105/dm1105.c
+++ b/drivers/media/pci/dm1105/dm1105.c
@@ -767,6 +767,8 @@ static void dm1105_ir_exit(struct dm1105_dev *dm1105)
static int dm1105_hw_init(struct dm1105_dev *dev)
{
+ int ret;
+
dm1105_disable_irqs(dev);
dm_writeb(DM1105_HOST_CTR, 0);
@@ -777,7 +779,10 @@ static int dm1105_hw_init(struct dm1105_dev *dev)
dm_writew(DM1105_TSCTR, 0xc10a);
/* map DMA and set address */
- dm1105_dma_map(dev);
+ ret = dm1105_dma_map(dev);
+ if (ret)
+ return -ENOMEM;
+
dm1105_set_dma_addr(dev);
/* big buffer */
dm_writel(DM1105_RLEN, 5 * DM1105_DMA_BYTES);
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 024/982] net: dsa: mv88e6xxx: fix number of g1 interrupts for 6320 family
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 023/982] media: dm1105: fix missing error check for dma_alloc_coherent Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 025/982] PCI: switchtec: Add Gen6 Device IDs Greg Kroah-Hartman
` (964 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Behún, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Behún <kabel@kernel.org>
[ Upstream commit d201c2612e5aada0c931cd55115175e0a5141023 ]
The 6320 family has 9 global1 interrupt, not 8. Fix it.
Signed-off-by: Marek Behún <kabel@kernel.org>
Link: https://patch.msgid.link/20260504153227.1390546-2-kabel@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/mv88e6xxx/chip.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index 29e4c94c84051..783d7035f065e 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -6228,7 +6228,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
.global1_addr = 0x1b,
.global2_addr = 0x1c,
.age_time_coeff = 15000,
- .g1_irqs = 8,
+ .g1_irqs = 9,
.g2_irqs = 10,
.atu_move_port_mask = 0xf,
.pvt = true,
@@ -6255,7 +6255,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
.global1_addr = 0x1b,
.global2_addr = 0x1c,
.age_time_coeff = 15000,
- .g1_irqs = 8,
+ .g1_irqs = 9,
.g2_irqs = 10,
.atu_move_port_mask = 0xf,
.pvt = true,
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 025/982] PCI: switchtec: Add Gen6 Device IDs
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 024/982] net: dsa: mv88e6xxx: fix number of g1 interrupts for 6320 family Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 026/982] net: dsa: mv88e6xxx: define .pot_clear() for 6321 Greg Kroah-Hartman
` (963 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ben Reed, Logan Gunthorpe,
Bjorn Helgaas, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Reed <Ben.Reed@microchip.com>
[ Upstream commit 5e6c21c56998e1e58d2f314e70779989ea0fee5d ]
Add device IDs for the next generation of switchtec products.
No changes to the driver were required with the new version of the
hardware.
[logang: rewrote commit message]
Signed-off-by: Ben Reed <Ben.Reed@microchip.com>
Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260505161633.67454-1-logang@deltatee.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/switch/switchtec.c | 16 ++++++++++++++++
include/linux/switchtec.h | 1 +
2 files changed, 17 insertions(+)
diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c
index 9011518b1d132..37c5ba40d959f 100644
--- a/drivers/pci/switch/switchtec.c
+++ b/drivers/pci/switch/switchtec.c
@@ -1853,6 +1853,22 @@ static const struct pci_device_id switchtec_pci_tbl[] = {
SWITCHTEC_PCI_DEVICE(0x5552, SWITCHTEC_GEN5), /* PAXA 52XG5 */
SWITCHTEC_PCI_DEVICE(0x5536, SWITCHTEC_GEN5), /* PAXA 36XG5 */
SWITCHTEC_PCI_DEVICE(0x5528, SWITCHTEC_GEN5), /* PAXA 28XG5 */
+ SWITCHTEC_PCI_DEVICE(0x6048, SWITCHTEC_GEN6), /* PFXs 48XG6 */
+ SWITCHTEC_PCI_DEVICE(0x6064, SWITCHTEC_GEN6), /* PFXs 64XG6 */
+ SWITCHTEC_PCI_DEVICE(0x6044, SWITCHTEC_GEN6), /* PFXs 144XG6 */
+ SWITCHTEC_PCI_DEVICE(0x6060, SWITCHTEC_GEN6), /* PFXs 160XG6 */
+ SWITCHTEC_PCI_DEVICE(0x6148, SWITCHTEC_GEN6), /* PSXs 48XG6 */
+ SWITCHTEC_PCI_DEVICE(0x6164, SWITCHTEC_GEN6), /* PSXs 64XG6 */
+ SWITCHTEC_PCI_DEVICE(0x6144, SWITCHTEC_GEN6), /* PSXs 144XG6 */
+ SWITCHTEC_PCI_DEVICE(0x6160, SWITCHTEC_GEN6), /* PSXs 160XG6 */
+ SWITCHTEC_PCI_DEVICE(0x6248, SWITCHTEC_GEN6), /* PFX 48XG6 */
+ SWITCHTEC_PCI_DEVICE(0x6264, SWITCHTEC_GEN6), /* PFX 64XG6 */
+ SWITCHTEC_PCI_DEVICE(0x6244, SWITCHTEC_GEN6), /* PFX 144XG6 */
+ SWITCHTEC_PCI_DEVICE(0x6260, SWITCHTEC_GEN6), /* PFX 160XG6 */
+ SWITCHTEC_PCI_DEVICE(0x6348, SWITCHTEC_GEN6), /* PSX 48XG6 */
+ SWITCHTEC_PCI_DEVICE(0x6364, SWITCHTEC_GEN6), /* PSX 64XG6 */
+ SWITCHTEC_PCI_DEVICE(0x6344, SWITCHTEC_GEN6), /* PSX 144XG6 */
+ SWITCHTEC_PCI_DEVICE(0x6360, SWITCHTEC_GEN6), /* PSX 160XG6 */
SWITCHTEC_PCI100X_DEVICE(0x1001, SWITCHTEC_GEN4), /* PCI1001 16XG4 */
SWITCHTEC_PCI100X_DEVICE(0x1002, SWITCHTEC_GEN4), /* PCI1002 12XG4 */
SWITCHTEC_PCI100X_DEVICE(0x1003, SWITCHTEC_GEN4), /* PCI1003 16XG4 */
diff --git a/include/linux/switchtec.h b/include/linux/switchtec.h
index 8d8fac1626bd9..32980f2f76e09 100644
--- a/include/linux/switchtec.h
+++ b/include/linux/switchtec.h
@@ -42,6 +42,7 @@ enum switchtec_gen {
SWITCHTEC_GEN3,
SWITCHTEC_GEN4,
SWITCHTEC_GEN5,
+ SWITCHTEC_GEN6,
};
struct mrpc_regs {
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 026/982] net: dsa: mv88e6xxx: define .pot_clear() for 6321
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 025/982] PCI: switchtec: Add Gen6 Device IDs Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 027/982] net: dsa: mv88e6xxx: enable .rmu_disable() for 6320 family Greg Kroah-Hartman
` (962 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Behún, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Behún <kabel@kernel.org>
[ Upstream commit 17826d9708a57d27011d0a6efdebb628d6f8299a ]
Commit 9e907d739cc3 ("net: dsa: mv88e6xxx: add POT operation") did not
add the .pot_clear() method to the 6321 switch operations structure.
Add them now.
Signed-off-by: Marek Behún <kabel@kernel.org>
Link: https://patch.msgid.link/20260504153227.1390546-4-kabel@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/mv88e6xxx/chip.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index 783d7035f065e..ac325b3abcae9 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -5245,6 +5245,7 @@ static const struct mv88e6xxx_ops mv88e6321_ops = {
.set_egress_port = mv88e6095_g1_set_egress_port,
.watchdog_ops = &mv88e6390_watchdog_ops,
.mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu,
+ .pot_clear = mv88e6xxx_g2_pot_clear,
.hardware_reset_pre = mv88e6xxx_g2_eeprom_wait,
.hardware_reset_post = mv88e6xxx_g2_eeprom_wait,
.reset = mv88e6352_g1_reset,
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 027/982] net: dsa: mv88e6xxx: enable .rmu_disable() for 6320 family
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 026/982] net: dsa: mv88e6xxx: define .pot_clear() for 6321 Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 028/982] media: em28xx-video: fix missing res_free() on init_usb_xfer failure Greg Kroah-Hartman
` (961 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Behún, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Behún <kabel@kernel.org>
[ Upstream commit e0fdb4157a85056bd256a7aebac4a3a2f580b201 ]
Commit 9e5baf9b3636 ("net: dsa: mv88e6xxx: add RMU disable op") did not
add the .rmu_disable() method for the 6320 family. Add it now.
Signed-off-by: Marek Behún <kabel@kernel.org>
Link: https://patch.msgid.link/20260504153227.1390546-5-kabel@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/mv88e6xxx/chip.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index ac325b3abcae9..17390a004c0e9 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -5198,6 +5198,7 @@ static const struct mv88e6xxx_ops mv88e6320_ops = {
.hardware_reset_pre = mv88e6xxx_g2_eeprom_wait,
.hardware_reset_post = mv88e6xxx_g2_eeprom_wait,
.reset = mv88e6352_g1_reset,
+ .rmu_disable = mv88e6352_g1_rmu_disable,
.vtu_getnext = mv88e6352_g1_vtu_getnext,
.vtu_loadpurge = mv88e6352_g1_vtu_loadpurge,
.stu_getnext = mv88e6352_g1_stu_getnext,
@@ -5249,6 +5250,7 @@ static const struct mv88e6xxx_ops mv88e6321_ops = {
.hardware_reset_pre = mv88e6xxx_g2_eeprom_wait,
.hardware_reset_post = mv88e6xxx_g2_eeprom_wait,
.reset = mv88e6352_g1_reset,
+ .rmu_disable = mv88e6352_g1_rmu_disable,
.vtu_getnext = mv88e6352_g1_vtu_getnext,
.vtu_loadpurge = mv88e6352_g1_vtu_loadpurge,
.stu_getnext = mv88e6352_g1_stu_getnext,
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 028/982] media: em28xx-video: fix missing res_free() on init_usb_xfer failure
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 027/982] net: dsa: mv88e6xxx: enable .rmu_disable() for 6320 family Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 029/982] crypto: ixp4xx - fix buffer chain unwind on allocation failure Greg Kroah-Hartman
` (960 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Haoxiang Li, Hans Verkuil,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
[ Upstream commit cc20e81da6d99926f94fad7af21f75c07e865769 ]
res_get() is called before em28xx_init_usb_xfer(), but the error
path of em28xx_init_usb_xfer() does not release the resource,
leading to a persistent busy state.
Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/em28xx/em28xx-video.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c
index 81fff2fe8c19b..a520bec031248 100644
--- a/drivers/media/usb/em28xx/em28xx-video.c
+++ b/drivers/media/usb/em28xx/em28xx-video.c
@@ -1105,8 +1105,10 @@ int em28xx_start_analog_streaming(struct vb2_queue *vq, unsigned int count)
dev->max_pkt_size,
dev->packet_multiplier,
em28xx_urb_data_copy);
- if (rc < 0)
+ if (rc < 0) {
+ res_free(dev, vq->type);
return rc;
+ }
/*
* djh: it's not clear whether this code is still needed. I'm
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 029/982] crypto: ixp4xx - fix buffer chain unwind on allocation failure
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 028/982] media: em28xx-video: fix missing res_free() on init_usb_xfer failure Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 030/982] clk: renesas: cpg-mssr: Add number of clock cells check Greg Kroah-Hartman
` (959 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ruoyu Wang, Linus Walleij,
Herbert Xu, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <ruoyuw560@gmail.com>
[ Upstream commit 25056329384010a8672552b134f609601dc4f80e ]
chainup_buffers() builds a linked list of buffer descriptors for a
scatterlist. If dma_pool_alloc() fails while constructing the list, the
current code sets buf to NULL and later dereferences it unconditionally
at the end of the function:
buf->next = NULL;
buf->phys_next = 0;
This can lead to a null-pointer dereference on allocation failure.
If the failure happens after part of the descriptor chain has already
been allocated and DMA-mapped, the partially constructed chain also
needs to be released.
Fix this by terminating the partially constructed chain on allocation
failure and letting the callers unwind it via their existing cleanup
paths. Also fix ablk_perform() to preserve the hook pointers before
checking for failure, so partially built chains can be freed correctly.
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Acked-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/ixp4xx_crypto.c | 25 ++++++++++++++-----------
1 file changed, 14 insertions(+), 11 deletions(-)
diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c
index cfb149302e0a9..c3e2a816476dc 100644
--- a/drivers/crypto/ixp4xx_crypto.c
+++ b/drivers/crypto/ixp4xx_crypto.c
@@ -882,8 +882,9 @@ static struct buffer_desc *chainup_buffers(struct device *dev,
ptr = sg_virt(sg);
next_buf = dma_pool_alloc(buffer_pool, flags, &next_buf_phys);
if (!next_buf) {
- buf = NULL;
- break;
+ buf->next = NULL;
+ buf->phys_next = 0;
+ return NULL;
}
sg_dma_address(sg) = dma_map_single(dev, ptr, len, dir);
buf->next = next_buf;
@@ -981,7 +982,7 @@ static int ablk_perform(struct skcipher_request *req, int encrypt)
unsigned int nbytes = req->cryptlen;
enum dma_data_direction src_direction = DMA_BIDIRECTIONAL;
struct ablk_ctx *req_ctx = skcipher_request_ctx(req);
- struct buffer_desc src_hook;
+ struct buffer_desc *buf, src_hook;
struct device *dev = &pdev->dev;
unsigned int offset;
gfp_t flags = req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP ?
@@ -1023,22 +1024,24 @@ static int ablk_perform(struct skcipher_request *req, int encrypt)
/* This was never tested by Intel
* for more than one dst buffer, I think. */
req_ctx->dst = NULL;
- if (!chainup_buffers(dev, req->dst, nbytes, &dst_hook,
- flags, DMA_FROM_DEVICE))
- goto free_buf_dest;
- src_direction = DMA_TO_DEVICE;
+ buf = chainup_buffers(dev, req->dst, nbytes, &dst_hook,
+ flags, DMA_FROM_DEVICE);
req_ctx->dst = dst_hook.next;
crypt->dst_buf = dst_hook.phys_next;
+ if (!buf)
+ goto free_buf_dest;
+ src_direction = DMA_TO_DEVICE;
} else {
req_ctx->dst = NULL;
}
req_ctx->src = NULL;
- if (!chainup_buffers(dev, req->src, nbytes, &src_hook, flags,
- src_direction))
- goto free_buf_src;
-
+ buf = chainup_buffers(dev, req->src, nbytes, &src_hook, flags,
+ src_direction);
req_ctx->src = src_hook.next;
crypt->src_buf = src_hook.phys_next;
+ if (!buf)
+ goto free_buf_src;
+
crypt->ctl_flags |= CTL_FLAG_PERFORM_ABLK;
qmgr_put_entry(send_qid, crypt_virt2phys(crypt));
BUG_ON(qmgr_stat_overflow(send_qid));
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 030/982] clk: renesas: cpg-mssr: Add number of clock cells check
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 029/982] crypto: ixp4xx - fix buffer chain unwind on allocation failure Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 031/982] drm/bridge: tc358768: Set pre_enable_prev_first for reverse order Greg Kroah-Hartman
` (958 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, Biju Das,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <geert+renesas@glider.be>
[ Upstream commit 7f0c422c7fbfd9294ff9321ada0c63561e5c6ea0 ]
The number of clock cells is not validated in the clock provider's
clk_src_get() callback. Add the missing check.
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com>
Link: https://patch.msgid.link/46e010659ffdffd5e3541369f3b65d43ebe236ec.1777562043.git.geert+renesas@glider.be
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/renesas/renesas-cpg-mssr.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/clk/renesas/renesas-cpg-mssr.c b/drivers/clk/renesas/renesas-cpg-mssr.c
index d6137379510c1..77365962a15a9 100644
--- a/drivers/clk/renesas/renesas-cpg-mssr.c
+++ b/drivers/clk/renesas/renesas-cpg-mssr.c
@@ -285,6 +285,9 @@ struct clk *cpg_mssr_clk_src_twocell_get(struct of_phandle_args *clkspec,
struct clk *clk;
int range_check;
+ if (clkspec->args_count != 2)
+ return ERR_PTR(-EINVAL);
+
switch (clkspec->args[0]) {
case CPG_CORE:
type = "core";
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 031/982] drm/bridge: tc358768: Set pre_enable_prev_first for reverse order
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 030/982] clk: renesas: cpg-mssr: Add number of clock cells check Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 032/982] ASoC: ti: omap3pandora: update board check to use DT compatible Greg Kroah-Hartman
` (957 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Parth Pancholi, Francesco Dolcini,
Tomi Valkeinen, Sasha Levin, João Paulo Gonçalves
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Parth Pancholi <parth.pancholi@toradex.com>
[ Upstream commit 6b2bb5438bcfd7bad868665cd2aed1caf9ba3f2b ]
Enable the pre_enable_prev_first flag on the tc358768 bridge to reverse
the pre-enable order, calling bridge pre_enable before panel prepare.
This ensures the bridge is ready before sending panel init commands in
the case of panels sending init commands in panel prepare function.
Signed-off-by: Parth Pancholi <parth.pancholi@toradex.com>
Tested-by: João Paulo Gonçalves <joao.goncalves@toradex.com> # Toradex Verdin AM62
Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Link: https://patch.msgid.link/20260311-tc358768-v2-2-e75a99131bd5@ideasonboard.com
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/tc358768.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c
index ed8094b2a7ff4..acbbf1e79fb78 100644
--- a/drivers/gpu/drm/bridge/tc358768.c
+++ b/drivers/gpu/drm/bridge/tc358768.c
@@ -449,6 +449,8 @@ static int tc358768_dsi_host_attach(struct mipi_dsi_host *host,
DRM_MODE_CONNECTOR_DSI);
if (IS_ERR(bridge))
return PTR_ERR(bridge);
+
+ bridge->pre_enable_prev_first = true;
}
priv->output.dev = dev;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 032/982] ASoC: ti: omap3pandora: update board check to use DT compatible
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 031/982] drm/bridge: tc358768: Set pre_enable_prev_first for reverse order Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 033/982] mmc: core: Add validation for host-provided max_segs Greg Kroah-Hartman
` (956 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ethan Nelson-Moore, Jarkko Nikula,
Mark Brown, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ethan Nelson-Moore <enelsonmoore@gmail.com>
[ Upstream commit 45efb8fbdae303539e7fb5562e147583d4ed63ad ]
The omap3pandora driver contains a check for the ARM machine ID via the
machine_is_omap3_pandora() macro. The board concerned now supports
only FDT booting, which does not use machine IDs, and therefore the
code should be updated to check the DT compatible property instead. The
legacy board file for this machine was removed in commit 7fcf7e061edd
("ARM: OMAP2+: Remove legacy booting support for Pandora").
The presence of this machine ID check prevents the removal of machine
IDs no longer used by the kernel from arch/arm/tools/mach-types,
because the machine_is_*() macros are generated from mach-types. To
resolve this issue, use of_machine_is_compatible() instead.
Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Acked-by: Jarkko Nikula <jarkko.nikula@bitmer.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/ti/omap3pandora.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/sound/soc/ti/omap3pandora.c b/sound/soc/ti/omap3pandora.c
index a287e9747c2a1..3cec2eaafe62f 100644
--- a/sound/soc/ti/omap3pandora.c
+++ b/sound/soc/ti/omap3pandora.c
@@ -11,12 +11,12 @@
#include <linux/delay.h>
#include <linux/regulator/consumer.h>
#include <linux/module.h>
+#include <linux/of.h>
#include <sound/core.h>
#include <sound/pcm.h>
#include <sound/soc.h>
-#include <asm/mach-types.h>
#include <linux/platform_data/asoc-ti-mcbsp.h>
#include "omap-mcbsp.h"
@@ -224,7 +224,8 @@ static int __init omap3pandora_soc_init(void)
{
int ret;
- if (!machine_is_omap3_pandora())
+ if (!of_machine_is_compatible("openpandora,omap3-pandora-600mhz") &&
+ !of_machine_is_compatible("openpandora,omap3-pandora-1ghz"))
return -ENODEV;
pr_info("OMAP3 Pandora SoC init\n");
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 033/982] mmc: core: Add validation for host-provided max_segs
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 032/982] ASoC: ti: omap3pandora: update board check to use DT compatible Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 034/982] mmc: davinci: avoid NULL deref of host->data in IRQ handler Greg Kroah-Hartman
` (955 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Shawn Lin, Ulf Hansson, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Lin <shawn.lin@rock-chips.com>
[ Upstream commit 3e0483e93a8be320f70a1ff68d835f7f015af311 ]
The max_segs field is of type unsigned short, and if a host driver
sets an excessively large value, it may be truncated to zero. This
can cause mmc_alloc_sg() to call kmalloc_objs() with a zero size
allocation request, which leads to undefined behavior.
Under the SLUB allocator, kmalloc(0) returns a special pointer
(ZERO_SIZE_PTR). The subsequent 'if (sg)' check will evaluate to
true, and sg_init_table() will then attempt to access invalid memory,
resulting in a crash:
dwmmc_rockchip 2a310000.mmc: Successfully tuned phase to 133
mmc1: new UHS-I speed SDR104 SDHC card at address aaaa
Unable to handle kernel paging request at virtual address 0000001ffffffff0
Mem abort info:
ESR = 0x0000000096000004
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=0000000102c88000
[0000001ffffffff0] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 0000000096000004 [#1] SMP
Modules linked in:
CPU: 2 UID: 0 PID: 102 Comm: kworker/2:1 Not tainted 7.0.0-rc6-next-20260331-00013-g4d93c25963c5-dirty #80 PREEMPT
Hardware name: Rockchip RK3576 EVB V10 Board (DT)
Workqueue: events_freezable mmc_rescan
pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : sg_init_table+0x2c/0x50
lr : sg_init_table+0x24/0x50
sp : ffff8000837db710
x29: ffff8000837db710 x28: 000000000000c000 x27: 0000000000000300
x26: 0000000000000000 x25: 0000000000000040 x24: ffff0000c46a0000
x23: 0000000000000000 x22: ffff0000c0c73c00 x21: 0000000000000010
x20: 0000000000000010 x19: 0000000000000000 x18: 000000000000002c
x17: 0000000000000000 x16: 0000000000000001 x15: 0000000000000000
x14: 0000000000000400 x13: ffff8000837dc000 x12: 0000000000000000
x11: ffff0000c0c73ca0 x10: 0000000000000040 x9 : 459ec1f0abbdbb00
x8 : 0000001fffffffe0 x7 : 0000000000000000 x6 : 000000000000003f
x5 : 0000000000035579 x4 : 0000000000000901 x3 : 0000000000000000
x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000010
Call trace:
sg_init_table+0x2c/0x50 (P)
mmc_mq_init_request+0x64/0x90
blk_mq_alloc_map_and_rqs+0x3ac/0x480
blk_mq_alloc_set_map_and_rqs+0x98/0x1e0
blk_mq_alloc_tag_set+0x1c0/0x290
mmc_init_queue+0x120/0x370
mmc_blk_alloc_req+0x150/0x420
To prevent this, add a validation check in mmc_mq_init_request() to
detect when sg_len (derived from max_segs) is zero. If sg_len is zero,
we return an error and print an error message, allowing host driver
developers to identify and fix incorrect max_segs configuration.
This is a defensive measure that ensures the MMC core fails gracefully
when host drivers provide invalid max_segs values, rather than crashing
with a page fault.
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/core/queue.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c
index b396e39007177..5f05d997a6af9 100644
--- a/drivers/mmc/core/queue.c
+++ b/drivers/mmc/core/queue.c
@@ -207,8 +207,14 @@ static int mmc_mq_init_request(struct blk_mq_tag_set *set, struct request *req,
struct mmc_queue *mq = set->driver_data;
struct mmc_card *card = mq->card;
struct mmc_host *host = card->host;
+ u16 sg_len = mmc_get_max_segments(host);
- mq_rq->sg = mmc_alloc_sg(mmc_get_max_segments(host), GFP_KERNEL);
+ if (!sg_len) {
+ dev_err(mmc_dev(host), "Wrong max_segs assigned\n");
+ return -EINVAL;
+ }
+
+ mq_rq->sg = mmc_alloc_sg(sg_len, GFP_KERNEL);
if (!mq_rq->sg)
return -ENOMEM;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 034/982] mmc: davinci: avoid NULL deref of host->data in IRQ handler
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 033/982] mmc: core: Add validation for host-provided max_segs Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 035/982] drm/amd/display: Fix CRC open failure during active rendering Greg Kroah-Hartman
` (954 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stepan Ionichev, Bartosz Golaszewski,
Ulf Hansson, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stepan Ionichev <sozdayvek@gmail.com>
[ Upstream commit 4f28846aaf8db9668e338b8987973f8935edff34 ]
mmc_davinci_irq() returns early only when both host->cmd and
host->data are NULL:
if (host->cmd == NULL && host->data == NULL) {
...
return IRQ_NONE;
}
So we may legitimately reach the rest of the handler with
host->data == NULL (and therefore data == NULL). The DATDNE branch
already guards against this with an explicit "if (data != NULL)"
check, but the subsequent TOUTRD ("read data timeout") and
CRCWR/CRCRD ("data CRC error") branches dereference data
unconditionally:
if (qstatus & MMCST0_TOUTRD) {
data->error = -ETIMEDOUT; <-- NULL deref
...
davinci_abort_data(host, data);
}
if (qstatus & (MMCST0_CRCWR | MMCST0_CRCRD)) {
data->error = -EILSEQ; <-- NULL deref
...
}
If either bit is set in qstatus while host->data is NULL, the kernel
will crash inside the IRQ handler. smatch flags this:
drivers/mmc/host/davinci_mmc.c:933 mmc_davinci_irq() error: we
previously assumed 'data' could be null (see line 914)
Gate both branches on a non-NULL data, matching the existing pattern
used by the DATDNE branch.
No functional change for callers where data is non-NULL, which is
the only case in which these branches did meaningful work before
this change.
Signed-off-by: Stepan Ionichev <sozdayvek@gmail.com>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/host/davinci_mmc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/mmc/host/davinci_mmc.c b/drivers/mmc/host/davinci_mmc.c
index e89a97b415154..b744651f3b625 100644
--- a/drivers/mmc/host/davinci_mmc.c
+++ b/drivers/mmc/host/davinci_mmc.c
@@ -934,7 +934,7 @@ static irqreturn_t mmc_davinci_irq(int irq, void *dev_id)
}
}
- if (qstatus & MMCST0_TOUTRD) {
+ if (data && (qstatus & MMCST0_TOUTRD)) {
/* Read data timeout */
data->error = -ETIMEDOUT;
end_transfer = 1;
@@ -946,7 +946,7 @@ static irqreturn_t mmc_davinci_irq(int irq, void *dev_id)
davinci_abort_data(host, data);
}
- if (qstatus & (MMCST0_CRCWR | MMCST0_CRCRD)) {
+ if (data && (qstatus & (MMCST0_CRCWR | MMCST0_CRCRD))) {
/* Data CRC error */
data->error = -EILSEQ;
end_transfer = 1;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 035/982] drm/amd/display: Fix CRC open failure during active rendering
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 034/982] mmc: davinci: avoid NULL deref of host->data in IRQ handler Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 036/982] PCI: intel-gw: Enable clock before PHY init Greg Kroah-Hartman
` (953 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ray Wu, Tom Chung, James Lin,
Daniel Wheeler, Alex Deucher, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tom Chung <chiahsuan.chung@amd.com>
[ Upstream commit 5eb2fdafeb6f4a442643b77a21a4c9e70586a146 ]
[Why]
Opening the CRC data file during active rendering can fail with -EINVAL.
The wait for commit->hw_done returns remaining jiffies on success, but
the CRC path was treating that as an error.
[How]
Handle wait_for_completion_interruptible_timeout() correctly:
positive return as success, 0 as timeout, and negative as error.
Reviewed-by: Ray Wu <ray.wu@amd.com>
Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
Signed-off-by: James Lin <pinglei.lin@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c
index 8a441a22c46ec..0c17877a6c5c8 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c
@@ -261,8 +261,13 @@ int amdgpu_dm_crtc_set_crc_source(struct drm_crtc *crtc, const char *src_name)
*/
ret = wait_for_completion_interruptible_timeout(
&commit->hw_done, 10 * HZ);
- if (ret)
+ if (ret < 0)
+ goto cleanup;
+
+ if (ret == 0) {
+ ret = -ETIMEDOUT;
goto cleanup;
+ }
}
enable = amdgpu_dm_is_valid_crc_source(source);
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 036/982] PCI: intel-gw: Enable clock before PHY init
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 035/982] drm/amd/display: Fix CRC open failure during active rendering Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 037/982] hfsplus: rework hfsplus_readdir() logic Greg Kroah-Hartman
` (952 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Eckert,
Manivannan Sadhasivam, Bjorn Helgaas, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Eckert <fe@dev.tdt.de>
[ Upstream commit febf9ed3c35e5eec7ea384ebbd55a5296e3ca5e9 ]
To ensure that the boot sequence is correct, the DWC PCIe core clock must
be switched on before PHY init call [1]. This changes are based on patched
kernel sources of the MaxLinear SDK.
The reason why the MaxLinear SDK is used as a reference here is, that this
PCIe DWC IP is used in the URX851 and URX850 SoC. This SoC was originally
developed by Intel when they acquired Lantiq’s home networking division in
2015 [2]. In 2020 the home network division was sold to MaxLinear [3].
Since then, this SoC belongs to MaxLinear. They use their own SDK, which
runs on kernel version '5.15.x'.
[1] https://github.com/maxlinear/linux/blob/updk_9.1.90/drivers/pci/controller/dwc/pcie-intel-gw.c#L544
[2] https://www.intc.com/news-events/press-releases/detail/364/intel-to-acquire-lantiq-advancing-the-connected-home
[3] https://investors.maxlinear.com/press-releases/detail/395/maxlinear-to-acquire-intels-home-gateway-platform
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260417-pcie-intel-gw-v5-4-0a2b933fe04f@dev.tdt.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pcie-intel-gw.c | 19 ++++++++++---------
1 file changed, 10 insertions(+), 9 deletions(-)
diff --git a/drivers/pci/controller/dwc/pcie-intel-gw.c b/drivers/pci/controller/dwc/pcie-intel-gw.c
index 333c33d98a701..7b21628a6a63e 100644
--- a/drivers/pci/controller/dwc/pcie-intel-gw.c
+++ b/drivers/pci/controller/dwc/pcie-intel-gw.c
@@ -284,13 +284,9 @@ static int intel_pcie_host_setup(struct intel_pcie *pcie)
intel_pcie_core_rst_assert(pcie);
intel_pcie_device_rst_assert(pcie);
-
- ret = phy_init(pcie->phy);
- if (ret)
- return ret;
-
intel_pcie_core_rst_deassert(pcie);
+ /* Controller clock must be provided earlier than PHY */
ret = clk_prepare_enable(pcie->core_clk);
if (ret) {
dev_err(pcie->pci.dev, "Core clock enable failed: %d\n", ret);
@@ -299,13 +295,17 @@ static int intel_pcie_host_setup(struct intel_pcie *pcie)
pci->atu_base = pci->dbi_base + 0xC0000;
+ ret = phy_init(pcie->phy);
+ if (ret)
+ goto phy_err;
+
intel_pcie_ltssm_disable(pcie);
intel_pcie_link_setup(pcie);
intel_pcie_init_n_fts(pci);
ret = dw_pcie_setup_rc(&pci->pp);
if (ret)
- goto app_init_err;
+ goto err;
dw_pcie_upconfig_setup(pci);
@@ -314,7 +314,7 @@ static int intel_pcie_host_setup(struct intel_pcie *pcie)
ret = dw_pcie_wait_for_link(pci);
if (ret)
- goto app_init_err;
+ goto err;
/* Enable integrated interrupts */
pcie_app_wr_mask(pcie, PCIE_APP_IRNEN, PCIE_APP_IRN_INT,
@@ -322,11 +322,12 @@ static int intel_pcie_host_setup(struct intel_pcie *pcie)
return 0;
-app_init_err:
+err:
+ phy_exit(pcie->phy);
+phy_err:
clk_disable_unprepare(pcie->core_clk);
clk_err:
intel_pcie_core_rst_assert(pcie);
- phy_exit(pcie->phy);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 037/982] hfsplus: rework hfsplus_readdir() logic
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 036/982] PCI: intel-gw: Enable clock before PHY init Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 038/982] drm/gud: Add RCade Display Adapter VID/PID pair Greg Kroah-Hartman
` (951 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, John Paul Adrian Glaubitz,
Yangtao Li, linux-fsdevel, Viacheslav Dubeyko, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <slava@dubeyko.com>
[ Upstream commit 4b0496432844628ad05a5b1efce329a3340174d2 ]
The xfstests' test-case generic/637 fails with error:
FSTYP -- hfsplus
PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.15.0-rc4+ #8 SMP PREEMPT_DYNAMIC Thu May 1 16:43:22 PDT 2025
MKFS_OPTIONS -- /dev/loop51
MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
QA output created by 637
entries 7 and 8 have duplicate d_off 8
Found unlinked files in open dir (see xfstests-dev/results//generic/637.full for details)
Debugging of the hfsplus_readdir() logic showed this:
hfsplus: hfsplus_readdir(): 163 ctx->pos 0
hfsplus: hfsplus_readdir(): 189 ctx->pos 1
hfsplus: hfsplus_readdir(): 264 ctx->pos 2, ino 18
hfsplus: hfsplus_readdir(): 264 ctx->pos 3, ino 19
hfsplus: hfsplus_readdir(): 264 ctx->pos 4, ino 28
hfsplus: hfsplus_readdir(): 264 ctx->pos 5, ino 118
hfsplus: hfsplus_readdir(): 264 ctx->pos 6, ino 29
hfsplus: hfsplus_readdir(): 264 ctx->pos 7, ino 30
hfsplus: hfsplus_readdir(): 264 ctx->pos 8, ino 31
hfsplus: hfsplus_readdir(): 304 ctx->pos 8
hfsplus: hfsplus_unlink():420 dir->i_ino 17, inode->i_ino 28
hfsplus: hfsplus_readdir(): 141 ctx->pos 7
hfsplus: hfsplus_readdir(): 264 ctx->pos 7, ino 31
hfsplus: hfsplus_readdir(): 264 ctx->pos 8, ino 32
hfsplus: hfsplus_readdir(): 264 ctx->pos 9, ino 33
It means that hfsplus_readdir() stopped the processing of
folder's items on ctx->pos 8, then, item with ino 28 has
been deleted and hfsplus_readdir() re-started the logic
from ctx->pos 7. As a result, previous and new sets of
folder's items have overlapping values for the case of
d_off 8.
Currently, HFS+ has very complicated and fragile logic
of rd->file->f_pos correction in hfsplus_delete_cat().
This patch removes this logic and it stores the current
pos into hfsplus_readdir_data. Finally, if rd->pos == ctx->pos
then hfsplus_readdir() tries to find the position in
b-tree's node by means of hfsplus_cat_key. This position is
used to re-start the folder's content traversal.
sudo ./check generic/637
FSTYP -- hfsplus
PLATFORM -- Linux/x86_64 hfsplus-testing-0001 7.1.0-rc1+ #44 SMP PREEMPT_DYNAMIC Mon May 4 15:58:45 PDT 2026
MKFS_OPTIONS -- /dev/loop51
MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
generic/637 22s ... 22s
Ran: generic/637
Passed all 1 tests
Closes: https://github.com/hfs-linux-kernel/hfs-linux-kernel/issues/198
cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
cc: Yangtao Li <frank.li@vivo.com>
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Link: https://lore.kernel.org/r/20260505220051.2854696-2-slava@dubeyko.com
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/hfsplus/catalog.c | 11 -----------
fs/hfsplus/dir.c | 28 +++++++++++-----------------
fs/hfsplus/hfsplus_fs.h | 5 +----
fs/hfsplus/inode.c | 2 --
fs/hfsplus/super.c | 2 --
5 files changed, 12 insertions(+), 36 deletions(-)
diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c
index 9a82bdf4caf24..2db185c67b2c3 100644
--- a/fs/hfsplus/catalog.c
+++ b/fs/hfsplus/catalog.c
@@ -332,7 +332,6 @@ int hfsplus_delete_cat(u32 cnid, struct inode *dir, const struct qstr *str)
struct super_block *sb = dir->i_sb;
struct hfs_find_data fd;
struct hfsplus_fork_raw fork;
- struct list_head *pos;
int err, off;
u16 type;
@@ -390,16 +389,6 @@ int hfsplus_delete_cat(u32 cnid, struct inode *dir, const struct qstr *str)
hfsplus_free_fork(sb, cnid, &fork, HFSPLUS_TYPE_RSRC);
}
- /* we only need to take spinlock for exclusion with ->release() */
- spin_lock(&HFSPLUS_I(dir)->open_dir_lock);
- list_for_each(pos, &HFSPLUS_I(dir)->open_dir_list) {
- struct hfsplus_readdir_data *rd =
- list_entry(pos, struct hfsplus_readdir_data, list);
- if (fd.tree->keycmp(fd.search_key, (void *)&rd->key) < 0)
- rd->file->f_pos--;
- }
- spin_unlock(&HFSPLUS_I(dir)->open_dir_lock);
-
err = hfs_brec_remove(&fd);
if (err)
goto out;
diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c
index 578da2528bee8..0d6f42d91e55e 100644
--- a/fs/hfsplus/dir.c
+++ b/fs/hfsplus/dir.c
@@ -185,7 +185,15 @@ static int hfsplus_readdir(struct file *file, struct dir_context *ctx)
}
if (ctx->pos >= inode->i_size)
goto out;
- err = hfs_brec_goto(&fd, ctx->pos - 1);
+ rd = file->private_data;
+ if (rd && rd->pos == ctx->pos) {
+ memcpy(fd.search_key, &rd->key, sizeof(struct hfsplus_cat_key));
+ err = hfs_brec_find(&fd, hfs_find_rec_by_key);
+ if (err == -ENOENT)
+ err = hfs_brec_goto(&fd, 1);
+ } else {
+ err = hfs_brec_goto(&fd, ctx->pos - 1);
+ }
if (err)
goto out;
for (;;) {
@@ -261,7 +269,6 @@ static int hfsplus_readdir(struct file *file, struct dir_context *ctx)
if (err)
goto out;
}
- rd = file->private_data;
if (!rd) {
rd = kmalloc(sizeof(struct hfsplus_readdir_data), GFP_KERNEL);
if (!rd) {
@@ -269,15 +276,8 @@ static int hfsplus_readdir(struct file *file, struct dir_context *ctx)
goto out;
}
file->private_data = rd;
- rd->file = file;
- spin_lock(&HFSPLUS_I(inode)->open_dir_lock);
- list_add(&rd->list, &HFSPLUS_I(inode)->open_dir_list);
- spin_unlock(&HFSPLUS_I(inode)->open_dir_lock);
}
- /*
- * Can be done after the list insertion; exclusion with
- * hfsplus_delete_cat() is provided by directory lock.
- */
+ rd->pos = ctx->pos;
memcpy(&rd->key, fd.key, sizeof(struct hfsplus_cat_key));
out:
kfree(strbuf);
@@ -287,13 +287,7 @@ static int hfsplus_readdir(struct file *file, struct dir_context *ctx)
static int hfsplus_dir_release(struct inode *inode, struct file *file)
{
- struct hfsplus_readdir_data *rd = file->private_data;
- if (rd) {
- spin_lock(&HFSPLUS_I(inode)->open_dir_lock);
- list_del(&rd->list);
- spin_unlock(&HFSPLUS_I(inode)->open_dir_lock);
- kfree(rd);
- }
+ kfree(file->private_data);
return 0;
}
diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h
index 9192637ed739e..8c18b79c0056e 100644
--- a/fs/hfsplus/hfsplus_fs.h
+++ b/fs/hfsplus/hfsplus_fs.h
@@ -246,8 +246,6 @@ struct hfsplus_inode_info {
sector_t fs_blocks;
u8 userflags; /* BSD user file flags */
u32 subfolders; /* Subfolder count (HFSX only) */
- struct list_head open_dir_list;
- spinlock_t open_dir_lock;
loff_t phys_size;
struct inode vfs_inode;
@@ -297,8 +295,7 @@ struct hfs_find_data {
};
struct hfsplus_readdir_data {
- struct list_head list;
- struct file *file;
+ loff_t pos;
struct hfsplus_cat_key key;
};
diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
index caf36ed7f590a..a006db2699c4f 100644
--- a/fs/hfsplus/inode.c
+++ b/fs/hfsplus/inode.c
@@ -449,8 +449,6 @@ struct inode *hfsplus_new_inode(struct super_block *sb, struct inode *dir,
inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode);
hip = HFSPLUS_I(inode);
- INIT_LIST_HEAD(&hip->open_dir_list);
- spin_lock_init(&hip->open_dir_lock);
mutex_init(&hip->extents_lock);
atomic_set(&hip->opencnt, 0);
hip->extent_state = 0;
diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
index 0d15e440d6869..1e4e5c3003de3 100644
--- a/fs/hfsplus/super.c
+++ b/fs/hfsplus/super.c
@@ -90,8 +90,6 @@ struct inode *hfsplus_iget(struct super_block *sb, unsigned long ino)
HFSPLUS_I(inode)->fs_blocks = 0;
HFSPLUS_I(inode)->userflags = 0;
HFSPLUS_I(inode)->subfolders = 0;
- INIT_LIST_HEAD(&HFSPLUS_I(inode)->open_dir_list);
- spin_lock_init(&HFSPLUS_I(inode)->open_dir_lock);
HFSPLUS_I(inode)->phys_size = 0;
if (inode->i_ino >= HFSPLUS_FIRSTUSER_CNID ||
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 038/982] drm/gud: Add RCade Display Adapter VID/PID pair
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 037/982] hfsplus: rework hfsplus_readdir() logic Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 039/982] media: video-i2c: use vb2_video_unregister_device on driver removal Greg Kroah-Hartman
` (950 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sophie D, Thomas Zimmermann,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sophie D <patches@scd31.com>
[ Upstream commit ac5ac0acf11df04295eb1811066097b7022d6c7f ]
The RCade Display Adapter is a hardware device that allows driving an
Arcade CRT display via the GUD protocol. Currently it spoofs an
existing GUD VID/PID pair. However, now that it has its own pair
assigned, it makes sense to add this to the list of pairs that GUD
supports natively.
More information can be found in the project repositories:
https://gitlab.scd31.com/stephen/stm32-usb-vga-adapter-hardware
https://gitlab.scd31.com/stephen/stm32-usb-vga-rcade-adapter
Link: https://pid.codes/1209/4FB3/
Signed-off-by: Sophie D <patches@scd31.com>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patch.msgid.link/20260509025405.4143956-1-patches@scd31.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/gud/gud_drv.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/gud/gud_drv.c b/drivers/gpu/drm/gud/gud_drv.c
index 8d1630b8edac1..2a382be27fd4c 100644
--- a/drivers/gpu/drm/gud/gud_drv.c
+++ b/drivers/gpu/drm/gud/gud_drv.c
@@ -668,6 +668,7 @@ static int gud_resume(struct usb_interface *intf)
static const struct usb_device_id gud_id_table[] = {
{ USB_DEVICE_INTERFACE_CLASS(0x1d50, 0x614d, USB_CLASS_VENDOR_SPEC) },
{ USB_DEVICE_INTERFACE_CLASS(0x16d0, 0x10a9, USB_CLASS_VENDOR_SPEC) },
+ { USB_DEVICE_INTERFACE_CLASS(0x1209, 0x4fb3, USB_CLASS_VENDOR_SPEC) },
{ }
};
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 039/982] media: video-i2c: use vb2_video_unregister_device on driver removal
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 038/982] drm/gud: Add RCade Display Adapter VID/PID pair Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 040/982] net: dsa: realtek: rtl8365mb: add support for RTL8367SB Greg Kroah-Hartman
` (949 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Arash Golgol, Hans Verkuil,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arash Golgol <arash.golgol@gmail.com>
[ Upstream commit 56384b486b80ce4a2bc93689aae49995f908f90d ]
The driver uses vb2_fop_release() as its file release operation, so
vb2_video_unregister_device() should be used instead of
video_unregister_device() during driver removal.
This ensures that the vb2 queue is properly disconnected before the
video device is unregistered.
Signed-off-by: Arash Golgol <arash.golgol@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/video-i2c.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/i2c/video-i2c.c b/drivers/media/i2c/video-i2c.c
index 685e4d5d174f4..83a4fc95252fa 100644
--- a/drivers/media/i2c/video-i2c.c
+++ b/drivers/media/i2c/video-i2c.c
@@ -911,7 +911,7 @@ static void video_i2c_remove(struct i2c_client *client)
if (data->chip->set_power)
data->chip->set_power(data, false);
- video_unregister_device(&data->vdev);
+ vb2_video_unregister_device(&data->vdev);
}
#ifdef CONFIG_PM
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 040/982] net: dsa: realtek: rtl8365mb: add support for RTL8367SB
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 039/982] media: video-i2c: use vb2_video_unregister_device on driver removal Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 041/982] integrity: Check for NULL returned by asymmetric_key_public_key Greg Kroah-Hartman
` (948 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luiz Angelo Daros de Luca,
Mieczyslaw Nalewaj, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mieczyslaw Nalewaj <namiltd@yahoo.com>
[ Upstream commit 28702a215c96917d85558ad6309a57ab224808c0 ]
Add chip info entry for the Realtek RTL8367SB switch. This device has
chip ID 0x6367 and version 0x0010. It exposes two external interfaces:
port 6 supports MII, TMII, RMII, RGMII, SGMII and HSGMII, while port 7
supports MII, TMII, RMII and RGMII. Use the existing 8365MB-VC jam table
for initialization.
Reviewed-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Link: https://patch.msgid.link/3c6d822b-0e85-4173-86ba-2badb140bbf1@yahoo.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/realtek/rtl8365mb.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/drivers/net/dsa/realtek/rtl8365mb.c b/drivers/net/dsa/realtek/rtl8365mb.c
index 97673ccb7ac79..f622e724e01f6 100644
--- a/drivers/net/dsa/realtek/rtl8365mb.c
+++ b/drivers/net/dsa/realtek/rtl8365mb.c
@@ -539,6 +539,20 @@ static const struct rtl8365mb_chip_info rtl8365mb_chip_infos[] = {
.jam_table = rtl8365mb_init_jam_8365mb_vc,
.jam_size = ARRAY_SIZE(rtl8365mb_init_jam_8365mb_vc),
},
+ {
+ .name = "RTL8367SB",
+ .chip_id = 0x6367,
+ .chip_ver = 0x0010,
+ .extints = {
+ { 6, 1, PHY_INTF(MII) | PHY_INTF(TMII) |
+ PHY_INTF(RMII) | PHY_INTF(RGMII) |
+ PHY_INTF(SGMII) | PHY_INTF(HSGMII) },
+ { 7, 2, PHY_INTF(MII) | PHY_INTF(TMII) |
+ PHY_INTF(RMII) | PHY_INTF(RGMII) },
+ },
+ .jam_table = rtl8365mb_init_jam_8365mb_vc,
+ .jam_size = ARRAY_SIZE(rtl8365mb_init_jam_8365mb_vc),
+ },
{
.name = "RTL8367RB-VB",
.chip_id = 0x6367,
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 041/982] integrity: Check for NULL returned by asymmetric_key_public_key
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 040/982] net: dsa: realtek: rtl8365mb: add support for RTL8367SB Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 042/982] clk: samsung: exynos850: mark APM I3C clocks as critical Greg Kroah-Hartman
` (947 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stefan Berger, Kamlesh Kumar,
Mimi Zohar, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Berger <stefanb@linux.ibm.com>
[ Upstream commit c93a5f038ccc11ed8558ce642f62d5ede701a348 ]
Check for a NULL pointer returned by asymmetric_key_public_key and return
-ENOKEY in this case.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Tested-by: Kamlesh Kumar <kam@juniper.net>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/integrity/digsig_asymmetric.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/security/integrity/digsig_asymmetric.c b/security/integrity/digsig_asymmetric.c
index 895f4b9ce8c6b..b6b66f34cbf93 100644
--- a/security/integrity/digsig_asymmetric.c
+++ b/security/integrity/digsig_asymmetric.c
@@ -108,6 +108,10 @@ int asymmetric_verify(struct key *keyring, const char *sig,
pks.hash_algo = hash_algo_name[hdr->hash_algo];
pk = asymmetric_key_public_key(key);
+ if (!pk) {
+ ret = -ENOKEY;
+ goto out;
+ }
pks.pkey_algo = pk->pkey_algo;
if (!strcmp(pk->pkey_algo, "rsa")) {
pks.encoding = "pkcs1";
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 042/982] clk: samsung: exynos850: mark APM I3C clocks as critical
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 041/982] integrity: Check for NULL returned by asymmetric_key_public_key Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:12 ` [PATCH 6.1 043/982] scsi: pm8001: Reject firmware update in fatal error state Greg Kroah-Hartman
` (946 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sam Protsenko, Tudor Ambarus,
Alexey Klimov, Krzysztof Kozlowski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Klimov <alexey.klimov@linaro.org>
[ Upstream commit 44984aaf1aa727ff944dd4b72fcf069d08b0056d ]
The Exynos850 APM co-processor relies on the I3C bus to communicate with
the PMIC. Currently, there is no dedicated PMIC consumer driver managing
these clocks, so the clock subsystem automatically gates them during the
initialisation. Once gated, any subsequent ACPM communication with APM
results in timeouts.
As a temporary workaround (and let's hope it doesn't become permanent),
mark both `gout_i3c_pclk` and `gout_i3c_sclk` as CLK_IS_CRITICAL ones to
prevent the clock subsystem from disabling them. This makes the ACPM
communication functional. This workaround should be reverted once a
proper ACPM PMIC driver is implemented to manage these clocks.
Cc: Sam Protsenko <semen.protsenko@linaro.org>
Cc: Tudor Ambarus <tudor.ambarus@linaro.org>
Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
Reviewed-by: Sam Protsenko <semen.protsenko@linaro.org>
Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Link: https://patch.msgid.link/20260430-exynos850-i3c-criticalclocks-v1-1-6e1fd8dfa21b@linaro.org
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/samsung/clk-exynos850.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/clk/samsung/clk-exynos850.c b/drivers/clk/samsung/clk-exynos850.c
index 87e463ad42741..8d1205de7fd9a 100644
--- a/drivers/clk/samsung/clk-exynos850.c
+++ b/drivers/clk/samsung/clk-exynos850.c
@@ -580,10 +580,11 @@ static const struct samsung_gate_clock apm_gate_clks[] __initconst = {
CLK_CON_GAT_GOUT_APM_APBIF_RTC_PCLK, 21, 0, 0),
GATE(CLK_GOUT_TOP_RTC_PCLK, "gout_top_rtc_pclk", "dout_apm_bus",
CLK_CON_GAT_GOUT_APM_APBIF_TOP_RTC_PCLK, 21, 0, 0),
+ /* TODO: Should be dealt with or enabled in PMIC ACPM driver */
GATE(CLK_GOUT_I3C_PCLK, "gout_i3c_pclk", "dout_apm_bus",
- CLK_CON_GAT_GOUT_APM_I3C_APM_PMIC_I_PCLK, 21, 0, 0),
+ CLK_CON_GAT_GOUT_APM_I3C_APM_PMIC_I_PCLK, 21, CLK_IS_CRITICAL, 0),
GATE(CLK_GOUT_I3C_SCLK, "gout_i3c_sclk", "mout_apm_i3c",
- CLK_CON_GAT_GOUT_APM_I3C_APM_PMIC_I_SCLK, 21, 0, 0),
+ CLK_CON_GAT_GOUT_APM_I3C_APM_PMIC_I_SCLK, 21, CLK_IS_CRITICAL, 0),
GATE(CLK_GOUT_SPEEDY_PCLK, "gout_speedy_pclk", "dout_apm_bus",
CLK_CON_GAT_GOUT_APM_SPEEDY_APM_PCLK, 21, 0, 0),
/* TODO: Should be enabled in GPIO driver (or made CLK_IS_CRITICAL) */
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 043/982] scsi: pm8001: Reject firmware update in fatal error state
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 042/982] clk: samsung: exynos850: mark APM I3C clocks as critical Greg Kroah-Hartman
@ 2026-09-30 15:12 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 044/982] scsi: pm8001: Reject non-fatal dump when controller is crashed Greg Kroah-Hartman
` (945 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kumar Meiyappan, Sagar Biradar,
Martin K. Petersen, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kumar Meiyappan <kumar.meiyappan@microchip.com>
[ Upstream commit 2a8fbcfb04aa9db189bfa3842d4f586aecd0e631 ]
pm8001_store_update_fw() allows a firmware update request even when the
controller has already entered a fatal error state.
Firmware update is not valid once the controller is in that state, and
attempting it can lead to a call trace. Reject the request early by
checking controller_fatal_error, set the firmware status to
FAIL_PARAMETERS, and return -EINVAL.
Signed-off-by: Kumar Meiyappan <kumar.meiyappan@microchip.com>
Signed-off-by: Sagar Biradar <sagar.biradar@microchip.com>
Link: https://patch.msgid.link/20260416153757.414896-1-sagar.biradar@microchip.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/pm8001/pm8001_ctl.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/scsi/pm8001/pm8001_ctl.c b/drivers/scsi/pm8001/pm8001_ctl.c
index 8113045f7cb93..0158e0353fe0d 100644
--- a/drivers/scsi/pm8001/pm8001_ctl.c
+++ b/drivers/scsi/pm8001/pm8001_ctl.c
@@ -827,6 +827,14 @@ static ssize_t pm8001_store_update_fw(struct device *cdev,
goto out;
}
+ if (pm8001_ha->controller_fatal_error) {
+ pm8001_dbg(pm8001_ha, FAIL,
+ "controller in fatal error state, firmware update rejected\n");
+ pm8001_ha->fw_status = FAIL_PARAMETERS;
+ ret = -EINVAL;
+ goto out;
+ }
+
for (i = 0; flash_command_table[i].code != FLASH_CMD_NONE; i++) {
if (!memcmp(flash_command_table[i].command,
cmd_ptr, strlen(cmd_ptr))) {
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 044/982] scsi: pm8001: Reject non-fatal dump when controller is crashed
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2026-09-30 15:12 ` [PATCH 6.1 043/982] scsi: pm8001: Reject firmware update in fatal error state Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 045/982] crypto: ecc - Unbreak the build on arm with CONFIG_KASAN_STACK=y Greg Kroah-Hartman
` (944 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kumar Meiyappan, Sagar Biradar,
Martin K. Petersen, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kumar Meiyappan <kumar.meiyappan@microchip.com>
[ Upstream commit aa3b8f56ef27ed72394a752820abdec4608b731c ]
pm80xx_get_non_fatal_dump() can be called even after the controller has
entered a fatal error state. In that case the forensic memory contents
are not safe to access for a non-fatal dump request, and attempting to
do so can trigger a call trace.
Check controller_fatal_error before reading the non-fatal dump buffer
and return -EINVAL when the controller is already in a crashed state.
This prevents non-fatal dump collection from running in an invalid
controller state.
Signed-off-by: Kumar Meiyappan <kumar.meiyappan@microchip.com>
Signed-off-by: Sagar Biradar <sagar.biradar@microchip.com>
Link: https://patch.msgid.link/20260416154650.415624-1-sagar.biradar@microchip.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/pm8001/pm80xx_hwi.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
index 2bf293e8f7472..371a33bab4c73 100644
--- a/drivers/scsi/pm8001/pm80xx_hwi.c
+++ b/drivers/scsi/pm8001/pm80xx_hwi.c
@@ -401,6 +401,13 @@ ssize_t pm80xx_get_non_fatal_dump(struct device *cdev,
char *buf_copy = buf;
temp = (u32 *)pm8001_ha->memoryMap.region[FORENSIC_MEM].virt_ptr;
+
+ if (pm8001_ha->controller_fatal_error) {
+ pm8001_dbg(pm8001_ha, FAIL,
+ "non-fatal dump not available in fatal error state\n");
+ return -EINVAL;
+ }
+
if (++pm8001_ha->non_fatal_count == 1) {
if (pm8001_ha->chip_id == chip_8001) {
snprintf(pm8001_ha->forensic_info.data_buf.direct_data,
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 045/982] crypto: ecc - Unbreak the build on arm with CONFIG_KASAN_STACK=y
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 044/982] scsi: pm8001: Reject non-fatal dump when controller is crashed Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 046/982] crypto: atmel-ecc - add support for atecc608b Greg Kroah-Hartman
` (943 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lukas Wunner, Andy Shevchenko,
Herbert Xu, Sasha Levin, Andrew Morton
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <lukas@wunner.de>
[ Upstream commit c64ba13e2033c3c6dc1a097bf35f9f1fe457c3f7 ]
Andrew reports build breakage of arm allmodconfig, reproducible with gcc
14.2.0 and 15.2.0:
crypto/ecc.c: In function 'ecc_point_mult':
crypto/ecc.c:1380:1: error: the frame size of 1360 bytes is larger than 1280 bytes [-Werror=frame-larger-than=]
gcc aggressively inlines functions called by ecc_point_mult() (without
there being any explicit inline declarations), which pushes stack usage
close to the limit imposed by CONFIG_FRAME_WARN. allmodconfig implies
CONFIG_KASAN_STACK=y, which increases the stack above that limit.
In the bugzilla entry linked below, gcc maintainers explain that gcc
estimates extra stack usage caused by inlining, but ASAN instrumentation
is added in post-IPA passes and thus the inlining heuristics cannot
account for it.
It could be argued that -Werror=frame-larger-than=1280 instructs the
compiler to avoid inlining beyond that limit lest the build breaks,
which would imply gcc behaves incorrectly. But gcc maintainers reject
this notion and believe that a warning switch should never affect code
generation, even if it is promoted to an error.
One way to unbreak the build is to limit inlining via -finline-limit=100
or by explicitly declaring some functions noinline. However while it
does keep stack usage of individual functions below the limit, *total*
stack usage increases.
A longterm solution is to refactor ecc.c for reduced stack usage. It
currently performs ECC point multiplication with a Montgomery ladder
which uses co-Z (conjugate) addition to trade off memory for speed.
The algorithm is susceptible to timing attacks and needs to be replaced
with a constant time Montgomery ladder, which should consume less memory
and thus resolve the stack usage issue as a side effect.
In the interim, raise the limit for ecc.c, as is already done for
several other files in the source tree.
Constrain to gcc because clang 19.1.7 does not exhibit the issue. It
makes do with a 724 bytes stack frame even though it inlines almost the
same functions as gcc.
Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=124949
Reported-by: Andrew Morton <akpm@linux-foundation.org> # off-list
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/Makefile | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/crypto/Makefile b/crypto/Makefile
index 303b21c43df05..f92458db8fe9f 100644
--- a/crypto/Makefile
+++ b/crypto/Makefile
@@ -186,6 +186,11 @@ obj-$(CONFIG_CRYPTO_ECC) += ecc.o
obj-$(CONFIG_CRYPTO_ESSIV) += essiv.o
obj-$(CONFIG_CRYPTO_CURVE25519) += curve25519-generic.o
+# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=124949
+ifeq ($(CONFIG_ARM)$(CONFIG_KASAN_STACK)$(CONFIG_CC_IS_GCC),yyy)
+CFLAGS_ecc.o += $(call cc-option,-Wframe-larger-than=1536)
+endif
+
ecdh_generic-y += ecdh.o
ecdh_generic-y += ecdh_helper.o
obj-$(CONFIG_CRYPTO_ECDH) += ecdh_generic.o
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 046/982] crypto: atmel-ecc - add support for atecc608b
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 045/982] crypto: ecc - Unbreak the build on arm with CONFIG_KASAN_STACK=y Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 047/982] media: imon: Add iMON VFD HID OEM v1.2 key mappings Greg Kroah-Hartman
` (942 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Herbert Xu,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@linux.dev>
[ Upstream commit b668edaf8dcc8d09f6f1e71797422b44d4bd22a3 ]
Tested on hardware with an ATECC608B at 0x60. The device binds
successfully, passes the driver's sanity check, and registers the
ecdh-nist-p256 KPP algorithm.
The hardware ECDH path was also exercised using a minimal KPP test
module, covering private key generation, public key derivation, and
shared secret computation.
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/atmel-ecc.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/crypto/atmel-ecc.c b/drivers/crypto/atmel-ecc.c
index d2c830cb20eed..b9c5832cf6fcc 100644
--- a/drivers/crypto/atmel-ecc.c
+++ b/drivers/crypto/atmel-ecc.c
@@ -366,6 +366,8 @@ static void atmel_ecc_remove(struct i2c_client *client)
static const struct of_device_id atmel_ecc_dt_ids[] = {
{
.compatible = "atmel,atecc508a",
+ }, {
+ .compatible = "atmel,atecc608b",
}, {
/* sentinel */
}
@@ -375,6 +377,7 @@ MODULE_DEVICE_TABLE(of, atmel_ecc_dt_ids);
static const struct i2c_device_id atmel_ecc_id[] = {
{ "atecc508a" },
+ { "atecc608b" },
{ }
};
MODULE_DEVICE_TABLE(i2c, atmel_ecc_id);
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 047/982] media: imon: Add iMON VFD HID OEM v1.2 key mappings
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 046/982] crypto: atmel-ecc - add support for atecc608b Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 048/982] RDMA/mlx5: Use QP port when decoding responder CQEs Greg Kroah-Hartman
` (941 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alessandro Baldi, Sean Young,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alessandro Baldi <baldovic@virgilio.it>
[ Upstream commit d97d13c24d7893abcfb80d38630ce74daaa1434c ]
Add Vol+/Vol-/Mute panel button mappings for iMON VFD HID OEM v1.2.
This version differs in the codes that generate the
KEY_VOLUMEUP, KEY_VOLUMEDOWN and KEY_MUTE events.
Signed-off-by: Alessandro Baldi <baldovic@virgilio.it>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/imon.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
index bb4aabb08c06e..c6ef6d25871ad 100644
--- a/drivers/media/rc/imon.c
+++ b/drivers/media/rc/imon.c
@@ -295,6 +295,10 @@ static const struct imon_usb_dev_descr imon_OEM_VFD = {
{ 0x000100000000ffeell, KEY_VOLUMEUP },
{ 0x010000000000ffeell, KEY_VOLUMEDOWN },
{ 0x000000000100ffeell, KEY_MUTE },
+ /* iMON VFD HID OEM v1.2 */
+ { 0x000000000a00ffeell, KEY_VOLUMEUP },
+ { 0x000000000b00ffeell, KEY_VOLUMEDOWN },
+ { 0x000000000c00ffeell, KEY_MUTE },
/* 0xffdc iMON MCE VFD */
{ 0x00010000ffffffeell, KEY_VOLUMEUP },
{ 0x01000000ffffffeell, KEY_VOLUMEDOWN },
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 048/982] RDMA/mlx5: Use QP port when decoding responder CQEs
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 047/982] media: imon: Add iMON VFD HID OEM v1.2 key mappings Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 049/982] mailbox: Make mbox_send_message() return error code when tx fails Greg Kroah-Hartman
` (940 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chenguang Zhao, Leon Romanovsky,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenguang Zhao <zhaochenguang@kylinos.cn>
[ Upstream commit 194762e6e436acde0f8f6aef44200b0058c36791 ]
The responder CQE path determines the link layer via
rdma_port_get_link_layer(). Use qp->port instead of
hardcoding port 1, which can mis-decode completions on
multi-port devices.
Signed-off-by: Chenguang Zhao <zhaochenguang@kylinos.cn>
Link: https://patch.msgid.link/20260410074046.2044595-1-zhaochenguang@kylinos.cn
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/mlx5/cq.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c
index a34bbe27bb76a..886e9560e913e 100644
--- a/drivers/infiniband/hw/mlx5/cq.c
+++ b/drivers/infiniband/hw/mlx5/cq.c
@@ -166,7 +166,8 @@ enum {
static void handle_responder(struct ib_wc *wc, struct mlx5_cqe64 *cqe,
struct mlx5_ib_qp *qp)
{
- enum rdma_link_layer ll = rdma_port_get_link_layer(qp->ibqp.device, 1);
+ enum rdma_link_layer ll =
+ rdma_port_get_link_layer(qp->ibqp.device, qp->port);
struct mlx5_ib_dev *dev = to_mdev(qp->ibqp.device);
struct mlx5_ib_srq *srq = NULL;
struct mlx5_ib_wq *wq;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 049/982] mailbox: Make mbox_send_message() return error code when tx fails
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 048/982] RDMA/mlx5: Use QP port when decoding responder CQEs Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 050/982] PCI: Wait for device readiness after D3hot -> D0uninitialized transition Greg Kroah-Hartman
` (939 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joonwon Kang, Sudeep Holla,
Jassi Brar, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joonwon Kang <joonwonkang@google.com>
[ Upstream commit 96a3d2f3167f5644b30e60171898e67123c3c2c6 ]
When the mailbox controller failed transmitting message, the error code
was only passed to the client's tx done handler and not to
mbox_send_message() in blocking mode. For this reason, the function could
return a false success. This commit resolves the issue by introducing the
tx status and checking it before mbox_send_message() returns.
This commit works with the premise that the multi-threads' access to a
channel in blocking mode is serialized by clients, not by the mailbox
APIs, since the current mbox_send_message() in blocking mode does not
support multi-threads.
Signed-off-by: Joonwon Kang <joonwonkang@google.com>
Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mailbox/mailbox.c | 6 +++++-
include/linux/mailbox_controller.h | 2 ++
2 files changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/mailbox/mailbox.c b/drivers/mailbox/mailbox.c
index c5b9d24efb69c..a00a02b6709c7 100644
--- a/drivers/mailbox/mailbox.c
+++ b/drivers/mailbox/mailbox.c
@@ -110,8 +110,10 @@ static void tx_tick(struct mbox_chan *chan, int r)
if (chan->cl->tx_done)
chan->cl->tx_done(chan->cl, mssg, r);
- if (r != -ETIME && chan->cl->tx_block)
+ if (r != -ETIME && chan->cl->tx_block) {
+ chan->tx_status = r;
complete(&chan->tx_complete);
+ }
}
static enum hrtimer_restart txdone_hrtimer(struct hrtimer *hrtimer)
@@ -281,6 +283,8 @@ int mbox_send_message(struct mbox_chan *chan, void *mssg)
if (ret == 0) {
t = -ETIME;
tx_tick(chan, t);
+ } else if (chan->tx_status < 0) {
+ t = chan->tx_status;
}
}
diff --git a/include/linux/mailbox_controller.h b/include/linux/mailbox_controller.h
index 6fee33cb52f58..02e54ac37a6c0 100644
--- a/include/linux/mailbox_controller.h
+++ b/include/linux/mailbox_controller.h
@@ -108,6 +108,7 @@ struct mbox_controller {
* @txdone_method: Way to detect TXDone chosen by the API
* @cl: Pointer to the current owner of this channel
* @tx_complete: Transmission completion
+ * @tx_status: Transmission status
* @active_req: Currently active request hook
* @msg_count: No. of mssg currently queued
* @msg_free: Index of next available mssg slot
@@ -120,6 +121,7 @@ struct mbox_chan {
unsigned txdone_method;
struct mbox_client *cl;
struct completion tx_complete;
+ int tx_status;
void *active_req;
unsigned msg_count, msg_free;
void *msg_data[MBOX_TX_QUEUE_LEN];
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 050/982] PCI: Wait for device readiness after D3hot -> D0uninitialized transition
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 049/982] mailbox: Make mbox_send_message() return error code when tx fails Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 051/982] drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id Greg Kroah-Hartman
` (938 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bjorn Helgaas,
Rafael J. Wysocki (Intel), Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Helgaas <helgaas@kernel.org>
[ Upstream commit 41167a1e98536b4baf0846fd259c8124bd1c4e1b ]
For a device that advertises No_Soft_Reset == 0, a transition from D3hot to
D0uninitialized is a soft reset, and the resulting internal device state is
undefined.
Per PCIe r7.0, sec 2.3.1, a transition from D3hot to D0uninitialized
mandates a minimum 10 ms delay before accessing the device. Following this
delay, the device is permitted to respond to initial configuration requests
with a Request Retry Status (RRS) completion status if it needs more time
to initialize.
Call pci_dev_wait() after pci_power_up() performs a D3hot->D0uninitialized
transition to ensure the device is ready to accept config accesses, as is
done after the similar transition in pci_pm_reset().
If the device is already ready, this is essentially a no-op except for one
additional config read.
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org>
Link: https://patch.msgid.link/20260518191220.636213-3-bhelgaas@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/pci.c | 24 ++++++++++++++++++++++--
1 file changed, 22 insertions(+), 2 deletions(-)
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index c87a5e9f75684..b0d4c3bc205bf 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -1274,7 +1274,18 @@ int pci_power_up(struct pci_dev *dev)
bool need_restore;
pci_power_t state;
u16 pmcsr;
+ int ret;
+ /*
+ * When setting power state to D0, platform_pci_set_power_state()
+ * ensures main power is on. If it puts the device in D0, it also
+ * completes any required delays after the transition; if it leaves
+ * the device in D1, D2, or D3hot, we use the PM Capability to
+ * transition to D0.
+ *
+ * In all cases, the device is either Configuration-Ready or
+ * inaccessible upon return.
+ */
platform_pci_set_power_state(dev, PCI_D0);
if (!dev->pm_cap) {
@@ -1315,10 +1326,19 @@ int pci_power_up(struct pci_dev *dev)
pci_write_config_word(dev, dev->pm_cap + PCI_PM_CTRL, 0);
/* Mandatory transition delays; see PCI PM 1.2. */
- if (state == PCI_D3hot)
+ if (state == PCI_D3hot) {
pci_dev_d3_sleep(dev);
- else if (state == PCI_D2)
+ if (!(pmcsr & PCI_PM_CTRL_NO_SOFT_RESET)) {
+ ret = pci_dev_wait(dev, "power up D3hot->D0uninitialized",
+ PCIE_RESET_READY_POLL_MS);
+ if (ret) {
+ dev->current_state = PCI_D3cold;
+ return -EIO;
+ }
+ }
+ } else if (state == PCI_D2) {
udelay(PCI_PM_D2_DELAY);
+ }
end:
dev->current_state = PCI_D0;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 051/982] drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 050/982] PCI: Wait for device readiness after D3hot -> D0uninitialized transition Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 052/982] drm/amdkfd: Check bounds on allocate_doorbell Greg Kroah-Hartman
` (937 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Francis,
Harish Kasiviswanathan, Alex Deucher, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Francis <David.Francis@amd.com>
[ Upstream commit bfe9a7545b2a7be1c543f1741e16f2d5ec4116ae ]
allocate_sdma_queue has an option where the sdma queue id can be
specified (used by CRIU). We weren't bounds-checking that
value.
Confirm it's less than the maximum number of queues.
Signed-off-by: David Francis <David.Francis@amd.com>
Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
index 4e754e47bff36..89e3c37e6c56f 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -1348,6 +1348,9 @@ static int allocate_sdma_queue(struct device_queue_manager *dqm,
}
if (restore_sdma_id) {
+ if (*restore_sdma_id >= get_num_sdma_queues(dqm))
+ return -EINVAL;
+
/* Re-use existing sdma_id */
if (!(dqm->sdma_bitmap & (1ULL << *restore_sdma_id))) {
pr_err("SDMA queue already in use\n");
@@ -1372,6 +1375,9 @@ static int allocate_sdma_queue(struct device_queue_manager *dqm,
return -ENOMEM;
}
if (restore_sdma_id) {
+ if (*restore_sdma_id >= get_num_xgmi_sdma_queues(dqm))
+ return -EINVAL;
+
/* Re-use existing sdma_id */
if (!(dqm->xgmi_sdma_bitmap & (1ULL << *restore_sdma_id))) {
pr_err("SDMA queue already in use\n");
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 052/982] drm/amdkfd: Check bounds on allocate_doorbell
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 051/982] drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 053/982] ALSA: usx2y: Drain pending US-428 pipe-4 output commands Greg Kroah-Hartman
` (936 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Francis,
Harish Kasiviswanathan, Alex Deucher, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Francis <David.Francis@amd.com>
[ Upstream commit 1f087bb8cf9e8797633da35c85435e557ef74d06 ]
allocated_doorbell has an option to set the doorbell id
to a specific value (used by CRIU). This value was not
bounds checked.
Check to confirm it's less than KFD_MAX_NUM_OF_QUEUES_PER_PROCESS.
Signed-off-by: David Francis <David.Francis@amd.com>
Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
index 89e3c37e6c56f..689abc3d3a395 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -361,6 +361,9 @@ static int allocate_doorbell(struct qcm_process_device *qpd,
} else {
/* For CP queues on SOC15 */
if (restore_id) {
+ if (*restore_id >= KFD_MAX_NUM_OF_QUEUES_PER_PROCESS)
+ return -EINVAL;
+
/* make sure that ID is free */
if (__test_and_set_bit(*restore_id, qpd->doorbell_bitmap))
return -EINVAL;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 053/982] ALSA: usx2y: Drain pending US-428 pipe-4 output commands
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 052/982] drm/amdkfd: Check bounds on allocate_doorbell Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 054/982] 9p: invalidate readdir buffer on seek Greg Kroah-Hartman
` (935 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cássio Gabriel, Takashi Iwai,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
[ Upstream commit 18977c0dd722f52217027ff75de2811c53cce2cc ]
The US-428 pipe-4 output path submits at most one pending p4out
entry from the shared-memory ring per input interrupt. If userspace
queues more than one command before the interrupt handler runs, later
commands remain pending until later input interrupts, even when async
pipe-4 URBs are available.
Drain pending entries while idle async URBs are available. Copy each
command into the existing per-URB async buffer before submission, so the
submitted transfer does not depend on a userspace-mapped ring slot
remaining unchanged after p4out_sent is advanced.
Also update p4out_sent only after usb_submit_urb() succeeds, so a
failed submission is not reported as sent.
This keeps the shared-memory ABI unchanged and fixes only the local
queue-draining behavior.
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Link: https://patch.msgid.link/20260519-alsa-usx2y-p4out-drain-v1-1-8f0a4550bae2@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/usx2y/usbusx2y.c | 39 ++++++++++++++++++++++----------------
1 file changed, 23 insertions(+), 16 deletions(-)
diff --git a/sound/usb/usx2y/usbusx2y.c b/sound/usb/usx2y/usbusx2y.c
index 0fe989a633769..e4385b18edfbe 100644
--- a/sound/usb/usx2y/usbusx2y.c
+++ b/sound/usb/usx2y/usbusx2y.c
@@ -180,7 +180,7 @@ static void i_usx2y_in04_int(struct urb *urb)
struct usx2ydev *usx2y = urb->context;
struct us428ctls_sharedmem *us428ctls = usx2y->us428ctls_sharedmem;
struct us428_p4out *p4out;
- int i, j, n, diff, send;
+ int i, j, n, diff, send, len;
usx2y->in04_int_calls++;
@@ -223,24 +223,31 @@ static void i_usx2y_in04_int(struct urb *urb)
} while (!err && usx2y->us04->submitted < usx2y->us04->len);
}
} else {
- if (us428ctls && us428ctls->p4out_last >= 0 && us428ctls->p4out_last < N_US428_P4OUT_BUFS) {
- if (us428ctls->p4out_last != us428ctls->p4out_sent) {
- send = us428ctls->p4out_sent + 1;
- if (send >= N_US428_P4OUT_BUFS)
- send = 0;
- for (j = 0; j < URBS_ASYNC_SEQ && !err; ++j) {
- if (!usx2y->as04.urb[j]->status) {
- p4out = us428ctls->p4out + send; // FIXME if more than 1 p4out is new, 1 gets lost.
- usb_fill_bulk_urb(usx2y->as04.urb[j], usx2y->dev,
- usb_sndbulkpipe(usx2y->dev, 0x04), &p4out->val.vol,
- p4out->type == ELT_LIGHT ? sizeof(struct us428_lights) : 5,
- i_usx2y_out04_int, usx2y);
- err = usb_submit_urb(usx2y->as04.urb[j], GFP_ATOMIC);
+ while (us428ctls &&
+ us428ctls->p4out_last >= 0 &&
+ us428ctls->p4out_last < N_US428_P4OUT_BUFS &&
+ us428ctls->p4out_last != us428ctls->p4out_sent) {
+ for (j = 0; j < URBS_ASYNC_SEQ && !err; ++j) {
+ if (!usx2y->as04.urb[j]->status) {
+ send = us428ctls->p4out_sent + 1;
+ if (send >= N_US428_P4OUT_BUFS)
+ send = 0;
+
+ p4out = us428ctls->p4out + send;
+ len = p4out->type == ELT_LIGHT ?
+ sizeof(struct us428_lights) : 5;
+ memcpy(usx2y->as04.urb[j]->transfer_buffer,
+ &p4out->val.vol, len);
+ usx2y->as04.urb[j]->transfer_buffer_length = len;
+ err = usb_submit_urb(usx2y->as04.urb[j], GFP_ATOMIC);
+ if (!err)
us428ctls->p4out_sent = send;
- break;
- }
+
+ break;
}
}
+ if (j >= URBS_ASYNC_SEQ || err)
+ break;
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 054/982] 9p: invalidate readdir buffer on seek
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 053/982] ALSA: usx2y: Drain pending US-428 pipe-4 output commands Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 055/982] arm64/daifflags: Make local_daif_*() helpers __always_inline Greg Kroah-Hartman
` (934 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pierre Barre, Dominique Martinet,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre Barre <pierre@barre.sh>
[ Upstream commit e661e17ddbed524b5fbda789a091b48b6b677067 ]
The per-fid readdir buffer (fid->rdir) is populated lazily and only
refilled when fully drained (rdir->head == rdir->tail). userspace
lseek() on a directory fd updates file->f_pos via generic_file_llseek()
but does not touch the cached buffer, so the next getdents() iterates
the stale cache and emits entries from the previous position instead
of the one the caller asked for.
Track the file position the cached data corresponds to in
struct p9_rdir, and drop the cache on entry to iterate_shared when it
no longer matches ctx->pos. The 9p protocol's Tread/Treaddir already
take an arbitrary offset on every request, so a refill at the new
position is always legal; no .llseek override or seek restriction is
needed.
Reported-by: Pierre Barre <pierre@barre.sh>
Link: https://lore.kernel.org/v9fs/496d10b9-40fe-4f81-8014-37497c37ff63@app.fastmail.com/
Signed-off-by: Pierre Barre <pierre@barre.sh>
Message-ID: <20260512132032.369281-2-pierre@barre.sh>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/9p/vfs_dir.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/fs/9p/vfs_dir.c b/fs/9p/vfs_dir.c
index 3bb95adc9619d..dd36dce582839 100644
--- a/fs/9p/vfs_dir.c
+++ b/fs/9p/vfs_dir.c
@@ -29,6 +29,7 @@
* struct p9_rdir - readdir accounting
* @head: start offset of current dirread buffer
* @tail: end offset of current dirread buffer
+ * @offset: file position the data at @head corresponds to
* @buf: dirread buffer
*
* private structure for keeping track of readdir
@@ -38,6 +39,7 @@
struct p9_rdir {
int head;
int tail;
+ loff_t offset;
uint8_t buf[];
};
@@ -104,6 +106,9 @@ static int v9fs_dir_readdir(struct file *file, struct dir_context *ctx)
kvec.iov_base = rdir->buf;
kvec.iov_len = buflen;
+ if (rdir->head < rdir->tail && rdir->offset != ctx->pos)
+ rdir->head = rdir->tail = 0;
+
while (1) {
if (rdir->tail == rdir->head) {
struct iov_iter to;
@@ -119,6 +124,7 @@ static int v9fs_dir_readdir(struct file *file, struct dir_context *ctx)
rdir->head = 0;
rdir->tail = n;
+ rdir->offset = ctx->pos;
}
while (rdir->head < rdir->tail) {
err = p9stat_read(fid->clnt, rdir->buf + rdir->head,
@@ -136,6 +142,7 @@ static int v9fs_dir_readdir(struct file *file, struct dir_context *ctx)
rdir->head += err;
ctx->pos += err;
+ rdir->offset = ctx->pos;
}
}
}
@@ -163,6 +170,9 @@ static int v9fs_dir_readdir_dotl(struct file *file, struct dir_context *ctx)
if (!rdir)
return -ENOMEM;
+ if (rdir->head < rdir->tail && rdir->offset != ctx->pos)
+ rdir->head = rdir->tail = 0;
+
while (1) {
if (rdir->tail == rdir->head) {
err = p9_client_readdir(fid, rdir->buf, buflen,
@@ -172,6 +182,7 @@ static int v9fs_dir_readdir_dotl(struct file *file, struct dir_context *ctx)
rdir->head = 0;
rdir->tail = err;
+ rdir->offset = ctx->pos;
}
while (rdir->head < rdir->tail) {
@@ -192,6 +203,7 @@ static int v9fs_dir_readdir_dotl(struct file *file, struct dir_context *ctx)
ctx->pos = curdirent.d_off;
rdir->head += err;
+ rdir->offset = ctx->pos;
}
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 055/982] arm64/daifflags: Make local_daif_*() helpers __always_inline
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 054/982] 9p: invalidate readdir buffer on seek Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 056/982] 9p: use kvzalloc for readdir buffer Greg Kroah-Hartman
` (933 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mark Rutland, Leonardo Bras,
Will Deacon, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leonardo Bras <leo.bras@arm.com>
[ Upstream commit 827ce94e0897a70241abf810b1d3d7d083053a39 ]
Make sure those helpers are always inlined and instrumentation safe.
Suggested-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Leonardo Bras <leo.bras@arm.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/include/asm/daifflags.h | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/arch/arm64/include/asm/daifflags.h b/arch/arm64/include/asm/daifflags.h
index 55f57dfa8e2fe..e2ad84c2f32bc 100644
--- a/arch/arm64/include/asm/daifflags.h
+++ b/arch/arm64/include/asm/daifflags.h
@@ -19,7 +19,7 @@
/* mask/save/unmask/restore all exceptions, including interrupts. */
-static inline void local_daif_mask(void)
+static __always_inline void local_daif_mask(void)
{
WARN_ON(system_has_prio_mask_debugging() &&
(read_sysreg_s(SYS_ICC_PMR_EL1) == (GIC_PRIO_IRQOFF |
@@ -38,7 +38,7 @@ static inline void local_daif_mask(void)
trace_hardirqs_off();
}
-static inline unsigned long local_daif_save_flags(void)
+static __always_inline unsigned long local_daif_save_flags(void)
{
unsigned long flags;
@@ -53,7 +53,7 @@ static inline unsigned long local_daif_save_flags(void)
return flags;
}
-static inline unsigned long local_daif_save(void)
+static __always_inline unsigned long local_daif_save(void)
{
unsigned long flags;
@@ -64,7 +64,7 @@ static inline unsigned long local_daif_save(void)
return flags;
}
-static inline void local_daif_restore(unsigned long flags)
+static __always_inline void local_daif_restore(unsigned long flags)
{
bool irq_disabled = flags & PSR_I_BIT;
@@ -124,7 +124,7 @@ static inline void local_daif_restore(unsigned long flags)
* Called by synchronous exception handlers to restore the DAIF bits that were
* modified by taking an exception.
*/
-static inline void local_daif_inherit(struct pt_regs *regs)
+static __always_inline void local_daif_inherit(struct pt_regs *regs)
{
unsigned long flags = regs->pstate & DAIF_MASK;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 056/982] 9p: use kvzalloc for readdir buffer
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 055/982] arm64/daifflags: Make local_daif_*() helpers __always_inline Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 057/982] firmware: arm_scmi: Validate SENSOR_UPDATE payload size Greg Kroah-Hartman
` (932 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pierre Barre, Dominique Martinet,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre Barre <pierre@barre.sh>
[ Upstream commit b4d71bea144550ff4a0917f8c4b06d4063eb27a6 ]
The readdir buffer is sized to msize, so kzalloc() can fail under
fragmentation with a page allocation failure in v9fs_alloc_rdir_buf()
/ v9fs_dir_readdir_dotl().
The buffer is only a response sink and is never pack_sg_list()'d,
so kvzalloc() is safe for all transports, unlike the fcall buffers
fixed in e21d451a82f3 ("9p: Use kvmalloc for message buffers on
supported transports").
Signed-off-by: Pierre Barre <pierre@barre.sh>
Message-ID: <20260512132032.369281-1-pierre@barre.sh>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/9p/vfs_dir.c | 2 +-
net/9p/client.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/9p/vfs_dir.c b/fs/9p/vfs_dir.c
index dd36dce582839..3be09b94a8e24 100644
--- a/fs/9p/vfs_dir.c
+++ b/fs/9p/vfs_dir.c
@@ -74,7 +74,7 @@ static struct p9_rdir *v9fs_alloc_rdir_buf(struct file *filp, int buflen)
struct p9_fid *fid = filp->private_data;
if (!fid->rdir)
- fid->rdir = kzalloc(sizeof(struct p9_rdir) + buflen, GFP_KERNEL);
+ fid->rdir = kvzalloc(sizeof(struct p9_rdir) + buflen, GFP_KERNEL);
return fid->rdir;
}
diff --git a/net/9p/client.c b/net/9p/client.c
index 70c2cf23128fb..1a65c51636188 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -880,7 +880,7 @@ static void p9_fid_destroy(struct p9_fid *fid)
spin_lock_irqsave(&clnt->lock, flags);
idr_remove(&clnt->fids, fid->fid);
spin_unlock_irqrestore(&clnt->lock, flags);
- kfree(fid->rdir);
+ kvfree(fid->rdir);
kfree(fid);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 057/982] firmware: arm_scmi: Validate SENSOR_UPDATE payload size
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 056/982] 9p: use kvzalloc for readdir buffer Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 058/982] firmware: arm_scmi: Validate BASE_ERROR_EVENT " Greg Kroah-Hartman
` (931 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cristian Marussi, Sudeep Holla,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <sudeep.holla@kernel.org>
[ Upstream commit 32bc5496b48174dbca1f187f710955ee4d9527a1 ]
SENSOR_UPDATE carries one or more sensor readings after the fixed
notification header. The parser derives the expected reading count
from the sensor description, but it did not verify that the received
payload contains those entries before parsing them.
Reject truncated update notifications before reading the variable
array.
Link: https://patch.msgid.link/20260517-scmi_fixes-v1-3-d86daec4defd@kernel.org
Reviewed-by: Cristian Marussi <cristian.marussi@arm.com>
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/arm_scmi/sensors.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/firmware/arm_scmi/sensors.c b/drivers/firmware/arm_scmi/sensors.c
index 4e3e937cb92c1..900ee86a2c662 100644
--- a/drivers/firmware/arm_scmi/sensors.c
+++ b/drivers/firmware/arm_scmi/sensors.c
@@ -1037,12 +1037,15 @@ scmi_sensor_fill_custom_report(const struct scmi_protocol_handle *ph,
case SCMI_EVENT_SENSOR_UPDATE:
{
int i;
+ size_t expected_sz;
struct scmi_sensor_info *s;
const struct scmi_sensor_update_notify_payld *p = payld;
struct scmi_sensor_update_report *r = report;
struct sensors_info *sinfo = ph->get_priv(ph);
- /* payld_sz is variable for this event */
+ if (payld_sz < sizeof(*p))
+ break;
+
r->sensor_id = le32_to_cpu(p->sensor_id);
if (r->sensor_id >= sinfo->num_sensors)
break;
@@ -1056,6 +1059,11 @@ scmi_sensor_fill_custom_report(const struct scmi_protocol_handle *ph,
* readings defined for this sensor or 1 for scalar sensors.
*/
r->readings_count = s->num_axis ?: 1;
+ expected_sz = sizeof(*p) + r->readings_count *
+ sizeof(p->readings[0]);
+ if (payld_sz < expected_sz)
+ break;
+
for (i = 0; i < r->readings_count; i++)
scmi_parse_sensor_readings(&r->readings[i],
&p->readings[i]);
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 058/982] firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 057/982] firmware: arm_scmi: Validate SENSOR_UPDATE payload size Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 059/982] wifi: mac80211: dont call ieee80211_handle_reconfig_failure when not needed Greg Kroah-Hartman
` (930 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sudeep Holla, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <sudeep.holla@kernel.org>
[ Upstream commit 56e7e64cdd0e7209a58c8ec66028d63387402919 ]
BASE_ERROR_EVENT carries a variable number of message reports,
with the count encoded in error_status. The notification parser used
that count without checking whether the received payload contained all
reported entries.
Reject truncated payloads before copying the report array.
Link: https://patch.msgid.link/20260517-scmi_fixes-v1-2-d86daec4defd@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/arm_scmi/base.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
diff --git a/drivers/firmware/arm_scmi/base.c b/drivers/firmware/arm_scmi/base.c
index a52f084a6a87b..f455165a81bcd 100644
--- a/drivers/firmware/arm_scmi/base.c
+++ b/drivers/firmware/arm_scmi/base.c
@@ -324,6 +324,8 @@ static void *scmi_base_fill_custom_report(const struct scmi_protocol_handle *ph,
void *report, u32 *src_id)
{
int i;
+ u32 error_status;
+ size_t expected_sz;
const struct scmi_base_error_notify_payld *p = payld;
struct scmi_base_error_report *r = report;
@@ -337,10 +339,19 @@ static void *scmi_base_fill_custom_report(const struct scmi_protocol_handle *ph,
if (evt_id != SCMI_EVENT_BASE_ERROR_EVENT || sizeof(*p) < payld_sz)
return NULL;
+ expected_sz = offsetof(typeof(*p), msg_reports);
+ if (payld_sz < expected_sz)
+ return NULL;
+
r->timestamp = timestamp;
r->agent_id = le32_to_cpu(p->agent_id);
- r->fatal = IS_FATAL_ERROR(le32_to_cpu(p->error_status));
- r->cmd_count = ERROR_CMD_COUNT(le32_to_cpu(p->error_status));
+ error_status = le32_to_cpu(p->error_status);
+ r->fatal = IS_FATAL_ERROR(error_status);
+ r->cmd_count = ERROR_CMD_COUNT(error_status);
+ expected_sz += r->cmd_count * sizeof(p->msg_reports[0]);
+ if (payld_sz < expected_sz)
+ return NULL;
+
for (i = 0; i < r->cmd_count; i++)
r->reports[i] = le64_to_cpu(p->msg_reports[i]);
*src_id = 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 059/982] wifi: mac80211: dont call ieee80211_handle_reconfig_failure when not needed
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 058/982] firmware: arm_scmi: Validate BASE_ERROR_EVENT " Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 060/982] bitfield: wire __bf_shf to __builtin_ctzll Greg Kroah-Hartman
` (929 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Miri Korenblit, Johannes Berg,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
[ Upstream commit 7a8a3ff2815501f78f494808355ddf37e08647d0 ]
In case reconfiguration of NAN fails, we call
ieee80211_handle_reconfig_failure, that marks all interfaces as not in
the driver.
Then, at the error path of the reconfig, cfg80211_shutdown_all_interfaces
is called to destroy all the interfaces.
If we have any other interface but the NAN one, for example a BSS
station, then when its state (links, stations) will be removed, we
won't tell the driver about this, because we will think that the
interfaces are not in the driver, and then drivers might remain with
dangling pointers to objects like stations and links (at least for
iwlwifi this is the case).
ieee80211_handle_reconfig_failure is meant to be called after we cleaned
up the state in the driver, there is no reason to call it for NAN
reconfiguration failure.
Fix the code to just warn in such a case, as we do in other error paths
in reconfig where it is too complicated to rewind.
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260513182548.6a25f3a0a6ec.I83d1f2a7eed20200a78a62757c6b193e3bab892b@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/util.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 116a3e70582be..73116ed609e1f 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -2617,11 +2617,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
}
break;
case NL80211_IFTYPE_NAN:
- res = ieee80211_reconfig_nan(sdata);
- if (res < 0) {
- ieee80211_handle_reconfig_failure(local);
- return res;
- }
+ WARN_ON(ieee80211_reconfig_nan(sdata));
break;
case NL80211_IFTYPE_AP_VLAN:
case NL80211_IFTYPE_MONITOR:
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 060/982] bitfield: wire __bf_shf to __builtin_ctzll
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 059/982] wifi: mac80211: dont call ieee80211_handle_reconfig_failure when not needed Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 061/982] nvme-core: align fabrics_q teardown with admin_q in nvme_free_ctrl Greg Kroah-Hartman
` (928 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Matt Coster, Yury Norov, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yury Norov <ynorov@nvidia.com>
[ Upstream commit 09472f591aa0b72c2dd6c693f48b2d6fea66c7ba ]
__bf_shf() is currently based on built-in ffsll. It's more
straightforward to wire it to __builtin_ctzll, which makes it a pure
rename.
Worth to notice that __builtin_ffsll() is buggy on GCC before 14.1:
int main() {
sizeof(struct {
int t : !(__builtin_ffsll(~0ULL) + 1 < 0);
});
}
test.c: In function 'main':
test.c:3:21: error: bit-field 't' width not an integer constant
3 | int t : !(__builtin_ffsll(~0ULL) + 1 < 0);
| ^
Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=124699
Reported-by: Matt Coster <matt.coster@imgtec.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202603222211.A2XiR1YU-lkp@intel.com/
Signed-off-by: Yury Norov <ynorov@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/bitfield.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/bitfield.h b/include/linux/bitfield.h
index 35622ff2c9951..65646d4917658 100644
--- a/include/linux/bitfield.h
+++ b/include/linux/bitfield.h
@@ -43,7 +43,7 @@
* reg |= FIELD_PREP(REG_FIELD_C, c);
*/
-#define __bf_shf(x) (__builtin_ffsll(x) - 1)
+#define __bf_shf __builtin_ctzll
#define __scalar_type_to_unsigned_cases(type) \
unsigned type: (unsigned type)0, \
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 061/982] nvme-core: align fabrics_q teardown with admin_q in nvme_free_ctrl
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 060/982] bitfield: wire __bf_shf to __builtin_ctzll Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 062/982] net: usb: qmi_wwan: add MeiG SRM813Q Greg Kroah-Hartman
` (927 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Hannes Reinecke,
Sagi Grimberg, Daniel Wagner, Maurizio Lombardi, Keith Busch,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maurizio Lombardi <mlombard@redhat.com>
[ Upstream commit f702badaf7d31dc3dea6c66da92b5f35fadd89dc ]
Currently, the final reference for the fabrics admin queue (fabrics_q)
is dropped inside nvme_remove_admin_tag_set(). However, the primary admin
queue (admin_q) defers dropping its final reference until
nvme_free_ctrl().
Move the blk_put_queue() call for fabrics_q from
nvme_remove_admin_tag_set() to nvme_free_ctrl(). This aligns the
lifecycle management of both admin queues, ensuring they are freed
symmetrically when the controller is finally torn down.
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/core.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index f7695aba66cc4..66600341bd6aa 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -5050,10 +5050,8 @@ EXPORT_SYMBOL_GPL(nvme_alloc_admin_tag_set);
void nvme_remove_admin_tag_set(struct nvme_ctrl *ctrl)
{
blk_mq_destroy_queue(ctrl->admin_q);
- if (ctrl->ops->flags & NVME_F_FABRICS) {
+ if (ctrl->fabrics_q)
blk_mq_destroy_queue(ctrl->fabrics_q);
- blk_put_queue(ctrl->fabrics_q);
- }
blk_mq_free_tag_set(ctrl->admin_tagset);
}
EXPORT_SYMBOL_GPL(nvme_remove_admin_tag_set);
@@ -5194,6 +5192,8 @@ static void nvme_free_ctrl(struct device *dev)
if (ctrl->admin_q)
blk_put_queue(ctrl->admin_q);
+ if (ctrl->fabrics_q)
+ blk_put_queue(ctrl->fabrics_q);
if (!subsys || ctrl->instance != subsys->instance)
ida_free(&nvme_instance_ida, ctrl->instance);
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 062/982] net: usb: qmi_wwan: add MeiG SRM813Q
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 061/982] nvme-core: align fabrics_q teardown with admin_q in nvme_free_ctrl Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 063/982] net: bridge: remove stale rcu_barrier() in br_multicast_dev_del() Greg Kroah-Hartman
` (926 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jan Volckaert, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Volckaert <janvolck@gmail.com>
[ Upstream commit 9758c11fc6c138a79a28a5659feeaa3abde7aa6a ]
Add support for the Qualcomm Technology Snapdragon X35-based MeiG SRM813Q
module.
The module can be put in different modes via AT commands
to enable/disable GPS functionality:
MODEM - PPP mode(2dee:4d63): AT+SER=1,1
If#= 0: RMNET
If#= 1: DIAG/ADB
If#= 2: MODEM
If#= 3: AT
P: Vendor=2dee ProdID=4d63 Rev=05.15
S: Manufacturer=MEIG
S: Product=LTE-A Module
S: SerialNumber=1bd51f0e
C: #Ifs= 4 Cfg#= 1 Atr=80 MxPwr=500mA
I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
NMEA mode(2dee:4d64): AT+SER=51,1
If#= 0: RMNET
If#= 1: DIAG/ADB
If#= 2: NMEA
If#= 3: AT
P: Vendor=2dee ProdID=4d64 Rev=05.15
S: Manufacturer=MEIG
S: Product=LTE-A Module
S: SerialNumber=1bd51f0e
C: #Ifs= 4 Cfg#= 1 Atr=80 MxPwr=500mA
I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
Signed-off-by: Jan Volckaert <janvolck@gmail.com>
Link: https://patch.msgid.link/20260517153237.55995-2-janvolck@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/qmi_wwan.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index d1ac454d17d5d..8ed86bdefb8d6 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1455,6 +1455,8 @@ static const struct usb_device_id products[] = {
{QMI_QUIRK_SET_DTR(0x1546, 0x1342, 4)}, /* u-blox LARA-L6 */
{QMI_QUIRK_SET_DTR(0x33f8, 0x0104, 4)}, /* Rolling RW101 RMNET */
{QMI_FIXED_INTF(0x2dee, 0x4d22, 5)}, /* MeiG Smart SRM825L */
+ {QMI_QUIRK_SET_DTR(0x2dee, 0x4d63, 0)}, /* MeiG SRM813Q w/ Modem(PPP) */
+ {QMI_QUIRK_SET_DTR(0x2dee, 0x4d64, 0)}, /* MeiG SRM813Q w/ NMEA */
/* 4. Gobi 1000 devices */
{QMI_GOBI1K_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 063/982] net: bridge: remove stale rcu_barrier() in br_multicast_dev_del()
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 062/982] net: usb: qmi_wwan: add MeiG SRM813Q Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 064/982] net/sched: sch_drr: make cl->quantum lockless Greg Kroah-Hartman
` (925 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Jakub Sitnicki,
Ido Schimmel, Nikolay Aleksandrov, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 25ae123db10ba9ab890b56bcdb0a4363aee8529a ]
This rcu_barrier() came from a time call_rcu() calls were used in
net/bridge/br_multicast.c.
Now kfree_rcu() is there, we can remove this problematic rcu_barrier()
which causes extreme RTNL pressure in many syzbot reports.
INFO: task syz-executor:77945 is blocked on a mutex likely owned by task kworker/u1024:5:36537.
task:kworker/u1024:5 state:D stack:24616 pid:36537 tgid:36537 ppid:2 task_flags:0x4208060 flags:0x00080000 last_sleep:612797637337
Workqueue: netns cleanup_net
Call Trace:
<TASK>
[<ffffffff81914eaa>] context_switch+0xf2a/0x1730 kernel/sched/core.c:6483
[<ffffffff81201143>] __schedule+0x1133/0x43a0 kernel/sched/core.c:8411
[<ffffffff8120446b>] __schedule_loop kernel/sched/core.c:8514 [inline]
[<ffffffff8120446b>] schedule+0xab/0x260 kernel/sched/core.c:8529
[<ffffffff8121a093>] schedule_timeout+0xc3/0x2b0 kernel/time/sleep_timeout.c:75
[<ffffffff81205347>] do_wait_for_common kernel/sched/completion.c:100 [inline]
[<ffffffff81205347>] __wait_for_common kernel/sched/completion.c:121 [inline]
[<ffffffff81205347>] wait_for_common kernel/sched/completion.c:132 [inline]
[<ffffffff81205347>] wait_for_completion+0x2c7/0x5d0 kernel/sched/completion.c:153
[<ffffffff81b8f27f>] rcu_barrier+0x49f/0x620 kernel/rcu/tree.c:3888
[<ffffffff860091b3>] br_multicast_dev_del+0x303/0x350 net/bridge/br_multicast.c:4459
[<ffffffff85fb5dbc>] br_dev_uninit+0x1c/0x40 net/bridge/br_device.c:157
[<ffffffff8568058c>] unregister_netdevice_many_notify+0x1c1c/0x2300 net/core/dev.c:12599
[<ffffffff8562be43>] ops_exit_rtnl_list net/core/net_namespace.c:187 [inline]
[<ffffffff8562be43>] ops_undo_list+0x3d3/0x940 net/core/net_namespace.c:248
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://patch.msgid.link/20260519095540.2643318-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bridge/br_multicast.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index f5f6da322227e..4245d8d7767d8 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -4284,8 +4284,6 @@ void br_multicast_dev_del(struct net_bridge *br)
br_multicast_ctx_deinit(&br->multicast_ctx);
br_multicast_gc(&deleted_head);
cancel_work_sync(&br->mcast_gc_work);
-
- rcu_barrier();
}
int br_multicast_set_router(struct net_bridge_mcast *brmctx, unsigned long val)
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 064/982] net/sched: sch_drr: make cl->quantum lockless
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 063/982] net: bridge: remove stale rcu_barrier() in br_multicast_dev_del() Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 065/982] net/rds: Dont sleep inside rds_ib_conn_path_shutdown Greg Kroah-Hartman
` (924 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit a4d880b85089e12a5f2e8e2fee386310cec5b99a ]
cl->quantum does not need to be protected by RTNL or qdisc spinlock.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260519094618.2632073-3-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_drr.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index f6048a2eddce4..437b09acef123 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -98,10 +98,8 @@ static int drr_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
}
}
- sch_tree_lock(sch);
if (tb[TCA_DRR_QUANTUM])
- cl->quantum = quantum;
- sch_tree_unlock(sch);
+ WRITE_ONCE(cl->quantum, quantum);
return 0;
}
@@ -250,7 +248,7 @@ static int drr_dump_class(struct Qdisc *sch, unsigned long arg,
nest = nla_nest_start_noflag(skb, TCA_OPTIONS);
if (nest == NULL)
goto nla_put_failure;
- if (nla_put_u32(skb, TCA_DRR_QUANTUM, cl->quantum))
+ if (nla_put_u32(skb, TCA_DRR_QUANTUM, READ_ONCE(cl->quantum)))
goto nla_put_failure;
return nla_nest_end(skb, nest);
@@ -361,7 +359,7 @@ static int drr_enqueue(struct sk_buff *skb, struct Qdisc *sch,
if (!cl_is_active(cl)) {
list_add_tail(&cl->alist, &q->active);
- WRITE_ONCE(cl->deficit, cl->quantum);
+ WRITE_ONCE(cl->deficit, READ_ONCE(cl->quantum));
}
sch->qstats.backlog += len;
@@ -402,7 +400,7 @@ static struct sk_buff *drr_dequeue(struct Qdisc *sch)
return skb;
}
- WRITE_ONCE(cl->deficit, cl->deficit + cl->quantum);
+ WRITE_ONCE(cl->deficit, cl->deficit + READ_ONCE(cl->quantum));
list_move_tail(&cl->alist, &q->active);
}
out:
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 065/982] net/rds: Dont sleep inside rds_ib_conn_path_shutdown
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 064/982] net/sched: sch_drr: make cl->quantum lockless Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 066/982] befs: handle set_blocksize failures Greg Kroah-Hartman
` (923 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Allison Henderson, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Allison Henderson <achender@kernel.org>
[ Upstream commit 16f48efaeb6991193fb7775c577f06f5b20b0c90 ]
New rds rdma self tests exposed a hang when tearing down
the ib network configs. This is caused by the shutdown worker
thread sleeping on the wait_event call, which blocks other work
items in the queue. Fix this by changing wait_event to
wait_event timeout, and looping until the wait check succeeds.
Signed-off-by: Allison Henderson <achender@kernel.org>
Link: https://patch.msgid.link/20260518012443.2629206-2-achender@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/rds/ib_cm.c | 25 ++++++++++++++++++++-----
1 file changed, 20 insertions(+), 5 deletions(-)
diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
index e50e01abb0799..d9b6c9d2f6791 100644
--- a/net/rds/ib_cm.c
+++ b/net/rds/ib_cm.c
@@ -1043,6 +1043,19 @@ int rds_ib_conn_path_connect(struct rds_conn_path *cp)
return ret;
}
+static unsigned long rds_ib_conn_path_shutdown_check_wait(struct rds_conn_path *cp)
+{
+ struct rds_connection *conn = cp->cp_conn;
+ struct rds_ib_connection *ic = conn->c_transport_data;
+
+ return (!ic->i_cm_id ||
+ (rds_ib_ring_empty(&ic->i_recv_ring) &&
+ (atomic_read(&ic->i_signaled_sends) == 0) &&
+ (atomic_read(&ic->i_fastreg_inuse_count)) == 0 &&
+ (atomic_read(&ic->i_fastreg_wrs) == RDS_IB_DEFAULT_FR_WR))) ? 0
+ : msecs_to_jiffies(1000);
+}
+
/*
* This is so careful about only cleaning up resources that were built up
* so that it can be called at any point during startup. In fact it
@@ -1083,11 +1096,13 @@ void rds_ib_conn_path_shutdown(struct rds_conn_path *cp)
* sends to complete we're ensured that there will be no
* more tx processing.
*/
- wait_event(rds_ib_ring_empty_wait,
- rds_ib_ring_empty(&ic->i_recv_ring) &&
- (atomic_read(&ic->i_signaled_sends) == 0) &&
- (atomic_read(&ic->i_fastreg_inuse_count) == 0) &&
- (atomic_read(&ic->i_fastreg_wrs) == RDS_IB_DEFAULT_FR_WR));
+ while (!wait_event_timeout(rds_ib_ring_empty_wait,
+ rds_ib_conn_path_shutdown_check_wait(cp) == 0,
+ msecs_to_jiffies(1000))) {
+ tasklet_schedule(&ic->i_send_tasklet);
+ tasklet_schedule(&ic->i_recv_tasklet);
+ }
+
tasklet_kill(&ic->i_send_tasklet);
tasklet_kill(&ic->i_recv_tasklet);
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 066/982] befs: handle set_blocksize failures
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 065/982] net/rds: Dont sleep inside rds_ib_conn_path_shutdown Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 067/982] affs: " Greg Kroah-Hartman
` (922 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig,
Christian Brauner (Amutable), Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <hch@lst.de>
[ Upstream commit 7597d42a25332617a3dfe596758d780ec6c028d7 ]
befs uses buffer_heads, which don't handle block size > PAGE_SIZE well.
Without this, mounting we will hit the
BUG_ON(offset >= folio_size(folio));
in folio_set_bh on the first __bread_gfp call.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260511071701.2456211-6-hch@lst.de
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/befs/linuxvfs.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/befs/linuxvfs.c b/fs/befs/linuxvfs.c
index 32749fcee090a..3646d82271474 100644
--- a/fs/befs/linuxvfs.c
+++ b/fs/befs/linuxvfs.c
@@ -890,7 +890,8 @@ befs_fill_super(struct super_block *sb, void *data, int silent)
*/
sb->s_magic = BEFS_SUPER_MAGIC;
/* Set real blocksize of fs */
- sb_set_blocksize(sb, (ulong) befs_sb->block_size);
+ if (!sb_set_blocksize(sb, (ulong) befs_sb->block_size))
+ goto unacquire_priv_sbp;
sb->s_op = &befs_sops;
sb->s_export_op = &befs_export_operations;
sb->s_time_min = 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 067/982] affs: handle set_blocksize failures
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 066/982] befs: handle set_blocksize failures Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 068/982] bfs: " Greg Kroah-Hartman
` (921 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig,
Christian Brauner (Amutable), Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <hch@lst.de>
[ Upstream commit 0861182af5983a39bd2a891966436c5679b74a45 ]
affs uses buffer_heads, which don't handle block size > PAGE_SIZE well.
Without this, mounting we will hit the
BUG_ON(offset >= folio_size(folio));
in folio_set_bh on the first __bread_gfp call.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260511071701.2456211-7-hch@lst.de
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/affs/affs.h | 5 -----
fs/affs/super.c | 6 ++++--
2 files changed, 4 insertions(+), 7 deletions(-)
diff --git a/fs/affs/affs.h b/fs/affs/affs.h
index bfa89e131ead0..af34fc78a9fb5 100644
--- a/fs/affs/affs.h
+++ b/fs/affs/affs.h
@@ -226,11 +226,6 @@ static inline bool affs_validblock(struct super_block *sb, int block)
block < AFFS_SB(sb)->s_partition_size);
}
-static inline void
-affs_set_blocksize(struct super_block *sb, int size)
-{
- sb_set_blocksize(sb, size);
-}
static inline struct buffer_head *
affs_bread(struct super_block *sb, int block)
{
diff --git a/fs/affs/super.c b/fs/affs/super.c
index 58b391446ae1f..6159ba45c843a 100644
--- a/fs/affs/super.c
+++ b/fs/affs/super.c
@@ -392,7 +392,8 @@ static int affs_fill_super(struct super_block *sb, void *data, int silent)
size = bdev_nr_sectors(sb->s_bdev);
pr_debug("initial blocksize=%d, #blocks=%d\n", 512, size);
- affs_set_blocksize(sb, PAGE_SIZE);
+ if (!sb_set_blocksize(sb, PAGE_SIZE))
+ return -EINVAL;
/* Try to find root block. Its location depends on the block size. */
i = bdev_logical_block_size(sb->s_bdev);
@@ -407,7 +408,8 @@ static int affs_fill_super(struct super_block *sb, void *data, int silent)
if (root_block < 0)
sbi->s_root_block = (reserved + size - 1) / 2;
pr_debug("setting blocksize to %d\n", blocksize);
- affs_set_blocksize(sb, blocksize);
+ if (!sb_set_blocksize(sb, blocksize))
+ return -EINVAL;
sbi->s_partition_size = size;
/* The root block location that was calculated above is not
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 068/982] bfs: handle set_blocksize failures
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 067/982] affs: " Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 069/982] minix: " Greg Kroah-Hartman
` (920 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig,
Christian Brauner (Amutable), Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <hch@lst.de>
[ Upstream commit 2430e3380936df0b648af720cae624eef035a2d1 ]
bfs uses buffer_heads, which don't handle block size > PAGE_SIZE well.
Without this, mounting will hit the
BUG_ON(offset >= folio_size(folio));
in folio_set_bh on the first __bread_gfp call.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260511071701.2456211-2-hch@lst.de
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/bfs/inode.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/bfs/inode.c b/fs/bfs/inode.c
index 07f7929d07fd8..c2dadba110c49 100644
--- a/fs/bfs/inode.c
+++ b/fs/bfs/inode.c
@@ -343,7 +343,8 @@ static int bfs_fill_super(struct super_block *s, void *data, int silent)
s->s_time_min = 0;
s->s_time_max = U32_MAX;
- sb_set_blocksize(s, BFS_BSIZE);
+ if (!sb_set_blocksize(s, BFS_BSIZE))
+ goto out;
sbh = sb_bread(s, 0);
if (!sbh)
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 069/982] minix: handle set_blocksize failures
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 068/982] bfs: " Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 070/982] qnx4: " Greg Kroah-Hartman
` (919 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig,
Christian Brauner (Amutable), Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <hch@lst.de>
[ Upstream commit 38a03dc2bc71e7e0746cdb9ef5e9947f72470c67 ]
minix uses buffer_heads, which don't handle block size > PAGE_SIZE well.
Without this, mounting we will hit the
BUG_ON(offset >= folio_size(folio));
in folio_set_bh on the first __bread_gfp call.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260511071701.2456211-9-hch@lst.de
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/minix/inode.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/minix/inode.c b/fs/minix/inode.c
index fbbc4ef1b7a2e..99ba8a1bf9394 100644
--- a/fs/minix/inode.c
+++ b/fs/minix/inode.c
@@ -270,7 +270,8 @@ static int minix_fill_super(struct super_block *s, void *data, int silent)
sbi->s_namelen = 60;
sbi->s_version = MINIX_V3;
sbi->s_mount_state = MINIX_VALID_FS;
- sb_set_blocksize(s, m3s->s_blocksize);
+ if (!sb_set_blocksize(s, m3s->s_blocksize))
+ goto out;
s->s_max_links = MINIX2_LINK_MAX;
} else
goto out_no_fs;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 070/982] qnx4: handle set_blocksize failures
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 069/982] minix: " Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 071/982] jfs: " Greg Kroah-Hartman
` (918 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Anders Larsen,
Christian Brauner (Amutable), Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <hch@lst.de>
[ Upstream commit c7d911ea1cc9a63b07e52f5e75b263be0615b289 ]
qnx4 uses buffer_heads, which don't handle block size > PAGE_SIZE well.
Without this, mounting will hit the
BUG_ON(offset >= folio_size(folio));
in folio_set_bh on the first __bread_gfp call.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260511071701.2456211-4-hch@lst.de
Acked-by: Anders Larsen <al@alarsen.net>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/qnx4/inode.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/qnx4/inode.c b/fs/qnx4/inode.c
index 391ea402920d9..b921e56b36e68 100644
--- a/fs/qnx4/inode.c
+++ b/fs/qnx4/inode.c
@@ -195,7 +195,8 @@ static int qnx4_fill_super(struct super_block *s, void *data, int silent)
return -ENOMEM;
s->s_fs_info = qs;
- sb_set_blocksize(s, QNX4_BLOCK_SIZE);
+ if (!sb_set_blocksize(s, QNX4_BLOCK_SIZE))
+ return -EINVAL;
s->s_op = &qnx4_sops;
s->s_magic = QNX4_SUPER_MAGIC;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 071/982] jfs: handle set_blocksize failures
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 070/982] qnx4: " Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 072/982] hpfs: " Greg Kroah-Hartman
` (917 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig,
Christian Brauner (Amutable), Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <hch@lst.de>
[ Upstream commit 05107f5602751fcfd3d108c1f579eb45aabead52 ]
jfs uses buffer_heads, which don't handle block size > PAGE_SIZE well.
Without this, mounting we will hit the
BUG_ON(offset >= folio_size(folio));
in folio_set_bh on the first __bread_gfp call.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260511071701.2456211-5-hch@lst.de
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/jfs/super.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/jfs/super.c b/fs/jfs/super.c
index 85d4f44f2ac4d..698470a2480c2 100644
--- a/fs/jfs/super.c
+++ b/fs/jfs/super.c
@@ -524,7 +524,8 @@ static int jfs_fill_super(struct super_block *sb, void *data, int silent)
/*
* Initialize blocksize to 4K.
*/
- sb_set_blocksize(sb, PSIZE);
+ if (!sb_set_blocksize(sb, PSIZE))
+ goto out_unload;
/*
* Set method vectors.
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 072/982] hpfs: handle set_blocksize failures
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 071/982] jfs: " Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 073/982] omfs: " Greg Kroah-Hartman
` (916 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig,
Christian Brauner (Amutable), Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <hch@lst.de>
[ Upstream commit a405996f23e04942aad064ab8d50c55827482872 ]
hpfs uses buffer_heads, which don't handle block size > PAGE_SIZE well.
Without this, mounting will hit the
BUG_ON(offset >= folio_size(folio));
in folio_set_bh on the first __bread_gfp call.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260511071701.2456211-3-hch@lst.de
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/hpfs/super.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/hpfs/super.c b/fs/hpfs/super.c
index 1cb89595b8756..c66f859ec9a9b 100644
--- a/fs/hpfs/super.c
+++ b/fs/hpfs/super.c
@@ -584,7 +584,8 @@ static int hpfs_fill_super(struct super_block *s, void *options, int silent)
}
/*sbi->sb_mounting = 1;*/
- sb_set_blocksize(s, 512);
+ if (!sb_set_blocksize(s, 512))
+ goto bail0;
sbi->sb_fs_size = -1;
if (!(bootblock = hpfs_map_sector(s, 0, &bh0, 0))) goto bail1;
if (!(superblock = hpfs_map_sector(s, 16, &bh1, 1))) goto bail2;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 073/982] omfs: handle set_blocksize failures
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 072/982] hpfs: " Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 074/982] isofs: " Greg Kroah-Hartman
` (915 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig,
Christian Brauner (Amutable), Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <hch@lst.de>
[ Upstream commit 18c3d6fcb557f920c9143711497625e70153874c ]
omfs uses buffer_heads, which don't handle block size > PAGE_SIZE well.
Without this, mounting we will hit the
BUG_ON(offset >= folio_size(folio));
in folio_set_bh on the first __bread_gfp call.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260511071701.2456211-11-hch@lst.de
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/omfs/inode.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c
index 9773846daa4bc..760f675a73d92 100644
--- a/fs/omfs/inode.c
+++ b/fs/omfs/inode.c
@@ -480,7 +480,8 @@ static int omfs_fill_super(struct super_block *sb, void *data, int silent)
sb->s_time_min = 0;
sb->s_time_max = U64_MAX / MSEC_PER_SEC;
- sb_set_blocksize(sb, 0x200);
+ if (!sb_set_blocksize(sb, 0x200))
+ goto end;
bh = sb_bread(sb, 0);
if (!bh)
@@ -532,7 +533,8 @@ static int omfs_fill_super(struct super_block *sb, void *data, int silent)
* Use sys_blocksize as the fs block since it is smaller than a
* page while the fs blocksize can be larger.
*/
- sb_set_blocksize(sb, sbi->s_sys_blocksize);
+ if (!sb_set_blocksize(sb, sbi->s_sys_blocksize))
+ goto out_brelse_bh;
/*
* ...and the difference goes into a shift. sys_blocksize is always
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 074/982] isofs: handle set_blocksize failures
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 073/982] omfs: " Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 075/982] HID: bpf: Add Huion Inspiroy Frego M button quirk Greg Kroah-Hartman
` (914 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig,
Christian Brauner (Amutable), Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <hch@lst.de>
[ Upstream commit 25ef4c4d9f0e96fb89c0ae0d7127c3f12a31bc32 ]
isofs uses buffer_heads, which don't handle block size > PAGE_SIZE well.
Without this, mounting we will hit the
BUG_ON(offset >= folio_size(folio));
in folio_set_bh on the first __bread_gfp call.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260511071701.2456211-8-hch@lst.de
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/isofs/inode.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
index e3052d3fe5dcd..8fd91f09086f1 100644
--- a/fs/isofs/inode.c
+++ b/fs/isofs/inode.c
@@ -859,7 +859,8 @@ static int isofs_fill_super(struct super_block *s, void *data, int silent)
* entries. By forcing the blocksize in this way, we ensure
* that we will never be required to do this.
*/
- sb_set_blocksize(s, orig_zonesize);
+ if (!sb_set_blocksize(s, orig_zonesize))
+ goto out_freesbi;
sbi->s_nls_iocharset = NULL;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 075/982] HID: bpf: Add Huion Inspiroy Frego M button quirk
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 074/982] isofs: " Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 076/982] usbip: vhci_hcd: fix NULL deref in status_show_vhci Greg Kroah-Hartman
` (913 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nikhil Chatterjee,
Benjamin Tissoires, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikhil Chatterjee <nikhilc1527@gmail.com>
[ Upstream commit 857e71cb0a538b1660743a4267a1e789575f7966 ]
The Huion Inspiroy Frego M pen report descriptor exposes the second
side button as Secondary Tip Switch instead of Secondary Barrel Switch.
This makes userspace see the control as the wrong pen button.
Add a HID-BPF report descriptor fixup for the Bluetooth 256c:8251
device and USB 256c:2012 L610 variant. The fixup matches the expected
pen descriptor and rewrites the offending usage from Secondary Tip
Switch to Secondary Barrel Switch.
Tested by building the HID-BPF object with:
make -C drivers/hid/bpf/progs Huion__Inspiroy-Frego-M.bpf.o
Signed-off-by: Nikhil Chatterjee <nikhilc1527@gmail.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../bpf/progs/Huion__Inspiroy-Frego-M.bpf.c | 87 +++++++++++++++++++
1 file changed, 87 insertions(+)
create mode 100644 drivers/hid/bpf/progs/Huion__Inspiroy-Frego-M.bpf.c
diff --git a/drivers/hid/bpf/progs/Huion__Inspiroy-Frego-M.bpf.c b/drivers/hid/bpf/progs/Huion__Inspiroy-Frego-M.bpf.c
new file mode 100644
index 0000000000000..e6ba2295dc775
--- /dev/null
+++ b/drivers/hid/bpf/progs/Huion__Inspiroy-Frego-M.bpf.c
@@ -0,0 +1,87 @@
+// SPDX-License-Identifier: GPL-2.0-only
+#include "vmlinux.h"
+#include "hid_bpf.h"
+#include "hid_bpf_helpers.h"
+#include <bpf/bpf_tracing.h>
+
+/*
+ * Huion Inspiroy Frego M Pen Tablet
+ * Model L610
+ * 256c:8251 (Bluetooth)
+ * 256c:2012 (USB)
+ */
+#define VID_HUION 0x256C
+#define PID_INSPIROY_FREGO_M 0x8251
+#define PID_L610 0x2012
+
+#define PEN_RDESC_SIZE 125
+#define SECONDARY_SWITCH_OFFSET 17
+
+HID_BPF_CONFIG(
+ HID_DEVICE(BUS_BLUETOOTH, HID_GROUP_GENERIC, VID_HUION, PID_INSPIROY_FREGO_M),
+ HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, VID_HUION, PID_L610)
+);
+
+/*
+ * The pen descriptor reports the second side button as Secondary Tip Switch
+ * instead of Secondary Barrel Switch.
+ *
+ * Relevant part of the original pen report descriptor:
+ *
+ * 0x09, 0x42, // Usage (Tip Switch) 12
+ * 0x09, 0x44, // Usage (Barrel Switch) 14
+ * 0x09, 0x43, // Usage (Secondary Tip Switch) 16 <- change to 0x5a
+ * 0x09, 0x3c, // Usage (Invert) 18
+ * 0x09, 0x45, // Usage (Eraser) 20
+ * 0x15, 0x00, // Logical Minimum (0) 22
+ * 0x25, 0x01, // Logical Maximum (1) 24
+ */
+SEC(HID_BPF_RDESC_FIXUP)
+int BPF_PROG(fix_secondary_barrel_rdesc, struct hid_bpf_ctx *hctx)
+{
+ __u8 *data = hid_bpf_get_data(hctx, 0 /* offset */, HID_MAX_DESCRIPTOR_SIZE /* size */);
+
+ if (!data)
+ return 0; /* EPERM check */
+
+ if (hctx->size != PEN_RDESC_SIZE)
+ return 0;
+
+ if (data[0] != 0x05 || data[1] != 0x0d || /* Usage Page (Digitizers) */
+ data[2] != 0x09 || data[3] != 0x02 || /* Usage (Pen) */
+ data[16] != 0x09 ||
+ data[SECONDARY_SWITCH_OFFSET] != 0x43) /* Secondary Tip Switch */
+ return 0;
+
+ data[SECONDARY_SWITCH_OFFSET] = 0x5a;
+
+ return 0;
+}
+
+HID_BPF_OPS(fix_secondary_barrel) = {
+ .hid_rdesc_fixup = (void *)fix_secondary_barrel_rdesc,
+};
+
+SEC("syscall")
+int probe(struct hid_bpf_probe_args *ctx)
+{
+ ctx->retval = ctx->rdesc_size != PEN_RDESC_SIZE;
+ if (ctx->retval) {
+ ctx->retval = -EINVAL;
+ return 0;
+ }
+
+ if (ctx->rdesc[0] != 0x05 || ctx->rdesc[1] != 0x0d || /* Usage Page (Digitizers) */
+ ctx->rdesc[2] != 0x09 || ctx->rdesc[3] != 0x02 || /* Usage (Pen) */
+ ctx->rdesc[16] != 0x09 ||
+ ctx->rdesc[SECONDARY_SWITCH_OFFSET] != 0x43) { /* Secondary Tip Switch */
+ ctx->retval = -EINVAL;
+ return 0;
+ }
+
+ ctx->retval = 0;
+
+ return 0;
+}
+
+char _license[] SEC("license") = "GPL";
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 076/982] usbip: vhci_hcd: fix NULL deref in status_show_vhci
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 075/982] HID: bpf: Add Huion Inspiroy Frego M button quirk Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 077/982] usb: core: hcd: fix possible deadlock in rh control transfers Greg Kroah-Hartman
` (912 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Adrian Wowk, Shuah Khan, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Wowk <dev@adrianwowk.com>
[ Upstream commit bc150783542ba2e7c1257d1299c6f3269bdba270 ]
platform_get_drvdata() can return NULL if a VHCI host controller's
probe failed (e.g. due to USB bus number exhaustion). status_show_vhci()
checked for a NULL pdev but not for a NULL hcd returned by
platform_get_drvdata(). Passing NULL to hcd_to_vhci_hcd() does not
return NULL - it returns a pointer offset of 0x260, causing a NULL
pointer dereference when that value is subsequently dereferenced.
Add a NULL check on hcd before calling hcd_to_vhci_hcd(). Move
status_show_not_ready() above status_show_vhci() to make it callable
from the new error path without a forward declaration.
Signed-off-by: Adrian Wowk <dev@adrianwowk.com>
Reviewed-by: Shuah Khan <skhan@linuxfoundation.org>
Link: https://patch.msgid.link/20260414010050.158064-2-dev@adrianwowk.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/usbip/vhci_sysfs.c | 52 +++++++++++++++++++---------------
1 file changed, 29 insertions(+), 23 deletions(-)
diff --git a/drivers/usb/usbip/vhci_sysfs.c b/drivers/usb/usbip/vhci_sysfs.c
index e2847cd3e6e36..7dd6465ee4358 100644
--- a/drivers/usb/usbip/vhci_sysfs.c
+++ b/drivers/usb/usbip/vhci_sysfs.c
@@ -59,6 +59,29 @@ static void port_show_vhci(char **out, int hub, int port, struct vhci_device *vd
*out += sprintf(*out, "\n");
}
+static ssize_t status_show_not_ready(int pdev_nr, char *out)
+{
+ char *s = out;
+ int i = 0;
+
+ for (i = 0; i < VHCI_HC_PORTS; i++) {
+ out += sprintf(out, "hs %04u %03u ",
+ (pdev_nr * VHCI_PORTS) + i,
+ VDEV_ST_NOTASSIGNED);
+ out += sprintf(out, "000 00000000 0000000000000000 0-0");
+ out += sprintf(out, "\n");
+ }
+
+ for (i = 0; i < VHCI_HC_PORTS; i++) {
+ out += sprintf(out, "ss %04u %03u ",
+ (pdev_nr * VHCI_PORTS) + VHCI_HC_PORTS + i,
+ VDEV_ST_NOTASSIGNED);
+ out += sprintf(out, "000 00000000 0000000000000000 0-0");
+ out += sprintf(out, "\n");
+ }
+ return out - s;
+}
+
/* Sysfs entry to show port status */
static ssize_t status_show_vhci(int pdev_nr, char *out)
{
@@ -76,6 +99,12 @@ static ssize_t status_show_vhci(int pdev_nr, char *out)
}
hcd = platform_get_drvdata(pdev);
+
+ if (!hcd) {
+ usbip_dbg_vhci_sysfs("show status error (hcd is NULL)\n");
+ return status_show_not_ready(pdev_nr, out);
+ }
+
vhci_hcd = hcd_to_vhci_hcd(hcd);
vhci = vhci_hcd->vhci;
@@ -104,29 +133,6 @@ static ssize_t status_show_vhci(int pdev_nr, char *out)
return out - s;
}
-static ssize_t status_show_not_ready(int pdev_nr, char *out)
-{
- char *s = out;
- int i = 0;
-
- for (i = 0; i < VHCI_HC_PORTS; i++) {
- out += sprintf(out, "hs %04u %03u ",
- (pdev_nr * VHCI_PORTS) + i,
- VDEV_ST_NOTASSIGNED);
- out += sprintf(out, "000 00000000 0000000000000000 0-0");
- out += sprintf(out, "\n");
- }
-
- for (i = 0; i < VHCI_HC_PORTS; i++) {
- out += sprintf(out, "ss %04u %03u ",
- (pdev_nr * VHCI_PORTS) + VHCI_HC_PORTS + i,
- VDEV_ST_NOTASSIGNED);
- out += sprintf(out, "000 00000000 0000000000000000 0-0");
- out += sprintf(out, "\n");
- }
- return out - s;
-}
-
static int status_name_to_id(const char *name)
{
char *c;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 077/982] usb: core: hcd: fix possible deadlock in rh control transfers
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 076/982] usbip: vhci_hcd: fix NULL deref in status_show_vhci Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 078/982] usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log Greg Kroah-Hartman
` (911 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Oliver Neukum, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <oneukum@suse.com>
[ Upstream commit d5559f43d76b398392b26a15cbc16d731969cd1c ]
>From within the SCSI error handler memory allocations must not
trigger IO. Handling errors in UAS and the storage driver may
involve resetting a device. The thread doing the reset itself
relies on VM magic. However, that is insufficient, as resetting
a device involves resuming it. Resumption as well as resetting
involves conrol transfers to the parent of the device to be reset.
That may be a root hub. Hence usbcore must heed the flags passed
to usb_submit_urb() processing control transfers to root hubs.
The problem exist since the storage driver has been merged.
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Link: https://patch.msgid.link/20260429094413.181038-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/core/hcd.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 980e09f793a6a..f0a637dab11f9 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -473,7 +473,8 @@ rh_string(int id, struct usb_hcd const *hcd, u8 *data, unsigned len)
/* Root hub control transfers execute synchronously */
-static int rh_call_control (struct usb_hcd *hcd, struct urb *urb)
+static int rh_call_control(struct usb_hcd *hcd,
+ struct urb *urb, gfp_t mem_flags)
{
struct usb_ctrlrequest *cmd;
u16 typeReq, wValue, wIndex, wLength;
@@ -508,8 +509,8 @@ static int rh_call_control (struct usb_hcd *hcd, struct urb *urb)
* tbuf should be at least as big as the
* USB hub descriptor.
*/
- tbuf_size = max_t(u16, sizeof(struct usb_hub_descriptor), wLength);
- tbuf = kzalloc(tbuf_size, GFP_KERNEL);
+ tbuf_size = max_t(u16, sizeof(struct usb_hub_descriptor), wLength);
+ tbuf = kzalloc(tbuf_size, mem_flags);
if (!tbuf) {
status = -ENOMEM;
goto err_alloc;
@@ -838,12 +839,13 @@ static int rh_queue_status (struct usb_hcd *hcd, struct urb *urb)
return retval;
}
-static int rh_urb_enqueue (struct usb_hcd *hcd, struct urb *urb)
+static int rh_urb_enqueue(struct usb_hcd *hcd,
+ struct urb *urb, gfp_t mem_flags)
{
if (usb_endpoint_xfer_int(&urb->ep->desc))
return rh_queue_status (hcd, urb);
if (usb_endpoint_xfer_control(&urb->ep->desc))
- return rh_call_control (hcd, urb);
+ return rh_call_control(hcd, urb, mem_flags);
return -EINVAL;
}
@@ -1551,7 +1553,7 @@ int usb_hcd_submit_urb (struct urb *urb, gfp_t mem_flags)
*/
if (is_root_hub(urb->dev)) {
- status = rh_urb_enqueue(hcd, urb);
+ status = rh_urb_enqueue(hcd, urb, mem_flags);
} else {
status = map_urb_for_dma(hcd, urb, mem_flags);
if (likely(status == 0)) {
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 078/982] usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 077/982] usb: core: hcd: fix possible deadlock in rh control transfers Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 079/982] USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set Greg Kroah-Hartman
` (910 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Stepan Ionichev, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stepan Ionichev <sozdayvek@gmail.com>
[ Upstream commit 5bf5e3fba9bc7dfd69701521dbe9809f8ccbdb02 ]
goku_irq() handles a number of bus events under a single ep0 path.
It already guards the gadget driver suspend/resume callbacks against a
NULL ->driver:
if (dev->gadget.speed != USB_SPEED_UNKNOWN
&& dev->driver
&& dev->driver->resume) {
spin_unlock(&dev->lock);
dev->driver->resume(&dev->gadget);
...
}
but the very next branch unconditionally dereferences dev->driver
when an INT_USBRESET arrives:
if (stat & INT_USBRESET) {
ACK(INT_USBRESET);
INFO(dev, "USB reset done, gadget %s\n",
dev->driver->driver.name);
}
If the controller raises INT_USBRESET before any gadget driver has
been bound (or after one has been unbound), dev->driver is NULL and
the printk dereferences NULL.
smatch flags the inconsistency:
drivers/usb/gadget/udc/goku_udc.c:1618 goku_irq() error:
we previously assumed 'dev->driver' could be null (see line 1607)
Fall back to a placeholder when the gadget driver is not bound.
No functional change while a gadget driver is bound.
Signed-off-by: Stepan Ionichev <sozdayvek@gmail.com>
Link: https://patch.msgid.link/20260509110636.19762-1-sozdayvek@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/udc/goku_udc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/gadget/udc/goku_udc.c b/drivers/usb/gadget/udc/goku_udc.c
index 5ffb3d5c635be..f9b094b04847e 100644
--- a/drivers/usb/gadget/udc/goku_udc.c
+++ b/drivers/usb/gadget/udc/goku_udc.c
@@ -1616,7 +1616,8 @@ static irqreturn_t goku_irq(int irq, void *_dev)
if (stat & INT_USBRESET) { /* hub reset done */
ACK(INT_USBRESET);
INFO(dev, "USB reset done, gadget %s\n",
- dev->driver->driver.name);
+ dev->driver ? dev->driver->driver.name :
+ "<not bound>");
}
// and INT_ERR on some endpoint's crc/bitstuff/... problem
}
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 079/982] USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 078/982] usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 080/982] usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue Greg Kroah-Hartman
` (909 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dave Carey, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Carey <carvsdriver@gmail.com>
[ Upstream commit e5ab27ddd74e2d67a94c51c6f2ad87b1ff13912b ]
The INGENIC 17EF:6161 touchscreen composite device has a ~55-second
watchdog that resets the USB device if the bulk-IN endpoint on the CDC
data interface goes unread. The existing ALWAYS_POLL_CTRL quirk keeps
the notification endpoint (ctrlurb / EP 0x82) polling continuously, but
that alone is insufficient: the firmware monitors bulk-IN activity, not
just notification-endpoint activity.
Add acm_submit_read_urbs() calls to the two ALWAYS_POLL_CTRL paths that
already restart the ctrlurb:
1. acm_probe(): start bulk reads at probe time alongside the ctrlurb,
so the watchdog is satisfied from first bind without requiring a
userspace process to open /dev/ttyACMn.
2. acm_port_shutdown(): restart bulk reads after port close alongside
the ctrlurb restart, so the watchdog keeps running when the last
TTY user closes the port.
acm_read_bulk_callback() already resubmits each URB unconditionally on
normal completion, so once submitted the reads remain active until an
explicit kill (disconnect, suspend). acm_submit_read_urb() is a no-op
for URBs that are already in flight (read_urbs_free bit clear), so the
existing acm_port_activate() call remains correct and races are avoided.
Tested on Lenovo Yoga Book 9 14IAH10 (83KJ): without this patch the
device resets every ~55 s when no TTY is open; with it the device
remains stable indefinitely.
Signed-off-by: Dave Carey <carvsdriver@gmail.com>
Link: https://patch.msgid.link/20260515141940.751397-1-carvsdriver@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/class/cdc-acm.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index d1c8f620596d8..9ff5feceadad4 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -786,6 +786,9 @@ static void acm_port_shutdown(struct tty_port *port)
"ctrl polling restart failed after port close\n");
/* port_shutdown() cleared DTR/RTS; restore them */
acm_set_control(acm, USB_CDC_CTRL_DTR | USB_CDC_CTRL_RTS);
+ if (acm_submit_read_urbs(acm, GFP_KERNEL))
+ dev_dbg(&acm->control->dev,
+ "read urb restart failed after port close\n");
}
}
@@ -1539,6 +1542,9 @@ static int acm_probe(struct usb_interface *intf,
if (usb_submit_urb(acm->ctrlurb, GFP_KERNEL))
dev_warn(&intf->dev,
"failed to start persistent ctrl polling\n");
+ if (acm_submit_read_urbs(acm, GFP_KERNEL))
+ dev_warn(&intf->dev,
+ "failed to start persistent bulk read polling\n");
}
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 080/982] usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 079/982] USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 081/982] serial: 8250: fix possible ISR soft lockup Greg Kroah-Hartman
` (908 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alan Stern, Andrew Jeffery,
Maoyi Xie, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <maoyixie.tju@gmail.com>
[ Upstream commit e2ffaac1884b921b8ec2b3a964c6a8b5d610bf4b ]
ast_udc_ep_dequeue() declares the loop cursor `req` outside the
list_for_each_entry(). After the loop it tests `&req->req != _req`
to decide whether the request was found. If the queue holds no
match, `req` is past-the-end. It then aliases
container_of(&ep->queue, struct ast_udc_request, queue) via offset
cancellation. Whether that synthetic address equals `_req` depends
on heap layout. The function can return 0 without dequeueing
anything.
Default `rc` to -EINVAL and set it to 0 only inside the match
branch. `req` is no longer read after the loop, so the past-the-end
dereference goes away. No extra cursor variable or post-loop test
is needed.
Suggested-by: Alan Stern <stern@rowland.harvard.edu>
Suggested-by: Andrew Jeffery <andrew@codeconstruct.com.au>
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Link: https://patch.msgid.link/20260521065428.3261238-1-maoyixie.tju@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/udc/aspeed_udc.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/drivers/usb/gadget/udc/aspeed_udc.c b/drivers/usb/gadget/udc/aspeed_udc.c
index d2944648d3d9c..2d8e22dc4861b 100644
--- a/drivers/usb/gadget/udc/aspeed_udc.c
+++ b/drivers/usb/gadget/udc/aspeed_udc.c
@@ -694,7 +694,7 @@ static int ast_udc_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
struct ast_udc_dev *udc = ep->udc;
struct ast_udc_request *req;
unsigned long flags;
- int rc = 0;
+ int rc = -EINVAL;
spin_lock_irqsave(&udc->lock, flags);
@@ -704,14 +704,11 @@ static int ast_udc_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
list_del_init(&req->queue);
ast_udc_done(ep, req, -ESHUTDOWN);
_req->status = -ECONNRESET;
+ rc = 0;
break;
}
}
- /* dequeue request not found */
- if (&req->req != _req)
- rc = -EINVAL;
-
spin_unlock_irqrestore(&udc->lock, flags);
return rc;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 081/982] serial: 8250: fix possible ISR soft lockup
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 080/982] usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 082/982] usb: host: add ARCH_AIROHA in XHCI MTK dependency Greg Kroah-Hartman
` (907 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marco Felsch, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Felsch <m.felsch@pengutronix.de>
[ Upstream commit 0c6bf45e5a345cc3b9ffbeaf9083ecac3c2293eb ]
There are rare cases in which the host gets stuck in the ISR because it
is flooded with messages during the startup phase.
The reason for the soft lockup in the ISR is the missing FIFO error IRQ
(FIFOE) handling. Not handling it and reporting IRQ_HANDLED triggers
the IRQ immediately again.
Fix this by adding a check for the FIFOE status and clearing the FIFO
if no data is ready (DR).
This behavior was observed on an AM62L device which uses the OMAP 8250
driver. Fix it for all 8250 drivers, since the OMAP driver's special
IRQ setup handling may trigger this behavior more frequently, but it
is not ensured that other 8250 drivers aren't affected.
Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
Link: https://patch.msgid.link/20260519-v7-1-topic-serial-8250-v1-1-56b04293a246@pengutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/8250/8250_port.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
index a1fce56100254..fbb65cb6a0cc9 100644
--- a/drivers/tty/serial/8250/8250_port.c
+++ b/drivers/tty/serial/8250/8250_port.c
@@ -1933,6 +1933,13 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir)
status = serial_lsr_in(up);
+ /*
+ * Recover from no-data-ready and FIFO error condition to avoid getting
+ * stuck in the ISR.
+ */
+ if (!(status & UART_LSR_DR) && (status & UART_LSR_FIFOE))
+ serial8250_clear_and_reinit_fifos(up);
+
/*
* If port is stopped and there are no error conditions in the
* FIFO, then don't drain the FIFO, as this may lead to TTY buffer
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 082/982] usb: host: add ARCH_AIROHA in XHCI MTK dependency
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 081/982] serial: 8250: fix possible ISR soft lockup Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 083/982] char/nvram: Remove redundant nvram_mutex Greg Kroah-Hartman
` (906 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Christian Marangi, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Marangi <ansuelsmth@gmail.com>
[ Upstream commit ffeaf31f05d664581aa436d9cb92b4d1d8d301ce ]
Airoha SoC use the same register map and logic of the Mediatek xHCI
driver, hence add it to the dependency list to permit compilation also
on this ARCH.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Link: https://patch.msgid.link/20260519164903.31258-1-ansuelsmth@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig
index 247568bc17a2b..9878adf8ae5e2 100644
--- a/drivers/usb/host/Kconfig
+++ b/drivers/usb/host/Kconfig
@@ -72,7 +72,7 @@ config USB_XHCI_HISTB
config USB_XHCI_MTK
tristate "xHCI support for MediaTek SoCs"
select MFD_SYSCON
- depends on (MIPS && SOC_MT7621) || ARCH_MEDIATEK || COMPILE_TEST
+ depends on (MIPS && SOC_MT7621) || ARCH_MEDIATEK || ARCH_AIROHA || COMPILE_TEST
help
Say 'Y' to enable the support for the xHCI host controller
found in MediaTek SoCs.
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 083/982] char/nvram: Remove redundant nvram_mutex
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 082/982] usb: host: add ARCH_AIROHA in XHCI MTK dependency Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 084/982] wifi: rtw89: pci: enable LTR based on pcie control register Greg Kroah-Hartman
` (905 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann,
Tellakula Yeswanth Krishna, Venkat Rao Bagalkote,
Ritesh Harjani (IBM), Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Venkat Rao Bagalkote <venkat88@linux.ibm.com>
[ Upstream commit e8c715f3a7dae43fabae261493a26474fec11863 ]
The global nvram_mutex in drivers/char/nvram.c is redundant and unused,
and this triggers compiler warnings on some configurations.
All platform-specific nvram operations already provide their own internal
synchronization, meaning the wrapper-level mutex does not provide any
additional safety.
Remove the nvram_mutex definition along with all remaining lock/unlock
users across PPC32, x86, and m68k code paths, and rely entirely on the
per-architecture nvram implementations for locking.
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Suggested-by: Arnd Bergmann <arnd@arndb.de>
Tested-by: Tellakula Yeswanth Krishna <yeswanth@linux.ibm.com>
Signed-off-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com>
Tested-by: yeswanth <yeswanth@linux.ibm.com>
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Link: https://patch.msgid.link/20260428061540.73668-1-venkat88@linux.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/nvram.c | 16 +++-------------
1 file changed, 3 insertions(+), 13 deletions(-)
diff --git a/drivers/char/nvram.c b/drivers/char/nvram.c
index e9f694b368719..bd7510abdc076 100644
--- a/drivers/char/nvram.c
+++ b/drivers/char/nvram.c
@@ -53,7 +53,6 @@
#include <asm/nvram.h>
#endif
-static DEFINE_MUTEX(nvram_mutex);
static DEFINE_SPINLOCK(nvram_state_lock);
static int nvram_open_cnt; /* #times opened */
static int nvram_open_mode; /* special open modes */
@@ -310,11 +309,8 @@ static long nvram_misc_ioctl(struct file *file, unsigned int cmd,
break;
#ifdef CONFIG_PPC32
case IOC_NVRAM_SYNC:
- if (ppc_md.nvram_sync != NULL) {
- mutex_lock(&nvram_mutex);
+ if (ppc_md.nvram_sync)
ppc_md.nvram_sync();
- mutex_unlock(&nvram_mutex);
- }
ret = 0;
break;
#endif
@@ -324,11 +320,8 @@ static long nvram_misc_ioctl(struct file *file, unsigned int cmd,
if (!capable(CAP_SYS_ADMIN))
return -EACCES;
- if (arch_nvram_ops.initialize != NULL) {
- mutex_lock(&nvram_mutex);
+ if (arch_nvram_ops.initialize)
ret = arch_nvram_ops.initialize();
- mutex_unlock(&nvram_mutex);
- }
break;
case NVRAM_SETCKS:
/* just set checksum, contents unchanged (maybe useful after
@@ -336,11 +329,8 @@ static long nvram_misc_ioctl(struct file *file, unsigned int cmd,
if (!capable(CAP_SYS_ADMIN))
return -EACCES;
- if (arch_nvram_ops.set_checksum != NULL) {
- mutex_lock(&nvram_mutex);
+ if (arch_nvram_ops.set_checksum)
ret = arch_nvram_ops.set_checksum();
- mutex_unlock(&nvram_mutex);
- }
break;
#endif /* CONFIG_X86 || CONFIG_M68K */
}
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 084/982] wifi: rtw89: pci: enable LTR based on pcie control register
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 083/982] char/nvram: Remove redundant nvram_mutex Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 085/982] netlabel: fix IPv6 unlabeled address add error handling Greg Kroah-Hartman
` (904 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dian-Syuan Yang, Ping-Ke Shih,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dian-Syuan Yang <dian_syuan0116@realtek.com>
[ Upstream commit 779bbe1902f29d0ef131249ddd42a8dfbe21d0fb ]
Originally, driver always transmits LTR (Latency Tolerance Reporting) to
pcie host, but it may cause pcie link down on some platforms because
LTR is not supported. As a result, driver will check the control
register of LTR setting to decide whether to enable LTR feature.
This applies to Wi-Fi 6 chips only. For Wi-Fi 7 chips, although the
driver still issues LTR, the hardware has its own internal logic
to determine whether to actually transmit it to pcie host.
Signed-off-by: Dian-Syuan Yang <dian_syuan0116@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260515014433.16168-5-pkshih@realtek.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/pci.c | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c
index cc553ca287d62..ac76697dc4627 100644
--- a/drivers/net/wireless/realtek/rtw89/pci.c
+++ b/drivers/net/wireless/realtek/rtw89/pci.c
@@ -2432,6 +2432,17 @@ static int rtw89_pci_mode_op(struct rtw89_dev *rtwdev)
return 0;
}
+static bool rtw89_pci_dev_ltr_enabled(struct rtw89_dev *rtwdev)
+{
+ struct rtw89_pci *rtwpci = (struct rtw89_pci *)rtwdev->priv;
+ struct pci_dev *pdev = rtwpci->pdev;
+ u16 cap;
+
+ pcie_capability_read_word(pdev, PCI_EXP_DEVCTL2, &cap);
+
+ return !!(cap & PCI_EXP_DEVCTL2_LTR_EN);
+}
+
static int rtw89_pci_ops_deinit(struct rtw89_dev *rtwdev)
{
const struct rtw89_pci_info *info = rtwdev->pci_info;
@@ -2526,7 +2537,7 @@ int rtw89_pci_ltr_set(struct rtw89_dev *rtwdev, bool en)
{
u32 val;
- if (!en)
+ if (!en || !rtw89_pci_dev_ltr_enabled(rtwdev))
return 0;
val = rtw89_read32(rtwdev, R_AX_LTR_CTRL_0);
@@ -2562,6 +2573,9 @@ int rtw89_pci_ltr_set_v1(struct rtw89_dev *rtwdev, bool en)
u32 dec_ctrl;
u32 val32;
+ if (!rtw89_pci_dev_ltr_enabled(rtwdev))
+ return 0;
+
val32 = rtw89_read32(rtwdev, R_AX_LTR_CTRL_0);
if (rtw89_pci_ltr_is_err_reg_val(val32))
return -EINVAL;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 085/982] netlabel: fix IPv6 unlabeled address add error handling
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 084/982] wifi: rtw89: pci: enable LTR based on pcie control register Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 086/982] rds: filter RDS_INFO_* getsockopt by callers netns Greg Kroah-Hartman
` (903 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chenguang Zhao, Paul Moore,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenguang Zhao <zhaochenguang@kylinos.cn>
[ Upstream commit 56872b930feee7ae07b9720ca950dd9fa65596ee ]
netlbl_unlhsh_add_addr6() always returned zero after
netlbl_af6list_add(), masking failures such as duplicate
IPv6 static label entries.
Signed-off-by: Chenguang Zhao <zhaochenguang@kylinos.cn>
Acked-by: Paul Moore <paul@paul-moore.com>
Link: https://patch.msgid.link/20260522022910.398416-1-zhaochenguang@kylinos.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netlabel/netlabel_unlabeled.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
index 6007cb000da67..c9684ddc2395d 100644
--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c
@@ -295,7 +295,7 @@ static int netlbl_unlhsh_add_addr6(struct netlbl_unlhsh_iface *iface,
if (ret_val != 0)
kfree(entry);
- return 0;
+ return ret_val;
}
#endif /* IPv6 */
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 086/982] rds: filter RDS_INFO_* getsockopt by callers netns
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 085/982] netlabel: fix IPv6 unlabeled address add error handling Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 087/982] rds: annotate data-race around rs_seen_congestion Greg Kroah-Hartman
` (902 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Allison Henderson, Simon Horman,
Praveen Kakkolangara, Maoyi Xie, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <maoyixie.tju@gmail.com>
[ Upstream commit c96a5209dda666004b8ee1ed7f0d493d09a4f200 ]
The RDS_INFO_* family of getsockopt(2) options reads several
file-scope global lists that are not per-netns:
rds_sock_info / rds6_sock_info,
rds_sock_inc_info / rds6_sock_inc_info -> rds_sock_list
rds_tcp_tc_info / rds6_tcp_tc_info -> rds_tcp_tc_list
rds_conn_info / rds6_conn_info,
rds_conn_message_info_cmn (for the *_SEND_MESSAGES and
*_RETRANS_MESSAGES variants),
rds_for_each_conn_info (for RDS_INFO_IB_CONNECTIONS)
-> rds_conn_hash[]
The handlers do not filter by the caller's network namespace.
rds_info_getsockopt() has no netns or capable() check, and
rds_create() has no capable() check, so AF_RDS is reachable from
an unprivileged user namespace. As a result, an unprivileged
caller in a fresh user_ns plus netns can read the bound address
and sock inode of every RDS socket on the host, the peer address
of incoming messages on every RDS socket on the host, the peer
address and TCP sequence numbers of every rds-tcp connection on
the host, and the peer address and RDS sequence numbers of every
RDS connection on the host.
The rds-tcp transport is reachable from a non-initial netns (see
rds_set_transport()), so a one-shot init_net gate at
rds_info_getsockopt() would deny legitimate per-netns visibility
to rds-tcp callers. Instead, filter at each handler by comparing
the netns of the caller's socket to the netns of the list entry,
or to rds_conn_net(conn) for connection paths. Only copy entries
whose netns matches the caller. Counters (RDS_INFO_COUNTERS) are
aggregate statistics and remain global.
Reproducer (KASAN VM, rds and rds_tcp loaded): an AF_RDS socket
binds 127.0.0.1:4242 in init_net as root. A child process enters
a fresh user_ns plus netns and opens AF_RDS there, then calls
getsockopt(SOL_RDS, RDS_INFO_SOCKETS). Before this change, the
child sees the init_net socket. After this change, the child
sees zero entries.
Drop the rds_sock_count, rds_tcp_tc_count, and rds6_tcp_tc_count
globals. v2 used them for the size precheck and lens->nr; v3
replaced the precheck with a per-ns count from a first pass over
the list, so the globals have no remaining readers. The matching
increments and decrements in rds_create()/rds_destroy_sock() and
rds_tcp_set_callbacks()/rds_tcp_restore_callbacks() go away with
them. Reported by the kernel test robot under clang W=1.
Suggested-by: Allison Henderson <achender@kernel.org>
Suggested-by: Simon Horman <horms@kernel.org>
Reviewed-by: Allison Henderson <achender@kernel.org>
Co-developed-by: Praveen Kakkolangara <praveen.kakkolangara@aumovio.com>
Signed-off-by: Praveen Kakkolangara <praveen.kakkolangara@aumovio.com>
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Link: https://patch.msgid.link/20260520084236.2724349-1-maoyixie.tju@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/rds/af_rds.c | 59 ++++++++++++++++++++++++++++++++++-------
net/rds/connection.c | 13 +++++++++
net/rds/tcp.c | 63 ++++++++++++++++++++++++++++----------------
3 files changed, 104 insertions(+), 31 deletions(-)
diff --git a/net/rds/af_rds.c b/net/rds/af_rds.c
index 752ae3fbc2e7a..a8004e8a78175 100644
--- a/net/rds/af_rds.c
+++ b/net/rds/af_rds.c
@@ -43,7 +43,6 @@
/* this is just used for stats gathering :/ */
static DEFINE_SPINLOCK(rds_sock_lock);
-static unsigned long rds_sock_count;
static LIST_HEAD(rds_sock_list);
DECLARE_WAIT_QUEUE_HEAD(rds_poll_waitq);
@@ -82,7 +81,6 @@ static int rds_release(struct socket *sock)
spin_lock_bh(&rds_sock_lock);
list_del_init(&rs->rs_item);
- rds_sock_count--;
spin_unlock_bh(&rds_sock_lock);
rds_trans_put(rs->rs_transport);
@@ -695,7 +693,6 @@ static int __rds_create(struct socket *sock, struct sock *sk, int protocol)
spin_lock_bh(&rds_sock_lock);
list_add_tail(&rs->rs_item, &rds_sock_list);
- rds_sock_count++;
spin_unlock_bh(&rds_sock_lock);
return 0;
@@ -736,6 +733,7 @@ static void rds_sock_inc_info(struct socket *sock, unsigned int len,
struct rds_info_iterator *iter,
struct rds_info_lengths *lens)
{
+ struct net *net = sock_net(sock->sk);
struct rds_sock *rs;
struct rds_incoming *inc;
unsigned int total = 0;
@@ -745,6 +743,9 @@ static void rds_sock_inc_info(struct socket *sock, unsigned int len,
spin_lock_bh(&rds_sock_lock);
list_for_each_entry(rs, &rds_sock_list, rs_item) {
+ /* Only show sockets in the caller's netns. */
+ if (!net_eq(sock_net(rds_rs_to_sk(rs)), net))
+ continue;
/* This option only supports IPv4 sockets. */
if (!ipv6_addr_v4mapped(&rs->rs_bound_addr))
continue;
@@ -775,6 +776,7 @@ static void rds6_sock_inc_info(struct socket *sock, unsigned int len,
struct rds_info_iterator *iter,
struct rds_info_lengths *lens)
{
+ struct net *net = sock_net(sock->sk);
struct rds_incoming *inc;
unsigned int total = 0;
struct rds_sock *rs;
@@ -784,6 +786,9 @@ static void rds6_sock_inc_info(struct socket *sock, unsigned int len,
spin_lock_bh(&rds_sock_lock);
list_for_each_entry(rs, &rds_sock_list, rs_item) {
+ /* Only show sockets in the caller's netns. */
+ if (!net_eq(sock_net(rds_rs_to_sk(rs)), net))
+ continue;
read_lock(&rs->rs_recv_lock);
list_for_each_entry(inc, &rs->rs_recv_queue, i_item) {
@@ -807,7 +812,9 @@ static void rds_sock_info(struct socket *sock, unsigned int len,
struct rds_info_iterator *iter,
struct rds_info_lengths *lens)
{
+ struct net *net = sock_net(sock->sk);
struct rds_info_socket sinfo;
+ unsigned int copied = 0;
unsigned int cnt = 0;
struct rds_sock *rs;
@@ -815,12 +822,24 @@ static void rds_sock_info(struct socket *sock, unsigned int len,
spin_lock_bh(&rds_sock_lock);
- if (len < rds_sock_count) {
- cnt = rds_sock_count;
- goto out;
+ /* First pass: count entries visible in the caller's netns. */
+ list_for_each_entry(rs, &rds_sock_list, rs_item) {
+ if (!net_eq(sock_net(rds_rs_to_sk(rs)), net))
+ continue;
+ if (!ipv6_addr_v4mapped(&rs->rs_bound_addr))
+ continue;
+ cnt++;
}
+ if (len < cnt)
+ goto out;
+
list_for_each_entry(rs, &rds_sock_list, rs_item) {
+ if (copied >= cnt)
+ break;
+ /* Only show sockets in the caller's netns. */
+ if (!net_eq(sock_net(rds_rs_to_sk(rs)), net))
+ continue;
/* This option only supports IPv4 sockets. */
if (!ipv6_addr_v4mapped(&rs->rs_bound_addr))
continue;
@@ -833,8 +852,13 @@ static void rds_sock_info(struct socket *sock, unsigned int len,
sinfo.inum = sock_i_ino(rds_rs_to_sk(rs));
rds_info_copy(iter, &sinfo, sizeof(sinfo));
- cnt++;
+ copied++;
}
+ /* A concurrent rds_bind() can change rs_bound_addr between the
+ * two passes without holding rds_sock_lock, so copied may be
+ * less than cnt. Report what was actually copied.
+ */
+ cnt = copied;
out:
lens->nr = cnt;
@@ -848,17 +872,32 @@ static void rds6_sock_info(struct socket *sock, unsigned int len,
struct rds_info_iterator *iter,
struct rds_info_lengths *lens)
{
+ struct net *net = sock_net(sock->sk);
struct rds6_info_socket sinfo6;
+ unsigned int copied = 0;
+ unsigned int cnt = 0;
struct rds_sock *rs;
len /= sizeof(struct rds6_info_socket);
spin_lock_bh(&rds_sock_lock);
- if (len < rds_sock_count)
+ /* First pass: count entries visible in the caller's netns. */
+ list_for_each_entry(rs, &rds_sock_list, rs_item) {
+ if (!net_eq(sock_net(rds_rs_to_sk(rs)), net))
+ continue;
+ cnt++;
+ }
+
+ if (len < cnt)
goto out;
list_for_each_entry(rs, &rds_sock_list, rs_item) {
+ if (copied >= cnt)
+ break;
+ /* Only show sockets in the caller's netns. */
+ if (!net_eq(sock_net(rds_rs_to_sk(rs)), net))
+ continue;
sinfo6.sndbuf = rds_sk_sndbuf(rs);
sinfo6.rcvbuf = rds_sk_rcvbuf(rs);
sinfo6.bound_addr = rs->rs_bound_addr;
@@ -868,10 +907,12 @@ static void rds6_sock_info(struct socket *sock, unsigned int len,
sinfo6.inum = sock_i_ino(rds_rs_to_sk(rs));
rds_info_copy(iter, &sinfo6, sizeof(sinfo6));
+ copied++;
}
+ cnt = copied;
out:
- lens->nr = rds_sock_count;
+ lens->nr = cnt;
lens->each = sizeof(struct rds6_info_socket);
spin_unlock_bh(&rds_sock_lock);
diff --git a/net/rds/connection.c b/net/rds/connection.c
index cd41f83863c89..beecd408e93ab 100644
--- a/net/rds/connection.c
+++ b/net/rds/connection.c
@@ -540,6 +540,7 @@ static void rds_conn_message_info_cmn(struct socket *sock, unsigned int len,
struct rds_info_lengths *lens,
int want_send, bool isv6)
{
+ struct net *net = sock_net(sock->sk);
struct hlist_head *head;
struct list_head *list;
struct rds_connection *conn;
@@ -562,6 +563,9 @@ static void rds_conn_message_info_cmn(struct socket *sock, unsigned int len,
struct rds_conn_path *cp;
int npaths;
+ /* Only show connections in the caller's netns. */
+ if (!net_eq(rds_conn_net(conn), net))
+ continue;
if (!isv6 && conn->c_isv6)
continue;
@@ -660,6 +664,7 @@ void rds_for_each_conn_info(struct socket *sock, unsigned int len,
u64 *buffer,
size_t item_len)
{
+ struct net *net = sock_net(sock->sk);
struct hlist_head *head;
struct rds_connection *conn;
size_t i;
@@ -672,6 +677,9 @@ void rds_for_each_conn_info(struct socket *sock, unsigned int len,
for (i = 0, head = rds_conn_hash; i < ARRAY_SIZE(rds_conn_hash);
i++, head++) {
hlist_for_each_entry_rcu(conn, head, c_hash_node) {
+ /* Only show connections in the caller's netns. */
+ if (!net_eq(rds_conn_net(conn), net))
+ continue;
/* Zero the per-item buffer before handing it to the
* visitor so any field the visitor does not write -
@@ -705,6 +713,7 @@ static void rds_walk_conn_path_info(struct socket *sock, unsigned int len,
u64 *buffer,
size_t item_len)
{
+ struct net *net = sock_net(sock->sk);
struct hlist_head *head;
struct rds_connection *conn;
size_t i;
@@ -719,6 +728,10 @@ static void rds_walk_conn_path_info(struct socket *sock, unsigned int len,
hlist_for_each_entry_rcu(conn, head, c_hash_node) {
struct rds_conn_path *cp;
+ /* Only show connections in the caller's netns. */
+ if (!net_eq(rds_conn_net(conn), net))
+ continue;
+
/* XXX We only copy the information from the first
* path for now. The problem is that if there are
* more than one underlying paths, we cannot report
diff --git a/net/rds/tcp.c b/net/rds/tcp.c
index 323fa5ed5c3ea..74ad2b5abb3ab 100644
--- a/net/rds/tcp.c
+++ b/net/rds/tcp.c
@@ -46,14 +46,6 @@
static DEFINE_SPINLOCK(rds_tcp_tc_list_lock);
static LIST_HEAD(rds_tcp_tc_list);
-/* rds_tcp_tc_count counts only IPv4 connections.
- * rds6_tcp_tc_count counts both IPv4 and IPv6 connections.
- */
-static unsigned int rds_tcp_tc_count;
-#if IS_ENABLED(CONFIG_IPV6)
-static unsigned int rds6_tcp_tc_count;
-#endif
-
/* Track rds_tcp_connection structs so they can be cleaned up */
static DEFINE_SPINLOCK(rds_tcp_conn_lock);
static LIST_HEAD(rds_tcp_conn_list);
@@ -109,11 +101,6 @@ void rds_tcp_restore_callbacks(struct socket *sock,
/* done under the callback_lock to serialize with write_space */
spin_lock(&rds_tcp_tc_list_lock);
list_del_init(&tc->t_list_item);
-#if IS_ENABLED(CONFIG_IPV6)
- rds6_tcp_tc_count--;
-#endif
- if (!tc->t_cpath->cp_conn->c_isv6)
- rds_tcp_tc_count--;
spin_unlock(&rds_tcp_tc_list_lock);
tc->t_sock = NULL;
@@ -200,11 +187,6 @@ void rds_tcp_set_callbacks(struct socket *sock, struct rds_conn_path *cp)
/* done under the callback_lock to serialize with write_space */
spin_lock(&rds_tcp_tc_list_lock);
list_add_tail(&tc->t_list_item, &rds_tcp_tc_list);
-#if IS_ENABLED(CONFIG_IPV6)
- rds6_tcp_tc_count++;
-#endif
- if (!tc->t_cpath->cp_conn->c_isv6)
- rds_tcp_tc_count++;
spin_unlock(&rds_tcp_tc_list_lock);
/* accepted sockets need our listen data ready undone */
@@ -232,20 +214,37 @@ static void rds_tcp_tc_info(struct socket *rds_sock, unsigned int len,
struct rds_info_iterator *iter,
struct rds_info_lengths *lens)
{
+ struct net *net = sock_net(rds_sock->sk);
struct rds_info_tcp_socket tsinfo;
struct rds_tcp_connection *tc;
+ unsigned int copied = 0;
+ unsigned int cnt = 0;
unsigned long flags;
spin_lock_irqsave(&rds_tcp_tc_list_lock, flags);
- if (len / sizeof(tsinfo) < rds_tcp_tc_count)
+ /* First pass: count entries visible in the caller's netns. */
+ list_for_each_entry(tc, &rds_tcp_tc_list, t_list_item) {
+ if (tc->t_cpath->cp_conn->c_isv6)
+ continue;
+ if (!net_eq(rds_conn_net(tc->t_cpath->cp_conn), net))
+ continue;
+ cnt++;
+ }
+
+ if (len / sizeof(tsinfo) < cnt)
goto out;
list_for_each_entry(tc, &rds_tcp_tc_list, t_list_item) {
struct inet_sock *inet = inet_sk(tc->t_sock->sk);
+ if (copied >= cnt)
+ break;
if (tc->t_cpath->cp_conn->c_isv6)
continue;
+ /* Only show connections in the caller's netns. */
+ if (!net_eq(rds_conn_net(tc->t_cpath->cp_conn), net))
+ continue;
tsinfo.local_addr = inet->inet_saddr;
tsinfo.local_port = inet->inet_sport;
@@ -260,10 +259,12 @@ static void rds_tcp_tc_info(struct socket *rds_sock, unsigned int len,
tsinfo.tos = tc->t_cpath->cp_conn->c_tos;
rds_info_copy(iter, &tsinfo, sizeof(tsinfo));
+ copied++;
}
+ cnt = copied;
out:
- lens->nr = rds_tcp_tc_count;
+ lens->nr = cnt;
lens->each = sizeof(tsinfo);
spin_unlock_irqrestore(&rds_tcp_tc_list_lock, flags);
@@ -278,19 +279,35 @@ static void rds6_tcp_tc_info(struct socket *sock, unsigned int len,
struct rds_info_iterator *iter,
struct rds_info_lengths *lens)
{
+ struct net *net = sock_net(sock->sk);
struct rds6_info_tcp_socket tsinfo6;
struct rds_tcp_connection *tc;
+ unsigned int copied = 0;
+ unsigned int cnt = 0;
unsigned long flags;
spin_lock_irqsave(&rds_tcp_tc_list_lock, flags);
- if (len / sizeof(tsinfo6) < rds6_tcp_tc_count)
+ /* First pass: count entries visible in the caller's netns. */
+ list_for_each_entry(tc, &rds_tcp_tc_list, t_list_item) {
+ if (!net_eq(rds_conn_net(tc->t_cpath->cp_conn), net))
+ continue;
+ cnt++;
+ }
+
+ if (len / sizeof(tsinfo6) < cnt)
goto out;
list_for_each_entry(tc, &rds_tcp_tc_list, t_list_item) {
struct sock *sk = tc->t_sock->sk;
struct inet_sock *inet = inet_sk(sk);
+ if (copied >= cnt)
+ break;
+ /* Only show connections in the caller's netns. */
+ if (!net_eq(rds_conn_net(tc->t_cpath->cp_conn), net))
+ continue;
+
tsinfo6.local_addr = sk->sk_v6_rcv_saddr;
tsinfo6.local_port = inet->inet_sport;
tsinfo6.peer_addr = sk->sk_v6_daddr;
@@ -303,10 +320,12 @@ static void rds6_tcp_tc_info(struct socket *sock, unsigned int len,
tsinfo6.last_seen_una = tc->t_last_seen_una;
rds_info_copy(iter, &tsinfo6, sizeof(tsinfo6));
+ copied++;
}
+ cnt = copied;
out:
- lens->nr = rds6_tcp_tc_count;
+ lens->nr = cnt;
lens->each = sizeof(tsinfo6);
spin_unlock_irqrestore(&rds_tcp_tc_list_lock, flags);
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 087/982] rds: annotate data-race around rs_seen_congestion
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 086/982] rds: filter RDS_INFO_* getsockopt by callers netns Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 088/982] s390/zcore: Removed unused variables Greg Kroah-Hartman
` (901 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+fbf3648ae7f5bdb05c59,
Jiayuan Chen, Allison Henderson, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <jiayuan.chen@linux.dev>
[ Upstream commit 67636cab273ed0c0b0f2adab6c9369a471cb7966 ]
rs_seen_congestion is read in rds_poll() and written in rds_sendmsg()
and rds_poll() without any lock. Use READ_ONCE()/WRITE_ONCE() to
annotate these lockless accesses and silence KCSAN.
Reported-by: syzbot+fbf3648ae7f5bdb05c59@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6a0f8d94.050a0220.6b33c.0000.GAE@google.com/
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Reviewed-by: Allison Henderson <achender@kernel.org>
Tested-by: Allison Henderson <achender@kernel.org>
Link: https://patch.msgid.link/20260522011621.304470-1-jiayuan.chen@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/rds/af_rds.c | 4 ++--
net/rds/send.c | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/rds/af_rds.c b/net/rds/af_rds.c
index a8004e8a78175..b166ac1f599e6 100644
--- a/net/rds/af_rds.c
+++ b/net/rds/af_rds.c
@@ -217,7 +217,7 @@ static __poll_t rds_poll(struct file *file, struct socket *sock,
poll_wait(file, sk_sleep(sk), wait);
- if (rs->rs_seen_congestion)
+ if (READ_ONCE(rs->rs_seen_congestion))
poll_wait(file, &rds_poll_waitq, wait);
read_lock_irqsave(&rs->rs_recv_lock, flags);
@@ -245,7 +245,7 @@ static __poll_t rds_poll(struct file *file, struct socket *sock,
/* clear state any time we wake a seen-congested socket */
if (mask)
- rs->rs_seen_congestion = 0;
+ WRITE_ONCE(rs->rs_seen_congestion, 0);
return mask;
}
diff --git a/net/rds/send.c b/net/rds/send.c
index 8aa06f7e4640c..2cedcb837b8f3 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -1340,7 +1340,7 @@ int rds_sendmsg(struct socket *sock, struct msghdr *msg, size_t payload_len)
ret = rds_cong_wait(conn->c_fcong, dport, nonblock, rs);
if (ret) {
- rs->rs_seen_congestion = 1;
+ WRITE_ONCE(rs->rs_seen_congestion, 1);
goto out;
}
while (!rds_send_queue_rm(rs, conn, cpath, rm, rs->rs_bound_port,
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 088/982] s390/zcore: Removed unused variables
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 087/982] rds: annotate data-race around rs_seen_congestion Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 089/982] clk: socfpga: agilex: implement l3_main_free_clk Greg Kroah-Hartman
` (900 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Borntraeger,
Heiko Carstens, Alexander Gordeev, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <hca@linux.ibm.com>
[ Upstream commit 0a2aa995c0a1d363b5f0803862e84834e3876ae2 ]
allmodconfig with clang W=1 points out unused global variables:
drivers/s390/char/zcore.c:49:23: error: variable
'zcore_reipl_file' set but not used [-Werror,-Wunused-but-set-global]
drivers/s390/char/zcore.c:50:23: error: variable
'zcore_hsa_file' set but not used [-Werror,-Wunused-but-set-global]
Remove both of them, since there is no point in keeping them.
Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/s390/char/zcore.c | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
diff --git a/drivers/s390/char/zcore.c b/drivers/s390/char/zcore.c
index a41833557d550..166c0b04fe713 100644
--- a/drivers/s390/char/zcore.c
+++ b/drivers/s390/char/zcore.c
@@ -48,8 +48,6 @@ struct ipib_info {
static struct debug_info *zcore_dbf;
static int hsa_available;
static struct dentry *zcore_dir;
-static struct dentry *zcore_reipl_file;
-static struct dentry *zcore_hsa_file;
static struct ipl_parameter_block *zcore_ipl_block;
static DEFINE_MUTEX(hsa_buf_mutex);
@@ -314,10 +312,8 @@ static int __init zcore_init(void)
goto fail;
zcore_dir = debugfs_create_dir("zcore" , NULL);
- zcore_reipl_file = debugfs_create_file("reipl", S_IRUSR, zcore_dir,
- NULL, &zcore_reipl_fops);
- zcore_hsa_file = debugfs_create_file("hsa", S_IRUSR|S_IWUSR, zcore_dir,
- NULL, &zcore_hsa_fops);
+ debugfs_create_file("reipl", S_IRUSR, zcore_dir, NULL, &zcore_reipl_fops);
+ debugfs_create_file("hsa", S_IRUSR|S_IWUSR, zcore_dir, NULL, &zcore_hsa_fops);
register_reboot_notifier(&zcore_reboot_notifier);
atomic_notifier_chain_register(&panic_notifier_list, &zcore_on_panic_notifier);
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 089/982] clk: socfpga: agilex: implement l3_main_free_clk
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 088/982] s390/zcore: Removed unused variables Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 090/982] thermal/drivers/tegra/soctherma: Switch to devm cooling device registration Greg Kroah-Hartman
` (899 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrian Ng Ho Yin, Dinh Nguyen,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Ng Ho Yin <adrian.ho.yin.ng@altera.com>
[ Upstream commit 1e7f56205813a2c48cdb3e9a4b0a24f49fd9a548 ]
The AGILEX_L3_MAIN_FREE_CLK is defined in the dt-bindings header but
was never implemented in the clock driver. Per the Agilex TRM,
l3_main_free_clk has no divider or mux and is a fixed 1:1 derivative
of noc_free_clk that clocks most of the interconnect datapath.
Signed-off-by: Adrian Ng Ho Yin <adrian.ho.yin.ng@altera.com>
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/socfpga/clk-agilex.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/clk/socfpga/clk-agilex.c b/drivers/clk/socfpga/clk-agilex.c
index 74d21bd82710e..2408f9f33312f 100644
--- a/drivers/clk/socfpga/clk-agilex.c
+++ b/drivers/clk/socfpga/clk-agilex.c
@@ -260,6 +260,8 @@ static const struct stratix10_perip_cnt_clock agilex_main_perip_cnt_clks[] = {
0, 0x3C, 0, 0, 0},
{ AGILEX_NOC_FREE_CLK, "noc_free_clk", NULL, noc_free_mux, ARRAY_SIZE(noc_free_mux),
0, 0x40, 0, 0, 0},
+ { AGILEX_L3_MAIN_FREE_CLK, "l3_main_free_clk", "noc_free_clk", NULL,
+ 1, 0, 0, 1, 0, 0},
{ AGILEX_L4_SYS_FREE_CLK, "l4_sys_free_clk", NULL, noc_mux, ARRAY_SIZE(noc_mux), 0,
0, 4, 0x30, 1},
{ AGILEX_EMAC_A_FREE_CLK, "emaca_free_clk", NULL, emaca_free_mux, ARRAY_SIZE(emaca_free_mux),
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 090/982] thermal/drivers/tegra/soctherma: Switch to devm cooling device registration
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 089/982] clk: socfpga: agilex: implement l3_main_free_clk Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 091/982] drm/panel: simple: Add AM-1280800W8TZQW-T00H Greg Kroah-Hartman
` (898 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Lezcano, Daniel Lezcano,
Lukasz Luba, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Lezcano <daniel.lezcano@oss.qualcomm.com>
[ Upstream commit ee126267bc04bfb03816ae9d71ca24c5bf99e739 ]
Use devm_thermal_of_cooling_device_register() to simplify resource
management and avoid manual cleanup in error paths.
As a side effect this change has the benefit of solving an existing
issue. Before, the function tegra_soctherm_remove() only called
debugfs_remove_recursive() and never called thermal_cooling_device_unregister()
for any of the cooling devices registered here.
After the driver removal, the thermal framework's cdev list would
still hold references to thermal_cooling_device objects whose devdata
pointer (ts) pointed to memory already freed by the platform device's
devm cleanup.
With this change, the cooling device is unregistered when the driver
is removed, thus fixing the issue above.
Signed-off-by: Daniel Lezcano <daniel.lezcano@oss.qualcomm.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org>
Reviewed-by: Lukasz Luba <lukasz.luba@arm.com>
Link: https://patch.msgid.link/20260424160019.41710-2-daniel.lezcano@oss.qualcomm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/thermal/tegra/soctherm.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/thermal/tegra/soctherm.c b/drivers/thermal/tegra/soctherm.c
index 1efe470f31e9a..0af9958073ffb 100644
--- a/drivers/thermal/tegra/soctherm.c
+++ b/drivers/thermal/tegra/soctherm.c
@@ -1704,9 +1704,9 @@ static void soctherm_init_hw_throt_cdev(struct platform_device *pdev)
stc->init = true;
} else {
- tcd = thermal_of_cooling_device_register(np_stcc,
- (char *)name, ts,
- &throt_cooling_ops);
+ tcd = devm_thermal_of_cooling_device_register(dev, np_stcc,
+ (char *)name, ts,
+ &throt_cooling_ops);
if (IS_ERR_OR_NULL(tcd)) {
dev_err(dev,
"throttle-cfg: %s: failed to register cooling device\n",
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 091/982] drm/panel: simple: Add AM-1280800W8TZQW-T00H
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 090/982] thermal/drivers/tegra/soctherma: Switch to devm cooling device registration Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 092/982] mips: cps: Assemble jr.hb with an R2 ISA level Greg Kroah-Hartman
` (897 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Trimarchi, Dario Binacchi,
Dmitry Baryshkov, Neil Armstrong, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dario Binacchi <dario.binacchi@amarulasolutions.com>
[ Upstream commit 6acb810ebc5d8dea5c250326c14dc44e32dc8e92 ]
Add Ampire, AM-1280800W8TZQW-T00H 10.1" TFT LCD panel timings.
Co-developed-by: Michael Trimarchi <michael@amarulasolutions.com>
Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20260515082232.1766586-2-dario.binacchi@amarulasolutions.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panel/panel-simple.c | 28 ++++++++++++++++++++++++++++
1 file changed, 28 insertions(+)
diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
index 316961a86b042..f7787d6c97fe3 100644
--- a/drivers/gpu/drm/panel/panel-simple.c
+++ b/drivers/gpu/drm/panel/panel-simple.c
@@ -741,6 +741,31 @@ static const struct panel_desc ampire_am_1280800n3tzqw_t00h = {
.connector_type = DRM_MODE_CONNECTOR_LVDS,
};
+static const struct drm_display_mode ampire_am_1280800w8tzqw_t00h_mode = {
+ .clock = 72400,
+ .hdisplay = 1280,
+ .hsync_start = 1280 + 40,
+ .hsync_end = 1280 + 40 + 80,
+ .htotal = 1280 + 40 + 80 + 40,
+ .vdisplay = 800,
+ .vsync_start = 800 + 10,
+ .vsync_end = 800 + 10 + 18,
+ .vtotal = 800 + 10 + 18 + 10,
+};
+
+static const struct panel_desc ampire_am_1280800w8tzqw_t00h = {
+ .modes = &ire_am_1280800w8tzqw_t00h_mode,
+ .num_modes = 1,
+ .bpc = 8,
+ .size = {
+ .width = 217,
+ .height = 136,
+ },
+ .bus_flags = DRM_BUS_FLAG_DE_HIGH,
+ .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG,
+ .connector_type = DRM_MODE_CONNECTOR_LVDS,
+};
+
static const struct drm_display_mode ampire_am_480272h3tmqw_t01h_mode = {
.clock = 9000,
.hdisplay = 480,
@@ -3965,6 +3990,9 @@ static const struct of_device_id platform_of_match[] = {
{
.compatible = "ampire,am-1280800n3tzqw-t00h",
.data = &ire_am_1280800n3tzqw_t00h,
+ }, {
+ .compatible = "ampire,am-1280800w8tzqw-t00h",
+ .data = &ire_am_1280800w8tzqw_t00h,
}, {
.compatible = "ampire,am-480272h3tmqw-t01h",
.data = &ire_am_480272h3tmqw_t01h,
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 092/982] mips: cps: Assemble jr.hb with an R2 ISA level
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 091/982] drm/panel: simple: Add AM-1280800W8TZQW-T00H Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 093/982] iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind Greg Kroah-Hartman
` (896 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rosen Penev, Maciej W. Rozycki,
Thomas Bogendoerfer, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <rosenp@gmail.com>
[ Upstream commit e5d64f868e484da06f5c141c18c32c01c269625e ]
A MIPS allmodconfig built with LLVM can select CPU_MIPS32_R1 together
with MIPS_MT_SMP. In that configuration clang invokes the integrated
assembler with -march=mips32, and the MIPS MT path in cps-vec.S fails
to assemble two jr.hb instructions:
arch/mips/kernel/cps-vec.S:376:2: error: instruction requires
a CPU feature not currently enabled
arch/mips/kernel/cps-vec.S:490:4: error: instruction requires
a CPU feature not currently enabled
The earlier jr.hb in the same file is already assembled inside a .set
MIPS_ISA_LEVEL_RAW scope. The two failing sites are reached after
popping back to the file's base ISA level, so LLVM correctly rejects
them for an R1 target.
Wrap those jr.hb instructions in the same ISA-level push/pop used by
the working site. This keeps the MT code unchanged while making the
required R2 hazard-branch encoding explicit to the assembler.
Assisted-by: Codex:GPT-5.5
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Reviewed-by: Maciej W. Rozycki <macro@orcam.me.uk>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/kernel/cps-vec.S | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/arch/mips/kernel/cps-vec.S b/arch/mips/kernel/cps-vec.S
index 9753432401487..156abad9c3249 100644
--- a/arch/mips/kernel/cps-vec.S
+++ b/arch/mips/kernel/cps-vec.S
@@ -394,8 +394,11 @@ LEAF(mips_cps_boot_vpes)
.set pop
PTR_LA t1, 1f
+ .set push
+ .set MIPS_ISA_LEVEL_RAW
jr.hb t1
nop
+ .set pop
1: mfc0 t1, CP0_MVPCONTROL
ori t1, t1, MVPCONTROL_VPC
mtc0 t1, CP0_MVPCONTROL
@@ -508,8 +511,11 @@ LEAF(mips_cps_boot_vpes)
li t0, TCHALT_H
mtc0 t0, CP0_TCHALT
PTR_LA t0, 1f
+ .set push
+ .set MIPS_ISA_LEVEL_RAW
1: jr.hb t0
nop
+ .set pop
2:
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 093/982] iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 092/982] mips: cps: Assemble jr.hb with an R2 ISA level Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 094/982] irqchip/gic-v4: Dont advertise VLPIs if no ITS is probed Greg Kroah-Hartman
` (895 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stepan Ionichev, Jonathan Cameron,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stepan Ionichev <sozdayvek@gmail.com>
[ Upstream commit 929fec2964f71d4b1ac664ee963d8226c5cf01c6 ]
iadc_probe() calls enable_irq_wake() after a successful
devm_request_irq(), but the driver has no remove callback or
matching disable_irq_wake(), so the wake reference count on the
IRQ is leaked on module unload or driver unbind.
Check the IRQ request error first, then register a devm action
that calls disable_irq_wake() so the wake reference is released
in the same scope as the enable. While here, drop the inverted
"if (!ret) ... else return ret" in favour of the standard
"if (ret) return ret;" pattern.
Signed-off-by: Stepan Ionichev <sozdayvek@gmail.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/qcom-spmi-iadc.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
diff --git a/drivers/iio/adc/qcom-spmi-iadc.c b/drivers/iio/adc/qcom-spmi-iadc.c
index acbda6636dc58..c57c50aeeffd7 100644
--- a/drivers/iio/adc/qcom-spmi-iadc.c
+++ b/drivers/iio/adc/qcom-spmi-iadc.c
@@ -482,6 +482,11 @@ static const struct iio_chan_spec iadc_channels[] = {
},
};
+static void iadc_disable_irq_wake(void *data)
+{
+ disable_irq_wake((unsigned long)data);
+}
+
static int iadc_probe(struct platform_device *pdev)
{
struct device_node *node = pdev->dev.of_node;
@@ -539,9 +544,16 @@ static int iadc_probe(struct platform_device *pdev)
if (!iadc->poll_eoc) {
ret = devm_request_irq(dev, irq_eoc, iadc_isr, 0,
"spmi-iadc", iadc);
- if (!ret)
- enable_irq_wake(irq_eoc);
- else
+ if (ret)
+ return ret;
+
+ ret = enable_irq_wake(irq_eoc);
+ if (ret)
+ return ret;
+
+ ret = devm_add_action_or_reset(dev, iadc_disable_irq_wake,
+ (void *)(unsigned long)irq_eoc);
+ if (ret)
return ret;
} else {
device_init_wakeup(iadc->dev, 1);
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 094/982] irqchip/gic-v4: Dont advertise VLPIs if no ITS is probed
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 093/982] iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 095/982] ALSA: usb-audio: Add quirk for Novation Mininova Greg Kroah-Hartman
` (894 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marc Zyngier, Mostafa Saleh,
Thomas Gleixner, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mostafa Saleh <smostafa@google.com>
[ Upstream commit e61654fbc3bc5d07ec9fafe29f33e19b2b5d0fd5 ]
When accidentally setting “kvm-arm.vgic_v4_enable=1” on a system that has
no MSI controller device tree node and GICv4, it results a panic as
“gic_domain” is NULL and the kernel attempts to access it.
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028
Mem abort info:
ESR = 0x0000000096000006
CPU: 1 UID: 0 PID: 295 Comm: lkvm-static Not tainted 7.1.0-rc4-ge3f15ad3970e #5 PREEMPT
Hardware name: linux,dummy-virt (DT)
pstate: 81402005 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : __irq_domain_instantiate+0x1d4/0x578
lr : __irq_domain_instantiate+0x1cc/0x578
Set vLPI support to false at init time if the host has no ITS, so it
propagates properly to kvm_vgic_global_state.has_gicv4.
Suggested-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Acked-by: Marc Zyngier <maz@kernel.org>
Link: https://patch.msgid.link/20260526125317.3672297-1-smostafa@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-gic-v3-its.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 84b00e14860eb..105b8e24905ed 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -5583,6 +5583,7 @@ int __init its_init(struct fwnode_handle *handle, struct rdists *rdists,
its_acpi_probe();
if (list_empty(&its_nodes)) {
+ rdists->has_vlpis = false;
pr_warn("ITS: No ITS available, not enabling LPIs\n");
return -ENXIO;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 095/982] ALSA: usb-audio: Add quirk for Novation Mininova
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 094/982] irqchip/gic-v4: Dont advertise VLPIs if no ITS is probed Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 096/982] net: hsr: require valid EOT supervision TLV Greg Kroah-Hartman
` (893 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Uwe Küchler, Takashi Iwai,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Küchler <uwe@kuechler.org>
[ Upstream commit b2e9d2cbbb71b00faf3e27fb741a27b9ad455edd ]
Add a device-specific quirk for the Novation Mininova synthesizer
(USB ID 1235:001e) to enable proper recognition and functionality
as a MIDI device.
Signed-off-by: Uwe Küchler <uwe@kuechler.org>
Link: https://patch.msgid.link/20260526162033.7513-1-uwe@kuechler.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/quirks-table.h | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
index d1bd8e0d60252..c20a4df886906 100644
--- a/sound/usb/quirks-table.h
+++ b/sound/usb/quirks-table.h
@@ -2131,6 +2131,14 @@ YAMAHA_DEVICE(0x7010, "UB99"),
}
}
},
+{
+ USB_DEVICE(0x1235, 0x001e),
+ QUIRK_DRIVER_INFO {
+ /* .vendor_name = "Novation", */
+ /* .product_name = "Mininova", */
+ QUIRK_DATA_RAW_BYTES(0)
+ }
+},
{
USB_DEVICE_VENDOR_SPEC(0x1235, 0x4661),
QUIRK_DRIVER_INFO {
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 096/982] net: hsr: require valid EOT supervision TLV
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 095/982] ALSA: usb-audio: Add quirk for Novation Mininova Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 097/982] ipv6: addrconf: fix temp address generation after prefix deprecation Greg Kroah-Hartman
` (892 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luka Gejak,
Fernando Fernandez Mancera, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luka Gejak <luka.gejak@linux.dev>
[ Upstream commit 46d111a3ef3b5972804dcdce0833767143a12192 ]
Supervision frames are only valid if terminated with a zero-length EOT
TLV. The current check fails to reject non-EOT entries as the terminal
TLV, potentially allowing malformed supervision traffic.
Fix this by strictly requiring the terminal TLV to be HSR_TLV_EOT with
a length of zero.
Signed-off-by: Luka Gejak <luka.gejak@linux.dev>
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Link: https://patch.msgid.link/20260523130420.62144-1-luka.gejak@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/hsr/hsr_forward.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c
index 2a6df958292c8..c66728d7d285e 100644
--- a/net/hsr/hsr_forward.c
+++ b/net/hsr/hsr_forward.c
@@ -110,7 +110,7 @@ static bool is_supervision_frame(struct hsr_priv *hsr, struct sk_buff *skb)
}
/* end of tlvs must follow at the end */
- if (hsr_sup_tlv->HSR_TLV_type == HSR_TLV_EOT &&
+ if (hsr_sup_tlv->HSR_TLV_type != HSR_TLV_EOT ||
hsr_sup_tlv->HSR_TLV_length != 0)
return false;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 097/982] ipv6: addrconf: fix temp address generation after prefix deprecation
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 096/982] net: hsr: require valid EOT supervision TLV Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 098/982] net: thunderx: fix PTP device ref leak in nicvf_probe() Greg Kroah-Hartman
` (891 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Łukasz Stelmach, Ido Schimmel,
Fernando Fernandez Mancera, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <fmancera@suse.de>
[ Upstream commit e20d8922aa8fe441d291364c96c2179a005b79ea ]
When a router temporarily deprecates an IPv6 prefix (either by sending a
Router Advertisement with Preferred Lifetime = 0 or by letting the
lifetime expire) and later restores it, the kernel permanently loses its
ability to generate temporary privacy addresses (RFC 8981) for that
prefix.
This happens because the address worker attempts to generate a
replacement temporary address when the current one nears expiration. As
the base prefix is deprecated already, the generation fails after
marking the temporary address as already having spawned a replacement
(ifp->regen_count++).
When the router eventually restores the prefix, the temporary address
becomes active again. However, once it naturally expires, the address
worker sees this temporary address already tried to generate one and
skips the regeneration.
Fix the issue by resetting the regen_count check of the latest temp
address generated for the prefix updated by the incoming RA.
Reported-by: Łukasz Stelmach <steelman@post.pl>
Closes: https://lore.kernel.org/netdev/87340td30q.fsf%25steelman@post.pl/
Suggested-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260523103811.3790-1-fmancera@suse.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/addrconf.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 9fe1f67ceacd4..849ed409f74fc 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1169,6 +1169,7 @@ ipv6_add_addr(struct inet6_dev *idev, struct ifa6_config *cfg,
ipv6_link_dev_addr(idev, ifa);
if (ifa->flags&IFA_F_TEMPORARY) {
+ /* manage_tempaddrs() relies on addresses being added to the head */
list_add(&ifa->tmp_list, &idev->tempaddr_list);
in6_ifa_hold(ifa);
}
@@ -2556,8 +2557,10 @@ static void manage_tempaddrs(struct inet6_dev *idev,
__u32 valid_lft, __u32 prefered_lft,
bool create, unsigned long now)
{
- u32 flags;
+ u32 orig_prefered_lft = prefered_lft;
struct inet6_ifaddr *ift;
+ bool reset_done = false;
+ u32 flags;
read_lock_bh(&idev->lock);
/* update all temporary addresses in the list */
@@ -2592,6 +2595,11 @@ static void manage_tempaddrs(struct inet6_dev *idev,
prefered_lft = max_prefered;
spin_lock(&ift->lock);
+ /* the first match is the most recent temp address */
+ if (!reset_done && orig_prefered_lft > 0) {
+ ift->regen_count = 0;
+ reset_done = true;
+ }
flags = ift->flags;
ift->valid_lft = valid_lft;
ift->prefered_lft = prefered_lft;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 098/982] net: thunderx: fix PTP device ref leak in nicvf_probe()
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 097/982] ipv6: addrconf: fix temp address generation after prefix deprecation Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 099/982] drm/amd/pm/si: Fix updating clock limits from power states Greg Kroah-Hartman
` (890 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haoxiang Li, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
[ Upstream commit 2bcf59eefb9f00a2b1d426b639ee49c305a80695 ]
cavium_ptp_get() acquires a reference to the PTP PCI device
through pci_get_device(). If any initialization step fails
after cavium_ptp_get(), the PTP PCI device reference is leaked.
Add a common error path to release the PTP reference before
returning from probe failures.
Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Link: https://patch.msgid.link/20260525082611.61817-1-lihaoxiang@isrc.iscas.ac.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/cavium/thunder/nicvf_main.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
index f2f95493ec89a..1c04ebaa705c0 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
@@ -2110,8 +2110,10 @@ static int nicvf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
}
err = pci_enable_device(pdev);
- if (err)
- return dev_err_probe(dev, err, "Failed to enable PCI device\n");
+ if (err) {
+ err = dev_err_probe(dev, err, "Failed to enable PCI device\n");
+ goto err_put_ptp;
+ }
err = pci_request_regions(pdev, DRV_NAME);
if (err) {
@@ -2261,6 +2263,8 @@ static int nicvf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
pci_release_regions(pdev);
err_disable_device:
pci_disable_device(pdev);
+err_put_ptp:
+ cavium_ptp_put(ptp_clock);
return err;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 099/982] drm/amd/pm/si: Fix updating clock limits from power states
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 098/982] net: thunderx: fix PTP device ref leak in nicvf_probe() Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 100/982] ACPICA: Fix condition check in acpi_ps_parse_loop() Greg Kroah-Hartman
` (889 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Deucher, Timur Kristóf,
Jeremy Klarenbeek, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeremy Klarenbeek <jeremy.klarenbeek99@gmail.com>
[ Upstream commit e6c5d36756e7d4d260e2365fc4d01226f1973152 ]
VBIOS can contain conflicting values between:
- the maximum allowed clocks and voltages on AC or DC
- the clocks and voltages in power states on AC or DC
Update maximum clock (and voltage) limits for both AC/DC
and take the highest value from the VBIOS limits and
the performance/battery power states. Previously this
was only done for AC, but is also needed for DC.
This commit fixes the behaviour on some laptop GPUs,
where the VBIOS limit was set to the lowest possible
clock frequency, so the GPU was stuck on the lowest
possible power level on battery.
Some affected GPUs are:
FirePro W4170M (Dell Precision M2800)
Radeon HD 8790M (Dell Latitude E6540)
and possibly other laptop GPUs.
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Co-developed-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Jeremy Klarenbeek <jeremy.klarenbeek99@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 29 ++++++++++++++++++----
1 file changed, 24 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
index a28bcff24254b..f71585ae68498 100644
--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
@@ -7218,6 +7218,7 @@ static void si_parse_pplib_clock_info(struct amdgpu_device *adev,
struct evergreen_power_info *eg_pi = evergreen_get_pi(adev);
struct si_power_info *si_pi = si_get_pi(adev);
struct si_ps *ps = si_get_ps(rps);
+ struct amdgpu_clock_and_voltage_limits *limits;
u16 leakage_voltage;
struct rv7xx_pl *pl = &ps->performance_levels[index];
int ret;
@@ -7277,12 +7278,30 @@ static void si_parse_pplib_clock_info(struct amdgpu_device *adev,
si_pi->mvdd_bootup_value = mvdd;
}
+ /*
+ * Update maximum allowed clock limits.
+ * VBIOS can contain conflicting values between:
+ * - the maximum allowed clocks and voltages on AC or DC
+ * - the clocks and voltages in power states on AC or DC
+ */
if ((rps->class & ATOM_PPLIB_CLASSIFICATION_UI_MASK) ==
- ATOM_PPLIB_CLASSIFICATION_UI_PERFORMANCE) {
- adev->pm.dpm.dyn_state.max_clock_voltage_on_ac.sclk = pl->sclk;
- adev->pm.dpm.dyn_state.max_clock_voltage_on_ac.mclk = pl->mclk;
- adev->pm.dpm.dyn_state.max_clock_voltage_on_ac.vddc = pl->vddc;
- adev->pm.dpm.dyn_state.max_clock_voltage_on_ac.vddci = pl->vddci;
+ ATOM_PPLIB_CLASSIFICATION_UI_PERFORMANCE)
+ limits = &adev->pm.dpm.dyn_state.max_clock_voltage_on_ac;
+ else if ((rps->class & ATOM_PPLIB_CLASSIFICATION_UI_MASK) ==
+ ATOM_PPLIB_CLASSIFICATION_UI_BATTERY)
+ limits = &adev->pm.dpm.dyn_state.max_clock_voltage_on_dc;
+ else
+ limits = NULL;
+
+ if (limits) {
+ if (pl->sclk > limits->sclk)
+ limits->sclk = pl->sclk;
+ if (pl->mclk > limits->mclk)
+ limits->mclk = pl->mclk;
+ if (pl->vddc > limits->vddc)
+ limits->vddc = pl->vddc;
+ if (pl->vddci > limits->vddci)
+ limits->vddci = pl->vddci;
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 100/982] ACPICA: Fix condition check in acpi_ps_parse_loop()
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 099/982] drm/amd/pm/si: Fix updating clock limits from power states Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 101/982] ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() Greg Kroah-Hartman
` (888 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, ikaros, Rafael J. Wysocki,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: ikaros <void0red@gmail.com>
[ Upstream commit 8de27e2d83c0d07ae9443c6304575b0609394bfd ]
Fix condition check for AML_ELSE_OP in acpi_ps_parse_loop() to prevent
out-of-bounds access.
Link: https://github.com/acpica/acpica/commit/3b537b92336e
Signed-off-by: ikaros <void0red@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/1959692.tdWV9SEqCh@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/acpica/psloop.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/acpi/acpica/psloop.c b/drivers/acpi/acpica/psloop.c
index 840512fa9fc61..e851c7fe31906 100644
--- a/drivers/acpi/acpica/psloop.c
+++ b/drivers/acpi/acpica/psloop.c
@@ -425,7 +425,10 @@ acpi_status acpi_ps_parse_loop(struct acpi_walk_state *walk_state)
ACPI_ERROR((AE_INFO,
"Skipping While/If block"));
- if (*walk_state->aml == AML_ELSE_OP) {
+ if ((walk_state->aml <
+ parser_state->aml_end)
+ && (*walk_state->aml ==
+ AML_ELSE_OP)) {
ACPI_ERROR((AE_INFO,
"Skipping Else block"));
walk_state->parser_state.aml =
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 101/982] ACPICA: Fix use-after-free in acpi_ds_terminate_control_method()
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 100/982] ACPICA: Fix condition check in acpi_ps_parse_loop() Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 102/982] ACPICA: add boundary checks in acpi_ps_get_next_field() Greg Kroah-Hartman
` (887 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, ikaros, Rafael J. Wysocki,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: ikaros <void0red@gmail.com>
[ Upstream commit 945e87267cfd90937b3c637f87324cbb56998b72 ]
Fix use-after-free issue in acpi_ds_terminate_control_method() by
clearing references to method locals and arguments.
Link: https://github.com/acpica/acpica/commit/36f22a94cb1b
Signed-off-by: ikaros <void0red@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/8730924.NyiUUSuA9g@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/acpica/dsmethod.c | 43 ++++++++++++++++++++++++++++++++++
1 file changed, 43 insertions(+)
diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
index 12efc4ac9ba64..01fe931163e6c 100644
--- a/drivers/acpi/acpica/dsmethod.c
+++ b/drivers/acpi/acpica/dsmethod.c
@@ -698,6 +698,8 @@ void
acpi_ds_terminate_control_method(union acpi_operand_object *method_desc,
struct acpi_walk_state *walk_state)
{
+ u32 i;
+ struct acpi_namespace_node *ref_node;
ACPI_FUNCTION_TRACE_PTR(ds_terminate_control_method, walk_state);
@@ -708,6 +710,47 @@ acpi_ds_terminate_control_method(union acpi_operand_object *method_desc,
}
if (walk_state) {
+ /*
+ * Check if the return value is a ref_of reference to a method local
+ * or argument. If so, clear the reference to avoid use-after-free
+ * when the walk state is deleted.
+ */
+ if (walk_state->return_desc &&
+ (walk_state->return_desc->common.type ==
+ ACPI_TYPE_LOCAL_REFERENCE)
+ && (walk_state->return_desc->reference.class ==
+ ACPI_REFCLASS_REFOF)) {
+ ref_node = walk_state->return_desc->reference.object;
+ if (ref_node) {
+
+ /* Check against method locals */
+ for (i = 0; i < ACPI_METHOD_NUM_LOCALS; i++) {
+ if (ref_node ==
+ &walk_state->local_variables[i]) {
+ acpi_ut_remove_reference
+ (walk_state->return_desc);
+ walk_state->return_desc = NULL;
+ break;
+ }
+ }
+
+ /* Check against method arguments if not already cleared */
+ if (walk_state->return_desc) {
+ for (i = 0; i < ACPI_METHOD_NUM_ARGS;
+ i++) {
+ if (ref_node ==
+ &walk_state->arguments[i]) {
+ acpi_ut_remove_reference
+ (walk_state->
+ return_desc);
+ walk_state->
+ return_desc = NULL;
+ break;
+ }
+ }
+ }
+ }
+ }
/* Delete all arguments and locals */
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 102/982] ACPICA: add boundary checks in acpi_ps_get_next_field()
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 101/982] ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:13 ` [PATCH 6.1 103/982] ACPICA: validate byte_count in acpi_ps_get_next_package_length() Greg Kroah-Hartman
` (886 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, ikaros, Rafael J. Wysocki,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: ikaros <void0red@gmail.com>
[ Upstream commit e15aa60de0256d63df2331bf5a4bc4dd287504cd ]
Add boundary checks in acpi_ps_get_next_field() to prevent out-of-bounds
access.
Link: https://github.com/acpica/acpica/commit/c39183ea84bc
Signed-off-by: ikaros <void0red@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/24388159.6Emhk5qWAg@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/acpica/psargs.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/drivers/acpi/acpica/psargs.c b/drivers/acpi/acpica/psargs.c
index 418d56203e27a..55af9b3fe8d40 100644
--- a/drivers/acpi/acpica/psargs.c
+++ b/drivers/acpi/acpica/psargs.c
@@ -474,6 +474,10 @@ static union acpi_parse_object *acpi_ps_get_next_field(struct acpi_parse_state
ASL_CV_CAPTURE_COMMENTS_ONLY(parser_state);
aml = parser_state->aml;
+ if (aml >= parser_state->aml_end) {
+ return_PTR(NULL);
+ }
+
/* Determine field type */
switch (ACPI_GET8(parser_state->aml)) {
@@ -522,6 +526,11 @@ static union acpi_parse_object *acpi_ps_get_next_field(struct acpi_parse_state
/* Get the 4-character name */
+ if ((parser_state->aml + ACPI_NAMESEG_SIZE) >
+ parser_state->aml_end) {
+ acpi_ps_free_op(field);
+ return_PTR(NULL);
+ }
ACPI_MOVE_32_TO_32(&name, parser_state->aml);
acpi_ps_set_name(field, name);
parser_state->aml += ACPI_NAMESEG_SIZE;
@@ -567,6 +576,10 @@ static union acpi_parse_object *acpi_ps_get_next_field(struct acpi_parse_state
/* Get the two bytes (Type/Attribute) */
+ if ((parser_state->aml + 2) > parser_state->aml_end) {
+ acpi_ps_free_op(field);
+ return_PTR(NULL);
+ }
access_type = ACPI_GET8(parser_state->aml);
parser_state->aml++;
access_attribute = ACPI_GET8(parser_state->aml);
@@ -578,6 +591,10 @@ static union acpi_parse_object *acpi_ps_get_next_field(struct acpi_parse_state
/* This opcode has a third byte, access_length */
if (opcode == AML_INT_EXTACCESSFIELD_OP) {
+ if (parser_state->aml >= parser_state->aml_end) {
+ acpi_ps_free_op(field);
+ return_PTR(NULL);
+ }
access_length = ACPI_GET8(parser_state->aml);
parser_state->aml++;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 103/982] ACPICA: validate byte_count in acpi_ps_get_next_package_length()
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 102/982] ACPICA: add boundary checks in acpi_ps_get_next_field() Greg Kroah-Hartman
@ 2026-09-30 15:13 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 104/982] ACPICA: Prevent adding invalid references Greg Kroah-Hartman
` (885 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, ikaros, Rafael J. Wysocki,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: ikaros <void0red@gmail.com>
[ Upstream commit d49c6ee08365a8596f639da46eb7e71752b0cd42 ]
Validate package length reading in acpi_ps_get_next_package_length().
Link: https://github.com/acpica/acpica/commit/40e03f9941e2
Signed-off-by: ikaros <void0red@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/3616255.QJadu78ljV@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/acpica/psargs.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/drivers/acpi/acpica/psargs.c b/drivers/acpi/acpica/psargs.c
index 55af9b3fe8d40..cc27f7888bdca 100644
--- a/drivers/acpi/acpica/psargs.c
+++ b/drivers/acpi/acpica/psargs.c
@@ -48,6 +48,7 @@ acpi_ps_get_next_package_length(struct acpi_parse_state *parser_state)
u32 package_length = 0;
u32 byte_count;
u8 byte_zero_mask = 0x3F; /* Default [0:5] */
+ u32 remaining;
ACPI_FUNCTION_TRACE(ps_get_next_package_length);
@@ -55,7 +56,23 @@ acpi_ps_get_next_package_length(struct acpi_parse_state *parser_state)
* Byte 0 bits [6:7] contain the number of additional bytes
* used to encode the package length, either 0,1,2, or 3
*/
+
+ /* Check if we have at least one byte to read */
+ remaining = (u32)ACPI_PTR_DIFF(parser_state->aml_end, aml);
+ if (remaining == 0) {
+ return_UINT32(0);
+ }
+
byte_count = (aml[0] >> 6);
+
+ /* Validate byte_count and ensure we have enough bytes to read */
+ if (byte_count >= remaining) {
+
+ /* Clamp to available bytes and advance to end */
+ parser_state->aml = parser_state->aml_end;
+ return_UINT32(0);
+ }
+
parser_state->aml += ((acpi_size)byte_count + 1);
/* Get bytes 3, 2, 1 as needed */
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 104/982] ACPICA: Prevent adding invalid references
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2026-09-30 15:13 ` [PATCH 6.1 103/982] ACPICA: validate byte_count in acpi_ps_get_next_package_length() Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 105/982] ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) Greg Kroah-Hartman
` (884 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, ikaros, Rafael J. Wysocki,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: ikaros <void0red@gmail.com>
[ Upstream commit 6e8c55e13a5e3a9f38921d62924f18ceba3330eb ]
Prevent adding references for local, argument, and debug objects
in acpi_ut_copy_simple_object().
Link: https://github.com/acpica/acpica/commit/f576898d7814
Signed-off-by: ikaros <void0red@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/4511989.ejJDZkT8p0@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/acpica/utcopy.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/acpi/acpica/utcopy.c b/drivers/acpi/acpica/utcopy.c
index 63c17f420fb86..9672a776513c2 100644
--- a/drivers/acpi/acpica/utcopy.c
+++ b/drivers/acpi/acpica/utcopy.c
@@ -731,7 +731,15 @@ acpi_ut_copy_simple_object(union acpi_operand_object *source_desc,
break;
}
- acpi_ut_add_reference(source_desc->reference.object);
+ /*
+ * Local/Arg/Debug references do not have a valid Object pointer
+ * that can be referenced
+ */
+ if ((source_desc->reference.class != ACPI_REFCLASS_LOCAL) &&
+ (source_desc->reference.class != ACPI_REFCLASS_ARG) &&
+ (source_desc->reference.class != ACPI_REFCLASS_DEBUG)) {
+ acpi_ut_add_reference(source_desc->reference.object);
+ }
break;
case ACPI_TYPE_REGION:
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 105/982] ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op)
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 104/982] ACPICA: Prevent adding invalid references Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 106/982] ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() Greg Kroah-Hartman
` (883 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, ikaros, Rafael J. Wysocki,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: ikaros <void0red@gmail.com>
[ Upstream commit 0e2021f49e64b3c8a9aa880d0c62a218bfe147ce ]
Add overflow check for Index + Length to prevent integer overflow
when calculating the truncation length. This prevents negative
size parameter being passed to memcpy().
Link: https://github.com/acpica/acpica/commit/d281ec1ac84e
Signed-off-by: ikaros <void0red@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/3760974.R56niFO833@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/acpica/exoparg3.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/acpi/acpica/exoparg3.c b/drivers/acpi/acpica/exoparg3.c
index 198da79c0cd48..ecb5bc536feeb 100644
--- a/drivers/acpi/acpica/exoparg3.c
+++ b/drivers/acpi/acpica/exoparg3.c
@@ -152,7 +152,7 @@ acpi_status acpi_ex_opcode_3A_1T_1R(struct acpi_walk_state *walk_state)
/* Truncate request if larger than the actual String/Buffer */
- else if ((index + length) > operand[0]->string.length) {
+ else if ((index + length) > operand[0]->string.length || (index + length) < index) { /* Check for overflow */
length =
(acpi_size)operand[0]->string.length -
(acpi_size)index;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 106/982] ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg()
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 105/982] ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 107/982] ACPICA: validate handler object type in two places Greg Kroah-Hartman
` (882 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, ikaros, Rafael J. Wysocki,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: ikaros <void0red@gmail.com>
[ Upstream commit 27d27e75ecb752a0b4da848c440bb3a88396ecba ]
Improve argument parsing in acpi_ps_get_next_simple_arg() to handle
remaining AML data safely.
Link: https://github.com/acpica/acpica/commit/ecbb8bcfe301
Signed-off-by: ikaros <void0red@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/2008043.taCxCBeP46@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/acpica/psargs.c | 78 +++++++++++++++++++++++++++++++-----
1 file changed, 68 insertions(+), 10 deletions(-)
diff --git a/drivers/acpi/acpica/psargs.c b/drivers/acpi/acpica/psargs.c
index cc27f7888bdca..1a52bc08db4ce 100644
--- a/drivers/acpi/acpica/psargs.c
+++ b/drivers/acpi/acpica/psargs.c
@@ -384,6 +384,8 @@ acpi_ps_get_next_simple_arg(struct acpi_parse_state *parser_state,
u32 length;
u16 opcode;
u8 *aml = parser_state->aml;
+ u32 remaining = (u32)ACPI_PTR_DIFF(parser_state->aml_end, aml);
+ u64 partial_value;
ACPI_FUNCTION_TRACE_U32(ps_get_next_simple_arg, arg_type);
@@ -393,8 +395,13 @@ acpi_ps_get_next_simple_arg(struct acpi_parse_state *parser_state,
/* Get 1 byte from the AML stream */
opcode = AML_BYTE_OP;
- arg->common.value.integer = (u64) *aml;
- length = 1;
+ if (remaining >= 1) {
+ arg->common.value.integer = (u64)*aml;
+ length = 1;
+ } else {
+ arg->common.value.integer = 0;
+ length = 0;
+ }
break;
case ARGP_WORDDATA:
@@ -402,8 +409,19 @@ acpi_ps_get_next_simple_arg(struct acpi_parse_state *parser_state,
/* Get 2 bytes from the AML stream */
opcode = AML_WORD_OP;
- ACPI_MOVE_16_TO_64(&arg->common.value.integer, aml);
- length = 2;
+ if (remaining >= 2) {
+ ACPI_MOVE_16_TO_64(&arg->common.value.integer, aml);
+ length = 2;
+ } else {
+ arg->common.value.integer = 0;
+ length = 0;
+ if (remaining > 0) {
+ partial_value = 0;
+ memcpy(&partial_value, aml, remaining);
+ arg->common.value.integer = partial_value;
+ length = remaining;
+ }
+ }
break;
case ARGP_DWORDDATA:
@@ -411,8 +429,19 @@ acpi_ps_get_next_simple_arg(struct acpi_parse_state *parser_state,
/* Get 4 bytes from the AML stream */
opcode = AML_DWORD_OP;
- ACPI_MOVE_32_TO_64(&arg->common.value.integer, aml);
- length = 4;
+ if (remaining >= 4) {
+ ACPI_MOVE_32_TO_64(&arg->common.value.integer, aml);
+ length = 4;
+ } else {
+ arg->common.value.integer = 0;
+ length = 0;
+ if (remaining > 0) {
+ partial_value = 0;
+ memcpy(&partial_value, aml, remaining);
+ arg->common.value.integer = partial_value;
+ length = remaining;
+ }
+ }
break;
case ARGP_QWORDDATA:
@@ -420,8 +449,19 @@ acpi_ps_get_next_simple_arg(struct acpi_parse_state *parser_state,
/* Get 8 bytes from the AML stream */
opcode = AML_QWORD_OP;
- ACPI_MOVE_64_TO_64(&arg->common.value.integer, aml);
- length = 8;
+ if (remaining >= 8) {
+ ACPI_MOVE_64_TO_64(&arg->common.value.integer, aml);
+ length = 8;
+ } else {
+ arg->common.value.integer = 0;
+ length = 0;
+ if (remaining > 0) {
+ partial_value = 0;
+ memcpy(&partial_value, aml, remaining);
+ arg->common.value.integer = partial_value;
+ length = remaining;
+ }
+ }
break;
case ARGP_CHARLIST:
@@ -434,10 +474,28 @@ acpi_ps_get_next_simple_arg(struct acpi_parse_state *parser_state,
/* Find the null terminator */
length = 0;
- while (aml[length]) {
+ while ((length < remaining) && aml[length]) {
+ length++;
+ }
+ if (length < remaining) {
+
+ /* Account for the terminating null */
length++;
+ } else {
+ /*
+ * No terminator found - add null at buffer boundary
+ * and report a warning
+ */
+ ACPI_WARNING((AE_INFO,
+ "Invalid AML string: no null terminator, truncating at offset %u",
+ (u32)(aml - parser_state->aml)));
+
+ /* Add null terminator at the boundary */
+ if (remaining > 0) {
+ aml[remaining - 1] = 0;
+ length = remaining;
+ }
}
- length++;
break;
case ARGP_NAME:
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 107/982] ACPICA: validate handler object type in two places
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 106/982] ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 108/982] ACPICA: Add package limit checks in parser functions Greg Kroah-Hartman
` (881 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, ikaros, Rafael J. Wysocki,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: ikaros <void0red@gmail.com>
[ Upstream commit c5296da2d516707862f8a2dbb4b515f777e5294f ]
ACPICA: validate handler object type in acpi_ev_has_default_handler()
and acpi_ev_find_region_handler().
Link: https://github.com/acpica/acpica/commit/f6fc648a1389
Signed-off-by: ikaros <void0red@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/48111441.fMDQidcC6G@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/acpica/evhandler.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/drivers/acpi/acpica/evhandler.c b/drivers/acpi/acpica/evhandler.c
index be9a05498adc3..6f16e863a60f3 100644
--- a/drivers/acpi/acpica/evhandler.c
+++ b/drivers/acpi/acpica/evhandler.c
@@ -130,6 +130,14 @@ acpi_ev_has_default_handler(struct acpi_namespace_node *node,
/* Walk the linked list of handlers for this object */
while (handler_obj) {
+
+ /* Validate handler object type before accessing fields */
+
+ if (handler_obj->common.type !=
+ ACPI_TYPE_LOCAL_ADDRESS_HANDLER) {
+ break;
+ }
+
if (handler_obj->address_space.space_id == space_id) {
if (handler_obj->address_space.handler_flags &
ACPI_ADDR_HANDLER_DEFAULT_INSTALLED) {
@@ -292,6 +300,9 @@ union acpi_operand_object *acpi_ev_find_region_handler(acpi_adr_space_type
/* Walk the handler list for this device */
while (handler_obj) {
+ if (handler_obj->common.type != ACPI_TYPE_LOCAL_ADDRESS_HANDLER) {
+ break;
+ }
/* Same space_id indicates a handler is installed */
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 108/982] ACPICA: Add package limit checks in parser functions
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 107/982] ACPICA: validate handler object type in two places Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 109/982] ACPICA: Add validation for node in acpi_ns_build_normalized_path() Greg Kroah-Hartman
` (880 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, ikaros, Rafael J. Wysocki,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: ikaros <void0red@gmail.com>
[ Upstream commit d27d48a528e437aed690f977e69a6fe73fe82ab5 ]
Add package limit checks in parser functions to prevent out-of-bounds
access.
Link: https://github.com/acpica/acpica/commit/b31b45af2122
Signed-off-by: ikaros <void0red@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/3212937.CbtlEUcBR6@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/acpica/nsxfname.c | 4 ++++
drivers/acpi/acpica/psargs.c | 4 ++++
drivers/acpi/acpica/psloop.c | 25 +++++++++++++++++++++++++
drivers/acpi/acpica/psparse.c | 8 ++++++++
4 files changed, 41 insertions(+)
diff --git a/drivers/acpi/acpica/nsxfname.c b/drivers/acpi/acpica/nsxfname.c
index b2cfdfef31947..8079364e2440e 100644
--- a/drivers/acpi/acpica/nsxfname.c
+++ b/drivers/acpi/acpica/nsxfname.c
@@ -512,6 +512,10 @@ acpi_status acpi_install_method(u8 *buffer)
parser_state.aml += acpi_ps_get_opcode_size(opcode);
parser_state.pkg_end = acpi_ps_get_next_package_end(&parser_state);
+ if ((parser_state.pkg_end > parser_state.aml_end) ||
+ (parser_state.pkg_end < parser_state.aml)) {
+ return (AE_AML_PACKAGE_LIMIT);
+ }
path = acpi_ps_get_next_namestring(&parser_state);
method_flags = *parser_state.aml++;
diff --git a/drivers/acpi/acpica/psargs.c b/drivers/acpi/acpica/psargs.c
index 1a52bc08db4ce..35166be684880 100644
--- a/drivers/acpi/acpica/psargs.c
+++ b/drivers/acpi/acpica/psargs.c
@@ -867,6 +867,10 @@ acpi_ps_get_next_arg(struct acpi_walk_state *walk_state,
parser_state->pkg_end =
acpi_ps_get_next_package_end(parser_state);
+ if ((parser_state->pkg_end > parser_state->aml_end)
+ || (parser_state->pkg_end < parser_state->aml)) {
+ return_ACPI_STATUS(AE_AML_PACKAGE_LIMIT);
+ }
break;
case ARGP_FIELDLIST:
diff --git a/drivers/acpi/acpica/psloop.c b/drivers/acpi/acpica/psloop.c
index e851c7fe31906..60c55743d399e 100644
--- a/drivers/acpi/acpica/psloop.c
+++ b/drivers/acpi/acpica/psloop.c
@@ -361,6 +361,13 @@ acpi_status acpi_ps_parse_loop(struct acpi_walk_state *walk_state)
walk_state->parser_state.aml =
acpi_ps_get_next_package_end
(&walk_state->parser_state);
+ if ((walk_state->parser_state.aml >
+ walk_state->parser_state.aml_end)
+ || (walk_state->parser_state.aml <
+ walk_state->aml)) {
+ return_ACPI_STATUS
+ (AE_AML_PACKAGE_LIMIT);
+ }
walk_state->aml =
walk_state->parser_state.aml;
}
@@ -421,6 +428,14 @@ acpi_status acpi_ps_parse_loop(struct acpi_walk_state *walk_state)
parser_state->aml =
acpi_ps_get_next_package_end
(parser_state);
+ if ((parser_state->aml >
+ parser_state->aml_end)
+ || (parser_state->aml <
+ walk_state->control_state->
+ control.aml_predicate_start)) {
+ return_ACPI_STATUS
+ (AE_AML_PACKAGE_LIMIT);
+ }
walk_state->aml = parser_state->aml;
ACPI_ERROR((AE_INFO,
@@ -436,6 +451,16 @@ acpi_status acpi_ps_parse_loop(struct acpi_walk_state *walk_state)
walk_state->parser_state.aml =
acpi_ps_get_next_package_end
(parser_state);
+ if ((walk_state->parser_state.
+ aml >
+ walk_state->parser_state.
+ aml_end)
+ || (walk_state->
+ parser_state.aml <
+ walk_state->aml)) {
+ return_ACPI_STATUS
+ (AE_AML_PACKAGE_LIMIT);
+ }
walk_state->aml =
parser_state->aml;
}
diff --git a/drivers/acpi/acpica/psparse.c b/drivers/acpi/acpica/psparse.c
index ba93f359760a9..a4eb254c62ea5 100644
--- a/drivers/acpi/acpica/psparse.c
+++ b/drivers/acpi/acpica/psparse.c
@@ -300,6 +300,7 @@ acpi_ps_next_parse_state(struct acpi_walk_state *walk_state,
{
struct acpi_parse_state *parser_state = &walk_state->parser_state;
acpi_status status = AE_CTRL_PENDING;
+ u8 *aml;
ACPI_FUNCTION_TRACE_PTR(ps_next_parse_state, op);
@@ -344,7 +345,14 @@ acpi_ps_next_parse_state(struct acpi_walk_state *walk_state,
* Predicate of an IF was true, and we are at the matching ELSE.
* Just close out this package
*/
+ aml = parser_state->aml;
+
parser_state->aml = acpi_ps_get_next_package_end(parser_state);
+ if ((parser_state->aml > parser_state->aml_end) ||
+ (parser_state->aml < aml)) {
+ status = AE_AML_PACKAGE_LIMIT;
+ break;
+ }
status = AE_CTRL_PENDING;
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 109/982] ACPICA: Add validation for node in acpi_ns_build_normalized_path()
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 108/982] ACPICA: Add package limit checks in parser functions Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 110/982] ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() Greg Kroah-Hartman
` (879 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, ikaros, Rafael J. Wysocki,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: ikaros <void0red@gmail.com>
[ Upstream commit 96b2b616870e46e2bc04efec03879683a0036e66 ]
Add validation for node in acpi_ns_build_normalized_path()
to prevent use-after-free vulnerabilities.
Link: https://github.com/acpica/acpica/commit/b35adf49e89a
Signed-off-by: ikaros <void0red@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/118666237.nniJfEyVGO@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/acpica/nsnames.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/acpi/acpica/nsnames.c b/drivers/acpi/acpica/nsnames.c
index d91153f657005..ab6d217d31db4 100644
--- a/drivers/acpi/acpica/nsnames.c
+++ b/drivers/acpi/acpica/nsnames.c
@@ -222,6 +222,12 @@ acpi_ns_build_normalized_path(struct acpi_namespace_node *node,
goto build_trailing_null;
}
+ /* Validate the Node to avoid use-after-free vulnerabilities */
+
+ if (ACPI_GET_DESCRIPTOR_TYPE(node) != ACPI_DESC_TYPE_NAMED) {
+ goto build_trailing_null;
+ }
+
next_node = node;
while (next_node && next_node != acpi_gbl_root_node) {
if (next_node != node) {
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 110/982] ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op()
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 109/982] ACPICA: Add validation for node in acpi_ns_build_normalized_path() Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 111/982] ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() Greg Kroah-Hartman
` (878 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, ikaros, Rafael J. Wysocki,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: ikaros <void0red@gmail.com>
[ Upstream commit 485829e6999b7909f50761a1c708660304edc945 ]
Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() to
prevent buffer overflows.
Link: https://github.com/acpica/acpica/commit/f85a43098d65
Signed-off-by: ikaros <void0red@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/2230782.OBFZWjSADL@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/acpica/exconfig.c | 26 ++++++++++++++++++++++++--
1 file changed, 24 insertions(+), 2 deletions(-)
diff --git a/drivers/acpi/acpica/exconfig.c b/drivers/acpi/acpica/exconfig.c
index d7d74ef87b186..06f897bec4f14 100644
--- a/drivers/acpi/acpica/exconfig.c
+++ b/drivers/acpi/acpica/exconfig.c
@@ -90,6 +90,8 @@ acpi_ex_load_table_op(struct acpi_walk_state *walk_state,
union acpi_operand_object *return_obj;
union acpi_operand_object *ddb_handle;
u32 table_index;
+ char oem_id[ACPI_OEM_ID_SIZE + 1];
+ char oem_table_id[ACPI_OEM_TABLE_ID_SIZE + 1];
ACPI_FUNCTION_TRACE(ex_load_table_op);
@@ -102,12 +104,32 @@ acpi_ex_load_table_op(struct acpi_walk_state *walk_state,
*return_desc = return_obj;
+ /*
+ * Validate OEM ID and OEM Table ID string lengths.
+ * acpi_tb_find_table expects strings that can safely read
+ * ACPI_OEM_ID_SIZE and ACPI_OEM_TABLE_ID_SIZE bytes.
+ */
+ if ((operand[1]->string.length > ACPI_OEM_ID_SIZE) ||
+ (operand[2]->string.length > ACPI_OEM_TABLE_ID_SIZE)) {
+ return_ACPI_STATUS(AE_AML_STRING_LIMIT);
+ }
+
+ /*
+ * Copy OEM strings to local buffers with guaranteed null-termination.
+ * This prevents heap-buffer-overflow when acpi_tb_find_table reads
+ * ACPI_OEM_ID_SIZE/ACPI_OEM_TABLE_ID_SIZE bytes.
+ */
+ memcpy(oem_id, operand[1]->string.pointer, operand[1]->string.length);
+ oem_id[operand[1]->string.length] = 0;
+ memcpy(oem_table_id, operand[2]->string.pointer,
+ operand[2]->string.length);
+ oem_table_id[operand[2]->string.length] = 0;
+
/* Find the ACPI table in the RSDT/XSDT */
acpi_ex_exit_interpreter();
status = acpi_tb_find_table(operand[0]->string.pointer,
- operand[1]->string.pointer,
- operand[2]->string.pointer, &table_index);
+ oem_id, oem_table_id, &table_index);
acpi_ex_enter_interpreter();
if (ACPI_FAILURE(status)) {
if (status != AE_NOT_FOUND) {
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 111/982] ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package()
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 110/982] ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 112/982] ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() Greg Kroah-Hartman
` (877 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiang Mei, Weiming Shi,
Rafael J. Wysocki, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <bestswngs@gmail.com>
[ Upstream commit f8d14b7bb0063bbbd86c0e4d73edb8cea7b362bc ]
acpi_ns_custom_package() unconditionally dereferences the first element
of the package to read the _BIX version number, without checking for
NULL:
if ((*Elements)->Common.Type != ACPI_TYPE_INTEGER)
When firmware returns a _BIX package whose first element is an
unresolvable reference, ACPICA evaluates that entry to NULL.
acpi_ns_remove_null_elements() does not strip NULL entries for
ACPI_PTYPE_CUSTOM packages (fixed-position format would break if
elements were shifted), so acpi_ns_custom_package() sees the NULL
and causes a crash.
Add a NULL check for the first element (version field) before
dereferencing it. The caller then receives AE_AML_OPERAND_TYPE
instead of crashing.
Link: https://github.com/acpica/acpica/commit/f3f111b9013b
Reported-by: Xiang Mei <xmei5@asu.edu>
Reported-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/5674388.Sb9uPGUboI@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/acpica/nsprepkg.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/acpi/acpica/nsprepkg.c b/drivers/acpi/acpica/nsprepkg.c
index 82932c9a774b4..887eb54942ffc 100644
--- a/drivers/acpi/acpica/nsprepkg.c
+++ b/drivers/acpi/acpica/nsprepkg.c
@@ -631,6 +631,13 @@ acpi_ns_custom_package(struct acpi_evaluate_info *info,
/* Get version number, must be Integer */
+ if (!(*elements)) {
+ ACPI_WARN_PREDEFINED((AE_INFO, info->full_pathname,
+ info->node_flags,
+ "Return Package has a NULL version element"));
+ return_ACPI_STATUS(AE_AML_OPERAND_TYPE);
+ }
+
if ((*elements)->common.type != ACPI_TYPE_INTEGER) {
ACPI_WARN_PREDEFINED((AE_INFO, info->full_pathname,
info->node_flags,
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 112/982] ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources()
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 111/982] ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 113/982] ACPICA: add boundary checks in two places Greg Kroah-Hartman
` (876 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, ikaros, Rafael J. Wysocki,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: ikaros <void0red@gmail.com>
[ Upstream commit b2e21fe8c3361c3d0d57ee56d359bea9b51fda3d ]
Enhance buffer validation in acpi_ut_walk_aml_resources() to prevent
buffer overflows.
Link: https://github.com/acpica/acpica/commit/975cb20c7992
Signed-off-by: ikaros <void0red@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/2481429.NG923GbCHz@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/acpica/utresrc.c | 30 ++++++++++++++++++++++++++++++
1 file changed, 30 insertions(+)
diff --git a/drivers/acpi/acpica/utresrc.c b/drivers/acpi/acpica/utresrc.c
index 16f9a7035b39c..82326d9547873 100644
--- a/drivers/acpi/acpica/utresrc.c
+++ b/drivers/acpi/acpica/utresrc.c
@@ -162,6 +162,28 @@ acpi_ut_walk_aml_resources(struct acpi_walk_state *walk_state,
/* Walk the byte list, abort on any invalid descriptor type or length */
while (aml < end_aml) {
+ /*
+ * Validate that the remaining buffer space can hold enough
+ * bytes to safely access fields during validation.
+ * For large resource descriptors (bit 7 set), we need enough
+ * bytes to access the Type field in serial_bus resources.
+ * Small resource descriptors only need sizeof(struct aml_resource_end_tag).
+ */
+ if ((acpi_size)(end_aml - aml) <
+ sizeof(struct aml_resource_end_tag)) {
+ return_ACPI_STATUS(AE_AML_BUFFER_LENGTH);
+ }
+
+ /*
+ * For large resource descriptors, ensure enough space for
+ * the header plus serial_bus Type field access.
+ */
+ if ((ACPI_GET8(aml) & ACPI_RESOURCE_NAME_LARGE) &&
+ ((acpi_size)(end_aml - aml) <
+ ACPI_OFFSET(struct aml_resource_common_serialbus,
+ type) + 1)) {
+ return_ACPI_STATUS(AE_AML_BUFFER_LENGTH);
+ }
/* Validate the Resource Type and Resource Length */
@@ -179,6 +201,14 @@ acpi_ut_walk_aml_resources(struct acpi_walk_state *walk_state,
length = acpi_ut_get_descriptor_length(aml);
+ /*
+ * Validate that the descriptor length doesn't exceed the
+ * remaining buffer size to prevent reading beyond the end.
+ */
+ if (length > (acpi_size)(end_aml - aml)) {
+ return_ACPI_STATUS(AE_AML_BUFFER_LENGTH);
+ }
+
/* Invoke the user function */
if (user_function) {
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 113/982] ACPICA: add boundary checks in two places
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 112/982] ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 114/982] hfs: rework hfsplus_readdir() logic Greg Kroah-Hartman
` (875 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, ikaros, Rafael J. Wysocki,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: ikaros <void0red@gmail.com>
[ Upstream commit bdc35754012906dbf094be104b103ca3adfef6f7 ]
Add boundary checks in acpi_ps_get_next_namestring() and
acpi_ps_peek_opcode() to prevent out-of-bounds access.
Link: https://github.com/acpica/acpica/commit/cfdc96896d8d
Signed-off-by: ikaros <void0red@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/5180044.0VBMTVartN@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/acpica/psargs.c | 18 +++++++++++++++++-
drivers/acpi/acpica/psparse.c | 6 ++++++
2 files changed, 23 insertions(+), 1 deletion(-)
diff --git a/drivers/acpi/acpica/psargs.c b/drivers/acpi/acpica/psargs.c
index 35166be684880..1d206670a9786 100644
--- a/drivers/acpi/acpica/psargs.c
+++ b/drivers/acpi/acpica/psargs.c
@@ -148,10 +148,16 @@ char *acpi_ps_get_next_namestring(struct acpi_parse_state *parser_state)
/* Point past any namestring prefix characters (backslash or carat) */
- while (ACPI_IS_ROOT_PREFIX(*end) || ACPI_IS_PARENT_PREFIX(*end)) {
+ while (end < parser_state->aml_end &&
+ (ACPI_IS_ROOT_PREFIX(*end) || ACPI_IS_PARENT_PREFIX(*end))) {
end++;
}
+ if (end >= parser_state->aml_end) {
+ parser_state->aml = parser_state->aml_end;
+ return_PTR(NULL);
+ }
+
/* Decode the path prefix character */
switch (*end) {
@@ -176,6 +182,11 @@ char *acpi_ps_get_next_namestring(struct acpi_parse_state *parser_state)
/* Multiple name segments, 4 chars each, count in next byte */
+ if ((end + 1) >= parser_state->aml_end) {
+ parser_state->aml = parser_state->aml_end;
+ return_PTR(NULL);
+ }
+
end += 2 + (*(end + 1) * ACPI_NAMESEG_SIZE);
break;
@@ -187,6 +198,11 @@ char *acpi_ps_get_next_namestring(struct acpi_parse_state *parser_state)
break;
}
+ if (end > parser_state->aml_end) {
+ parser_state->aml = parser_state->aml_end;
+ return_PTR(NULL);
+ }
+
parser_state->aml = end;
return_PTR((char *)start);
}
diff --git a/drivers/acpi/acpica/psparse.c b/drivers/acpi/acpica/psparse.c
index a4eb254c62ea5..fc5a18cf0c610 100644
--- a/drivers/acpi/acpica/psparse.c
+++ b/drivers/acpi/acpica/psparse.c
@@ -70,6 +70,9 @@ u16 acpi_ps_peek_opcode(struct acpi_parse_state * parser_state)
u16 opcode;
aml = parser_state->aml;
+ if (aml >= parser_state->aml_end) {
+ return (0xFFFF);
+ }
opcode = (u16) ACPI_GET8(aml);
if (opcode == AML_EXTENDED_PREFIX) {
@@ -77,6 +80,9 @@ u16 acpi_ps_peek_opcode(struct acpi_parse_state * parser_state)
/* Extended opcode, get the second opcode byte */
aml++;
+ if (aml >= parser_state->aml_end) {
+ return (0xFFFF);
+ }
opcode = (u16) ((opcode << 8) | ACPI_GET8(aml));
}
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 114/982] hfs: rework hfsplus_readdir() logic
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 113/982] ACPICA: add boundary checks in two places Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 115/982] pinctrl: renesas: rzv2m: Use -ENOTSUPP instead of -EOPNOTSUPP Greg Kroah-Hartman
` (874 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, John Paul Adrian Glaubitz,
Yangtao Li, linux-fsdevel, Viacheslav Dubeyko, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <slava@dubeyko.com>
[ Upstream commit 7fde7e806657fbe0d33f489521b488eed94f9b39 ]
The xfstests' test-case generic/637 fails with error:
FSTYP -- hfs
PLATFORM -- Linux/x86_64 kvm-xfstests 6.15.0-rc4-xfstests-g00b827f0cffa #1 SMP PREEMPT_DYNAMIC Fri May 25
MKFS_OPTIONS -- /dev/vdc
MOUNT_OPTIONS -- /dev/vdc /vdc
QA output created by 637
entries 7 and 8 have duplicate d_off 8
Found unlinked files in open dir (see xfstests-dev/results//generic/637.full for details)
Likewise HFS+, currently, HFS has very complicated and
fragile logic of rd->file->f_pos correction in hfs_delete_cat().
This patch removes this logic and it stores the current
pos into hfs_readdir_data. Finally, if rd->pos == ctx->pos
then hfs_readdir() tries to find the position in
b-tree's node by means of hfs_cat_key. This position is
used to re-start the folder's content traversal.
sudo ./check generic/637
FSTYP -- hfs
PLATFORM -- Linux/x86_64 hfsplus-testing-0001 7.1.0-rc1+ #55 SMP PREEMPT_DYNAMIC Tue May 19 15:18:02 PDT 2026
MKFS_OPTIONS -- /dev/loop51
MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
generic/637 32s ... 31s
Ran: generic/637
Passed all 1 tests
Closes: https://github.com/hfs-linux-kernel/hfs-linux-kernel/issues/65
cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
cc: Yangtao Li <frank.li@vivo.com>
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Link: https://lore.kernel.org/r/20260519222811.1311071-2-slava@dubeyko.com
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/hfs/catalog.c | 9 ---------
fs/hfs/dir.c | 28 +++++++++++-----------------
fs/hfs/hfs.h | 3 +--
fs/hfs/hfs_fs.h | 2 --
fs/hfs/inode.c | 4 ----
5 files changed, 12 insertions(+), 34 deletions(-)
diff --git a/fs/hfs/catalog.c b/fs/hfs/catalog.c
index d365bf0b8c77d..41e09f209f745 100644
--- a/fs/hfs/catalog.c
+++ b/fs/hfs/catalog.c
@@ -222,7 +222,6 @@ int hfs_cat_delete(u32 cnid, struct inode *dir, const struct qstr *str)
{
struct super_block *sb;
struct hfs_find_data fd;
- struct hfs_readdir_data *rd;
int res, type;
hfs_dbg(CAT_MOD, "delete_cat: %s,%u\n", str ? str->name : NULL, cnid);
@@ -248,14 +247,6 @@ int hfs_cat_delete(u32 cnid, struct inode *dir, const struct qstr *str)
}
}
- /* we only need to take spinlock for exclusion with ->release() */
- spin_lock(&HFS_I(dir)->open_dir_lock);
- list_for_each_entry(rd, &HFS_I(dir)->open_dir_list, list) {
- if (fd.tree->keycmp(fd.search_key, (void *)&rd->key) < 0)
- rd->file->f_pos--;
- }
- spin_unlock(&HFS_I(dir)->open_dir_lock);
-
res = hfs_brec_remove(&fd);
if (res)
goto out;
diff --git a/fs/hfs/dir.c b/fs/hfs/dir.c
index 527f6e46cbe81..f392aee79f422 100644
--- a/fs/hfs/dir.c
+++ b/fs/hfs/dir.c
@@ -97,7 +97,15 @@ static int hfs_readdir(struct file *file, struct dir_context *ctx)
}
if (ctx->pos >= inode->i_size)
goto out;
- err = hfs_brec_goto(&fd, ctx->pos - 1);
+ rd = file->private_data;
+ if (rd && rd->pos == ctx->pos) {
+ memcpy(fd.search_key, &rd->key, sizeof(struct hfs_cat_key));
+ err = hfs_brec_find(&fd);
+ if (err == -ENOENT)
+ err = hfs_brec_goto(&fd, 1);
+ } else {
+ err = hfs_brec_goto(&fd, ctx->pos - 1);
+ }
if (err)
goto out;
@@ -146,7 +154,6 @@ static int hfs_readdir(struct file *file, struct dir_context *ctx)
if (err)
goto out;
}
- rd = file->private_data;
if (!rd) {
rd = kmalloc(sizeof(struct hfs_readdir_data), GFP_KERNEL);
if (!rd) {
@@ -154,15 +161,8 @@ static int hfs_readdir(struct file *file, struct dir_context *ctx)
goto out;
}
file->private_data = rd;
- rd->file = file;
- spin_lock(&HFS_I(inode)->open_dir_lock);
- list_add(&rd->list, &HFS_I(inode)->open_dir_list);
- spin_unlock(&HFS_I(inode)->open_dir_lock);
}
- /*
- * Can be done after the list insertion; exclusion with
- * hfs_delete_cat() is provided by directory lock.
- */
+ rd->pos = ctx->pos;
memcpy(&rd->key, &fd.key->cat, sizeof(struct hfs_cat_key));
out:
hfs_find_exit(&fd);
@@ -171,13 +171,7 @@ static int hfs_readdir(struct file *file, struct dir_context *ctx)
static int hfs_dir_release(struct inode *inode, struct file *file)
{
- struct hfs_readdir_data *rd = file->private_data;
- if (rd) {
- spin_lock(&HFS_I(inode)->open_dir_lock);
- list_del(&rd->list);
- spin_unlock(&HFS_I(inode)->open_dir_lock);
- kfree(rd);
- }
+ kfree(file->private_data);
return 0;
}
diff --git a/fs/hfs/hfs.h b/fs/hfs/hfs.h
index 6f194d0768b6f..f46d12ce04a3f 100644
--- a/fs/hfs/hfs.h
+++ b/fs/hfs/hfs.h
@@ -281,8 +281,7 @@ struct hfs_mdb {
/*======== Data structures kept in memory ========*/
struct hfs_readdir_data {
- struct list_head list;
- struct file *file;
+ loff_t pos;
struct hfs_cat_key key;
};
diff --git a/fs/hfs/hfs_fs.h b/fs/hfs/hfs_fs.h
index 1bce2ec271d4d..203757a273ac3 100644
--- a/fs/hfs/hfs_fs.h
+++ b/fs/hfs/hfs_fs.h
@@ -68,8 +68,6 @@ struct hfs_inode_info {
struct hfs_cat_key cat_key;
- struct list_head open_dir_list;
- spinlock_t open_dir_lock;
struct inode *rsrc_inode;
struct mutex extents_lock;
diff --git a/fs/hfs/inode.c b/fs/hfs/inode.c
index e45cc396dc004..e4530fdd93de0 100644
--- a/fs/hfs/inode.c
+++ b/fs/hfs/inode.c
@@ -193,8 +193,6 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
return NULL;
mutex_init(&HFS_I(inode)->extents_lock);
- INIT_LIST_HEAD(&HFS_I(inode)->open_dir_list);
- spin_lock_init(&HFS_I(inode)->open_dir_lock);
hfs_cat_build_key(sb, (btree_key *)&HFS_I(inode)->cat_key, dir->i_ino, name);
inode->i_ino = HFS_SB(sb)->next_id++;
inode->i_mode = mode;
@@ -328,8 +326,6 @@ static int hfs_read_inode(struct inode *inode, void *data)
HFS_I(inode)->flags = 0;
HFS_I(inode)->rsrc_inode = NULL;
mutex_init(&HFS_I(inode)->extents_lock);
- INIT_LIST_HEAD(&HFS_I(inode)->open_dir_list);
- spin_lock_init(&HFS_I(inode)->open_dir_lock);
/* Initialize the inode */
inode->i_uid = hsb->s_uid;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 115/982] pinctrl: renesas: rzv2m: Use -ENOTSUPP instead of -EOPNOTSUPP
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 114/982] hfs: rework hfsplus_readdir() logic Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 116/982] host1x: bus: Fix missing ops null check in error teardown Greg Kroah-Hartman
` (873 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, Claudiu Beznea,
Geert Uytterhoeven, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
[ Upstream commit 01f94d53947df35ba77cdb3992a4e3ef9d9dc1ad ]
The pinctrl and GPIO core code make exceptions for the -ENOTSUPP error
code. One such example is gpio_set_config_with_argument_optional(), which
returns success when gpio_set_config_with_argument() returns -ENOTSUPP, but
reports failure for all other error codes.
Returning -EOPNOTSUPP from the pinctrl driver on the unsupported pinctrl
operation may lead to boot failures when pinctrl drivers implements
struct gpio_chip::set_config, the system uses GPIO hogs, and the
struct gpio_chip::set_config implementation returns -EOPNOTSUPP for the
unsupported operations.
Currently, the driver does not implement struct gpio_chip::set_config().
To avoid future failures, return -ENOTSUPP from
rzv2m_pinctrl_pinconf_set().
rzv2m_pinctrl_pinconf_group_get() is used when dumping pinctrl
configuration. pinconf_generic_dump_one(), which calls it, makes
exceptions for the -EINVAL and -ENOTSUPP error codes. The documentation
for struct pinconf_ops::pin_config_group_get states that it "should
return -ENOTSUPP and -EINVAL using the same rules as pin_config_get()".
The documentation for struct pinconf_ops::pin_config_get states:
"get the config of a certain pin, if the requested config is not available
on this controller this should return -ENOTSUPP and if it is available but
disabled it should return -EINVAL".
Return -ENOTSUPP for the unsupported pinctrl operation.
Suggested-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20260522105717.1727837-1-claudiu.beznea@kernel.org
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/renesas/pinctrl-rzv2m.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/pinctrl/renesas/pinctrl-rzv2m.c b/drivers/pinctrl/renesas/pinctrl-rzv2m.c
index dc4299c03b990..2ac91512f0c61 100644
--- a/drivers/pinctrl/renesas/pinctrl-rzv2m.c
+++ b/drivers/pinctrl/renesas/pinctrl-rzv2m.c
@@ -664,7 +664,7 @@ static int rzv2m_pinctrl_pinconf_set(struct pinctrl_dev *pctldev,
}
default:
- return -EOPNOTSUPP;
+ return -ENOTSUPP;
}
}
@@ -713,7 +713,7 @@ static int rzv2m_pinctrl_pinconf_group_get(struct pinctrl_dev *pctldev,
/* Check config matches previous pins */
if (i && prev_config != *config)
- return -EOPNOTSUPP;
+ return -ENOTSUPP;
prev_config = *config;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 116/982] host1x: bus: Fix missing ops null check in error teardown
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 115/982] pinctrl: renesas: rzv2m: Use -ENOTSUPP instead of -EOPNOTSUPP Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 117/982] scripts: modpost: detect and report truncated buf_printf() output Greg Kroah-Hartman
` (872 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, shayderrr, Thierry Reding,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: shayderrr <darknessshayder@gmail.com>
[ Upstream commit 71d25f668bc5c0f36ea843462e12307dea45aaa3 ]
In host1x_device_init(), the error teardown paths do not check
client->ops before dereferencing it, unlike the forward init paths
which correctly guard with 'client->ops &&'. This can result in a
NULL pointer dereference if client->ops is NULL.
Fix by adding the missing client->ops check in both the teardown
and teardown_late labels.
Signed-off-by: shayderrr <darknessshayder@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://patch.msgid.link/20260517170456.84927-1-darknessshayder@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/host1x/bus.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/host1x/bus.c b/drivers/gpu/host1x/bus.c
index 8c819af1bce69..751ef2f3342cd 100644
--- a/drivers/gpu/host1x/bus.c
+++ b/drivers/gpu/host1x/bus.c
@@ -226,7 +226,7 @@ int host1x_device_init(struct host1x_device *device)
teardown:
list_for_each_entry_continue_reverse(client, &device->clients, list)
- if (client->ops->exit)
+ if (client->ops && client->ops->exit)
client->ops->exit(client);
/* reset client to end of list for late teardown */
@@ -234,7 +234,7 @@ int host1x_device_init(struct host1x_device *device)
teardown_late:
list_for_each_entry_continue_reverse(client, &device->clients, list)
- if (client->ops->late_exit)
+ if (client->ops && client->ops->late_exit)
client->ops->late_exit(client);
mutex_unlock(&device->clients_lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 117/982] scripts: modpost: detect and report truncated buf_printf() output
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 116/982] host1x: bus: Fix missing ops null check in error teardown Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 118/982] ASoC: Intel: catpt: Complete coredump handling Greg Kroah-Hartman
` (871 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexandre Courbot, Nathan Chancellor,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandre Courbot <acourbot@nvidia.com>
[ Upstream commit d7231d8cb262b1e350c00271bf53d54414b4f3b1 ]
buf_printf() uses a fixed-size stack buffer. vsnprintf() returns the
number of bytes that *would* have been written to that buffer, which can
be larger than the size of said buffer if the formatted string is too
long.
The problem is that whenever this happens buf_printf() currently passes
this length, unchecked, to buf_write(), which silently reads past the
stack buffer and copies invalid data into the output buffer.
Fix this by detecting vsnprintf() failures and truncations before
appending to the output buffer, and report a fatal error instead of
producing corrupt symbol names.
Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
Link: https://patch.msgid.link/20260527-nova-exports-v2-1-06de4c556d55@nvidia.com
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/mod/modpost.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index b2388814fe976..990e514cd747d 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -1861,8 +1861,17 @@ void __attribute__((format(printf, 2, 3))) buf_printf(struct buffer *buf,
va_start(ap, fmt);
len = vsnprintf(tmp, SZ, fmt, ap);
- buf_write(buf, tmp, len);
va_end(ap);
+
+ if (len < 0) {
+ perror("vsnprintf failed");
+ exit(1);
+ }
+ if (len >= SZ)
+ fatal("buf_printf output truncated for string %s: %d bytes needed, %d available\n",
+ tmp, len + 1, SZ);
+
+ buf_write(buf, tmp, len);
}
void buf_write(struct buffer *buf, const char *s, int len)
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 118/982] ASoC: Intel: catpt: Complete coredump handling
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 117/982] scripts: modpost: detect and report truncated buf_printf() output Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 119/982] libbpf: Add __NR_bpf definition for LoongArch Greg Kroah-Hartman
` (870 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cezary Rojewski, Mark Brown,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cezary Rojewski <cezary.rojewski@intel.com>
[ Upstream commit 7e5d59f407bc39d43b350cc45f7880647429eb5d ]
An exception may occur during the firmware booting procedure. In such
case the firmware sends COREDUMP_REQUESTS and expects the driver to dump
relevant information and finish with the COREDUMP_RELEASE write.
To distinguish such situation from generic timeout, always signal
fw_ready completion when a coredump request is received and translate
it to -EREMOTEIO in catpt_boot_firmware().
The "FW READY" print makes the success clearly visible even when
the event-traces are not enabled.
Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
Link: https://patch.msgid.link/20260528083444.1439233-2-cezary.rojewski@intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/intel/catpt/ipc.c | 8 ++++++++
sound/soc/intel/catpt/loader.c | 3 +++
sound/soc/intel/catpt/registers.h | 12 ++++++++++++
3 files changed, 23 insertions(+)
diff --git a/sound/soc/intel/catpt/ipc.c b/sound/soc/intel/catpt/ipc.c
index 5b718a846fda5..3341a3a190e62 100644
--- a/sound/soc/intel/catpt/ipc.c
+++ b/sound/soc/intel/catpt/ipc.c
@@ -205,6 +205,7 @@ static void catpt_dsp_process_response(struct catpt_dev *cdev, u32 header)
memcpy_fromio(&config, cdev->lpe_ba + off, sizeof(config));
trace_catpt_ipc_payload((u8 *)&config, sizeof(config));
+ dev_dbg(cdev->dev, "FW READY 0x%08x\n", header);
catpt_ipc_arm(ipc, &config);
complete(&cdev->fw_ready);
return;
@@ -215,6 +216,13 @@ static void catpt_dsp_process_response(struct catpt_dev *cdev, u32 header)
dev_err(cdev->dev, "ADSP device coredump received\n");
ipc->ready = false;
catpt_coredump(cdev);
+
+ if (catpt_readl_dram(cdev, COREDUMP) == CATPT_COREDUMP_REQUEST) {
+ dev_dbg(cdev->dev, "releasing firmware from the coredump state\n");
+ catpt_writel_dram(cdev, COREDUMP, CATPT_COREDUMP_RELEASE);
+ }
+
+ complete(&cdev->fw_ready);
/* TODO: attempt recovery */
break;
diff --git a/sound/soc/intel/catpt/loader.c b/sound/soc/intel/catpt/loader.c
index ff7b8f0d34ac7..6602587787cb4 100644
--- a/sound/soc/intel/catpt/loader.c
+++ b/sound/soc/intel/catpt/loader.c
@@ -626,6 +626,9 @@ int catpt_boot_firmware(struct catpt_dev *cdev, bool restore)
if (!ret) {
dev_err(cdev->dev, "firmware ready timeout\n");
return -ETIMEDOUT;
+ /* Wake up does not mean FW is ready, an exception could occur. */
+ } else if (!cdev->ipc.ready) {
+ return -EREMOTEIO;
}
/* update sram pg & clock once done booting */
diff --git a/sound/soc/intel/catpt/registers.h b/sound/soc/intel/catpt/registers.h
index 47280d82842eb..a6da59dff76ef 100644
--- a/sound/soc/intel/catpt/registers.h
+++ b/sound/soc/intel/catpt/registers.h
@@ -124,6 +124,11 @@
#define CATPT_SSCR2_DEFAULT 0x0
#define CATPT_SSPSP2_DEFAULT 0x0
+/* Coredump register and its states */
+#define CATPT_DRAM_COREDUMP 0x1F4
+#define CATPT_COREDUMP_REQUEST UINT_MAX
+#define CATPT_COREDUMP_RELEASE 0
+
/* Physically the same block, access address differs between host and dsp */
#define CATPT_DSP_DRAM_OFFSET 0x400000
#define catpt_to_host_offset(offset) ((offset) & ~(CATPT_DSP_DRAM_OFFSET))
@@ -137,6 +142,8 @@
/* registry I/O helpers */
+#define catpt_dram_addr(cdev) \
+ ((cdev)->lpe_ba + (cdev)->spec->host_dram_offset)
#define catpt_shim_addr(cdev) \
((cdev)->lpe_ba + (cdev)->spec->host_shim_offset)
#define catpt_dma_addr(cdev, dma) \
@@ -151,6 +158,11 @@
#define catpt_writel_ssp(cdev, ssp, reg, val) \
writel(val, catpt_ssp_addr(cdev, ssp) + (reg))
+#define catpt_readl_dram(cdev, reg) \
+ readl(catpt_dram_addr(cdev) + CATPT_DRAM_##reg)
+#define catpt_writel_dram(cdev, reg, val) \
+ writel(val, catpt_dram_addr(cdev) + CATPT_DRAM_##reg)
+
#define catpt_readl_shim(cdev, reg) \
readl(catpt_shim_addr(cdev) + CATPT_SHIM_##reg)
#define catpt_writel_shim(cdev, reg, val) \
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 119/982] libbpf: Add __NR_bpf definition for LoongArch
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 118/982] ASoC: Intel: catpt: Complete coredump handling Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 120/982] soundwire: dmi-quirks: Disable ghost Realtek devices Greg Kroah-Hartman
` (869 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tiezhu Yang, Andrii Nakryiko,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <yangtiezhu@loongson.cn>
[ Upstream commit a4a5d4ee061240a1d39053db0a87f841d43277c0 ]
LoongArch uses the generic syscall table, where __NR_bpf is defined
as 280 in include/uapi/asm-generic/unistd.h.
To align with other architectures, add the __NR_bpf definition for
LoongArch to avoid a potential compilation failure: "error __NR_bpf
not defined. libbpf does not support your arch."
This is a follow up patch of:
commit b0c47807d31d ("bpf: Add sparc support to tools and samples.")
commit bad1926dd2f6 ("bpf, s390: fix build for libbpf and selftest suite")
commit ca31ca8247e2 ("tools/bpf: fix perf build error with uClibc (seen on ARC)")
commit e32cb12ff52a ("bpf, mips: Fix build errors about __NR_bpf undeclared")
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20260526063936.16769-1-yangtiezhu@loongson.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/build/feature/test-bpf.c | 2 ++
tools/lib/bpf/bpf.c | 2 ++
2 files changed, 4 insertions(+)
diff --git a/tools/build/feature/test-bpf.c b/tools/build/feature/test-bpf.c
index 727d22e34a6e5..febc3a93c29fc 100644
--- a/tools/build/feature/test-bpf.c
+++ b/tools/build/feature/test-bpf.c
@@ -20,6 +20,8 @@
# define __NR_bpf 6319
# elif defined(__mips__) && defined(_ABI64)
# define __NR_bpf 5315
+# elif defined(__loongarch__)
+# define __NR_bpf 280
# else
# error __NR_bpf not defined. libbpf does not support your arch.
# endif
diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c
index 1d49a03528365..484d30691a600 100644
--- a/tools/lib/bpf/bpf.c
+++ b/tools/lib/bpf/bpf.c
@@ -59,6 +59,8 @@
# define __NR_bpf 6319
# elif defined(__mips__) && defined(_ABI64)
# define __NR_bpf 5315
+# elif defined(__loongarch__)
+# define __NR_bpf 280
# else
# error __NR_bpf not defined. libbpf does not support your arch.
# endif
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 120/982] soundwire: dmi-quirks: Disable ghost Realtek devices
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 119/982] libbpf: Add __NR_bpf definition for LoongArch Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 121/982] soundwire: only handle alert events when the peripheral is attached Greg Kroah-Hartman
` (868 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Charles Keepax, Pierre-Louis Bossart,
Vinod Koul, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <ckeepax@opensource.cirrus.com>
[ Upstream commit 4dab2b904414fac53535c4e4cdad808132f4cdc2 ]
Many systems ship with a Realtek audio codec in the ACPI that doesn't
physically exist in the system. This confuses the newer function
topology system that creates the soundcard, as it builds the card based
on the ACPI information.
Whilst we are working with the laptop vendors to try and stop this
happening there are quite a few systems where this has shipped. Add a
quirk to disable this "ghost" device.
Currently this patch should cover:
- Asus UX5406AA
- Lenovo Yoga Pro 9i (83SF)
- Lenovo Yoga Slim 7 Ultra (83QK)
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev>
Link: https://patch.msgid.link/20260520163631.3300102-4-ckeepax@opensource.cirrus.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soundwire/dmi-quirks.c | 35 ++++++++++++++++++++++++++++++++++
1 file changed, 35 insertions(+)
diff --git a/drivers/soundwire/dmi-quirks.c b/drivers/soundwire/dmi-quirks.c
index 5854218e1a274..32a46a2d90f7c 100644
--- a/drivers/soundwire/dmi-quirks.c
+++ b/drivers/soundwire/dmi-quirks.c
@@ -90,6 +90,19 @@ static const struct adr_remap intel_rooks_county[] = {
{}
};
+/*
+ * Many platforms have ghost realtek devices in the ACPI that don't physically
+ * exist, remove those devices.
+ */
+static const struct adr_remap ghost_realtek[] = {
+ /* rt722 on link3 */
+ {
+ 0x000330025d072201ull,
+ 0x0000000000000000ull
+ },
+ {}
+};
+
static const struct dmi_system_id adr_remap_quirk_table[] = {
/* TGL devices */
{
@@ -164,6 +177,28 @@ static const struct dmi_system_id adr_remap_quirk_table[] = {
},
.driver_data = (void *)hp_omen_16,
},
+ /* PTL devices */
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUS"),
+ DMI_MATCH(DMI_BOARD_NAME, "UX5406AA"),
+ },
+ .driver_data = (void *)ghost_realtek,
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "83QK"),
+ },
+ .driver_data = (void *)ghost_realtek,
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "83SF"),
+ },
+ .driver_data = (void *)ghost_realtek,
+ },
{}
};
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 121/982] soundwire: only handle alert events when the peripheral is attached
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 120/982] soundwire: dmi-quirks: Disable ghost Realtek devices Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 122/982] mmc: davinci: fix mmc_add_host order in probe Greg Kroah-Hartman
` (867 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bard Liao, Péter Ujfalusi,
Ranjani Sridharan, Pierre-Louis Bossart, Vinod Koul, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bard Liao <yung-chuan.liao@linux.intel.com>
[ Upstream commit 38cd651ebce7065a81c7e950d9e2ea1572304605 ]
It doesn't make sense to handle an alert event when the peripheral is
not attached. The slave->status could be SDW_SLAVE_ATTACHED or
SDW_SLAVE_ALERT when it is attached on the bus.
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev>
Link: https://patch.msgid.link/20260520025720.1999367-1-yung-chuan.liao@linux.intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soundwire/bus.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/soundwire/bus.c b/drivers/soundwire/bus.c
index 1b6ba23edf0fa..46bb9026a6c61 100644
--- a/drivers/soundwire/bus.c
+++ b/drivers/soundwire/bus.c
@@ -1874,6 +1874,10 @@ int sdw_handle_slave_status(struct sdw_bus *bus,
break;
case SDW_SLAVE_ALERT:
+ if (slave->status != SDW_SLAVE_ATTACHED &&
+ slave->status != SDW_SLAVE_ALERT)
+ continue;
+
ret = sdw_handle_slave_alerts(slave);
if (ret < 0)
dev_err(&slave->dev,
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 122/982] mmc: davinci: fix mmc_add_host order in probe
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 121/982] soundwire: only handle alert events when the peripheral is attached Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 123/982] mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC Greg Kroah-Hartman
` (866 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Osama Abdelkader, Ulf Hansson,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Osama Abdelkader <osama.abdelkader@gmail.com>
[ Upstream commit d04e0151d316edbdb4f0397a9b92a1936e4a1421 ]
mmc_add_host() makes the host visible to the MMC core. Register the
interrupt handlers and advertise MMC_CAP_SDIO_IRQ before that, so the
core cannot start using the host before IRQ handling is set up.
Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
Signed-off-by: Ulf Hansson <ulfh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/host/davinci_mmc.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
diff --git a/drivers/mmc/host/davinci_mmc.c b/drivers/mmc/host/davinci_mmc.c
index b744651f3b625..62e75df6b6b00 100644
--- a/drivers/mmc/host/davinci_mmc.c
+++ b/drivers/mmc/host/davinci_mmc.c
@@ -1303,14 +1303,10 @@ static int davinci_mmcsd_probe(struct platform_device *pdev)
goto cpu_freq_fail;
}
- ret = mmc_add_host(mmc);
- if (ret < 0)
- goto mmc_add_host_fail;
-
ret = devm_request_irq(&pdev->dev, irq, mmc_davinci_irq, 0,
mmc_hostname(mmc), host);
if (ret)
- goto request_irq_fail;
+ goto mmc_add_host_fail;
if (host->sdio_irq >= 0) {
ret = devm_request_irq(&pdev->dev, host->sdio_irq,
@@ -1320,6 +1316,10 @@ static int davinci_mmcsd_probe(struct platform_device *pdev)
mmc->caps |= MMC_CAP_SDIO_IRQ;
}
+ ret = mmc_add_host(mmc);
+ if (ret < 0)
+ goto mmc_add_host_fail;
+
rename_region(mem, mmc_hostname(mmc));
dev_info(mmc_dev(host->mmc), "Using %s, %d-bit mode\n",
@@ -1328,8 +1328,6 @@ static int davinci_mmcsd_probe(struct platform_device *pdev)
return 0;
-request_irq_fail:
- mmc_remove_host(mmc);
mmc_add_host_fail:
mmc_davinci_cpufreq_deregister(host);
cpu_freq_fail:
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 123/982] mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 122/982] mmc: davinci: fix mmc_add_host order in probe Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 124/982] tracing: Disable KCOV instrumentation for trace_irqsoff.o Greg Kroah-Hartman
` (865 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lad Prabhakar, Wolfram Sang,
Geert Uytterhoeven, Ulf Hansson, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
[ Upstream commit 5ce500d31a1625d8fe7ede950201b8df076bdd48 ]
The RZ/G2N (R8A774B1) SoC was previously handled via the generic
"renesas,rcar-gen3-sdhi" fallback compatible string. However, because
the SDHI IP on RZ/G2N is identical with the R-Car M3-N (R8A77965), it
requires the specific quirks and configuration defined in
`of_r8a77965_compatible` rather than the generic Gen3 data.
Add the explicit "renesas,sdhi-r8a774b1" match entry to map it correctly.
Note that the DT binding file renesas,sdhi.yaml does not need an update
as the entry for this SoC is already present.
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Ulf Hansson <ulfh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/host/renesas_sdhi_internal_dmac.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/mmc/host/renesas_sdhi_internal_dmac.c b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
index 58dbc28ead58f..20118b3c428c9 100644
--- a/drivers/mmc/host/renesas_sdhi_internal_dmac.c
+++ b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
@@ -269,6 +269,7 @@ static const struct renesas_sdhi_of_data_with_quirks of_rza2_compatible = {
static const struct of_device_id renesas_sdhi_internal_dmac_of_match[] = {
{ .compatible = "renesas,sdhi-r7s9210", .data = &of_rza2_compatible, },
{ .compatible = "renesas,sdhi-mmc-r8a77470", .data = &of_rcar_gen3_compatible, },
+ { .compatible = "renesas,sdhi-r8a774b1", .data = &of_r8a77965_compatible, },
{ .compatible = "renesas,sdhi-r8a774e1", .data = &of_r8a7795_compatible, },
{ .compatible = "renesas,sdhi-r8a7795", .data = &of_r8a7795_compatible, },
{ .compatible = "renesas,sdhi-r8a77961", .data = &of_r8a77961_compatible, },
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 124/982] tracing: Disable KCOV instrumentation for trace_irqsoff.o
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 123/982] mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 125/982] mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC Greg Kroah-Hartman
` (864 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karl Mehltretter, Steven Rostedt,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <kmehltretter@gmail.com>
[ Upstream commit 01046072880b654dbadf71be2f645aad4a7b5d87 ]
When KCOV runs its boot selftest with whole-kernel instrumentation
enabled, it sets current->kcov_mode to KCOV_MODE_TRACE_PC without
installing a coverage area. Any instrumented code accepted as task-context
coverage in that window dereferences current->kcov_area and crashes.
On ARMv5 Versatile PB with CONFIG_KCOV_SELFTEST=y,
CONFIG_KCOV_INSTRUMENT_ALL=y and CONFIG_IRQSOFF_TRACER=y, boot hits a
NULL pointer fault during the selftest:
kcov: running self test
Internal error: Oops: 5 [#1] ARM
PC is at __sanitizer_cov_trace_pc+0x4c/0x90
Kernel panic - not syncing: Fatal exception
A diagnostic run showed the unwanted coverage comes from the IRQs-off
tracer callbacks reached from ARM IRQ entry before hardirq context is
visible to KCOV:
__sanitizer_cov_trace_pc from tracer_hardirqs_off+0x18/0x1cc
tracer_hardirqs_off from trace_hardirqs_off+0x34/0x54
trace_hardirqs_off from __irq_svc+0x58/0xb0
__irq_svc from kcov_init+0x7c/0xdc
and similarly through tracer_hardirqs_on().
trace_preemptirq.o is already excluded because this tracing path can run
from early interrupt code and produce coverage unrelated to syscall
inputs. Exclude trace_irqsoff.o as well, instead of requiring users to
turn off CONFIG_KCOV_INSTRUMENT_ALL=y, which is the default whole-kernel
KCOV mode.
With the exclusion in place, the same ARMv5 Versatile PB QEMU test boots
through the KCOV selftest and reaches userspace.
Tested on ARMv5 Versatile PB QEMU with CONFIG_KCOV_SELFTEST=y,
CONFIG_KCOV_INSTRUMENT_ALL=y and CONFIG_IRQSOFF_TRACER=y.
Link: https://patch.msgid.link/20260525170428.67211-1-kmehltretter@gmail.com
Assisted-by: Codex:gpt-5
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/Makefile | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/kernel/trace/Makefile b/kernel/trace/Makefile
index c6651e16b5572..7752b2b04396e 100644
--- a/kernel/trace/Makefile
+++ b/kernel/trace/Makefile
@@ -31,9 +31,10 @@ ifdef CONFIG_GCOV_PROFILE_FTRACE
GCOV_PROFILE := y
endif
-# Functions in this file could be invoked from early interrupt
-# code and produce random code coverage.
+# Functions in these files can run from IRQ entry before hardirq context
+# is visible to KCOV, and produce coverage unrelated to syscall inputs.
KCOV_INSTRUMENT_trace_preemptirq.o := n
+KCOV_INSTRUMENT_trace_irqsoff.o := n
CFLAGS_bpf_trace.o := -I$(src)
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 125/982] mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 124/982] tracing: Disable KCOV instrumentation for trace_irqsoff.o Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 126/982] iio: light: stk3310: Deal with the ps interrupt issue in PM Greg Kroah-Hartman
` (863 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lad Prabhakar, Geert Uytterhoeven,
Wolfram Sang, Ulf Hansson, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
[ Upstream commit ebf7f2198ac4817bd2929cf83c697cefa8bf36a9 ]
The RZ/G2E (R8A774C0) SoC was previously handled via the generic
"renesas,rcar-gen3-sdhi" fallback compatible string. However, because
the SDHI IP on RZ/G2E is identical with the R-Car E3 (R8A77990), it
requires the specific quirks and configuration defined in
`of_r8a77990_compatible` rather than the generic Gen3 data.
Add the explicit "renesas,sdhi-r8a774c0" match entry to map it correctly.
Note that the DT binding file renesas,sdhi.yaml does not need an update
as the entry for this SoC is already present.
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Ulf Hansson <ulfh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/host/renesas_sdhi_internal_dmac.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/mmc/host/renesas_sdhi_internal_dmac.c b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
index 20118b3c428c9..e05ac6475899d 100644
--- a/drivers/mmc/host/renesas_sdhi_internal_dmac.c
+++ b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
@@ -270,6 +270,7 @@ static const struct of_device_id renesas_sdhi_internal_dmac_of_match[] = {
{ .compatible = "renesas,sdhi-r7s9210", .data = &of_rza2_compatible, },
{ .compatible = "renesas,sdhi-mmc-r8a77470", .data = &of_rcar_gen3_compatible, },
{ .compatible = "renesas,sdhi-r8a774b1", .data = &of_r8a77965_compatible, },
+ { .compatible = "renesas,sdhi-r8a774c0", .data = &of_r8a77990_compatible, },
{ .compatible = "renesas,sdhi-r8a774e1", .data = &of_r8a7795_compatible, },
{ .compatible = "renesas,sdhi-r8a7795", .data = &of_r8a7795_compatible, },
{ .compatible = "renesas,sdhi-r8a77961", .data = &of_r8a77961_compatible, },
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 126/982] iio: light: stk3310: Deal with the ps interrupt issue in PM
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 125/982] mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 127/982] perf/ftrace: Fix WARNING in __unregister_ftrace_function Greg Kroah-Hartman
` (862 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Miao Li, Jonathan Cameron,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miao Li <limiao@kylinos.cn>
[ Upstream commit 9c1d639e90cf42f5c1401f91f38ffd89af6dd970 ]
On the Inspur HS326 laptop(which integrated with HiSilicon M900
processor), if the STK3311-X chip's PS interrupt is configured
in "Recommended interrupt mode", the interrupt cannot be triggered
normally after waking from suspend or hibernation.
In this case, neither disabling and re-enabling the interrupt nor
resetting the PS threshold register can restore the interrupt to
normal operation.
If the interrupt is disabled in suspend() then reset the PS threshold
register and enable the interrupt in resume(). This resolves the issue.
Signed-off-by: Miao Li <limiao@kylinos.cn>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/light/stk3310.c | 76 +++++++++++++++++++++++++++++++++----
1 file changed, 69 insertions(+), 7 deletions(-)
diff --git a/drivers/iio/light/stk3310.c b/drivers/iio/light/stk3310.c
index 7b8e0da6aabc1..b1b0e77922ac1 100644
--- a/drivers/iio/light/stk3310.c
+++ b/drivers/iio/light/stk3310.c
@@ -106,6 +106,9 @@ struct stk3310_data {
struct mutex lock;
bool als_enabled;
bool ps_enabled;
+ bool ps_int_enabled;
+ uint32_t ps_thdl;
+ uint32_t ps_thdh;
uint32_t ps_near_level;
u64 timestamp;
struct regmap *regmap;
@@ -275,10 +278,17 @@ static int stk3310_write_event(struct iio_dev *indio_dev,
buf = cpu_to_be16(val);
ret = regmap_bulk_write(data->regmap, reg, &buf, 2);
- if (ret < 0)
+ if (ret < 0) {
dev_err(&client->dev, "failed to set PS threshold!\n");
+ return ret;
+ }
- return ret;
+ if (reg == STK3310_REG_THDH_PS)
+ data->ps_thdh = val;
+ else
+ data->ps_thdl = val;
+
+ return 0;
}
static int stk3310_read_event_config(struct iio_dev *indio_dev,
@@ -313,11 +323,17 @@ static int stk3310_write_event_config(struct iio_dev *indio_dev,
/* Set INT_PS value */
mutex_lock(&data->lock);
ret = regmap_field_write(data->reg_int_ps, state);
- if (ret < 0)
+ if (ret < 0) {
dev_err(&client->dev, "failed to set interrupt mode\n");
+ mutex_unlock(&data->lock);
+ return ret;
+ }
+
+ data->ps_int_enabled = state;
+
mutex_unlock(&data->lock);
- return ret;
+ return 0;
}
static int stk3310_read_raw(struct iio_dev *indio_dev,
@@ -490,10 +506,15 @@ static int stk3310_init(struct iio_dev *indio_dev)
/* Enable PS interrupts */
ret = regmap_field_write(data->reg_int_ps, STK3310_PSINT_EN);
- if (ret < 0)
+ if (ret < 0) {
dev_err(&client->dev, "failed to enable interrupts!\n");
+ return ret;
+ }
- return ret;
+ data->ps_int_enabled = true;
+ data->ps_thdh = STK3310_PS_MAX_VAL;
+
+ return 0;
}
static bool stk3310_is_volatile_reg(struct device *dev, unsigned int reg)
@@ -660,9 +681,18 @@ static void stk3310_remove(struct i2c_client *client)
static int stk3310_suspend(struct device *dev)
{
struct stk3310_data *data;
+ int ret;
data = iio_priv(i2c_get_clientdata(to_i2c_client(dev)));
+ if (data->ps_int_enabled) {
+ ret = regmap_field_write(data->reg_int_ps, 0x0);
+ if (ret < 0) {
+ dev_err(dev, "failed to disable ps int at suspend.\n");
+ return ret;
+ }
+ }
+
return stk3310_set_state(data, STK3310_STATE_STANDBY);
}
@@ -670,6 +700,8 @@ static int stk3310_resume(struct device *dev)
{
u8 state = 0;
struct stk3310_data *data;
+ __be16 buf;
+ int ret;
data = iio_priv(i2c_get_clientdata(to_i2c_client(dev)));
if (data->ps_enabled)
@@ -677,7 +709,37 @@ static int stk3310_resume(struct device *dev)
if (data->als_enabled)
state |= STK3310_STATE_EN_ALS;
- return stk3310_set_state(data, state);
+ ret = stk3310_set_state(data, state);
+ if (ret < 0)
+ return ret;
+
+ if (data->ps_thdl != 0x0) {
+ buf = cpu_to_be16(data->ps_thdl);
+ ret = regmap_bulk_write(data->regmap, STK3310_REG_THDL_PS, &buf, 2);
+ if (ret < 0) {
+ dev_err(dev, "failed to set reg THDL_PS at resume.\n");
+ return ret;
+ }
+ }
+
+ if (data->ps_thdh != STK3310_PS_MAX_VAL) {
+ buf = cpu_to_be16(data->ps_thdh);
+ ret = regmap_bulk_write(data->regmap, STK3310_REG_THDH_PS, &buf, 2);
+ if (ret < 0) {
+ dev_err(dev, "failed to set reg THDH_PS at resume.\n");
+ return ret;
+ }
+ }
+
+ if (data->ps_int_enabled) {
+ ret = regmap_field_write(data->reg_int_ps, STK3310_PSINT_EN);
+ if (ret < 0) {
+ dev_err(dev, "failed to enable ps int at resume.\n");
+ return ret;
+ }
+ }
+
+ return 0;
}
static DEFINE_SIMPLE_DEV_PM_OPS(stk3310_pm_ops, stk3310_suspend,
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 127/982] perf/ftrace: Fix WARNING in __unregister_ftrace_function
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 126/982] iio: light: stk3310: Deal with the ps interrupt issue in PM Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 128/982] iio: accel: mma8452: switch to non-devm request_threaded_irq() Greg Kroah-Hartman
` (861 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rik van Riel, Steven Rostedt,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rik van Riel <riel@surriel.com>
[ Upstream commit 9581123304b23049437324038698af9fb56ee663 ]
perf_ftrace_function_unregister() unconditionally calls
unregister_ftrace_function() without checking whether the ftrace_ops
was ever successfully registered. This triggers a WARN_ON in
__unregister_ftrace_function() when the ops doesn't have
FTRACE_OPS_FL_ENABLED set.
This can happen during perf_event_alloc() error cleanup when
perf_trace_destroy() is called via __free_event() on an event whose
ftrace_ops registration failed or was already torn down by
perf_try_init_event()'s err_destroy path.
The call path is:
perf_event_alloc() error cleanup
-> __free_event()
-> event->destroy() [tp_perf_event_destroy]
-> perf_trace_destroy()
-> perf_trace_event_close()
-> TRACE_REG_PERF_CLOSE
-> perf_ftrace_function_unregister()
-> unregister_ftrace_function()
-> __unregister_ftrace_function()
-> WARN_ON(!(ops->flags & FTRACE_OPS_FL_ENABLED))
Fix this by checking FTRACE_OPS_FL_ENABLED before attempting to
unregister. If the ops is not enabled, just free the filter and
return success.
Link: https://patch.msgid.link/20260527111301.2d0d8256@fangorn
Signed-off-by: Rik van Riel <riel@surriel.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/trace_event_perf.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/kernel/trace/trace_event_perf.c b/kernel/trace/trace_event_perf.c
index f2000cf2b3bba..a7e41eee9a796 100644
--- a/kernel/trace/trace_event_perf.c
+++ b/kernel/trace/trace_event_perf.c
@@ -501,7 +501,17 @@ static int perf_ftrace_function_register(struct perf_event *event)
static int perf_ftrace_function_unregister(struct perf_event *event)
{
struct ftrace_ops *ops = &event->ftrace_ops;
- int ret = unregister_ftrace_function(ops);
+ int ret = 0;
+
+ /*
+ * Perf will call this unconditionally even if the ops is not
+ * enabled. The unregister_ftrace_function() will warn if called
+ * when not enabled. Just bypass the unregistering if ops isn't
+ * enabled here.
+ */
+ if (ops->flags & FTRACE_OPS_FL_ENABLED)
+ ret = unregister_ftrace_function(ops);
+
ftrace_free_filter(ops);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 128/982] iio: accel: mma8452: switch to non-devm request_threaded_irq()
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 127/982] perf/ftrace: Fix WARNING in __unregister_ftrace_function Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 129/982] libbpf: Also reset {insn,data}_cur on realloc failure Greg Kroah-Hartman
` (860 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sanjay Chitroda, Jonathan Cameron,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanjay Chitroda <sanjayembeddedse@gmail.com>
[ Upstream commit 0a6726ec20cd4c0101f2de0ca485a11676224dea ]
Avoid using devm_request_threaded_irq() as the driver requires explicit
error-handling path(s). Using devm_* API together with goto-based
unwinding breaks the expected LIFO resource release model.
Add explicit IRQ cleanup in the driver teardown paths to follow kernel
resource management conventions.
Signed-off-by: Sanjay Chitroda <sanjayembeddedse@gmail.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/accel/mma8452.c | 19 ++++++++++++-------
1 file changed, 12 insertions(+), 7 deletions(-)
diff --git a/drivers/iio/accel/mma8452.c b/drivers/iio/accel/mma8452.c
index 28002c714ea98..7be63b5965993 100644
--- a/drivers/iio/accel/mma8452.c
+++ b/drivers/iio/accel/mma8452.c
@@ -1695,18 +1695,16 @@ static int mma8452_probe(struct i2c_client *client,
goto trigger_cleanup;
if (client->irq) {
- ret = devm_request_threaded_irq(&client->dev,
- client->irq,
- NULL, mma8452_interrupt,
- IRQF_TRIGGER_LOW | IRQF_ONESHOT,
- client->name, indio_dev);
+ ret = request_threaded_irq(client->irq, NULL, mma8452_interrupt,
+ IRQF_TRIGGER_LOW | IRQF_ONESHOT,
+ client->name, indio_dev);
if (ret)
goto buffer_cleanup;
}
ret = pm_runtime_set_active(&client->dev);
if (ret < 0)
- goto buffer_cleanup;
+ goto free_irq;
pm_runtime_enable(&client->dev);
pm_runtime_set_autosuspend_delay(&client->dev,
@@ -1715,7 +1713,7 @@ static int mma8452_probe(struct i2c_client *client,
ret = iio_device_register(indio_dev);
if (ret < 0)
- goto buffer_cleanup;
+ goto free_irq;
ret = mma8452_set_freefall_mode(data, false);
if (ret < 0)
@@ -1726,6 +1724,10 @@ static int mma8452_probe(struct i2c_client *client,
unregister_device:
iio_device_unregister(indio_dev);
+free_irq:
+ if (client->irq)
+ free_irq(client->irq, indio_dev);
+
buffer_cleanup:
iio_triggered_buffer_cleanup(indio_dev);
@@ -1751,6 +1753,9 @@ static void mma8452_remove(struct i2c_client *client)
pm_runtime_disable(&client->dev);
pm_runtime_set_suspended(&client->dev);
+ if (client->irq)
+ free_irq(client->irq, indio_dev);
+
iio_triggered_buffer_cleanup(indio_dev);
mma8452_trigger_cleanup(indio_dev);
mma8452_standby(iio_priv(indio_dev));
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 129/982] libbpf: Also reset {insn,data}_cur on realloc failure
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 128/982] iio: accel: mma8452: switch to non-devm request_threaded_irq() Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 130/982] net: ibm: emac: Reserve VLAN header in MJS limit Greg Kroah-Hartman
` (859 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Borkmann, Alexei Starovoitov,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <daniel@iogearbox.net>
[ Upstream commit d2f7bd066ed492aeaf82864fbf1f06770f9d9f9d ]
realloc_insn_buf() as well as realloc_data_buf() free and NULL
gen->insn_start / gen->data_start on -ENOMEM but leave gen->insn_cur /
gen->data_cur pointing into the old, freed buffer. Just reset the
cursors to NULL alongside the base pointers so the freed state is
coherent.
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/r/20260529094119.307264-3-daniel@iogearbox.net
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/bpf/gen_loader.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/tools/lib/bpf/gen_loader.c b/tools/lib/bpf/gen_loader.c
index b74c82bb831e6..13fac40d5fd92 100644
--- a/tools/lib/bpf/gen_loader.c
+++ b/tools/lib/bpf/gen_loader.c
@@ -63,6 +63,7 @@ static int realloc_insn_buf(struct bpf_gen *gen, __u32 size)
gen->error = -ENOMEM;
free(gen->insn_start);
gen->insn_start = NULL;
+ gen->insn_cur = NULL;
return -ENOMEM;
}
gen->insn_start = insn_start;
@@ -86,6 +87,7 @@ static int realloc_data_buf(struct bpf_gen *gen, __u32 size)
gen->error = -ENOMEM;
free(gen->data_start);
gen->data_start = NULL;
+ gen->data_cur = NULL;
return -ENOMEM;
}
gen->data_start = data_start;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 130/982] net: ibm: emac: Reserve VLAN header in MJS limit
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 129/982] libbpf: Also reset {insn,data}_cur on realloc failure Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 131/982] wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi Greg Kroah-Hartman
` (858 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Rosen Penev, Paolo Abeni,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <rosenp@gmail.com>
[ Upstream commit 0906c117f81c2ae6e6dbfa82719f79c75e1c9325 ]
The IBM EMAC programs its Maximum Jumbo Size (MJS) drop
threshold from ndev->mtu directly. The hardware sizes the threshold
against the L2 frame minus the ethernet header, but does not
discount the 802.1Q tag, so a frame carrying a VLAN tag and a full
1500-byte payload exceeds MJS by exactly 4 bytes and is dropped.
This is normally hidden because JPSM (and therefore the MJS check)
only engages when the MTU is raised above ETH_DATA_LEN. With the
qca8k DSA tagger the conduit MTU is bumped by QCA_HDR_LEN to 1502
during dsa_conduit_setup(), which is enough to enable JPSM and
expose the off-by-VLAN-tag in the limit.
Pad MJS by VLAN_HLEN so a VLAN-tagged full-MTU frame passes.
Reported on Meraki MX60 (qca8k switch): tagged VLAN
traffic drops at 1500-byte payload, while 1496 bytes works
and untagged 1500 bytes works.
Assisted-by: Claude:Opus-4.7
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://patch.msgid.link/20260526202247.13823-1-rosenp@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/ibm/emac/core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/ibm/emac/core.c b/drivers/net/ethernet/ibm/emac/core.c
index 9b08e41ccc294..d78a5a9e79b55 100644
--- a/drivers/net/ethernet/ibm/emac/core.c
+++ b/drivers/net/ethernet/ibm/emac/core.c
@@ -30,6 +30,7 @@
#include <linux/skbuff.h>
#include <linux/crc32.h>
#include <linux/ethtool.h>
+#include <linux/if_vlan.h>
#include <linux/mii.h>
#include <linux/bitops.h>
#include <linux/workqueue.h>
@@ -465,7 +466,7 @@ static inline u32 emac_iff2rmr(struct net_device *ndev)
if (emac_has_feature(dev, EMAC_APM821XX_REQ_JUMBO_FRAME_SIZE)) {
r &= ~EMAC4_RMR_MJS_MASK;
- r |= EMAC4_RMR_MJS(ndev->mtu);
+ r |= EMAC4_RMR_MJS(ndev->mtu + VLAN_HLEN);
}
return r;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 131/982] wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 130/982] net: ibm: emac: Reserve VLAN header in MJS limit Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 132/982] ASoC: qcom: q6apm: return error code to consumers on failures Greg Kroah-Hartman
` (857 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Miaoqing Pan, Rameshkumar Sundaram,
Baochen Qiang, Jeff Johnson, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqing Pan <miaoqing.pan@oss.qualcomm.com>
[ Upstream commit 6b471e9aefee9ed73278eb1141e0d8530a56fae9 ]
In certain cases, hardware might provide packets with a
length greater than the maximum native Wi-Fi header length.
This can lead to accessing and modifying fields in the header
within the ath11k_dp_rx_h_undecap_nwifi() function for the
DP_RX_DECAP_TYPE_NATIVE_WIFI decap type and
potentially result in invalid data access and memory corruption.
Kernel stack is corrupted in: ath11k_dp_rx_h_undecap+0x6b0/0x6b0 [ath11k]
Call trace:
ath11k_dp_rx_h_mpdu+0x0/0x2e8 [ath11k]
ath11k_dp_rx_h_mpdu+0x1e0/0x2e8 [ath11k]
ath11k_dp_rx_wbm_err+0x1e0/0x450 [ath11k]
ath11k_dp_rx_process_wbm_err+0x2fc/0x460 [ath11k]
ath11k_dp_service_srng+0x2e0/0x348 [ath11k]
Add a sanity check before processing the SKB to prevent invalid
data access in the undecap native Wi-Fi function for the
DP_RX_DECAP_TYPE_NATIVE_WIFI decap type.
This adapted from the discussion/patch of the ath12k driver [1].
Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1
Link: https://lore.kernel.org/linux-wireless/20250211090302.4105141-1-tamizh.raja@oss.qualcomm.com/ # [1]
Signed-off-by: Miaoqing Pan <miaoqing.pan@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260512022351.2033155-2-miaoqing.pan@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath11k/dp_rx.c | 50 +++++++++++++++++++++++--
1 file changed, 47 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c
index e6ae900006074..7e59260a30b89 100644
--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
+++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
@@ -2513,6 +2513,29 @@ static void ath11k_dp_rx_deliver_msdu(struct ath11k *ar, struct napi_struct *nap
ieee80211_rx_napi(ar->hw, pubsta, msdu, napi);
}
+static bool ath11k_dp_rx_check_nwifi_hdr_len_valid(struct ath11k_base *ab,
+ struct hal_rx_desc *rx_desc,
+ struct sk_buff *msdu)
+{
+ struct ieee80211_hdr *hdr;
+ u8 decap_type;
+ u32 hdr_len;
+
+ decap_type = ath11k_dp_rx_h_msdu_start_decap_type(ab, rx_desc);
+ if (decap_type != DP_RX_DECAP_TYPE_NATIVE_WIFI)
+ return true;
+
+ hdr = (struct ieee80211_hdr *)msdu->data;
+ hdr_len = ieee80211_hdrlen(hdr->frame_control);
+
+ if (likely(hdr_len <= DP_MAX_NWIFI_HDR_LEN))
+ return true;
+
+ ab->soc_stats.invalid_rbm++;
+ WARN_ON_ONCE(1);
+ return false;
+}
+
static int ath11k_dp_rx_process_msdu(struct ath11k *ar,
struct sk_buff *msdu,
struct sk_buff_head *msdu_list,
@@ -2583,6 +2606,11 @@ static int ath11k_dp_rx_process_msdu(struct ath11k *ar,
}
}
+ if (unlikely(!ath11k_dp_rx_check_nwifi_hdr_len_valid(ab, rx_desc, msdu))) {
+ ret = -EINVAL;
+ goto free_out;
+ }
+
ath11k_dp_rx_h_ppdu(ar, rx_desc, rx_status);
ath11k_dp_rx_h_mpdu(ar, msdu, rx_desc, rx_status);
@@ -3244,6 +3272,12 @@ static int ath11k_dp_rx_h_verify_tkip_mic(struct ath11k *ar, struct ath11k_peer
RX_FLAG_IV_STRIPPED | RX_FLAG_DECRYPTED;
skb_pull(msdu, hal_rx_desc_sz);
+ if (unlikely(!ath11k_dp_rx_check_nwifi_hdr_len_valid(ar->ab, rx_desc,
+ msdu))) {
+ dev_kfree_skb_any(msdu);
+ return -EINVAL;
+ }
+
ath11k_dp_rx_h_ppdu(ar, rx_desc, rxs);
ath11k_dp_rx_h_undecap(ar, msdu, rx_desc,
HAL_ENCRYPT_TYPE_TKIP_MIC, rxs, true);
@@ -3936,6 +3970,10 @@ static int ath11k_dp_rx_h_null_q_desc(struct ath11k *ar, struct sk_buff *msdu,
skb_put(msdu, hal_rx_desc_sz + l3pad_bytes + msdu_len);
skb_pull(msdu, hal_rx_desc_sz + l3pad_bytes);
}
+
+ if (unlikely(!ath11k_dp_rx_check_nwifi_hdr_len_valid(ar->ab, desc, msdu)))
+ return -EINVAL;
+
ath11k_dp_rx_h_ppdu(ar, desc, status);
ath11k_dp_rx_h_mpdu(ar, msdu, desc, status);
@@ -3980,7 +4018,7 @@ static bool ath11k_dp_rx_h_reo_err(struct ath11k *ar, struct sk_buff *msdu,
return drop;
}
-static void ath11k_dp_rx_h_tkip_mic_err(struct ath11k *ar, struct sk_buff *msdu,
+static bool ath11k_dp_rx_h_tkip_mic_err(struct ath11k *ar, struct sk_buff *msdu,
struct ieee80211_rx_status *status)
{
u16 msdu_len;
@@ -3988,6 +4026,7 @@ static void ath11k_dp_rx_h_tkip_mic_err(struct ath11k *ar, struct sk_buff *msdu,
u8 l3pad_bytes;
struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
u32 hal_rx_desc_sz = ar->ab->hw_params.hal_desc_sz;
+ struct ath11k_base *ab = ar->ab;
rxcb->is_first_msdu = ath11k_dp_rx_h_msdu_end_first_msdu(ar->ab, desc);
rxcb->is_last_msdu = ath11k_dp_rx_h_msdu_end_last_msdu(ar->ab, desc);
@@ -3997,6 +4036,9 @@ static void ath11k_dp_rx_h_tkip_mic_err(struct ath11k *ar, struct sk_buff *msdu,
skb_put(msdu, hal_rx_desc_sz + l3pad_bytes + msdu_len);
skb_pull(msdu, hal_rx_desc_sz + l3pad_bytes);
+ if (unlikely(!ath11k_dp_rx_check_nwifi_hdr_len_valid(ab, desc, msdu)))
+ return true;
+
ath11k_dp_rx_h_ppdu(ar, desc, status);
status->flag |= (RX_FLAG_MMIC_STRIPPED | RX_FLAG_MMIC_ERROR |
@@ -4004,19 +4046,21 @@ static void ath11k_dp_rx_h_tkip_mic_err(struct ath11k *ar, struct sk_buff *msdu,
ath11k_dp_rx_h_undecap(ar, msdu, desc,
HAL_ENCRYPT_TYPE_TKIP_MIC, status, false);
+
+ return false;
}
static bool ath11k_dp_rx_h_rxdma_err(struct ath11k *ar, struct sk_buff *msdu,
struct ieee80211_rx_status *status)
{
struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
- bool drop = false;
+ bool drop;
ar->ab->soc_stats.rxdma_error[rxcb->err_code]++;
switch (rxcb->err_code) {
case HAL_REO_ENTR_RING_RXDMA_ECODE_TKIP_MIC_ERR:
- ath11k_dp_rx_h_tkip_mic_err(ar, msdu, status);
+ drop = ath11k_dp_rx_h_tkip_mic_err(ar, msdu, status);
break;
default:
/* TODO: Review other rxdma error code to check if anything is
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 132/982] ASoC: qcom: q6apm: return error code to consumers on failures
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 131/982] wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 133/982] ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive Greg Kroah-Hartman
` (856 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srinivas Kandagatla, Mark Brown,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
[ Upstream commit 3075ae5abbc370d2a9a01bd6d554a412d406f5bd ]
Return errors from audioreach_set_media_format() to ensure callers are
notified when media format setup fails.
This could hide failures while programming media format parameters for
individual modules and allow graph setup to continue with incomplete
configuration.
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Link: https://patch.msgid.link/20260528185806.6316-3-srinivas.kandagatla@oss.qualcomm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/qcom/qdsp6/q6apm.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/sound/soc/qcom/qdsp6/q6apm.c b/sound/soc/qcom/qdsp6/q6apm.c
index f9ee8bbe35f25..48488ba2be212 100644
--- a/sound/soc/qcom/qdsp6/q6apm.c
+++ b/sound/soc/qcom/qdsp6/q6apm.c
@@ -272,10 +272,7 @@ int q6apm_graph_media_format_shmem(struct q6apm_graph *graph,
if (!module)
return -ENODEV;
- audioreach_set_media_format(graph, module, cfg);
-
- return 0;
-
+ return audioreach_set_media_format(graph, module, cfg);
}
EXPORT_SYMBOL_GPL(q6apm_graph_media_format_shmem);
@@ -375,6 +372,7 @@ int q6apm_graph_media_format_pcm(struct q6apm_graph *graph, struct audioreach_mo
struct audioreach_sub_graph *sgs;
struct audioreach_container *container;
struct audioreach_module *module;
+ int ret;
list_for_each_entry(sgs, &info->sg_list, node) {
list_for_each_entry(container, &sgs->container_list, node) {
@@ -383,7 +381,9 @@ int q6apm_graph_media_format_pcm(struct q6apm_graph *graph, struct audioreach_mo
(module->module_id == MODULE_ID_RD_SHARED_MEM_EP))
continue;
- audioreach_set_media_format(graph, module, cfg);
+ ret = audioreach_set_media_format(graph, module, cfg);
+ if (ret)
+ return ret;
}
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 133/982] ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 132/982] ASoC: qcom: q6apm: return error code to consumers on failures Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 134/982] ata: ahci: fail probe if BAR too small for claimed ports Greg Kroah-Hartman
` (855 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cezary Rojewski, Mark Brown,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cezary Rojewski <cezary.rojewski@intel.com>
[ Upstream commit eb7107264da8545ba7381a76818bae553e1fd1e4 ]
Revert changes done in commit 489db5d94150 ("ASoC: pcm3168a:
Don't disable pcm3168a when CONFIG_PM defined") and add
pm_runtime_status_suspended() check.
The suspended-check addresses regulator's "unbalanced disables"
warning during driver removal even when CONFIG_PM is enabled.
Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
Link: https://patch.msgid.link/20260525201801.1336936-4-cezary.rojewski@intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/pcm3168a.c | 20 +++++++-------------
1 file changed, 7 insertions(+), 13 deletions(-)
diff --git a/sound/soc/codecs/pcm3168a.c b/sound/soc/codecs/pcm3168a.c
index 329549936bd5c..e5ac1146588cc 100644
--- a/sound/soc/codecs/pcm3168a.c
+++ b/sound/soc/codecs/pcm3168a.c
@@ -820,15 +820,6 @@ int pcm3168a_probe(struct device *dev, struct regmap *regmap)
}
EXPORT_SYMBOL_GPL(pcm3168a_probe);
-static void pcm3168a_disable(struct device *dev)
-{
- struct pcm3168a_priv *pcm3168a = dev_get_drvdata(dev);
-
- regulator_bulk_disable(ARRAY_SIZE(pcm3168a->supplies),
- pcm3168a->supplies);
- clk_disable_unprepare(pcm3168a->scki);
-}
-
void pcm3168a_remove(struct device *dev)
{
struct pcm3168a_priv *pcm3168a = dev_get_drvdata(dev);
@@ -840,10 +831,12 @@ void pcm3168a_remove(struct device *dev)
* The asserted level of GPIO_ACTIVE_LOW is LOW.
*/
gpiod_set_value_cansleep(pcm3168a->gpio_rst, 1);
+
pm_runtime_disable(dev);
-#ifndef CONFIG_PM
- pcm3168a_disable(dev);
-#endif
+ if (!pm_runtime_status_suspended(dev)) {
+ regulator_bulk_disable(ARRAY_SIZE(pcm3168a->supplies), pcm3168a->supplies);
+ clk_disable_unprepare(pcm3168a->scki);
+ }
}
EXPORT_SYMBOL_GPL(pcm3168a_remove);
@@ -899,7 +892,8 @@ static int pcm3168a_rt_suspend(struct device *dev)
regcache_cache_only(pcm3168a->regmap, true);
- pcm3168a_disable(dev);
+ regulator_bulk_disable(ARRAY_SIZE(pcm3168a->supplies), pcm3168a->supplies);
+ clk_disable_unprepare(pcm3168a->scki);
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 134/982] ata: ahci: fail probe if BAR too small for claimed ports
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 133/982] ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 135/982] ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach Greg Kroah-Hartman
` (854 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, liyouhong, Damien Le Moal,
Niklas Cassel, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: liyouhong <liyouhong@kylinos.cn>
[ Upstream commit c4086c6e1af757e1ff26fa2d2926b3ec0195de79 ]
When an AHCI controller is disabled in BIOS, its HOST_CAP register may
contain a bogus value, e.g. 0xFFFFFFFF.
Since CAP.NP (Number of Ports) is a zeroes based 5-bit register field,
a value of 0x1f means 32 ports. If CAP.NP claims more ports than can
physically fit within the mapped BAR region, accessing port registers
beyond the BAR boundary causes a kernel panic.
Add validation in ahci_init_one() to check that the BAR size is
sufficient for the number of ports claimed in CAP.NP. The check
calculates the required MMIO size as:
required_size = 0x100 (global registers) + max_ports * 0x80
If required_size exceeds the actual BAR size, the probe fails with
-ENODEV, preventing the panic and providing a clear error message.
Reported-by: liyouhong <liyouhong@kylinos.cn>
Closes: https://lore.kernel.org/all/20260422080322.1006592-1-dayou5941@163.com/
Suggested-by: Damien Le Moal <dlemoal@kernel.org>
Suggested-by: Niklas Cassel <cassel@kernel.org>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: liyouhong <liyouhong@kylinos.cn>
[cassel: commit log]
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ata/ahci.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index cdc18f95cb59f..de996b7c51002 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -1768,6 +1768,24 @@ static ssize_t remapped_nvme_show(struct device *dev,
static DEVICE_ATTR_RO(remapped_nvme);
+static int ahci_validate_bar_size(struct pci_dev *pdev, int bar,
+ struct ahci_host_priv *hpriv)
+{
+ u32 cap = readl(hpriv->mmio + HOST_CAP);
+ unsigned int max_ports = ahci_nr_ports(cap);
+ u32 last_port_end = 0x100 + (max_ports * 0x80);
+ resource_size_t bar_size = pci_resource_len(pdev, bar);
+
+ if (last_port_end > bar_size) {
+ dev_warn(&pdev->dev,
+ "BAR%d too small for %u ports (last port ends at %#x, BAR %pa)\n",
+ bar, max_ports, last_port_end, &bar_size);
+ return -ENODEV;
+ }
+
+ return 0;
+}
+
static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
{
unsigned int board_id = ent->driver_data;
@@ -1870,6 +1888,10 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
hpriv->mmio = pcim_iomap_table(pdev)[ahci_pci_bar];
+ rc = ahci_validate_bar_size(pdev, ahci_pci_bar, hpriv);
+ if (rc)
+ return rc;
+
/* detect remapped nvme devices */
ahci_remap_check(pdev, ahci_pci_bar, hpriv);
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 135/982] ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 134/982] ata: ahci: fail probe if BAR too small for claimed ports Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 136/982] net: qrtr: fix node refcount leak on ctrl packet alloc failure Greg Kroah-Hartman
` (853 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chen Pei, Dan Williams (nvidia),
Alison Schofield, Rafael J. Wysocki, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Pei <cp0613@linux.alibaba.com>
[ Upstream commit 3a59c3b772e5dc0cedecce8e7fbf7c2d6245b643 ]
PCI root bridges enumerated by acpi_pci_root_add() can be the _DEP
supplier for other ACPI consumers, most notably ACPI0017 CXL root
devices whose probe path depends on acpi_pci_find_root() succeeding.
Once the root bus has been added, those consumers can safely be
enumerated, so notify them by clearing the dependency.
Call acpi_dev_clear_dependencies() at the end of acpi_pci_root_add(),
after pci_bus_add_devices(), following the same pattern used by other
ACPI suppliers such as the EC (drivers/acpi/ec.c) and the ACPI PCI
Link device (drivers/acpi/pci_link.c). The clear is intentionally
done only on the success path; on the error paths the supplier did
not attach and consumers must keep dep_unmet set.
This is a prerequisite for honoring _DEP on ACPI0016 host bridges,
which matters on architectures where the probe order of acpi_pci_root
relative to cxl_acpi is not guaranteed (e.g. RISC-V).
Signed-off-by: Chen Pei <cp0613@linux.alibaba.com>
Suggested-by: Dan Williams (nvidia) <djbw@kernel.org>
Tested-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Link: https://patch.msgid.link/20260526025118.38935-2-cp0613@linux.alibaba.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/pci_root.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
index 92e7aefcce81b..4201677fa748b 100644
--- a/drivers/acpi/pci_root.c
+++ b/drivers/acpi/pci_root.c
@@ -763,6 +763,10 @@ static int acpi_pci_root_add(struct acpi_device *device,
pci_lock_rescan_remove();
pci_bus_add_devices(root->bus);
pci_unlock_rescan_remove();
+
+ /* Clear _DEP dependencies to allow consumers to enumerate */
+ acpi_dev_clear_dependencies(device);
+
return 1;
remove_dmar:
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 136/982] net: qrtr: fix node refcount leak on ctrl packet alloc failure
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 135/982] ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 137/982] net: wwan: t7xx: Add delay between MD and SAP suspend Greg Kroah-Hartman
` (852 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Alexander Lobakin,
Manivannan Sadhasivam, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 3b09ff54114566864eea59020f6b69c5bb325b9d ]
qrtr_send_resume_tx() calls qrtr_node_lookup() which takes a
reference on the returned node. If the subsequent call to
qrtr_alloc_ctrl_packet() fails due to memory allocation failure, the
function returns -ENOMEM without calling qrtr_node_release() to
release the node reference.
Add qrtr_node_release(node) before returning on the allocation failure
path to properly release the reference.
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com>
Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/20260528080019.1176700-1-vulab@iscas.ac.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/qrtr/af_qrtr.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/qrtr/af_qrtr.c b/net/qrtr/af_qrtr.c
index d13ca058fef6d..7e5527ca6ab92 100644
--- a/net/qrtr/af_qrtr.c
+++ b/net/qrtr/af_qrtr.c
@@ -1004,8 +1004,10 @@ static int qrtr_send_resume_tx(struct qrtr_cb *cb)
return -EINVAL;
skb = qrtr_alloc_ctrl_packet(&pkt, GFP_KERNEL);
- if (!skb)
+ if (!skb) {
+ qrtr_node_release(node);
return -ENOMEM;
+ }
pkt->cmd = cpu_to_le32(QRTR_TYPE_RESUME_TX);
pkt->client.node = cpu_to_le32(cb->dst_node);
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 137/982] net: wwan: t7xx: Add delay between MD and SAP suspend
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 136/982] net: qrtr: fix node refcount leak on ctrl packet alloc failure Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 138/982] iommu/rockchip: disable fetch dte time limit Greg Kroah-Hartman
` (851 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jose Ignacio Tornos Martinez,
Loic Poulain, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
[ Upstream commit ae733795e593272f67d607c09d2a00637ac13ed0 ]
SAP (Service Access Point) suspend occasionally times out with error
-110 (ETIMEDOUT), followed by modem port errors and complete modem
failure requiring a system reboot to recover.
Error symptoms:
mtk_t7xx 0000:72:00.0: [PM] SAP suspend error: -110
mtk_t7xx 0000:72:00.0: can't suspend (...returned -110)
mtk_t7xx 0000:07:00.0: Failed to send skb: -22
mtk_t7xx 0000:07:00.0: Write error on MBIM port, -22
The modem firmware needs time after receiving the MD (modem) suspend
request to complete internal operations before it is ready to accept
the SAP suspend request. Without this delay, if runtime PM attempts
to suspend while the firmware is busy, the SAP suspend command times
out, leaving the modem in an unrecoverable state.
Root cause and userspace interaction:
ModemManager 1.24+ includes changes that reduce the likelihood of this
issue by ensuring the modem is in a low-power state before the kernel
attempts runtime suspend. However, the kernel driver should not depend
on specific userspace behavior or ModemManager versions. Older versions
(1.20-1.22) are still widely deployed, and the kernel should be robust
regardless of userspace implementation details.
There appears to be no hardware status register or other mechanism
available to query whether the firmware is ready for SAP suspend.
A delay between the two suspend requests is the most reliable solution
found through testing.
Add a 50ms delay between MD suspend and SAP suspend. This gives the
firmware adequate time to complete internal operations without adding
significant latency to the suspend path. This makes the driver robust
across all ModemManager versions and system conditions.
Testing: 96+ hours of continuous operation with ModemManager 1.20.2
and Fibocom FM350-GL modem. Zero SAP suspend timeouts observed across
2000+ successful suspend/resume cycles. Previously failed within
24 hours with 100% reproducibility.
Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Link: https://patch.msgid.link/20260527061451.12710-1-jtornosm@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wwan/t7xx/t7xx_pci.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/wwan/t7xx/t7xx_pci.c b/drivers/net/wwan/t7xx/t7xx_pci.c
index 91256e005b846..b19bb261e76bf 100644
--- a/drivers/net/wwan/t7xx/t7xx_pci.c
+++ b/drivers/net/wwan/t7xx/t7xx_pci.c
@@ -313,6 +313,9 @@ static int __t7xx_pci_pm_suspend(struct pci_dev *pdev)
goto abort_suspend;
}
+ /* Delay to prevent SAP suspend timeout */
+ msleep(50);
+
ret = t7xx_send_pm_request(t7xx_dev, H2D_CH_SUSPEND_REQ_AP);
if (ret) {
t7xx_send_pm_request(t7xx_dev, H2D_CH_RESUME_REQ);
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 138/982] iommu/rockchip: disable fetch dte time limit
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 137/982] net: wwan: t7xx: Add delay between MD and SAP suspend Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 139/982] fs/ntfs3: preserve non-DOS attribute bits in system.dos_attrib Greg Kroah-Hartman
` (850 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Simon Xue, Sven Püschel,
Heiko Stuebner, Joerg Roedel, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Xue <xxm@rock-chips.com>
[ Upstream commit 8d4346ecd4950ae08cc76a6de327c264e846758c ]
Disable the Bit 31 of the AUTO_GATING iommu register, as it causes
hangups with the RGA3 (Raster Graphics Acceleration 3) peripheral.
The RGA3 register description of the TRM already states that the bit
must be set to 1. The vendor kernel sets the bit unconditionally to
1 to fix VOP (Video Output Processor) screen black issues. This patch
squashes the 2 vendor kernel commits with the following commit messages:
Master fetch data and cpu update page table may work in parallel, may
have the following procedure:
master cpu
fetch dte update page tabl
| |
(make dte invalid) <- zap iotlb entry
| |
fetch dte again
(make dte invalid) <- zap iotlb entry
| |
fetch dte again
(make dte invalid) <- zap iotlb entry
| |
fetch dte again
(make iommu block) <- zap iotlb entry
New iommu version has the above bug, if fetch dte consecutively four
times, then it will be blocked. Fortunately, we can set bit 31 of
register MMU_AUTO_GATING to 1 to make it work as old version which does
not have this issue.
This issue only appears on RV1126 so far, so make a workaround dedicated
to "rockchip,rv1126" machine type.
iommu/rockchip: fix vop blocked and screen black on RK356X and RK3588
RK3568 and RK3588 has the same issue as RV1126/RV1109 that caused by
dte fetch time limit, So we can set BIT(31) of register 0x24 default
to 1 as a workaround.
Signed-off-by: Simon Xue <xxm@rock-chips.com>
Signed-off-by: Sven Püschel <s.pueschel@pengutronix.de>
Acked-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/rockchip-iommu.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c
index 43bb577a26e59..5ce951bbd69af 100644
--- a/drivers/iommu/rockchip-iommu.c
+++ b/drivers/iommu/rockchip-iommu.c
@@ -73,6 +73,8 @@
#define SPAGE_ORDER 12
#define SPAGE_SIZE (1 << SPAGE_ORDER)
+#define DISABLE_FETCH_DTE_TIME_LIMIT BIT(31)
+
/*
* Support mapping any size that fits in one page table:
* 4 KiB to 4 MiB
@@ -922,6 +924,7 @@ static int rk_iommu_enable(struct rk_iommu *iommu)
struct iommu_domain *domain = iommu->domain;
struct rk_iommu_domain *rk_domain = to_rk_domain(domain);
int ret, i;
+ u32 auto_gate;
ret = clk_bulk_enable(iommu->num_clocks, iommu->clocks);
if (ret)
@@ -940,6 +943,11 @@ static int rk_iommu_enable(struct rk_iommu *iommu)
rk_ops->mk_dtentries(rk_domain->dt_dma));
rk_iommu_base_command(iommu->bases[i], RK_MMU_CMD_ZAP_CACHE);
rk_iommu_write(iommu->bases[i], RK_MMU_INT_MASK, RK_MMU_IRQ_MASK);
+
+ /* Workaround for iommu blocked, BIT(31) default to 1 */
+ auto_gate = rk_iommu_read(iommu->bases[i], RK_MMU_AUTO_GATING);
+ auto_gate |= DISABLE_FETCH_DTE_TIME_LIMIT;
+ rk_iommu_write(iommu->bases[i], RK_MMU_AUTO_GATING, auto_gate);
}
ret = rk_iommu_enable_paging(iommu);
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 139/982] fs/ntfs3: preserve non-DOS attribute bits in system.dos_attrib
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (137 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 138/982] iommu/rockchip: disable fetch dte time limit Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 140/982] fs/ntfs3: validate index entry key bounds Greg Kroah-Hartman
` (849 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ZhengYuan Huang, Konstantin Komarov,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhengYuan Huang <gality369@gmail.com>
[ Upstream commit b1c1101067d9536bcb0fe023b96ee2dde5535959 ]
[BUG]
A corrupted ntfs3 image can hit a NULL function pointer call in
generic_perform_write() after toggling system.ntfs_attrib and then
overwriting system.dos_attrib on the same file.
BUG: kernel NULL pointer dereference, address: 0000000000000000
\#PF: supervisor instruction fetch in kernel mode
\#PF: error_code(0x0010) - not-present page
PGD bed5067 P4D bed5067 PUD 0
Oops: Oops: 0010 [#1] SMP KASAN NOPTI
RIP: 0010:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
RSP: 0018:ffff88801025f988 EFLAGS: 00010246
Call Trace:
generic_perform_write+0x409/0x8c0 mm/filemap.c:4255
__generic_file_write_iter+0x1bb/0x200 mm/filemap.c:4372
ntfs_file_write_iter+0xcd9/0x1c20 fs/ntfs3/file.c:1253
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x63b/0xf70 fs/read_write.c:686
ksys_write+0x133/0x250 fs/read_write.c:738
__do_sys_write fs/read_write.c:749 [inline]
__se_sys_write fs/read_write.c:746 [inline]
__x64_sys_write+0x77/0xc0 fs/read_write.c:746
...
[CAUSE]
system.ntfs_attrib updates ATTR_DATA flags via ni_new_attr_flags()
and switches i_mapping->a_ops to ntfs_aops_cmpr when
FILE_ATTRIBUTE_COMPRESSED is set. system.dos_attrib then overwrites
ni->std_fa from a one-byte DOS attribute value, clearing the compression
bit without updating ATTR_DATA or the mapping operations.
Old buffered writes use is_compressed(ni) to choose
__generic_file_write_iter(). That leaves generic_perform_write() calling
a NULL write_begin callback from ntfs_aops_cmpr.
[FIX]
Treat system.dos_attrib as a low-byte DOS attribute update and preserve the
existing non-DOS attribute bits in ni->std_fa. This keeps compressed and
sparse state consistent with ATTR_DATA and the mapping operations while
keeping the existing DOS attribute semantics intact.
Signed-off-by: ZhengYuan Huang <gality369@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/xattr.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c
index 409f9545e9cd5..a235050e92098 100644
--- a/fs/ntfs3/xattr.c
+++ b/fs/ntfs3/xattr.c
@@ -874,7 +874,9 @@ static noinline int ntfs_setxattr(const struct xattr_handler *handler,
!memcmp(name, SYSTEM_DOS_ATTRIB, sizeof(SYSTEM_DOS_ATTRIB))) {
if (sizeof(u8) != size)
goto out;
- new_fa = cpu_to_le32(*(u8 *)value);
+ /* system.dos_attrib only covers the low DOS attribute byte. */
+ new_fa = (ni->std_fa & ~cpu_to_le32(0xff)) |
+ cpu_to_le32(*(u8 *)value);
goto set_new_fa;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 140/982] fs/ntfs3: validate index entry key bounds
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 139/982] fs/ntfs3: preserve non-DOS attribute bits in system.dos_attrib Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 141/982] ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e() Greg Kroah-Hartman
` (848 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ZhengYuan Huang, Konstantin Komarov,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhengYuan Huang <gality369@gmail.com>
[ Upstream commit 98d6e5d9dc1d34dcffc61549617581a5fe1ef807 ]
[BUG]
A malformed NTFS directory index entry can advertise a key_size larger
than the bytes actually present in its NTFS_DE payload. Directory lookup
then passes that malformed key to cmp_fnames(), which can read past the
end of the kmalloc'ed index buffer.
BUG: KASAN: slab-out-of-bounds in fname_full_size fs/ntfs3/ntfs.h:590 [inline]
BUG: KASAN: slab-out-of-bounds in cmp_fnames+0x1ea/0x230 fs/ntfs3/index.c:46
Read of size 1 at addr ffff88801c313018 by task syz.6.3365/9279
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0xbe/0x130 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xd1/0x650 mm/kasan/report.c:482
kasan_report+0xfb/0x140 mm/kasan/report.c:595
__asan_report_load1_noabort+0x14/0x30 mm/kasan/report_generic.c:378
fname_full_size fs/ntfs3/ntfs.h:590 [inline]
cmp_fnames+0x1ea/0x230 fs/ntfs3/index.c:46
hdr_find_e.isra.0+0x3ed/0x670 fs/ntfs3/index.c:762
indx_find+0x4b5/0x900 fs/ntfs3/index.c:1186
dir_search_u+0x2c0/0x460 fs/ntfs3/dir.c:254
ntfs_lookup+0x1cc/0x2a0 fs/ntfs3/namei.c:85
__lookup_slow+0x241/0x450 fs/namei.c:1816
lookup_slow fs/namei.c:1833 [inline]
walk_component+0x31c/0x570 fs/namei.c:2151
link_path_walk+0x592/0xd60 fs/namei.c:2519
path_lookupat+0x138/0x660 fs/namei.c:2675
filename_lookup+0x1f3/0x560 fs/namei.c:2705
filename_setxattr+0xad/0x1c0 fs/xattr.c:660
path_setxattrat+0x1d8/0x280 fs/xattr.c:713
__do_sys_lsetxattr fs/xattr.c:754 [inline]
__se_sys_lsetxattr fs/xattr.c:750 [inline]
__x64_sys_lsetxattr+0xd0/0x150 fs/xattr.c:750
...
Allocated by task 9279:
kasan_save_stack+0x39/0x70 mm/kasan/common.c:56
kasan_save_track+0x14/0x40 mm/kasan/common.c:77
kasan_save_alloc_info+0x37/0x60 mm/kasan/generic.c:573
poison_kmalloc_redzone mm/kasan/common.c:400 [inline]
__kasan_kmalloc+0xc3/0xd0 mm/kasan/common.c:417
kasan_kmalloc include/linux/kasan.h:262 [inline]
__do_kmalloc_node mm/slub.c:5650 [inline]
__kmalloc_noprof+0x2bd/0x900 mm/slub.c:5662
kmalloc_noprof include/linux/slab.h:961 [inline]
indx_read+0x41d/0xad0 fs/ntfs3/index.c:1059
indx_find+0x447/0x900 fs/ntfs3/index.c:1179
dir_search_u+0x2c0/0x460 fs/ntfs3/dir.c:254
ntfs_lookup+0x1cc/0x2a0 fs/ntfs3/namei.c:85
__lookup_slow+0x241/0x450 fs/namei.c:1816
lookup_slow fs/namei.c:1833 [inline]
walk_component+0x31c/0x570 fs/namei.c:2151
link_path_walk+0x592/0xd60 fs/namei.c:2519
path_lookupat+0x138/0x660 fs/namei.c:2675
filename_lookup+0x1f3/0x560 fs/namei.c:2705
filename_setxattr+0xad/0x1c0 fs/xattr.c:660
path_setxattrat+0x1d8/0x280 fs/xattr.c:713
__do_sys_lsetxattr fs/xattr.c:754 [inline]
__se_sys_lsetxattr fs/xattr.c:750 [inline]
__x64_sys_lsetxattr+0xd0/0x150 fs/xattr.c:750
...
[CAUSE]
The index-header validators only validated INDEX_HDR-level geometry.
They did not walk each NTFS_DE to verify entry alignment, subnode
layout, or that key_size fit inside the entry payload. They also
allowed a last sentinel entry to carry a non-zero key_size.
[FIX]
Walk every NTFS_DE in ntfs3's index-header validators and reject
entries with invalid layout, mismatched subnode state, oversized
key_size, or non-zero sentinel keys before lookup or log replay can
consume them.
Signed-off-by: ZhengYuan Huang <gality369@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/fslog.c | 26 ++++++++++++++++++++------
fs/ntfs3/index.c | 37 ++++++++++++++++++++++++++++++++++++-
2 files changed, 56 insertions(+), 7 deletions(-)
diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
index c0f4822699a9b..c7762a24f8fed 100644
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -2645,11 +2645,12 @@ static int read_next_log_rec(struct ntfs_log *log, struct lcb *lcb, u64 *lsn)
bool check_index_header(const struct INDEX_HDR *hdr, size_t bytes)
{
+ const bool has_subnode = hdr_has_subnode(hdr);
__le16 mask;
u32 min_de, de_off, used, total;
const struct NTFS_DE *e;
- if (hdr_has_subnode(hdr)) {
+ if (has_subnode) {
min_de = sizeof(struct NTFS_DE) + sizeof(u64);
mask = NTFS_IE_HAS_SUBNODES;
} else {
@@ -2666,20 +2667,33 @@ bool check_index_header(const struct INDEX_HDR *hdr, size_t bytes)
return false;
}
- e = Add2Ptr(hdr, de_off);
+ e = (const struct NTFS_DE *)((const u8 *)hdr + de_off);
for (;;) {
u16 esize = le16_to_cpu(e->size);
- struct NTFS_DE *next = Add2Ptr(e, esize);
+ u16 key_size = le16_to_cpu(e->key_size);
+ u16 data_size;
- if (esize < min_de || PtrOffset(hdr, next) > used ||
+ if (!IS_ALIGNED(esize, 8) || esize < min_de ||
(e->flags & NTFS_IE_HAS_SUBNODES) != mask) {
return false;
}
- if (de_is_last(e))
+ if (size_add(de_off, esize) > used)
+ return false;
+
+ if (de_is_last(e)) {
+ if (key_size)
+ return false;
+
break;
+ }
+
+ data_size = esize - min_de;
+ if (key_size > data_size)
+ return false;
- e = next;
+ de_off += esize;
+ e = (const struct NTFS_DE *)((const u8 *)hdr + de_off);
}
return true;
diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
index 90720adb4d839..ce1e9cff8d1b7 100644
--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -612,16 +612,51 @@ static const struct NTFS_DE *hdr_insert_head(struct INDEX_HDR *hdr,
*/
static bool index_hdr_check(const struct INDEX_HDR *hdr, u32 bytes)
{
+ const bool has_subnode = hdr_has_subnode(hdr);
+ const u16 min_size = sizeof(struct NTFS_DE) +
+ (has_subnode ? sizeof(u64) : 0);
u32 end = le32_to_cpu(hdr->used);
u32 tot = le32_to_cpu(hdr->total);
u32 off = le32_to_cpu(hdr->de_off);
+ const struct NTFS_DE *e;
if (!IS_ALIGNED(off, 8) || tot > bytes || end > tot ||
- size_add(off, sizeof(struct NTFS_DE)) > end) {
+ size_add(off, min_size) > end) {
/* incorrect index buffer. */
return false;
}
+ /* Ensure every key stays inside its entry before lookup walks it. */
+ e = (const struct NTFS_DE *)((const u8 *)hdr + off);
+ for (;;) {
+ u16 e_size = le16_to_cpu(e->size);
+ u16 key_size = le16_to_cpu(e->key_size);
+ u16 data_size;
+
+ if (!IS_ALIGNED(e_size, 8) || e_size < min_size ||
+ de_has_vcn(e) != has_subnode) {
+ /* incorrect index entry. */
+ return false;
+ }
+
+ if (size_add(off, e_size) > end)
+ return false;
+
+ if (de_is_last(e)) {
+ if (key_size)
+ return false;
+
+ break;
+ }
+
+ data_size = e_size - min_size;
+ if (key_size > data_size)
+ return false;
+
+ off += e_size;
+ e = (const struct NTFS_DE *)((const u8 *)hdr + off);
+ }
+
return true;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 141/982] ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e()
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 140/982] fs/ntfs3: validate index entry key bounds Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 142/982] ASoC: codecs: rk3328: Use managed GPIO and clock helpers Greg Kroah-Hartman
` (847 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alessandro Schino,
Konstantin Komarov, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alessandro Schino <7991aleschino@gmail.com>
[ Upstream commit aa1bdbb39f49c5bc9779316891c40005517842a5 ]
The bounds check in ntfs_dir_emit() compares fname->name_len (a
character count) against e->size (a byte count) without accounting
for the 2-byte-per-character UTF-16LE encoding or the ATTR_FILE_NAME
header size:
if (fname->name_len + sizeof(struct NTFS_DE) > le16_to_cpu(e->size))
This computes: name_len + 16 > e_size
The correct check must account for the ATTR_FILE_NAME header (66 bytes
before the name) and the UTF-16LE character size (2 bytes each):
sizeof(NTFS_DE) + offsetof(ATTR_FILE_NAME, name) +
name_len * sizeof(short) > e_size
Which computes: 16 + 66 + name_len * 2 > e_size
The correct calculation already exists as fname_full_size() in ntfs.h
and is used in cmp_fnames(), namei.c, and fslog.c, but was not used
in the readdir path.
A crafted NTFS image with an index entry containing a small e->size
but large fname->name_len bypasses the current check, causing
ntfs_utf16_to_nls() to read past the entry boundary.
Additionally, add a key_size validation in hdr_find_e() to ensure the
declared key_size does not exceed the available entry data, preventing
comparison functions from reading past entry boundaries on the lookup
path.
Signed-off-by: Alessandro Schino <7991aleschino@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/dir.c | 4 +++-
fs/ntfs3/index.c | 4 ++++
2 files changed, 7 insertions(+), 1 deletion(-)
diff --git a/fs/ntfs3/dir.c b/fs/ntfs3/dir.c
index c49e64ebbd0a9..ca13b5a1fdabf 100644
--- a/fs/ntfs3/dir.c
+++ b/fs/ntfs3/dir.c
@@ -304,7 +304,9 @@ static inline bool ntfs_dir_emit(struct ntfs_sb_info *sbi,
if (sbi->options->nohidden && (fname->dup.fa & FILE_ATTRIBUTE_HIDDEN))
return true;
- if (fname->name_len + sizeof(struct NTFS_DE) > le16_to_cpu(e->size))
+ if (sizeof(struct NTFS_DE) +
+ offsetof(struct ATTR_FILE_NAME, name) +
+ fname->name_len * sizeof(short) > le16_to_cpu(e->size))
return true;
name_len = ntfs_utf16_to_nls(sbi, fname->name, fname->name_len, name,
diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
index ce1e9cff8d1b7..82feda419c0aa 100644
--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -794,6 +794,10 @@ static struct NTFS_DE *hdr_find_e(const struct ntfs_index *indx,
binary_search:
e_key_len = le16_to_cpu(e->key_size);
+ /* Validate key_size fits within the entry data area. */
+ if (e_key_len > le16_to_cpu(e->size) - sizeof(struct NTFS_DE))
+ return NULL;
+
diff2 = (*cmp)(key, key_len, e + 1, e_key_len, ctx);
if (diff2 > 0) {
if (found) {
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 142/982] ASoC: codecs: rk3328: Use managed GPIO and clock helpers
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 141/982] ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e() Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 143/982] ALSA: seq: oss: Reject reads that cannot fit the next event Greg Kroah-Hartman
` (846 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cássio Gabriel, Mark Brown,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
[ Upstream commit 0cf3489bba9ad13aae052232e223e19a620fe7a7 ]
rk3328_platform_probe() acquires the mute GPIO with gpiod_get_optional()
but never releases it. It also enables mclk and pclk manually while
relying on probe error labels for unwind, and the driver has no platform
remove callback to disable those clocks after a successful unbind.
This path has already needed fixes for missing clock unwinds on probe
errors. Use devm_gpiod_get_optional() and devm_clk_get_enabled() so the
GPIO and enabled clock lifetimes are tied to the device. This removes the
manual error labels and makes both probe failure and driver unbind follow
the normal devres cleanup path.
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Link: https://patch.msgid.link/20260525-asoc-rk3328-devm-resources-v1-1-2abde0006f89@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/rk3328_codec.c | 54 ++++++++-------------------------
1 file changed, 13 insertions(+), 41 deletions(-)
diff --git a/sound/soc/codecs/rk3328_codec.c b/sound/soc/codecs/rk3328_codec.c
index 1d523bfd9d84f..11d797288027a 100644
--- a/sound/soc/codecs/rk3328_codec.c
+++ b/sound/soc/codecs/rk3328_codec.c
@@ -426,7 +426,6 @@ static int rk3328_platform_probe(struct platform_device *pdev)
struct rk3328_codec_priv *rk3328;
struct regmap *grf;
void __iomem *base;
- int ret = 0;
rk3328 = devm_kzalloc(&pdev->dev, sizeof(*rk3328), GFP_KERNEL);
if (!rk3328)
@@ -442,14 +441,13 @@ static int rk3328_platform_probe(struct platform_device *pdev)
regmap_write(grf, RK3328_GRF_SOC_CON2,
(BIT(14) << 16 | BIT(14)));
- ret = of_property_read_u32(rk3328_np, "spk-depop-time-ms",
- &rk3328->spk_depop_time);
- if (ret < 0) {
+ if (of_property_read_u32(rk3328_np, "spk-depop-time-ms",
+ &rk3328->spk_depop_time)) {
dev_info(&pdev->dev, "spk_depop_time use default value.\n");
rk3328->spk_depop_time = 200;
}
- rk3328->mute = gpiod_get_optional(&pdev->dev, "mute", GPIOD_OUT_HIGH);
+ rk3328->mute = devm_gpiod_get_optional(&pdev->dev, "mute", GPIOD_OUT_HIGH);
if (IS_ERR(rk3328->mute))
return PTR_ERR(rk3328->mute);
/*
@@ -462,57 +460,31 @@ static int rk3328_platform_probe(struct platform_device *pdev)
regmap_write(grf, RK3328_GRF_SOC_CON10, BIT(17) | BIT(1));
}
- rk3328->mclk = devm_clk_get(&pdev->dev, "mclk");
+ rk3328->mclk = devm_clk_get_enabled(&pdev->dev, "mclk");
if (IS_ERR(rk3328->mclk))
return PTR_ERR(rk3328->mclk);
- ret = clk_prepare_enable(rk3328->mclk);
- if (ret)
- return ret;
clk_set_rate(rk3328->mclk, INITIAL_FREQ);
- rk3328->pclk = devm_clk_get(&pdev->dev, "pclk");
- if (IS_ERR(rk3328->pclk)) {
- dev_err(&pdev->dev, "can't get acodec pclk\n");
- ret = PTR_ERR(rk3328->pclk);
- goto err_unprepare_mclk;
- }
-
- ret = clk_prepare_enable(rk3328->pclk);
- if (ret < 0) {
- dev_err(&pdev->dev, "failed to enable acodec pclk\n");
- goto err_unprepare_mclk;
- }
+ rk3328->pclk = devm_clk_get_enabled(&pdev->dev, "pclk");
+ if (IS_ERR(rk3328->pclk))
+ return dev_err_probe(&pdev->dev, PTR_ERR(rk3328->pclk),
+ "failed to get or enable acodec pclk\n");
base = devm_platform_ioremap_resource(pdev, 0);
- if (IS_ERR(base)) {
- ret = PTR_ERR(base);
- goto err_unprepare_pclk;
- }
+ if (IS_ERR(base))
+ return PTR_ERR(base);
rk3328->regmap = devm_regmap_init_mmio(&pdev->dev, base,
&rk3328_codec_regmap_config);
- if (IS_ERR(rk3328->regmap)) {
- ret = PTR_ERR(rk3328->regmap);
- goto err_unprepare_pclk;
- }
+ if (IS_ERR(rk3328->regmap))
+ return PTR_ERR(rk3328->regmap);
platform_set_drvdata(pdev, rk3328);
- ret = devm_snd_soc_register_component(&pdev->dev, &soc_codec_rk3328,
+ return devm_snd_soc_register_component(&pdev->dev, &soc_codec_rk3328,
rk3328_dai,
ARRAY_SIZE(rk3328_dai));
- if (ret)
- goto err_unprepare_pclk;
-
- return 0;
-
-err_unprepare_pclk:
- clk_disable_unprepare(rk3328->pclk);
-
-err_unprepare_mclk:
- clk_disable_unprepare(rk3328->mclk);
- return ret;
}
static const struct of_device_id rk3328_codec_of_match[] __maybe_unused = {
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 143/982] ALSA: seq: oss: Reject reads that cannot fit the next event
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 142/982] ASoC: codecs: rk3328: Use managed GPIO and clock helpers Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 144/982] dpaa2-switch: rework FDB management on the bridge leave path Greg Kroah-Hartman
` (845 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cássio Gabriel, Takashi Iwai,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
[ Upstream commit 611f538253d970f4d152003841544e875828d015 ]
snd_seq_oss_read() checks whether the next queued OSS sequencer event
fits in the remaining userspace buffer before removing it from the read
queue.
The check is inverted. It currently stops when the event is smaller than
the remaining buffer, so a normal 4-byte event is not copied for an
8-byte read buffer. Conversely, an 8-byte event can be copied for a
smaller read count.
Break only when the remaining userspace buffer is smaller than the next
event, and report -EINVAL if no complete event has been copied. This
prevents an undersized read from looking like end-of-file while leaving
the event queued for a later read with a large enough buffer.
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Link: https://patch.msgid.link/20260602-alsa-seq-oss-read-size-check-v1-1-10e59b1742e0@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/core/seq/oss/seq_oss_rw.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/sound/core/seq/oss/seq_oss_rw.c b/sound/core/seq/oss/seq_oss_rw.c
index 307ef98c44c7b..45bb458597708 100644
--- a/sound/core/seq/oss/seq_oss_rw.c
+++ b/sound/core/seq/oss/seq_oss_rw.c
@@ -57,7 +57,8 @@ snd_seq_oss_read(struct seq_oss_devinfo *dp, char __user *buf, int count)
break;
}
ev_len = ev_length(&rec);
- if (ev_len < count) {
+ if (count < ev_len) {
+ err = -EINVAL;
snd_seq_oss_readq_unlock(readq, flags);
break;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 144/982] dpaa2-switch: rework FDB management on the bridge leave path
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 143/982] ALSA: seq: oss: Reject reads that cannot fit the next event Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 145/982] dpaa2-switch: fix the error path in dpaa2_switch_rx() Greg Kroah-Hartman
` (844 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ioana Ciornei, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ioana Ciornei <ioana.ciornei@nxp.com>
[ Upstream commit efc1d92eacf03afa6f4d53bf7120e059b6f961f2 ]
On bridge leave, the dpaa2_switch_port_set_fdb() function always
allocates a new FDB for the port which is becoming standalone. In case
no FDB is found, then the port leaving a bridge will continue to use the
current one.
The above logic does not cover the case in which there are multiple
bridges which have ports from the same DPSW instance. In this case, when
the last port leaves bridge #1, it finds an unused FDB to switch to, but
the old FDB is not marked as unused. Since the number of FDBs is equal
to the number of DPSW interfaces, this will eventually lead to multiple
ports sharing the same FDB.
Fix this by changing how we are managing the FDBs on the leave path.
Instead of directly allocating a new FDB, first verify if the current
port is the last one to leave a bridge. If this is the case, then
continue to use the current FDB and only allocate another FDB if there
are other ports remaining in the bridge.
Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Link: https://patch.msgid.link/20260528173452.1953102-2-ioana.ciornei@nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../ethernet/freescale/dpaa2/dpaa2-switch.c | 31 ++++++++++++++-----
1 file changed, 24 insertions(+), 7 deletions(-)
diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
index 8f7c3466f52c4..763fc85c8d46c 100644
--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
+++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
@@ -55,27 +55,44 @@ dpaa2_switch_filter_block_get_unused(struct ethsw_core *ethsw)
static u16 dpaa2_switch_port_set_fdb(struct ethsw_port_priv *port_priv,
struct net_device *bridge_dev)
{
+ struct ethsw_core *ethsw = port_priv->ethsw_data;
struct ethsw_port_priv *other_port_priv = NULL;
struct dpaa2_switch_fdb *fdb;
struct net_device *other_dev;
+ bool last_fdb_user = true;
struct list_head *iter;
+ int i;
/* If we leave a bridge (bridge_dev is NULL), find an unused
* FDB and use that.
*/
if (!bridge_dev) {
- fdb = dpaa2_switch_fdb_get_unused(port_priv->ethsw_data);
-
- /* If there is no unused FDB, we must be the last port that
- * leaves the last bridge, all the others are standalone. We
- * can just keep the FDB that we already have.
- */
+ /* First verify if this is the last port to leave this bridge */
+ for (i = 0; i < ethsw->sw_attr.num_ifs; i++) {
+ if (!ethsw->ports[i] || ethsw->ports[i] == port_priv)
+ continue;
+ if (ethsw->ports[i]->fdb == port_priv->fdb) {
+ last_fdb_user = false;
+ break;
+ }
+ }
- if (!fdb) {
+ /* If this is the last user of the FDB, just keep using it. */
+ if (last_fdb_user) {
port_priv->fdb->bridge_dev = NULL;
return 0;
}
+ /* Since we are not the last port which leaves a bridge,
+ * acquire a new FDB and use it. The number of FDBs is sized to
+ * accommodate all switch ports as standalone, each with its
+ * private FDB, which means that dpaa2_switch_fdb_get_unused()
+ * must succeed here. WARN if not.
+ */
+ fdb = dpaa2_switch_fdb_get_unused(port_priv->ethsw_data);
+ if (WARN_ON(!fdb))
+ return 0;
+
port_priv->fdb = fdb;
port_priv->fdb->in_use = true;
port_priv->fdb->bridge_dev = NULL;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 145/982] dpaa2-switch: fix the error path in dpaa2_switch_rx()
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 144/982] dpaa2-switch: rework FDB management on the bridge leave path Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 146/982] net: dsa: sja1105: flower: reject cross-chip redirect Greg Kroah-Hartman
` (843 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ioana Ciornei, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ioana Ciornei <ioana.ciornei@nxp.com>
[ Upstream commit 74c1c9f5c0c30bbd0c2cf87b6e3507e7ea46c13d ]
In case of an error in dpaa2_switch_rx(), the dpaa2_switch_free_fd()
function is called in order to free the FD. This is incorrect since the
dpaa2_switch_free_fd() is intended to be used on Tx frame descriptors,
meaning that it expects in the software annotation area of the FD data
to find a valid skb pointer on which to call dev_kfree_skb().
Fix this by extracting the dma_unmap_page() from
dpaa2_switch_build_linear_skb() directly into the dpaa2_switch_rx()
function. This allows us to directly use free_pages() in case of an
error before an SKB was created and kfree_skb() afterwards.
Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Link: https://patch.msgid.link/20260528173452.1953102-3-ioana.ciornei@nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../ethernet/freescale/dpaa2/dpaa2-switch.c | 23 ++++++++++---------
1 file changed, 12 insertions(+), 11 deletions(-)
diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
index 763fc85c8d46c..a89b954ec91af 100644
--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
+++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
@@ -2400,18 +2400,13 @@ static int dpaa2_switch_port_blocking_event(struct notifier_block *nb,
/* Build a linear skb based on a single-buffer frame descriptor */
static struct sk_buff *dpaa2_switch_build_linear_skb(struct ethsw_core *ethsw,
- const struct dpaa2_fd *fd)
+ const struct dpaa2_fd *fd,
+ void *fd_vaddr)
{
u16 fd_offset = dpaa2_fd_get_offset(fd);
- dma_addr_t addr = dpaa2_fd_get_addr(fd);
u32 fd_length = dpaa2_fd_get_len(fd);
struct device *dev = ethsw->dev;
struct sk_buff *skb = NULL;
- void *fd_vaddr;
-
- fd_vaddr = dpaa2_iova_to_virt(ethsw->iommu_domain, addr);
- dma_unmap_page(dev, addr, DPAA2_SWITCH_RX_BUF_SIZE,
- DMA_FROM_DEVICE);
skb = build_skb(fd_vaddr, DPAA2_SWITCH_RX_BUF_SIZE +
SKB_DATA_ALIGN(sizeof(struct skb_shared_info)));
@@ -2437,6 +2432,7 @@ static void dpaa2_switch_tx_conf(struct dpaa2_switch_fq *fq,
static void dpaa2_switch_rx(struct dpaa2_switch_fq *fq,
const struct dpaa2_fd *fd)
{
+ dma_addr_t addr = dpaa2_fd_get_addr(fd);
struct ethsw_core *ethsw = fq->ethsw;
struct ethsw_port_priv *port_priv;
struct net_device *netdev;
@@ -2444,10 +2440,14 @@ static void dpaa2_switch_rx(struct dpaa2_switch_fq *fq,
struct sk_buff *skb;
u16 vlan_tci, vid;
int if_id, err;
+ void *vaddr;
+
+ vaddr = dpaa2_iova_to_virt(ethsw->iommu_domain, addr);
+ dma_unmap_page(ethsw->dev, addr, DPAA2_SWITCH_RX_BUF_SIZE,
+ DMA_FROM_DEVICE);
/* get switch ingress interface ID */
if_id = upper_32_bits(dpaa2_fd_get_flc(fd)) & 0x0000FFFF;
-
if (if_id >= ethsw->sw_attr.num_ifs) {
dev_err(ethsw->dev, "Frame received from unknown interface!\n");
goto err_free_fd;
@@ -2463,7 +2463,7 @@ static void dpaa2_switch_rx(struct dpaa2_switch_fq *fq,
}
}
- skb = dpaa2_switch_build_linear_skb(ethsw, fd);
+ skb = dpaa2_switch_build_linear_skb(ethsw, fd, vaddr);
if (unlikely(!skb))
goto err_free_fd;
@@ -2481,7 +2481,8 @@ static void dpaa2_switch_rx(struct dpaa2_switch_fq *fq,
err = __skb_vlan_pop(skb, &vlan_tci);
if (err) {
dev_info(ethsw->dev, "__skb_vlan_pop() returned %d", err);
- goto err_free_fd;
+ kfree_skb(skb);
+ return;
}
}
@@ -2496,7 +2497,7 @@ static void dpaa2_switch_rx(struct dpaa2_switch_fq *fq,
return;
err_free_fd:
- dpaa2_switch_free_fd(ethsw, fd);
+ free_pages((unsigned long)vaddr, 0);
}
static void dpaa2_switch_detect_features(struct ethsw_core *ethsw)
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 146/982] net: dsa: sja1105: flower: reject cross-chip redirect
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 145/982] dpaa2-switch: fix the error path in dpaa2_switch_rx() Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 147/982] dpaa2-switch: fix handling of NAPI on the remove path Greg Kroah-Hartman
` (842 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Yang, Vladimir Oltean,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Yang <mmyangfl@gmail.com>
[ Upstream commit cfa5274a5dc2a23b957da5dc806d2ac0c7a66af0 ]
dsa_port_from_netdev() may return a valid port from a different switch
chip. Programming another chip's port index into the local hardware
causes redirection to the wrong port, or an out-of-bounds access if the
index exceeds the local chip's port count.
Apply a minimal fix that adds a check to catch this case and adjusts the
extack message. When cls->common.skip_sw is not set, the operation could
instead redirect to the upstream port and let the software or upstream
switch(es) handle the forward, but that is not addressed here.
Signed-off-by: David Yang <mmyangfl@gmail.com>
Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
Link: https://patch.msgid.link/20260530003940.2000994-1-mmyangfl@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/sja1105/sja1105_flower.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/dsa/sja1105/sja1105_flower.c b/drivers/net/dsa/sja1105/sja1105_flower.c
index fad5afe3819cc..23cc263085a8b 100644
--- a/drivers/net/dsa/sja1105/sja1105_flower.c
+++ b/drivers/net/dsa/sja1105/sja1105_flower.c
@@ -388,9 +388,9 @@ int sja1105_cls_flower_add(struct dsa_switch *ds, int port,
struct dsa_port *to_dp;
to_dp = dsa_port_from_netdev(act->dev);
- if (IS_ERR(to_dp)) {
+ if (IS_ERR(to_dp) || to_dp->ds != ds) {
NL_SET_ERR_MSG_MOD(extack,
- "Destination not a switch port");
+ "Destination not a local switch port");
return -EOPNOTSUPP;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 147/982] dpaa2-switch: fix handling of NAPI on the remove path
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 146/982] net: dsa: sja1105: flower: reject cross-chip redirect Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 148/982] xhci: Prevent queuing new commands if xhci is inaccessible Greg Kroah-Hartman
` (841 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ioana Ciornei, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ioana Ciornei <ioana.ciornei@nxp.com>
[ Upstream commit e23d7c8c1d4ba435c457d7ffb2669175ec819b07 ]
All the NAPI instances for a DPSW device are attached to the first
switch port's net_device but shared by all ports. The NAPI instances get
disabled only once the last port goes down.
This causes an issue on the .remove() path where each port is
unregistered and freed one at a time, causing the NAPI instances to be
deleted even though they are not disabled.
In order to avoid this, split up the unregister_netdev() calls from the
free_netdev() so that we make sure all ports go down before we attempt
a deletion of NAPI instances. Also, make the netif_napi_del() explicit
as it is on the .probe() path.
Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Link: https://patch.msgid.link/20260528173452.1953102-6-ioana.ciornei@nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/ethernet/freescale/dpaa2/dpaa2-switch.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
index a89b954ec91af..939591171aa55 100644
--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
+++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
@@ -3271,7 +3271,6 @@ static void dpaa2_switch_teardown(struct fsl_mc_device *sw_dev)
static int dpaa2_switch_remove(struct fsl_mc_device *sw_dev)
{
- struct ethsw_port_priv *port_priv;
struct ethsw_core *ethsw;
struct device *dev;
int i;
@@ -3283,11 +3282,17 @@ static int dpaa2_switch_remove(struct fsl_mc_device *sw_dev)
dpsw_disable(ethsw->mc_io, 0, ethsw->dpsw_handle);
- for (i = 0; i < ethsw->sw_attr.num_ifs; i++) {
- port_priv = ethsw->ports[i];
- unregister_netdev(port_priv->netdev);
+ /* Unregister all the netdevs so that they are brought down and the
+ * shared NAPI instances gets disabled.
+ */
+ for (i = 0; i < ethsw->sw_attr.num_ifs; i++)
+ unregister_netdev(ethsw->ports[i]->netdev);
+
+ for (i = 0; i < DPAA2_SWITCH_RX_NUM_FQS; i++)
+ netif_napi_del(ðsw->fq[i].napi);
+
+ for (i = 0; i < ethsw->sw_attr.num_ifs; i++)
dpaa2_switch_remove_port(ethsw, i);
- }
kfree(ethsw->fdbs);
kfree(ethsw->filter_blocks);
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 148/982] xhci: Prevent queuing new commands if xhci is inaccessible
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 147/982] dpaa2-switch: fix handling of NAPI on the remove path Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 149/982] drm/amd/pm: bound pp_dpm_set_pp_table() memcpy Greg Kroah-Hartman
` (840 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mathias Nyman, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
[ Upstream commit 82b70c799281cc24506085be978b829149ba0ca4 ]
Refuse to queue a new command on the command ring if xHC is marked
inaccessible with the HCD_FLAG_HW_ACCESSIBLE.
HCD_FLAG_HW_ACCESSIBLE is set and cleared in suspend and resume.
Also print a warning if xhci is being suspended with commands
still pending on the command ring.
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://patch.msgid.link/20260603091132.1110849-13-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/xhci-ring.c | 6 ++++++
drivers/usb/host/xhci.c | 4 ++++
2 files changed, 10 insertions(+)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index b0da53e9037ed..3f34aa004bc98 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -4429,6 +4429,7 @@ static int queue_command(struct xhci_hcd *xhci, struct xhci_command *cmd,
u32 field3, u32 field4, bool command_must_succeed)
{
int reserved_trbs = xhci->cmd_ring_reserved_trbs;
+ struct usb_hcd *hcd = xhci_to_hcd(xhci);
int ret;
if ((xhci->xhc_state & XHCI_STATE_DYING) ||
@@ -4438,6 +4439,11 @@ static int queue_command(struct xhci_hcd *xhci, struct xhci_command *cmd,
return -ESHUTDOWN;
}
+ if (!HCD_HW_ACCESSIBLE(hcd)) {
+ xhci_warn(xhci, "Can't queue command, xHC not accessible\n");
+ return -ESHUTDOWN;
+ }
+
if (!command_must_succeed)
reserved_trbs++;
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 37fb2491d88f2..104ee26b27aa4 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1062,6 +1062,10 @@ int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup)
/* step 1: stop endpoint */
/* skipped assuming that port suspend has done */
+ /* Check if command ring is empty */
+ if (!list_empty(&xhci->cmd_list))
+ xhci_warn(xhci, "Suspending and stopping xHC with pending command!\n");
+
/* step 2: clear Run/Stop bit */
command = readl(&xhci->op_regs->command);
command &= ~CMD_RUN;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 149/982] drm/amd/pm: bound pp_dpm_set_pp_table() memcpy
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 148/982] xhci: Prevent queuing new commands if xhci is inaccessible Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 150/982] RDMA/irdma: Fix typo in SQ completions generation Greg Kroah-Hartman
` (839 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Asad Kamal, Yang Wang, Alex Deucher,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asad Kamal <asad.kamal@amd.com>
[ Upstream commit f193e71fa9fab2e68ef85201b106e8f580d3a25b ]
The powerplay path allocates hardcode_pp_table once with kmemdup(...,
soft_pp_table_size). memcpy(..., size) used the sysfs store count (up to
PAGE_SIZE) with no upper bound, causing heap overflow. Reject
writes where size exceeds soft_pp_table_size.
Signed-off-by: Asad Kamal <asad.kamal@amd.com>
Reviewed-by: Yang Wang <kevinyang.wang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c b/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c
index 1f8b744d6b178..e4494d963e356 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c
@@ -681,6 +681,9 @@ static int pp_dpm_set_pp_table(void *handle, const char *buf, size_t size)
if (!hwmgr || !hwmgr->pm_en)
return -EINVAL;
+ if (size > hwmgr->soft_pp_table_size)
+ return -EINVAL;
+
if (!hwmgr->hardcode_pp_table) {
hwmgr->hardcode_pp_table = kmemdup(hwmgr->soft_pp_table,
hwmgr->soft_pp_table_size,
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 150/982] RDMA/irdma: Fix typo in SQ completions generation
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 149/982] drm/amd/pm: bound pp_dpm_set_pp_table() memcpy Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 151/982] clk: keystone: dont cache clock rate Greg Kroah-Hartman
` (838 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cyrill Gorcunov, Jacob Moroni,
Jason Gunthorpe, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cyrill Gorcunov <gorcunov@gmail.com>
[ Upstream commit b548a6c4eee5c428663f3944e173e6c92e2e8d6f ]
When we generate completion for SQ the opcode while being properly read
from ring buffer is ignored when written back to completion. Seems
to be a simple typo.
Link: https://patch.msgid.link/r/ahjB87k54bYdFbft@grain
Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
Reviewed-by: Jacob Moroni <jmoroni@google.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/irdma/utils.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/irdma/utils.c b/drivers/infiniband/hw/irdma/utils.c
index 98a3849c39bf0..b66910b2942c2 100644
--- a/drivers/infiniband/hw/irdma/utils.c
+++ b/drivers/infiniband/hw/irdma/utils.c
@@ -2589,7 +2589,7 @@ void irdma_generate_flush_completions(struct irdma_qp *iwqp)
cmpl->cpi.wr_id = qp->sq_wrtrk_array[wqe_idx].wrid;
sw_wqe = qp->sq_base[wqe_idx].elem;
get_64bit_val(sw_wqe, 24, &wqe_qword);
- cmpl->cpi.op_type = (u8)FIELD_GET(IRDMAQPSQ_OPCODE, IRDMAQPSQ_OPCODE);
+ cmpl->cpi.op_type = (u8)FIELD_GET(IRDMAQPSQ_OPCODE, wqe_qword);
cmpl->cpi.q_type = IRDMA_CQE_QTYPE_SQ;
/* remove the SQ WR by moving SQ tail*/
IRDMA_RING_SET_TAIL(*sq_ring,
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 151/982] clk: keystone: dont cache clock rate
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 150/982] RDMA/irdma: Fix typo in SQ completions generation Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 152/982] ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP Greg Kroah-Hartman
` (837 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Walle, Kevin Hilman,
Randolph Sapp, Nishanth Menon, Antonios Christidis, Brian Masney,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Walle <mwalle@kernel.org>
[ Upstream commit a80b32a140c8612bbaed27009c383d43304db6d5 ]
The TISCI firmware will return 0 if the clock or consumer is not
enabled although there is a stored value in the firmware. IOW a call to
set rate will work but at get rate will always return 0 if the clock is
disabled.
The clk framework will try to cache the clock rate when it's requested
by a consumer. If the clock or consumer is not enabled at that point,
the cached value is 0, which is wrong. Thus, disable the cache
altogether.
Signed-off-by: Michael Walle <mwalle@kernel.org>
Reviewed-by: Kevin Hilman <khilman@baylibre.com>
Reviewed-by: Randolph Sapp <rs@ti.com>
Reviewed-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Antonios Christidis <a-christidis@ti.com>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Link: https://patch.msgid.link/20260507-clk-sci-v2-1-38f59b48777a@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/keystone/sci-clk.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/clk/keystone/sci-clk.c b/drivers/clk/keystone/sci-clk.c
index 254f2cf24be21..e1d5c08564c2c 100644
--- a/drivers/clk/keystone/sci-clk.c
+++ b/drivers/clk/keystone/sci-clk.c
@@ -334,6 +334,14 @@ static int _sci_clk_build(struct sci_clk_provider *provider,
init.ops = &sci_clk_ops;
init.num_parents = sci_clk->num_parents;
+
+ /*
+ * A clock rate query to the SCI firmware will return 0 if either the
+ * clock itself is disabled or the attached device/consumer is disabled.
+ * This makes it inherently unsuitable for the caching of the clk
+ * framework.
+ */
+ init.flags = CLK_GET_RATE_NOCACHE;
sci_clk->hw.init = &init;
ret = devm_clk_hw_register(provider->dev, &sci_clk->hw);
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 152/982] ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 151/982] clk: keystone: dont cache clock rate Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 153/982] ipmi: si: Use platform_get_irq_optional() to retrieve interrupt Greg Kroah-Hartman
` (836 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrei Faleichyk, Takashi Iwai,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrei Faleichyk <andrei.faleichyk@noogadev.com>
[ Upstream commit 3580bc53520ce4efc94ece5886ad3670b93667ba ]
The internal microphone on ASUS VivoBook X509DAP (subsystem ID
0x1043:0x197e) is not detected without a quirk entry. Add
ALC256_FIXUP_ASUS_MIC_NO_PRESENCE to fix the issue.
Signed-off-by: Andrei Faleichyk <andrei.faleichyk@noogadev.com>
Link: https://patch.msgid.link/20260603213313.6298-1-andrei.faleichyk@noogadev.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/pci/hda/patch_realtek.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 7b4fd95c66f9b..94bcf1fc639b9 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -10146,6 +10146,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x1043, 0x18f1, "Asus FX505DT", ALC256_FIXUP_ASUS_HEADSET_MIC),
SND_PCI_QUIRK(0x1043, 0x194e, "ASUS UX563FD", ALC294_FIXUP_ASUS_HPE),
SND_PCI_QUIRK(0x1043, 0x1970, "ASUS UX550VE", ALC289_FIXUP_ASUS_GA401),
+ SND_PCI_QUIRK(0x1043, 0x197e, "ASUS VivoBook X509DAP", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1043, 0x1982, "ASUS B1400CEPE", ALC256_FIXUP_ASUS_HPE),
SND_PCI_QUIRK(0x1043, 0x19ce, "ASUS B9450FA", ALC294_FIXUP_ASUS_HPE),
SND_PCI_QUIRK(0x1043, 0x19e1, "ASUS UX581LV", ALC295_FIXUP_ASUS_MIC_NO_PRESENCE),
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 153/982] ipmi: si: Use platform_get_irq_optional() to retrieve interrupt
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 152/982] ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 154/982] wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications Greg Kroah-Hartman
` (835 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Rosen Penev, Corey Minyard,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <rosenp@gmail.com>
[ Upstream commit 39851b7e580a65bee732e5364f0efb974b242370 ]
Use platform_get_irq_optional() to retrieve the interrupt resource
instead of directly parsing and mapping the OF node via
irq_of_parse_and_map(). This is the standard pattern for platform
devices. irq_of_parse_and_map() requires ire_dispose_mapping(), which
is missing.
Assisted-by: Antigravity:Gemini-3.5-Flash
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Message-ID: <20260603192511.6869-1-rosenp@gmail.com>
[Handle a negative return from platform_get_irq_optional() to mean
no interrupt is assigned.]
Signed-off-by: Corey Minyard <corey@minyard.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/ipmi/ipmi_si_platform.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/char/ipmi/ipmi_si_platform.c b/drivers/char/ipmi/ipmi_si_platform.c
index 505cc978c97a0..f7f602067a574 100644
--- a/drivers/char/ipmi/ipmi_si_platform.c
+++ b/drivers/char/ipmi/ipmi_si_platform.c
@@ -279,7 +279,10 @@ static int of_ipmi_probe(struct platform_device *pdev)
io.regspacing = regspacing ? be32_to_cpup(regspacing) : DEFAULT_REGSPACING;
io.regshift = regshift ? be32_to_cpup(regshift) : 0;
- io.irq = irq_of_parse_and_map(pdev->dev.of_node, 0);
+ io.irq = platform_get_irq_optional(pdev, 0);
+ if (io.irq < 0)
+ io.irq = 0;
+
io.dev = &pdev->dev;
dev_dbg(&pdev->dev, "addr 0x%lx regsize %d spacing %d irq %d\n",
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 154/982] wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 153/982] ipmi: si: Use platform_get_irq_optional() to retrieve interrupt Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 155/982] RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() Greg Kroah-Hartman
` (834 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thiyagarajan Pandiyan, Johannes Berg,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thiyagarajan Pandiyan <thiyagarajan@aerlync.com>
[ Upstream commit dfb67ae569bf0726187725b1ef8d89377778861e ]
Currently, ie_len in cfg80211_notify_new_peer_candidate is defined as
1-byte field, capping the maximum IE list size at 255 bytes. When a
large beacon is received, the IE list is truncated, passing incomplete
data to wpa_supplicant. This causes supplicant to fail parsing the IEs.
Increasing the size of ie_len to allow the full length of the IE list to
be forwarded properly.
Signed-off-by: Thiyagarajan Pandiyan <thiyagarajan@aerlync.com>
Link: https://patch.msgid.link/20260605054307.427874-1-thiyagarajan@aerlync.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/cfg80211.h | 2 +-
net/wireless/nl80211.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index f39a60475c24c..90aad35cccc10 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -7273,7 +7273,7 @@ void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid,
* cfg80211 then sends a notification to userspace.
*/
void cfg80211_notify_new_peer_candidate(struct net_device *dev,
- const u8 *macaddr, const u8 *ie, u8 ie_len,
+ const u8 *macaddr, const u8 *ie, size_t ie_len,
int sig_dbm, gfp_t gfp);
/**
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 069b04c29b64e..aa85e2e063bbc 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -18280,7 +18280,7 @@ void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
}
void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
- const u8 *ie, u8 ie_len,
+ const u8 *ie, size_t ie_len,
int sig_dbm, gfp_t gfp)
{
struct wireless_dev *wdev = dev->ieee80211_ptr;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 155/982] RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz()
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (153 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 154/982] wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 156/982] RDMA/mlx5: Fix state and counter desync on loopback enable failure Greg Kroah-Hartman
` (833 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jason Gunthorpe, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <jgg@nvidia.com>
[ Upstream commit 09ea6837a0434fb4db99528a5055b6d822135dcf ]
Several corner cases, especially important on 32 bits:
- umem->iova is u64, the function argument should pass in u64 or
iova will be truncated
- Check that the length is not too large for the iova
- Check that lengths > 4G don't overflow the GENMASK
Link: https://patch.msgid.link/r/2-v1-88303e9e509f+f7-ib_umem_types_jgg@nvidia.com
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/core/umem.c | 18 ++++++++++++------
include/rdma/ib_umem.h | 4 ++--
2 files changed, 14 insertions(+), 8 deletions(-)
diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index 1d154055a335b..9b1994ba7b487 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -78,14 +78,17 @@ static void __ib_umem_release(struct ib_device *dev, struct ib_umem *umem, int d
*/
unsigned long ib_umem_find_best_pgsz(struct ib_umem *umem,
unsigned long pgsz_bitmap,
- unsigned long virt)
+ u64 virt)
{
unsigned long curr_len = 0;
dma_addr_t curr_base = ~0;
- unsigned long va, pgoff;
+ unsigned long pgoff;
struct scatterlist *sg;
- dma_addr_t mask;
+ unsigned long mask = 0;
+ unsigned int bits;
dma_addr_t end;
+ u64 last_va;
+ u64 va;
int i;
umem->iova = va = virt;
@@ -103,9 +106,12 @@ unsigned long ib_umem_find_best_pgsz(struct ib_umem *umem,
* number of required pages. Compute the largest page size that could
* work based on VA address bits that don't change.
*/
- mask = pgsz_bitmap &
- GENMASK(BITS_PER_LONG - 1,
- bits_per((umem->length - 1 + virt) ^ virt));
+ if (check_add_overflow(umem->length - 1, virt, &last_va))
+ return 0;
+ bits = bits_per(virt ^ last_va);
+ if (bits < BITS_PER_LONG)
+ mask = pgsz_bitmap & GENMASK(BITS_PER_LONG - 1, bits);
+
/* offset into first SGL */
pgoff = umem->address & ~PAGE_MASK;
diff --git a/include/rdma/ib_umem.h b/include/rdma/ib_umem.h
index d049e7a60ad65..ace2ffff2312d 100644
--- a/include/rdma/ib_umem.h
+++ b/include/rdma/ib_umem.h
@@ -80,7 +80,7 @@ int ib_umem_copy_from(void *dst, struct ib_umem *umem, size_t offset,
size_t length);
unsigned long ib_umem_find_best_pgsz(struct ib_umem *umem,
unsigned long pgsz_bitmap,
- unsigned long virt);
+ u64 virt);
/**
* ib_umem_find_best_pgoff - Find best HW page size
@@ -144,7 +144,7 @@ static inline int ib_umem_copy_from(void *dst, struct ib_umem *umem, size_t offs
}
static inline unsigned long ib_umem_find_best_pgsz(struct ib_umem *umem,
unsigned long pgsz_bitmap,
- unsigned long virt)
+ u64 virt)
{
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 156/982] RDMA/mlx5: Fix state and counter desync on loopback enable failure
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (154 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 155/982] RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 157/982] bpf: NUL-terminate replaced sysctl value Greg Kroah-Hartman
` (832 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Li RongQing, Jason Gunthorpe,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li RongQing <lirongqing@baidu.com>
[ Upstream commit 0d32eabccbe4b2f8d45be3192c5f3c76c8af703d ]
In mlx5_ib_enable_lb(), dev->lb.enabled was unconditionally set
to true even if mlx5_nic_vport_update_local_lb() failed.
Fix this by only setting dev->lb.enabled on success. On failure,
roll back the reference counters and return the error.
Link: https://patch.msgid.link/r/20260601095818.2227-1-lirongqing@baidu.com
Signed-off-by: Li RongQing <lirongqing@baidu.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/mlx5/main.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 987e9087c9d92..9da42edecb05c 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -1689,6 +1689,9 @@ int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp)
dev->lb.qps == 1) {
if (!dev->lb.enabled) {
err = mlx5_nic_vport_update_local_lb(dev->mdev, true);
+ if (err)
+ goto err_rollback;
+
dev->lb.enabled = true;
}
}
@@ -1696,6 +1699,14 @@ int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp)
mutex_unlock(&dev->lb.mutex);
return err;
+
+err_rollback:
+ if (td)
+ dev->lb.user_td--;
+ if (qp)
+ dev->lb.qps--;
+ mutex_unlock(&dev->lb.mutex);
+ return err;
}
void mlx5_ib_disable_lb(struct mlx5_ib_dev *dev, bool td, bool qp)
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 157/982] bpf: NUL-terminate replaced sysctl value
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (155 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 156/982] RDMA/mlx5: Fix state and counter desync on loopback enable failure Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 158/982] net: cpsw_new: unregister devlink on port registration failure Greg Kroah-Hartman
` (831 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zilin Guan, Dawei Feng,
Yonghong Song, Alexei Starovoitov, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dawei Feng <dawei.feng@seu.edu.cn>
[ Upstream commit a66e3b5bacf38d6ab29fa05a9754f7a114485605 ]
When writing to sysctls, proc_sys_call_handler() guarantees that the
buffer passed to proc handlers is NUL-terminated. If
bpf_sysctl_set_new_value() replaces the pending sysctl value, it can
hand a replacement buffer directly to proc handlers. However, the
helper currently copies only buf_len bytes into that buffer without
appending a NUL terminator, leaving downstream parsers vulnerable to
out-of-bounds access.
Fix this by appending a '\0' after the replaced value to restore the
expected sysctl semantics. Since the helper already rejects buf_len
greater than PAGE_SIZE - 1, there is always room for the extra byte.
Reproduced in a QEMU x86_64 guest booted with KASAN while exercising
the sysctl replacement path with a cgroup/sysctl BPF program. The
reproducer targets `/proc/sys/net/core/flow_limit_cpu_bitmap`, fills
the original user write buffer with non-zero bytes, and overrides the
sysctl value so the replacement buffer lacks a terminating NUL. Under
that setup, the pre-fix kernel reported:
BUG: KASAN: slab-out-of-bounds in strnchrnul+0x72/0x90
Read of size 1 at addr ffff88800de57000 by task repro_patch3/66
CPU: 0 UID: 0 PID: 66 Comm: repro_patch3 Not tainted 7.1.0-rc3-00269-g8370ca1f87cc #6 PREEMPT(lazy)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x68/0xa0
print_report+0xcb/0x5e0
? __virt_addr_valid+0x21d/0x3f0
? strnchrnul+0x72/0x90
? strnchrnul+0x72/0x90
kasan_report+0xca/0x100
? strnchrnul+0x72/0x90
strnchrnul+0x72/0x90
bitmap_parse+0x37/0x2e0
flow_limit_cpu_sysctl+0xc6/0x840
? __pfx_flow_limit_cpu_sysctl+0x10/0x10
? __kvmalloc_node_noprof+0x5ba/0x870
proc_sys_call_handler+0x31d/0x480
? __pfx_proc_sys_call_handler+0x10/0x10
? selinux_file_permission+0x39f/0x500
? lock_is_held_type+0x9e/0x120
vfs_write+0x98e/0x1000
...
</TASK>
The buggy address is located 0 bytes to the right of
allocated 4096-byte region [ffff88800de56000, ffff88800de57000)
With this fix applied, rerunning the same sysctl-targeted path yields
no corresponding KASAN reports.
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Link: https://lore.kernel.org/r/20260603105317.944304-2-dawei.feng@seu.edu.cn
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/cgroup.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
index 3929c7548e6ff..6158b021f617f 100644
--- a/kernel/bpf/cgroup.c
+++ b/kernel/bpf/cgroup.c
@@ -2148,6 +2148,7 @@ BPF_CALL_3(bpf_sysctl_set_new_value, struct bpf_sysctl_kern *, ctx,
return -E2BIG;
memcpy(ctx->new_val, buf, buf_len);
+ ((char *)ctx->new_val)[buf_len] = '\0';
ctx->new_len = buf_len;
ctx->new_updated = 1;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 158/982] net: cpsw_new: unregister devlink on port registration failure
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (156 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 157/982] bpf: NUL-terminate replaced sysctl value Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 159/982] hsr: broadcast netlink notifications in the devices net namespace Greg Kroah-Hartman
` (830 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aleksandr Loktionov,
Alexander Sverdlin, Guangshuo Li, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit b64f763b607426ac97e44b114f0b8844ac3b86dd ]
cpsw_probe() registers devlink before registering the CPSW ports.
If cpsw_register_ports() fails, the error path only unregisters the
notifiers and then releases the lower level resources. It does not undo
the successful cpsw_register_devlink() call, leaving the devlink instance
and its parameters registered after probe has failed.
Add a devlink cleanup label for the path where devlink registration has
already succeeded, and use it when port registration fails.
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Reviewed-by: Alexander Sverdlin <alexander.sverdlin@siemens.com>
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Link: https://patch.msgid.link/20260604043115.1409134-1-lgs201920130244@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/ti/cpsw_new.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/ti/cpsw_new.c b/drivers/net/ethernet/ti/cpsw_new.c
index 17c267f6d79aa..931fc8fdead05 100644
--- a/drivers/net/ethernet/ti/cpsw_new.c
+++ b/drivers/net/ethernet/ti/cpsw_new.c
@@ -2010,7 +2010,7 @@ static int cpsw_probe(struct platform_device *pdev)
ret = cpsw_register_ports(cpsw);
if (ret)
- goto clean_unregister_notifiers;
+ goto clean_unregister_devlink;
dev_notice(dev, "initialized (regs %pa, pool size %d) hw_ver:%08X %d.%d (%d)\n",
&ss_res->start, descs_pool_size,
@@ -2022,6 +2022,8 @@ static int cpsw_probe(struct platform_device *pdev)
return 0;
+clean_unregister_devlink:
+ cpsw_unregister_devlink(cpsw);
clean_unregister_notifiers:
cpsw_unregister_notifiers(cpsw);
clean_cpts:
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 159/982] hsr: broadcast netlink notifications in the devices net namespace
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (157 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 158/982] net: cpsw_new: unregister devlink on port registration failure Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 160/982] ALSA: es18xx: check control allocation before private data setup Greg Kroah-Hartman
` (829 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fernando Fernandez Mancera,
Maoyi Xie, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <maoyixie.tju@gmail.com>
[ Upstream commit a762fabd7ef9a6cc07258684138f9c3f078d0326 ]
The HSR generic netlink family sets .netnsok = true. HSR devices can
live in network namespaces other than init_net.
Two async notifiers broadcast events with genlmsg_multicast(). They
are hsr_nl_ringerror() and hsr_nl_nodedown(). That helper delivers
only on the default genl socket in init_net. So the events always land
in init_net. The network namespace of the device does not matter.
This has two effects. A listener in the device's own namespace never
sees its own ring error and node down events. A privileged listener in
init_net receives events from HSR devices in other namespaces. The
payload carries the peer node MAC (HSR_A_NODE_ADDR) and the slave port
ifindex (HSR_A_IFINDEX).
Switch both callers to genlmsg_multicast_netns(). Other families with
.netnsok = true already do this. Examples are gtp, ovpn, team,
batman-adv, netdev-genl, ethtool and handshake.
hsr_nl_ringerror() already has the slave port. It uses
dev_net(port->dev). hsr_nl_nodedown() takes the namespace from the
master port via hsr_port_get_hsr().
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Link: https://patch.msgid.link/20260604054949.2999304-1-maoyixie.tju@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/hsr/hsr_netlink.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/net/hsr/hsr_netlink.c b/net/hsr/hsr_netlink.c
index 898f18c6da53e..72aad6f845319 100644
--- a/net/hsr/hsr_netlink.c
+++ b/net/hsr/hsr_netlink.c
@@ -233,7 +233,8 @@ void hsr_nl_ringerror(struct hsr_priv *hsr, unsigned char addr[ETH_ALEN],
goto nla_put_failure;
genlmsg_end(skb, msg_head);
- genlmsg_multicast(&hsr_genl_family, skb, 0, 0, GFP_ATOMIC);
+ genlmsg_multicast_netns(&hsr_genl_family, dev_net(port->dev),
+ skb, 0, 0, GFP_ATOMIC);
return;
@@ -269,8 +270,12 @@ void hsr_nl_nodedown(struct hsr_priv *hsr, unsigned char addr[ETH_ALEN])
if (res < 0)
goto nla_put_failure;
+ rcu_read_lock();
+ master = hsr_port_get_hsr(hsr, HSR_PT_MASTER);
genlmsg_end(skb, msg_head);
- genlmsg_multicast(&hsr_genl_family, skb, 0, 0, GFP_ATOMIC);
+ genlmsg_multicast_netns(&hsr_genl_family, dev_net(master->dev),
+ skb, 0, 0, GFP_ATOMIC);
+ rcu_read_unlock();
return;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 160/982] ALSA: es18xx: check control allocation before private data setup
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (158 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 159/982] hsr: broadcast netlink notifications in the devices net namespace Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 161/982] netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() Greg Kroah-Hartman
` (828 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ruoyu Wang, Takashi Iwai,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <ruoyuw560@gmail.com>
[ Upstream commit 422e42b7c2b882ba1d16d4afc8891bcea7c4de93 ]
snd_es18xx_mixer() creates controls with snd_ctl_new1() and then stores
bookkeeping pointers or sets private_free before calling snd_ctl_add().
snd_ctl_new1() can return NULL on allocation failure, so those writes
can dereference a NULL control pointer.
Check the returned control pointers before using them and return -ENOMEM
on allocation failure.
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Link: https://patch.msgid.link/20260607074219.3-1-ruoyuw560@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/isa/es18xx.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/sound/isa/es18xx.c b/sound/isa/es18xx.c
index 0a32845b1017a..1d21c24c9e20d 100644
--- a/sound/isa/es18xx.c
+++ b/sound/isa/es18xx.c
@@ -1776,6 +1776,8 @@ static int snd_es18xx_mixer(struct snd_card *card)
for (idx = 0; idx < ARRAY_SIZE(snd_es18xx_base_controls); idx++) {
struct snd_kcontrol *kctl;
kctl = snd_ctl_new1(&snd_es18xx_base_controls[idx], chip);
+ if (!kctl)
+ return -ENOMEM;
if (chip->caps & ES18XX_HWV) {
switch (idx) {
case 0:
@@ -1837,6 +1839,8 @@ static int snd_es18xx_mixer(struct snd_card *card)
for (idx = 0; idx < ARRAY_SIZE(snd_es18xx_hw_volume_controls); idx++) {
struct snd_kcontrol *kctl;
kctl = snd_ctl_new1(&snd_es18xx_hw_volume_controls[idx], chip);
+ if (!kctl)
+ return -ENOMEM;
if (idx == 0)
chip->hw_volume = kctl;
else
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 161/982] netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (159 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 160/982] ALSA: es18xx: check control allocation before private data setup Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 162/982] btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk() Greg Kroah-Hartman
` (827 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rosen Penev,
Fernando Fernandez Mancera, Pablo Neira Ayuso, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <rosenp@gmail.com>
[ Upstream commit d3bf9eae486490832bd08fd62ab0ac601f346bd4 ]
The timestamp-only fast path dereferences the option stream as
*(__be32 *)ptr, which assumes 4-byte alignment that the TCP option
stream does not guarantee. Use get_unaligned_be32() instead, which
reads the value safely and already returns host byte order, so the
htonl() on the comparison constant can be dropped.
This matches the existing get_unaligned_be32() use later in the same
function.
Assisted-by: Claude:Opus-4.7
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_conntrack_proto_tcp.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index ef1068f9c2fad..c75f42168b6d5 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -405,11 +405,11 @@ static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
return;
/* Fast path for timestamp-only option */
- if (length == TCPOLEN_TSTAMP_ALIGNED
- && *(__be32 *)ptr == htonl((TCPOPT_NOP << 24)
- | (TCPOPT_NOP << 16)
- | (TCPOPT_TIMESTAMP << 8)
- | TCPOLEN_TIMESTAMP))
+ if (length == TCPOLEN_TSTAMP_ALIGNED &&
+ get_unaligned_be32(ptr) == ((TCPOPT_NOP << 24) |
+ (TCPOPT_NOP << 16) |
+ (TCPOPT_TIMESTAMP << 8) |
+ TCPOLEN_TIMESTAMP))
return;
while (length > 0) {
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 162/982] btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk()
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (160 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 161/982] netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:14 ` [PATCH 6.1 163/982] btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF Greg Kroah-Hartman
` (826 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ZhengYuan Huang, David Sterba,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhengYuan Huang <gality369@gmail.com>
[ Upstream commit 18d32b0013efba19f7ad3e5b08d7aee813d604a6 ]
[BUG]
Running btrfs balance can trigger a null-ptr-deref before relocating a
data chunk when metadata corruption leaves a chunk in the chunk tree
without a corresponding block group in the in-memory cache:
KASAN: null-ptr-deref in range [0x0000000000000088-0x000000000000008f]
RIP: 0010:btrfs_may_alloc_data_chunk+0x40/0x1c0 fs/btrfs/volumes.c:3601
Call Trace:
__btrfs_balance fs/btrfs/volumes.c:4217 [inline]
btrfs_balance+0x2516/0x42b0 fs/btrfs/volumes.c:4604
btrfs_ioctl_balance fs/btrfs/ioctl.c:3577 [inline]
btrfs_ioctl+0x25cf/0x5b90 fs/btrfs/ioctl.c:5313
...
[CAUSE]
__btrfs_balance() iterates the on-disk chunk tree and passes the chunk
logical bytenr to btrfs_may_alloc_data_chunk() before relocating a data
chunk. That helper then queries the in-memory block group cache:
cache = btrfs_lookup_block_group(fs_info, chunk_offset);
chunk_type = cache->flags; /* cache may be NULL */
A corrupt image can contain a chunk item whose matching block group
item is missing, so no block group is ever inserted into the cache. In
that case btrfs_lookup_block_group() returns NULL.
The code only guards this with ASSERT(cache), which becomes a no-op when
CONFIG_BTRFS_ASSERT is disabled. The subsequent dereference of
cache->flags therefore crashes the kernel.
[FIX]
Add a NULL check after btrfs_lookup_block_group() in
btrfs_may_alloc_data_chunk() and print and error message for clarity.
Signed-off-by: ZhengYuan Huang <gality369@gmail.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/volumes.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 9f5d5f5c53131..e0a310bd0421f 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -3495,7 +3495,11 @@ static int btrfs_may_alloc_data_chunk(struct btrfs_fs_info *fs_info,
u64 chunk_type;
cache = btrfs_lookup_block_group(fs_info, chunk_offset);
- ASSERT(cache);
+ if (unlikely(!cache)) {
+ btrfs_err(fs_info, "balance: chunk at bytenr %llu has no corresponding block group",
+ chunk_offset);
+ return -EUCLEAN;
+ }
chunk_type = cache->flags;
btrfs_put_block_group(cache);
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 163/982] btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (161 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 162/982] btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk() Greg Kroah-Hartman
@ 2026-09-30 15:14 ` Greg Kroah-Hartman
2026-09-30 15:15 ` [PATCH 6.1 164/982] NFS: fix eof updates after NFSv4.2 fallocate/zero-range Greg Kroah-Hartman
` (825 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qu Wenruo, Zhang Cen, David Sterba,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Cen <rollkingzzc@gmail.com>
[ Upstream commit 0af37c217edf15fa21dac1c40822086df356c6bb ]
ROOT_REF and ROOT_BACKREF items contain a struct btrfs_root_ref followed
by the subvolume name. Several readers assume that this layout is already
valid and then use the on-disk name length directly. A corrupted item can
therefore make those readers address bytes outside the item, and
BTRFS_IOC_GET_SUBVOL_INFO can copy too many bytes into its fixed-size UAPI
name buffer.
Validate ROOT_REF and ROOT_BACKREF items in tree-checker before any reader
uses them. Reject records that do not contain a non-empty name, whose
name_len does not exactly describe the remaining item payload, or whose
name exceeds BTRFS_NAME_LEN.
For BTRFS_IOC_GET_SUBVOL_INFO, copy only the validated on-disk name_len
instead of deriving the copy length from the item size. The ioctl result is
zeroed when allocated. That leaves the existing trailing zero byte
untouched.
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Zhang Cen <rollkingzzc@gmail.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/ioctl.c | 11 +++++------
fs/btrfs/tree-checker.c | 35 +++++++++++++++++++++++++++++++++++
2 files changed, 40 insertions(+), 6 deletions(-)
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index b84b1cce17723..e278da90888e1 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -3058,7 +3058,6 @@ static int btrfs_ioctl_get_subvol_info(struct inode *inode, void __user *argp)
struct btrfs_root_ref *rref;
struct extent_buffer *leaf;
unsigned long item_off;
- unsigned long item_len;
int slot;
int ret = 0;
@@ -3133,17 +3132,17 @@ static int btrfs_ioctl_get_subvol_info(struct inode *inode, void __user *argp)
btrfs_item_key_to_cpu(leaf, &key, slot);
if (key.objectid == subvol_info->treeid &&
key.type == BTRFS_ROOT_BACKREF_KEY) {
+ u16 name_len;
+
subvol_info->parent_id = key.offset;
rref = btrfs_item_ptr(leaf, slot, struct btrfs_root_ref);
+ name_len = btrfs_root_ref_name_len(leaf, rref);
subvol_info->dirid = btrfs_root_ref_dirid(leaf, rref);
- item_off = btrfs_item_ptr_offset(leaf, slot)
- + sizeof(struct btrfs_root_ref);
- item_len = btrfs_item_size(leaf, slot)
- - sizeof(struct btrfs_root_ref);
+ item_off = btrfs_item_ptr_offset(leaf, slot) + sizeof(*rref);
read_extent_buffer(leaf, subvol_info->name,
- item_off, item_len);
+ item_off, name_len);
} else {
ret = -ENOENT;
goto out;
diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c
index 0b1ab9b6b84b4..3e3ffa23cea65 100644
--- a/fs/btrfs/tree-checker.c
+++ b/fs/btrfs/tree-checker.c
@@ -1232,6 +1232,37 @@ static int check_root_item(struct extent_buffer *leaf, struct btrfs_key *key,
return 0;
}
+static int check_root_ref(struct extent_buffer *leaf, struct btrfs_key *key, int slot)
+{
+ struct btrfs_root_ref *rref;
+ u32 item_size = btrfs_item_size(leaf, slot);
+ u32 name_len;
+
+ if (unlikely(item_size <= sizeof(*rref))) {
+ generic_err(leaf, slot,
+ "invalid root ref item size for key type %u, have %u expect > %zu",
+ key->type, item_size, sizeof(*rref));
+ return -EUCLEAN;
+ }
+
+ rref = btrfs_item_ptr(leaf, slot, struct btrfs_root_ref);
+ name_len = btrfs_root_ref_name_len(leaf, rref);
+ if (unlikely(name_len > BTRFS_NAME_LEN)) {
+ generic_err(leaf, slot,
+ "root ref name too long for key type %u, have %u max %u",
+ key->type, name_len, BTRFS_NAME_LEN);
+ return -EUCLEAN;
+ }
+ if (unlikely(item_size != sizeof(*rref) + name_len)) {
+ generic_err(leaf, slot,
+ "invalid root ref item size for key type %u, have %u expect %zu",
+ key->type, item_size, sizeof(*rref) + name_len);
+ return -EUCLEAN;
+ }
+
+ return 0;
+}
+
__printf(3,4)
__cold
static void extent_err(const struct extent_buffer *eb, int slot,
@@ -1765,6 +1796,10 @@ static int check_leaf_item(struct extent_buffer *leaf,
case BTRFS_ROOT_ITEM_KEY:
ret = check_root_item(leaf, key, slot);
break;
+ case BTRFS_ROOT_REF_KEY:
+ case BTRFS_ROOT_BACKREF_KEY:
+ ret = check_root_ref(leaf, key, slot);
+ break;
case BTRFS_EXTENT_ITEM_KEY:
case BTRFS_METADATA_ITEM_KEY:
ret = check_extent_item(leaf, key, slot, prev_key);
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 164/982] NFS: fix eof updates after NFSv4.2 fallocate/zero-range
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (162 preceding siblings ...)
2026-09-30 15:14 ` [PATCH 6.1 163/982] btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF Greg Kroah-Hartman
@ 2026-09-30 15:15 ` Greg Kroah-Hartman
2026-09-30 15:15 ` [PATCH 6.1 165/982] RDMA/rtrs-srv: Fix integer underflow in process_read and process_write Greg Kroah-Hartman
` (824 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dai Ngo, Anna Schumaker, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dai Ngo <dai.ngo@oracle.com>
[ Upstream commit 35168eb947f230aaa35fd8416a30563ef89f5421 ]
Generic/075 reliably exposes a regression when the client holds an
NFSv4 write delegation: ZERO_RANGE/ALLOCATE extends the file on the
server, but the local inode keeps the old i_size. The test then fails
with 'Size error' because the post-op attribute refresh refuses to
touch i_size while a delegation is outstanding, and the cached EOF
was never marked stale.
Update _nfs42_proc_fallocate() so that on success it:
- bumps i_size when the operation extends the file, and
- marks NFS_INO_INVALID_BLOCKS since the block count can also change
Tested with xfstests generic/075 over NFSv4.2.
Signed-off-by: Dai Ngo <dai.ngo@oracle.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/nfs42proc.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c
index 923ccd3b540f5..ad0ab93c1bb04 100644
--- a/fs/nfs/nfs42proc.c
+++ b/fs/nfs/nfs42proc.c
@@ -79,12 +79,17 @@ static int _nfs42_proc_fallocate(struct rpc_message *msg, struct file *filep,
status = nfs4_call_sync(server->client, server, msg,
&args.seq_args, &res.seq_res, 0);
if (status == 0) {
- if (nfs_should_remove_suid(inode)) {
- spin_lock(&inode->i_lock);
+ loff_t newsize = offset + len;
+
+ spin_lock(&inode->i_lock);
+ if (newsize > i_size_read(inode))
+ i_size_write(inode, newsize);
+ nfs_set_cache_invalid(inode, NFS_INO_INVALID_BLOCKS);
+ if (nfs_should_remove_suid(inode))
nfs_set_cache_invalid(inode,
- NFS_INO_REVAL_FORCED | NFS_INO_INVALID_MODE);
- spin_unlock(&inode->i_lock);
- }
+ NFS_INO_REVAL_FORCED |
+ NFS_INO_INVALID_MODE);
+ spin_unlock(&inode->i_lock);
status = nfs_post_op_update_inode_force_wcc(inode,
res.falloc_fattr);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 165/982] RDMA/rtrs-srv: Fix integer underflow in process_read and process_write
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (163 preceding siblings ...)
2026-09-30 15:15 ` [PATCH 6.1 164/982] NFS: fix eof updates after NFSv4.2 fallocate/zero-range Greg Kroah-Hartman
@ 2026-09-30 15:15 ` Greg Kroah-Hartman
2026-09-30 15:15 ` [PATCH 6.1 166/982] xprtrdma: Add request-pool slack for delayed recycling Greg Kroah-Hartman
` (823 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aurelien DESBRIERES, Md Haris Iqbal,
Jason Gunthorpe, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aurelien DESBRIERES <aurelien@hackers.camp>
[ Upstream commit 54bf38b27afc08a0eb6b732f9c14eb8a4bcb66b5 ]
usr_len is read from a network-supplied message field (le16_to_cpu)
and used to compute data_len = off - usr_len without validating that
usr_len <= off. A malicious RDMA client can send usr_len > off causing
an integer underflow, resulting in data_len wrapping to a huge size_t
value which is then passed to the rdma_ev callback as a memory length,
leading to out-of-bounds memory access.
Fix by reading and validating usr_len <= off before rtrs_srv_get_ops_ids()
in both process_read() and process_write(), ensuring the early return
path acquires no reference and has no resource leak.
Link: https://patch.msgid.link/r/20260608134802.5019-1-aurelien@hackers.camp
Reported-by: Aurelien DESBRIERES <aurelien@hackers.camp>
Reviewed-by: Md Haris Iqbal <haris.iqbal@ionos.com>
Signed-off-by: Aurelien DESBRIERES <aurelien@hackers.camp>
Assisted-by: Claude <claude-sonnet-4-6>
Acked-by: Md Haris Iqbal <haris.iqbal@ionos.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/ulp/rtrs/rtrs-srv.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
index 086dba6b97c64..a7c0b7e513fea 100644
--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
@@ -1040,6 +1040,11 @@ static void process_read(struct rtrs_srv_con *con,
"Processing read request failed, invalid message\n");
return;
}
+ usr_len = le16_to_cpu(msg->usr_len);
+ if (usr_len > off) {
+ pr_debug("rtrs-srv: Invalid usr_len %zu > off %u\n", usr_len, off);
+ return;
+ }
rtrs_srv_get_ops_ids(srv_path);
rtrs_srv_update_rdma_stats(srv_path->stats, off, READ);
id = srv_path->ops_ids[buf_id];
@@ -1047,7 +1052,6 @@ static void process_read(struct rtrs_srv_con *con,
id->dir = READ;
id->msg_id = buf_id;
id->rd_msg = msg;
- usr_len = le16_to_cpu(msg->usr_len);
data_len = off - usr_len;
data = page_address(srv->chunks[buf_id]);
ret = ctx->ops.rdma_ev(srv->priv, id, data, data_len,
@@ -1093,6 +1097,11 @@ static void process_write(struct rtrs_srv_con *con,
rtrs_srv_state_str(srv_path->state));
return;
}
+ usr_len = le16_to_cpu(req->usr_len);
+ if (usr_len > off) {
+ pr_debug("rtrs-srv: Invalid usr_len %zu > off %u\n", usr_len, off);
+ return;
+ }
rtrs_srv_get_ops_ids(srv_path);
rtrs_srv_update_rdma_stats(srv_path->stats, off, WRITE);
id = srv_path->ops_ids[buf_id];
@@ -1100,7 +1109,6 @@ static void process_write(struct rtrs_srv_con *con,
id->dir = WRITE;
id->msg_id = buf_id;
- usr_len = le16_to_cpu(req->usr_len);
data_len = off - usr_len;
data = page_address(srv->chunks[buf_id]);
ret = ctx->ops.rdma_ev(srv->priv, id, data, data_len,
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 166/982] xprtrdma: Add request-pool slack for delayed recycling
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (164 preceding siblings ...)
2026-09-30 15:15 ` [PATCH 6.1 165/982] RDMA/rtrs-srv: Fix integer underflow in process_read and process_write Greg Kroah-Hartman
@ 2026-09-30 15:15 ` Greg Kroah-Hartman
2026-09-30 15:15 ` [PATCH 6.1 167/982] configfs_depend_prep(): pass configfs_dirent instead of dentry Greg Kroah-Hartman
` (822 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chuck Lever, Anna Schumaker,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
[ Upstream commit 64bf6892057b746c55bcc045b9492741b72d8d27 ]
After the previous patch gates req recycling on Send completion,
a completed RPC's rpcrdma_req can remain pinned by the sendctx
ring until the next signaled Send completion releases it. The
transmitted-RPC ceiling is unchanged: xprt_request_get_cong()
gates Sends against xprt->cwnd, the RPC/RDMA credit window fed
by server-granted credits and capped at re_max_requests. The
req pool, however, must exceed max_reqs by enough that this
recycle delay does not stall a slot allocation that the credit
window would admit.
The headroom is bounded. frwr_open() sets re_send_batch to
re_max_requests >> 3 -- one in every eight Sends is signaled --
so at most re_send_batch unsignaled Sends can be outstanding
before the next signaled completion releases them. That equals
max_reqs / 8 reqs in the worst case, with a one-slot floor for
small max_reqs values where the right-shift rounds to zero.
The sendctx ring and the hardware Send Queue are not enlarged
to match. Both are sized in rpcrdma_sendctxs_create() and
frwr_query_device() for re_max_requests in-flight Sends, which
is the ceiling the credit window enforces. The pool slack does
not raise that ceiling -- it only lets allocation keep pace
with the credit window during the brief interval in which
earlier reqs are pinned waiting for the next signaled
completion. At any moment, at most re_send_batch sendctxes are
held by unswept unsignaled Sends, leaving the rest of the ring
available for newly admitted Sends.
Allocate max_reqs + DIV_ROUND_UP(max_reqs, 8) request objects
and name the slack calculation at the allocation site so the
1/8 bound stays tied to the Send-signaling batch size.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sunrpc/xprtrdma/verbs.c | 21 ++++++++++++++++++++-
1 file changed, 20 insertions(+), 1 deletion(-)
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index a97f0b18ac429..34a3c08a82fba 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -1110,6 +1110,22 @@ static void rpcrdma_reps_destroy(struct rpcrdma_buffer *buf)
spin_unlock(&buf->rb_lock);
}
+static unsigned int rpcrdma_req_pool_slack(unsigned int max_reqs)
+{
+ /* The sendctx ring can hold up to one Send-signaling batch
+ * (re_send_batch, set by frwr_open() to re_max_requests >> 3)
+ * of unfinished Sends. Each pins its req until a signaled Send
+ * completion releases the sendctx. Size the pool above max_reqs
+ * by that batch so the recycle delay does not stall a slot
+ * allocation that the RPC/RDMA credit window would admit.
+ *
+ * Round up: re_max_requests >> 3 is zero when max_reqs < 8, but
+ * a single unsignaled Send is still enough to pin one req. One
+ * slack slot covers that case.
+ */
+ return DIV_ROUND_UP(max_reqs, 8);
+}
+
/**
* rpcrdma_buffer_create - Create initial set of req/rep objects
* @r_xprt: transport instance to (re)initialize
@@ -1119,6 +1135,7 @@ static void rpcrdma_reps_destroy(struct rpcrdma_buffer *buf)
int rpcrdma_buffer_create(struct rpcrdma_xprt *r_xprt)
{
struct rpcrdma_buffer *buf = &r_xprt->rx_buf;
+ unsigned int max_reqs;
int i, rc;
buf->rb_bc_srv_max_requests = 0;
@@ -1132,7 +1149,9 @@ int rpcrdma_buffer_create(struct rpcrdma_xprt *r_xprt)
INIT_LIST_HEAD(&buf->rb_all_reps);
rc = -ENOMEM;
- for (i = 0; i < r_xprt->rx_xprt.max_reqs; i++) {
+ max_reqs = r_xprt->rx_xprt.max_reqs;
+ max_reqs += rpcrdma_req_pool_slack(max_reqs);
+ for (i = 0; i < max_reqs; i++) {
struct rpcrdma_req *req;
req = rpcrdma_req_create(r_xprt,
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 167/982] configfs_depend_prep(): pass configfs_dirent instead of dentry
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (165 preceding siblings ...)
2026-09-30 15:15 ` [PATCH 6.1 166/982] xprtrdma: Add request-pool slack for delayed recycling Greg Kroah-Hartman
@ 2026-09-30 15:15 ` Greg Kroah-Hartman
2026-09-30 15:15 ` [PATCH 6.1 168/982] net: ibm: emac: mal: fix potential system hang in mal_remove() Greg Kroah-Hartman
` (821 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jan Kara, Breno Leitao, Al Viro,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
[ Upstream commit 764682e0118432260191d194edbdaff208260483 ]
Again, the only thing it uses dentry for is dentry->d_fsdata; for the
recursive call the situation is the same as with configfs_detach_prep()
and the same observation about ->s_dentry->d_fsdata applies.
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/configfs/dir.c | 12 ++++--------
1 file changed, 4 insertions(+), 8 deletions(-)
diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
index 01c9d54833b30..69762a33dff6b 100644
--- a/fs/configfs/dir.c
+++ b/fs/configfs/dir.c
@@ -1060,15 +1060,12 @@ static int configfs_dump(struct configfs_dirent *sd, int level)
* much on the stack, though, so folks that need this function - be careful
* about your stack! Patches will be accepted to make it iterative.
*/
-static int configfs_depend_prep(struct dentry *origin,
+static int configfs_depend_prep(struct configfs_dirent *sd,
struct config_item *target)
{
- struct configfs_dirent *child_sd, *sd;
+ struct configfs_dirent *child_sd;
int ret = 0;
- BUG_ON(!origin || !origin->d_fsdata);
- sd = origin->d_fsdata;
-
if (sd->s_element == target) /* Boo-yah */
goto out;
@@ -1076,8 +1073,7 @@ static int configfs_depend_prep(struct dentry *origin,
if ((child_sd->s_type & CONFIGFS_DIR) &&
!(child_sd->s_type & CONFIGFS_USET_DROPPING) &&
!(child_sd->s_type & CONFIGFS_USET_CREATING)) {
- ret = configfs_depend_prep(child_sd->s_dentry,
- target);
+ ret = configfs_depend_prep(child_sd, target);
if (!ret)
goto out; /* Child path boo-yah */
}
@@ -1098,7 +1094,7 @@ static int configfs_do_depend_item(struct dentry *subsys_dentry,
spin_lock(&configfs_dirent_lock);
/* Scan the tree, return 0 if found */
- ret = configfs_depend_prep(subsys_dentry, target);
+ ret = configfs_depend_prep(subsys_dentry->d_fsdata, target);
if (ret)
goto out_unlock_dirent_lock;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 168/982] net: ibm: emac: mal: fix potential system hang in mal_remove()
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (166 preceding siblings ...)
2026-09-30 15:15 ` [PATCH 6.1 167/982] configfs_depend_prep(): pass configfs_dirent instead of dentry Greg Kroah-Hartman
@ 2026-09-30 15:15 ` Greg Kroah-Hartman
2026-09-30 15:15 ` [PATCH 6.1 169/982] platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table Greg Kroah-Hartman
` (820 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rosen Penev, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <rosenp@gmail.com>
[ Upstream commit 7c5d41f87f079990bf241359e3c1332d8d10fe87 ]
napi_disable() is not idempotent and calling it on an already-disabled
or unenabled NAPI context will cause the kernel to spin indefinitely
waiting for the NAPI_STATE_SCHED bit to clear.
In mal_remove(), napi_disable() is called unconditionally. If no MACs were
registered, NAPI was never enabled. Also, if they were registered but
subsequently unregistered, NAPI was already disabled in
mal_unregister_commac(). In either case, calling napi_disable() causes
the kernel to hang upon module removal.
Fix this by only calling napi_disable() in mal_remove() if the commac list
is not empty (which implies NAPI is enabled).
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://patch.msgid.link/20260603230821.5619-1-rosenp@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/ibm/emac/mal.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/ibm/emac/mal.c b/drivers/net/ethernet/ibm/emac/mal.c
index f30a2b8a7c173..4e8afa8ad5e4a 100644
--- a/drivers/net/ethernet/ibm/emac/mal.c
+++ b/drivers/net/ethernet/ibm/emac/mal.c
@@ -716,13 +716,13 @@ static int mal_remove(struct platform_device *ofdev)
MAL_DBG(mal, "remove" NL);
/* Synchronize with scheduled polling */
- napi_disable(&mal->napi);
-
- if (!list_empty(&mal->list))
+ if (!list_empty(&mal->list)) {
+ napi_disable(&mal->napi);
/* This is *very* bad */
WARN(1, KERN_EMERG
"mal%d: commac list is not empty on remove!\n",
mal->index);
+ }
free_irq(mal->serr_irq, mal);
free_irq(mal->txde_irq, mal);
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 169/982] platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (167 preceding siblings ...)
2026-09-30 15:15 ` [PATCH 6.1 168/982] net: ibm: emac: mal: fix potential system hang in mal_remove() Greg Kroah-Hartman
@ 2026-09-30 15:15 ` Greg Kroah-Hartman
2026-09-30 15:15 ` [PATCH 6.1 170/982] wifi: mt76: transform aspm_conf for pci_disable_link_state Greg Kroah-Hartman
` (819 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gleb Sonichev, Pali Rohár,
Ilpo Järvinen, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gleb Sonichev <sonichev555@gmail.com>
[ Upstream commit bfe91a80b13f8068f6fa07aa8c468d284150d4ad ]
The Inspiron N5110 needs the touchpad LED quirk (Vostro V130 quirk)
to properly control the touchpad LED. Add its DMI identifier
to the existing quirk table, next to the similar Inspiron M5110 entry.
Tested on Dell Inspiron N5110.
The touchpad LED works correctly with this quirk enabled.
Signed-off-by: Gleb Sonichev <sonichev555@gmail.com>
Acked-by: Pali Rohár <pali@kernel.org>
Link: https://patch.msgid.link/20260525100047.20046-1-sonichev555@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/dell/dell-laptop.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/platform/x86/dell/dell-laptop.c b/drivers/platform/x86/dell/dell-laptop.c
index e92c3ad06d696..215861c11dc45 100644
--- a/drivers/platform/x86/dell/dell-laptop.c
+++ b/drivers/platform/x86/dell/dell-laptop.c
@@ -205,6 +205,15 @@ static const struct dmi_system_id dell_quirks[] __initconst = {
},
.driver_data = &quirk_dell_vostro_v130,
},
+ {
+ .callback = dmi_matched,
+ .ident = "Dell Inspiron N5110",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron N5110"),
+ },
+ .driver_data = &quirk_dell_vostro_v130,
+ },
{
.callback = dmi_matched,
.ident = "Dell Vostro 3360",
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 170/982] wifi: mt76: transform aspm_conf for pci_disable_link_state
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (168 preceding siblings ...)
2026-09-30 15:15 ` [PATCH 6.1 169/982] platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table Greg Kroah-Hartman
@ 2026-09-30 15:15 ` Greg Kroah-Hartman
2026-09-30 15:15 ` [PATCH 6.1 171/982] btrfs: protect sb_write_pointer() with invalidate lock Greg Kroah-Hartman
` (818 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiajia Liu, Felix Fietkau,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiajia Liu <liujiajia@kylinos.cn>
[ Upstream commit 2dd78856223484895306351df1f903a4b75d213f ]
commit b478e162f227 ("PCI/ASPM: Consolidate link state defines") changed
PCIE_LINK_STATE_L0S (1) to (BIT(0) | BIT(1)). PCI_EXP_LNKCTL_ASPM_L0S (1)
and PCI_EXP_LNKCTL_ASPM_L1 (2) are no longer matched with
PCIE_LINK_STATE_L0S (3) and PCIE_LINK_STATE_L1 (4).
On the platform enabling ASPM L0s and L1, mt76_pci_disable_aspm is not able
to disable L1. Fix this by transforming aspm_conf to pcie link state.
Signed-off-by: Jiajia Liu <liujiajia@kylinos.cn>
Link: https://patch.msgid.link/20260602054349.42429-1-liujia6264@gmail.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/pci.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/pci.c b/drivers/net/wireless/mediatek/mt76/pci.c
index 4c1c159fbb62f..36dba6e03e8b4 100644
--- a/drivers/net/wireless/mediatek/mt76/pci.c
+++ b/drivers/net/wireless/mediatek/mt76/pci.c
@@ -30,8 +30,14 @@ void mt76_pci_disable_aspm(struct pci_dev *pdev)
if (IS_ENABLED(CONFIG_PCIEASPM)) {
int err;
+ int state = 0;
- err = pci_disable_link_state(pdev, aspm_conf);
+ if (aspm_conf & PCI_EXP_LNKCTL_ASPM_L0S)
+ state |= PCIE_LINK_STATE_L0S;
+ if (aspm_conf & PCI_EXP_LNKCTL_ASPM_L1)
+ state |= PCIE_LINK_STATE_L1;
+
+ err = pci_disable_link_state(pdev, state);
if (!err)
return;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 171/982] btrfs: protect sb_write_pointer() with invalidate lock
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (169 preceding siblings ...)
2026-09-30 15:15 ` [PATCH 6.1 170/982] wifi: mt76: transform aspm_conf for pci_disable_link_state Greg Kroah-Hartman
@ 2026-09-30 15:15 ` Greg Kroah-Hartman
2026-09-30 15:15 ` [PATCH 6.1 172/982] hwmon: (adt7462) Add of_match_table to support devicetree Greg Kroah-Hartman
` (817 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, KangNing Liao, Qu Wenruo,
David Sterba, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: KangNing Liao <lkangn.kernel@gmail.com>
[ Upstream commit 123b9a545f4d0348e81f558a032bf2a93ee5722f ]
sb_write_pointer() reads the super block from the block device page cache
using read_cache_page_gfp(). This has the same race with BLKBSZSET as the
one fixed by commit 3f29d661e568 ("btrfs: sync read disk super and set
block size").
Take the mapping invalidate lock around read_cache_page_gfp() to
serialize the read against block size changes.
Signed-off-by: KangNing Liao <lkangn.kernel@gmail.com>
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/zoned.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/btrfs/zoned.c b/fs/btrfs/zoned.c
index 4e2ed51297ea1..1c4f959923dd4 100644
--- a/fs/btrfs/zoned.c
+++ b/fs/btrfs/zoned.c
@@ -123,8 +123,10 @@ static int sb_write_pointer(struct block_device *bdev, struct blk_zone *zones,
u64 bytenr = ALIGN_DOWN(zone_end, BTRFS_SUPER_INFO_SIZE) -
BTRFS_SUPER_INFO_SIZE;
+ filemap_invalidate_lock(mapping);
page[i] = read_cache_page_gfp(mapping,
bytenr >> PAGE_SHIFT, GFP_NOFS);
+ filemap_invalidate_unlock(mapping);
if (IS_ERR(page[i])) {
if (i == 1)
btrfs_release_disk_super(super[0]);
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 172/982] hwmon: (adt7462) Add of_match_table to support devicetree
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (170 preceding siblings ...)
2026-09-30 15:15 ` [PATCH 6.1 171/982] btrfs: protect sb_write_pointer() with invalidate lock Greg Kroah-Hartman
@ 2026-09-30 15:15 ` Greg Kroah-Hartman
2026-09-30 15:15 ` [PATCH 6.1 173/982] vdpa/ifcvf: handle dev_set_name() failure in ifcvf_vdpa_dev_add() Greg Kroah-Hartman
` (816 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kory Maincent, Romain Gantois,
Guenter Roeck, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kory Maincent <kory.maincent@bootlin.com>
[ Upstream commit cd1b42617aafe01810ab7d3b9948d2f5fa9fb8af ]
Add of_match_table to add support of devicetree probing.
Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
[rgantois: Removed of_match_ptr().]
Signed-off-by: Romain Gantois <romain.gantois@bootlin.com>
Link: https://lore.kernel.org/r/20260608-adt7462-bindings-v2-1-272982c40325@bootlin.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/adt7462.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/hwmon/adt7462.c b/drivers/hwmon/adt7462.c
index 9c0235849d4b6..f6ec0c1e51b19 100644
--- a/drivers/hwmon/adt7462.c
+++ b/drivers/hwmon/adt7462.c
@@ -12,6 +12,7 @@
#include <linux/hwmon.h>
#include <linux/hwmon-sysfs.h>
#include <linux/err.h>
+#include <linux/mod_devicetable.h>
#include <linux/mutex.h>
#include <linux/log2.h>
#include <linux/slab.h>
@@ -1814,10 +1815,17 @@ static const struct i2c_device_id adt7462_id[] = {
};
MODULE_DEVICE_TABLE(i2c, adt7462_id);
+static const struct of_device_id adt7462_of_match[] = {
+ { .compatible = "onnn,adt7462" },
+ { },
+};
+MODULE_DEVICE_TABLE(of, adt7462_of_match);
+
static struct i2c_driver adt7462_driver = {
.class = I2C_CLASS_HWMON,
.driver = {
.name = "adt7462",
+ .of_match_table = adt7462_of_match,
},
.probe_new = adt7462_probe,
.id_table = adt7462_id,
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 173/982] vdpa/ifcvf: handle dev_set_name() failure in ifcvf_vdpa_dev_add()
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (171 preceding siblings ...)
2026-09-30 15:15 ` [PATCH 6.1 172/982] hwmon: (adt7462) Add of_match_table to support devicetree Greg Kroah-Hartman
@ 2026-09-30 15:15 ` Greg Kroah-Hartman
2026-09-30 15:15 ` [PATCH 6.1 174/982] ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC Greg Kroah-Hartman
` (815 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Evgenii Burenchev, Jason Wang,
Zhu Lingshan, Michael S. Tsirkin, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Evgenii Burenchev <evg28bur@yandex.ru>
[ Upstream commit 4c653e85857b41a7148917f2628fae1d04a9c251 ]
dev_set_name() may fail and return an error, but its return value
is currently ignored and overwritten by _vdpa_register_device().
Abort device creation if dev_set_name() fails and release the
device reference to avoid continuing with an improperly initialized
struct device.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Evgenii Burenchev <evg28bur@yandex.ru>
Acked-by: Jason Wang <jasowang@redhat.com>
Acked-by: Zhu Lingshan <lingshan.zhu@kernel.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260226152924.38790-1-evg28bur@yandex.ru>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vdpa/ifcvf/ifcvf_main.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/vdpa/ifcvf/ifcvf_main.c b/drivers/vdpa/ifcvf/ifcvf_main.c
index d5036f49f161a..b1711b2e30ceb 100644
--- a/drivers/vdpa/ifcvf/ifcvf_main.c
+++ b/drivers/vdpa/ifcvf/ifcvf_main.c
@@ -766,15 +766,22 @@ static int ifcvf_vdpa_dev_add(struct vdpa_mgmt_dev *mdev, const char *name,
ret = dev_set_name(&vdpa_dev->dev, "%s", name);
else
ret = dev_set_name(&vdpa_dev->dev, "vdpa%u", vdpa_dev->index);
+ if (ret) {
+ IFCVF_ERR(pdev, "Failed to set device name");
+ goto err;
+ }
ret = _vdpa_register_device(&adapter->vdpa, vf->nr_vring);
if (ret) {
- put_device(&adapter->vdpa.dev);
IFCVF_ERR(pdev, "Failed to register to vDPA bus");
- return ret;
+ goto err;
}
return 0;
+
+err:
+ put_device(&adapter->vdpa.dev);
+ return ret;
}
static void ifcvf_vdpa_dev_del(struct vdpa_mgmt_dev *mdev, struct vdpa_device *dev)
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 174/982] ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (172 preceding siblings ...)
2026-09-30 15:15 ` [PATCH 6.1 173/982] vdpa/ifcvf: handle dev_set_name() failure in ifcvf_vdpa_dev_add() Greg Kroah-Hartman
@ 2026-09-30 15:15 ` Greg Kroah-Hartman
2026-09-30 15:15 ` [PATCH 6.1 175/982] ata: libata-pmp: add JMicron JMS562 quirk Greg Kroah-Hartman
` (814 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Furst Blumier, Takashi Iwai,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Furst Blumier <seal@furst.blue>
[ Upstream commit 98e157916f83c26a41448267180944048d2f1460 ]
The HP 255 15.6 inch G9 Notebook PC (PCI SSID 103c:8a1b) uses the
ALC236 codec but lacks an entry in the quirk table, causing the kernel
to fall back to a null SSID match (103c:0000) and skip the necessary
fixup. Add a quirk entry using ALC236_FIXUP_HP_MUTE_LED_COEFBIT2,
matching the HP 255 G8 which uses the same codec and fixup. This fixes
the mute-button LED and fixes an issue with unplugging and replugging a
headset jack not being recognized as an audio sink.
Signed-off-by: Furst Blumier <seal@furst.blue>
Link: https://patch.msgid.link/20260609201706.502075-1-seal@furst.blue
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/pci/hda/patch_realtek.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 94bcf1fc639b9..a7e802e6d0d58 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -10021,6 +10021,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x103c, 0x89ca, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
SND_PCI_QUIRK(0x103c, 0x89d3, "HP EliteBook 645 G9 (MB 89D2)", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
SND_PCI_QUIRK(0x103c, 0x8a0f, "HP Pavilion 14-ec1xxx", ALC287_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8a1b, "HP 255 15.6 inch G9 Notebook PC", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
SND_PCI_QUIRK(0x103c, 0x8a1f, "HP Laptop 14s-dr5xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
SND_PCI_QUIRK(0x103c, 0x8a20, "HP Laptop 15s-fq5xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
SND_PCI_QUIRK(0x103c, 0x8a25, "HP Victus 16-d1xxx (MB 8A25)", ALC245_FIXUP_HP_MUTE_LED_COEFBIT),
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 175/982] ata: libata-pmp: add JMicron JMS562 quirk
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (173 preceding siblings ...)
2026-09-30 15:15 ` [PATCH 6.1 174/982] ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC Greg Kroah-Hartman
@ 2026-09-30 15:15 ` Greg Kroah-Hartman
2026-09-30 15:15 ` [PATCH 6.1 176/982] platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table Greg Kroah-Hartman
` (813 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xu Rao, Damien Le Moal,
Niklas Cassel, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Rao <raoxu@uniontech.com>
[ Upstream commit c62aff1174cf88e10716c7513702443c47551fc6 ]
JMicron JMS562, as used in QNAP QDA-A2AR RAID1 adapters, may
keep the exported ATA device not ready while the array is rebuilding.
In this state, libata may repeatedly try to softreset and classify
the fan-out link. On the affected adapter, this can time out, make
PMP/SCR access fail, and eventually disable the fan-out link before
the RAID volume is exported.
A failing boot shows the fan-out link failing SRST, PMP access
timing out, SCR read failing, and the link being disabled:
ata4.00: softreset failed (device not ready)
ata4.15: qc timeout after 3000 msecs (cmd 0xe4)
ata4.00: failed to read SCR 0 (Emask=0x4)
ata4.00: failed to recover link after 3 tries, disabling
After that, the root filesystem on the exported RAID volume cannot
be found.
Add JMS562 to the existing JMicron PMP quirk that disables LPM,
avoids softreset on fan-out links, and assumes an ATA device. This
prevents libata from dropping the exported RAID volume during rebuild
recovery.
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ata/libata-pmp.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c
index e2e9cbd405fa0..97f9fe5f5fb02 100644
--- a/drivers/ata/libata-pmp.c
+++ b/drivers/ata/libata-pmp.c
@@ -446,8 +446,13 @@ static void sata_pmp_quirks(struct ata_port *ap)
* otherwise. Don't try hard to recover it.
*/
ap->pmp_link[ap->nr_pmp_links - 1].flags |= ATA_LFLAG_NO_RETRY;
- } else if (vendor == 0x197b && (devid == 0x2352 || devid == 0x0325)) {
+ } else if (vendor == 0x197b &&
+ (devid == 0x0562 || devid == 0x2352 || devid == 0x0325)) {
/*
+ * 0x0562: JMicron JMS562, as used in QNAP QDA-A2AR RAID1
+ * adapters. The exported device may stay not ready
+ * while the array is rebuilding, and SRST/classify can
+ * time out before the RAID volume is exported.
* 0x2352: found in Thermaltake BlackX Duet, jmicron JMB350?
* 0x0325: jmicron JMB394.
*/
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 176/982] platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (174 preceding siblings ...)
2026-09-30 15:15 ` [PATCH 6.1 175/982] ata: libata-pmp: add JMicron JMS562 quirk Greg Kroah-Hartman
@ 2026-09-30 15:15 ` Greg Kroah-Hartman
2026-09-30 15:15 ` [PATCH 6.1 177/982] sctp: Unwind address notifier registration on failure Greg Kroah-Hartman
` (812 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nikolay Metchev, Hans de Goede,
Ilpo Järvinen, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Metchev <nikolaymetchev@gmail.com>
[ Upstream commit c39023ca9a447f09c072080efc84d6874c2275c9 ]
The volume rocker buttons on the HP ProBook x360 440 G1 convertible emit
events 0xc4-0xc7 via the intel-hid ACPI device (INT33D5). These codes are
only present in intel_array_keymap, which is used when the "5 button
array" input device exists. On this machine button_array_present()
returns false because the firmware does not advertise the array through
the HEBC method, so notify_handler() routes the events to a NULL
priv->array and they are dropped as "unknown event 0xc4". As a result
the side volume keys do nothing.
Add the machine to button_array_table so the array device is created and
the volume rocker emits KEY_VOLUMEUP / KEY_VOLUMEDOWN. This is equivalent
to booting with the enable_5_button_array=1 module parameter, which was
used to confirm the fix on the affected hardware.
Signed-off-by: Nikolay Metchev <nikolaymetchev@gmail.com>
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Link: https://patch.msgid.link/20260609213309.445019-1-nikolaymetchev@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/intel/hid.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/platform/x86/intel/hid.c b/drivers/platform/x86/intel/hid.c
index ddf46fceb1c37..a6d4c8e3a78db 100644
--- a/drivers/platform/x86/intel/hid.c
+++ b/drivers/platform/x86/intel/hid.c
@@ -123,6 +123,13 @@ static const struct dmi_system_id button_array_table[] = {
DMI_MATCH(DMI_PRODUCT_NAME, "Surface Go 4"),
},
},
+ {
+ .ident = "HP ProBook x360 440 G1",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "HP"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "HP ProBook x360 440 G1"),
+ },
+ },
{ }
};
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 177/982] sctp: Unwind address notifier registration on failure
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (175 preceding siblings ...)
2026-09-30 15:15 ` [PATCH 6.1 176/982] platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table Greg Kroah-Hartman
@ 2026-09-30 15:15 ` Greg Kroah-Hartman
2026-09-30 15:15 ` [PATCH 6.1 178/982] PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems Greg Kroah-Hartman
` (811 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yuho Choi, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <dbgh9129@gmail.com>
[ Upstream commit c8459ee2fef502d6ef6c063751c33d9ac7943eab ]
sctp_v4_add_protocol() and sctp_v6_add_protocol() register their
address notifiers before registering the SCTP protocol handlers. If
protocol registration fails, the functions return without unregistering
the notifiers.
Unregister the notifiers on the protocol registration failure paths.
Also propagate notifier registration failures instead of ignoring them.
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Link: https://patch.msgid.link/20260608162230.46644-1-dbgh9129@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sctp/ipv6.c | 10 ++++++++--
net/sctp/protocol.c | 10 ++++++++--
2 files changed, 16 insertions(+), 4 deletions(-)
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index be190f5696d88..3b07b9f5d7525 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -1202,11 +1202,17 @@ void sctp_v6_protosw_exit(void)
/* Register with inet6 layer. */
int sctp_v6_add_protocol(void)
{
+ int ret;
+
/* Register notifier for inet6 address additions/deletions. */
- register_inet6addr_notifier(&sctp_inet6addr_notifier);
+ ret = register_inet6addr_notifier(&sctp_inet6addr_notifier);
+ if (ret)
+ return ret;
- if (inet6_add_protocol(&sctpv6_protocol, IPPROTO_SCTP) < 0)
+ if (inet6_add_protocol(&sctpv6_protocol, IPPROTO_SCTP) < 0) {
+ unregister_inet6addr_notifier(&sctp_inet6addr_notifier);
return -EAGAIN;
+ }
return 0;
}
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 9384ff5418d59..c6a5af7560748 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -1269,12 +1269,18 @@ static void sctp_v4_protosw_exit(void)
static int sctp_v4_add_protocol(void)
{
+ int ret;
+
/* Register notifier for inet address additions/deletions. */
- register_inetaddr_notifier(&sctp_inetaddr_notifier);
+ ret = register_inetaddr_notifier(&sctp_inetaddr_notifier);
+ if (ret)
+ return ret;
/* Register SCTP with inet layer. */
- if (inet_add_protocol(&sctp_protocol, IPPROTO_SCTP) < 0)
+ if (inet_add_protocol(&sctp_protocol, IPPROTO_SCTP) < 0) {
+ unregister_inetaddr_notifier(&sctp_inetaddr_notifier);
return -EAGAIN;
+ }
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 178/982] PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (176 preceding siblings ...)
2026-09-30 15:15 ` [PATCH 6.1 177/982] sctp: Unwind address notifier registration on failure Greg Kroah-Hartman
@ 2026-09-30 15:15 ` Greg Kroah-Hartman
2026-09-30 15:15 ` [PATCH 6.1 179/982] dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc Greg Kroah-Hartman
` (810 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jose Ignacio Tornos Martinez,
Bjorn Helgaas, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
[ Upstream commit 6a4f64c3a3ada43e71ef1e06da89beb36bdaeefa ]
Some Qualcomm PCIe devices (WCN6855/WCN7850 WiFi cards, SDX62/SDX65 modems)
do not properly support Secondary Bus Reset (SBR).
Testing confirms this is device-specific, not deployment-specific:
MediaTek MT7925e successfully uses bus reset through the same passive
M.2-to-PCIe adapters where Qualcomm devices fail, proving PERST# is
properly wired through the adapters.
Prevent use of Secondary Bus Reset for these devices.
Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://lore.kernel.org/all/20260609163649.319755-4-jtornosm@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/quirks.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 41779aea9b2bc..a9c5dfdd11a85 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -3673,6 +3673,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003c, quirk_no_bus_reset);
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0033, quirk_no_bus_reset);
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0034, quirk_no_bus_reset);
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003e, quirk_no_bus_reset);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_QCOM, 0x1103, quirk_no_bus_reset); /* WCN6855 */
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_QCOM, 0x1107, quirk_no_bus_reset); /* WCN7850 */
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_QCOM, 0x0308, quirk_no_bus_reset); /* SDX62/SDX65 */
/*
* Root port on some Cavium CN8xxx chips do not successfully complete a bus
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 179/982] dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (177 preceding siblings ...)
2026-09-30 15:15 ` [PATCH 6.1 178/982] PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems Greg Kroah-Hartman
@ 2026-09-30 15:15 ` Greg Kroah-Hartman
2026-09-30 15:15 ` [PATCH 6.1 180/982] hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i Greg Kroah-Hartman
` (809 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tze Yee Ng, Vinod Koul, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tze Yee Ng <tze.yee.ng@altera.com>
[ Upstream commit df0c2dc68770cf43f15df40b184df030b850ea05 ]
The driver only had runtime PM callbacks. If a channel stayed allocated
across system suspend/resume, the runtime usage count could remain
non-zero while hardware state (DMAC_CFG, clocks) was lost, and
axi_dma_runtime_resume() would not run to restore it.
Add system-sleep PM ops that use pm_runtime_force_suspend() and
pm_runtime_force_resume() so suspend/resume reuses the existing
axi_dma_suspend() and axi_dma_resume() paths.
Replace pm_runtime_get() with pm_runtime_resume_and_get() in
dma_chan_alloc_chan_resources() so clocks are enabled before a client
can immediately submit a transfer and touch MMIO.
Signed-off-by: Tze Yee Ng <tze.yee.ng@altera.com>
Link: https://patch.msgid.link/18bf778a3a1cc2f377ef8eb0d1508d8ac6371896.1779688569.git.tze.yee.ng@altera.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
index 46b080941b621..d313db5379f8c 100644
--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
+++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
@@ -464,11 +464,17 @@ static void dw_axi_dma_synchronize(struct dma_chan *dchan)
static int dma_chan_alloc_chan_resources(struct dma_chan *dchan)
{
struct axi_dma_chan *chan = dchan_to_axi_dma_chan(dchan);
+ int ret;
+
+ ret = pm_runtime_resume_and_get(chan->chip->dev);
+ if (ret < 0)
+ return ret;
/* ASSERT: channel is idle */
if (axi_chan_is_hw_enable(chan)) {
dev_err(chan2dev(chan), "%s is non-idle!\n",
axi_chan_name(chan));
+ pm_runtime_put(chan->chip->dev);
return -EBUSY;
}
@@ -479,12 +485,11 @@ static int dma_chan_alloc_chan_resources(struct dma_chan *dchan)
64, 0);
if (!chan->desc_pool) {
dev_err(chan2dev(chan), "No memory for descriptors\n");
+ pm_runtime_put(chan->chip->dev);
return -ENOMEM;
}
dev_vdbg(dchan2dev(dchan), "%s: allocating\n", axi_chan_name(chan));
- pm_runtime_get(chan->chip->dev);
-
return 0;
}
@@ -1548,6 +1553,8 @@ static int dw_remove(struct platform_device *pdev)
}
static const struct dev_pm_ops dw_axi_dma_pm_ops = {
+ SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
+ pm_runtime_force_resume)
SET_RUNTIME_PM_OPS(axi_dma_runtime_suspend, axi_dma_runtime_resume, NULL)
};
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 180/982] hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (178 preceding siblings ...)
2026-09-30 15:15 ` [PATCH 6.1 179/982] dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc Greg Kroah-Hartman
@ 2026-09-30 15:15 ` Greg Kroah-Hartman
2026-09-30 15:15 ` [PATCH 6.1 181/982] spi: xilinx: let transfers timeout in case of no IRQ Greg Kroah-Hartman
` (808 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Potin Lai, Guenter Roeck,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Potin Lai <potin.lai.pt@gmail.com>
[ Upstream commit 83dda7ed185501ba1f8165aeca83ff4a8ef7c263 ]
Swap the high setting and low setting coefficients in the lm25066_coeff
table for LM5064, LM5066, and LM5066i. The coefficients were previously
mapped incorrectly, resulting in inverted current and power scaling.
Additionally, dynamically assign the exponent (R) registers inside the
probe's LM25066_DEV_SETUP_CL check. This ensures that the proper
exponent is applied (e.g., for LM25056, high setting power exponent
is -4, but low setting power exponent is -3).
Signed-off-by: Potin Lai <potin.lai.pt@gmail.com>
Link: https://lore.kernel.org/r/20260611-lm25066-driver-fix-v3-1-9d7d4b4e253d@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/pmbus/lm25066.c | 54 ++++++++++++++++++-----------------
1 file changed, 28 insertions(+), 26 deletions(-)
diff --git a/drivers/hwmon/pmbus/lm25066.c b/drivers/hwmon/pmbus/lm25066.c
index 8fef24a25d728..25b8d9fbb5a1a 100644
--- a/drivers/hwmon/pmbus/lm25066.c
+++ b/drivers/hwmon/pmbus/lm25066.c
@@ -133,23 +133,23 @@ static const struct __coeff lm25066_coeff[][PSC_NUM_CLASSES + 2] = {
.R = -2,
},
[PSC_CURRENT_IN] = {
- .m = 10742,
- .b = 1552,
+ .m = 5456,
+ .b = 2118,
.R = -2,
},
[PSC_CURRENT_IN_L] = {
- .m = 5456,
- .b = 2118,
+ .m = 10742,
+ .b = 1552,
.R = -2,
},
[PSC_POWER] = {
- .m = 1204,
- .b = 8524,
+ .m = 612,
+ .b = 11202,
.R = -3,
},
[PSC_POWER_L] = {
- .m = 612,
- .b = 11202,
+ .m = 1204,
+ .b = 8524,
.R = -3,
},
[PSC_TEMPERATURE] = {
@@ -168,23 +168,23 @@ static const struct __coeff lm25066_coeff[][PSC_NUM_CLASSES + 2] = {
.R = -2,
},
[PSC_CURRENT_IN] = {
- .m = 10753,
- .b = -1200,
+ .m = 5405,
+ .b = -600,
.R = -2,
},
[PSC_CURRENT_IN_L] = {
- .m = 5405,
- .b = -600,
+ .m = 10753,
+ .b = -1200,
.R = -2,
},
[PSC_POWER] = {
- .m = 1204,
- .b = -6000,
+ .m = 605,
+ .b = -8000,
.R = -3,
},
[PSC_POWER_L] = {
- .m = 605,
- .b = -8000,
+ .m = 1204,
+ .b = -6000,
.R = -3,
},
[PSC_TEMPERATURE] = {
@@ -203,23 +203,23 @@ static const struct __coeff lm25066_coeff[][PSC_NUM_CLASSES + 2] = {
.R = -2,
},
[PSC_CURRENT_IN] = {
- .m = 15076,
- .b = -504,
+ .m = 7645,
+ .b = 100,
.R = -2,
},
[PSC_CURRENT_IN_L] = {
- .m = 7645,
- .b = 100,
+ .m = 15076,
+ .b = -504,
.R = -2,
},
[PSC_POWER] = {
- .m = 1701,
- .b = -4000,
+ .m = 861,
+ .b = -965,
.R = -3,
},
[PSC_POWER_L] = {
- .m = 861,
- .b = -965,
+ .m = 1701,
+ .b = -4000,
.R = -3,
},
[PSC_TEMPERATURE] = {
@@ -520,18 +520,20 @@ static int lm25066_probe(struct i2c_client *client)
info->m[PSC_VOLTAGE_OUT] = coeff[PSC_VOLTAGE_OUT].m;
info->b[PSC_VOLTAGE_OUT] = coeff[PSC_VOLTAGE_OUT].b;
info->R[PSC_VOLTAGE_OUT] = coeff[PSC_VOLTAGE_OUT].R;
- info->R[PSC_CURRENT_IN] = coeff[PSC_CURRENT_IN].R;
- info->R[PSC_POWER] = coeff[PSC_POWER].R;
if (config & LM25066_DEV_SETUP_CL) {
info->m[PSC_CURRENT_IN] = coeff[PSC_CURRENT_IN_L].m;
info->b[PSC_CURRENT_IN] = coeff[PSC_CURRENT_IN_L].b;
+ info->R[PSC_CURRENT_IN] = coeff[PSC_CURRENT_IN_L].R;
info->m[PSC_POWER] = coeff[PSC_POWER_L].m;
info->b[PSC_POWER] = coeff[PSC_POWER_L].b;
+ info->R[PSC_POWER] = coeff[PSC_POWER_L].R;
} else {
info->m[PSC_CURRENT_IN] = coeff[PSC_CURRENT_IN].m;
info->b[PSC_CURRENT_IN] = coeff[PSC_CURRENT_IN].b;
+ info->R[PSC_CURRENT_IN] = coeff[PSC_CURRENT_IN].R;
info->m[PSC_POWER] = coeff[PSC_POWER].m;
info->b[PSC_POWER] = coeff[PSC_POWER].b;
+ info->R[PSC_POWER] = coeff[PSC_POWER].R;
}
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 181/982] spi: xilinx: let transfers timeout in case of no IRQ
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (179 preceding siblings ...)
2026-09-30 15:15 ` [PATCH 6.1 180/982] hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i Greg Kroah-Hartman
@ 2026-09-30 15:15 ` Greg Kroah-Hartman
2026-09-30 15:15 ` [PATCH 6.1 182/982] Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV Greg Kroah-Hartman
` (807 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vadim Fedorenko, Michal Simek,
Mark Brown, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vadim Fedorenko <vadim.fedorenko@linux.dev>
[ Upstream commit 0f95264f49ace739d411fd9149e2b3545d741d06 ]
In case of failed HW the driver may not see an interrupt and will stuck
in waiting forever. We can avoid such situation by timing out of
transfers if the interrupt is not seen in a reasonable time.
This problem can be found on unload of ptp_ocp driver for TimeCard which
uses Xilinx SPI AXI and SPI-NOR flash memory. During tear-down process
spi-nor drivers send soft reset command which is not triggering an
interrupt stalling the unload process completely.
Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Acked-by: Michal Simek <michal.simek@amd.com>
Link: https://patch.msgid.link/20260610222843.782337-1-vadim.fedorenko@linux.dev
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-xilinx.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/spi/spi-xilinx.c b/drivers/spi/spi-xilinx.c
index 6551628998926..0c8360d7f39bc 100644
--- a/drivers/spi/spi-xilinx.c
+++ b/drivers/spi/spi-xilinx.c
@@ -283,7 +283,11 @@ static int xilinx_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t)
if (use_irq) {
xspi->write_fn(cr, xspi->regs + XSPI_CR_OFFSET);
- wait_for_completion(&xspi->done);
+ if (!wait_for_completion_timeout(&xspi->done, secs_to_jiffies(1))) {
+ dev_err(&spi->dev, "SPI transfer timed out\n");
+ xspi_init_hw(xspi);
+ return -ETIMEDOUT;
+ }
/* A transmit has just completed. Process received data
* and check for more data to transmit. Always inhibit
* the transmitter while the Isr refills the transmit
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 182/982] Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (180 preceding siblings ...)
2026-09-30 15:15 ` [PATCH 6.1 181/982] spi: xilinx: let transfers timeout in case of no IRQ Greg Kroah-Hartman
@ 2026-09-30 15:15 ` Greg Kroah-Hartman
2026-09-30 15:15 ` [PATCH 6.1 183/982] Bluetooth: btusb: Add support for TP-Link TL-UB250 Greg Kroah-Hartman
` (806 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hrvoje Nuic, Luiz Augusto von Dentz,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hrvoje Nuic <hrvoje.nuic@gmail.com>
[ Upstream commit ce21a5cf3d1fd92b84ea9ad2b7c7240aff2162d2 ]
Add the USB ID for the Mercusys MA530 Bluetooth adapter. The device uses
a Realtek RTL8761BUV controller and works with the existing Realtek setup
path.
The device reports vendor ID 0x2c4e and product ID 0x0115, and loads the
rtl_bt/rtl8761bu_fw.bin firmware successfully with this quirk.
Signed-off-by: Hrvoje Nuic <hrvoje.nuic@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btusb.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index acf58aaa551ef..0e38bf99d572b 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -659,6 +659,8 @@ static const struct usb_device_id blacklist_table[] = {
{ USB_DEVICE(0x2ff8, 0xb011), .driver_info = BTUSB_REALTEK },
/* Additional Realtek 8761BUV Bluetooth devices */
+ { USB_DEVICE(0x2c4e, 0x0115), .driver_info = BTUSB_REALTEK |
+ BTUSB_WIDEBAND_SPEECH },
{ USB_DEVICE(0x2357, 0x0604), .driver_info = BTUSB_REALTEK |
BTUSB_WIDEBAND_SPEECH },
{ USB_DEVICE(0x0b05, 0x190e), .driver_info = BTUSB_REALTEK |
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 183/982] Bluetooth: btusb: Add support for TP-Link TL-UB250
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (181 preceding siblings ...)
2026-09-30 15:15 ` [PATCH 6.1 182/982] Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV Greg Kroah-Hartman
@ 2026-09-30 15:15 ` Greg Kroah-Hartman
2026-09-30 15:15 ` [PATCH 6.1 184/982] Bluetooth: L2CAP: validate connectionless PSM length Greg Kroah-Hartman
` (805 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul Menzel, Cris,
Luiz Augusto von Dentz, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cris <cxs1494089474@gmail.com>
[ Upstream commit ea77debfe443f505a4edbb7f21340a583a8a143f ]
Add USB ID 2357:0607 for TP-Link TL-UB250.
This is a Realtek RTL8761BUV based Bluetooth adapter.
Without this entry the device is picked up by the generic Bluetooth USB
class match and exposes hci0, but the Realtek setup path is not used and
rtl8761bu firmware/config are not loaded.
The controller reports Realtek Semiconductor Corporation as the
manufacturer and LMP subversion 0x8761. With this entry added, btusb
loads rtl_bt/rtl8761bu_fw.bin and rtl_bt/rtl8761bu_config.bin
successfully.
Relevant part of /sys/kernel/debug/usb/devices:
T: Bus=01 Lev=02 Prnt=06 Port=00 Cnt=01 Dev#= 9 Spd=12 MxCh= 0
D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=2357 ProdID=0607 Rev= 2.00
S: Product=TP-Link TL-UB250 Adapter
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
Use the same flags as the existing TP-Link 2357:0604 entry.
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Cris <cxs1494089474@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btusb.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 0e38bf99d572b..795a6b3de900d 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -663,6 +663,8 @@ static const struct usb_device_id blacklist_table[] = {
BTUSB_WIDEBAND_SPEECH },
{ USB_DEVICE(0x2357, 0x0604), .driver_info = BTUSB_REALTEK |
BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x2357, 0x0607), .driver_info = BTUSB_REALTEK |
+ BTUSB_WIDEBAND_SPEECH },
{ USB_DEVICE(0x0b05, 0x190e), .driver_info = BTUSB_REALTEK |
BTUSB_WIDEBAND_SPEECH },
{ USB_DEVICE(0x2550, 0x8761), .driver_info = BTUSB_REALTEK |
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 184/982] Bluetooth: L2CAP: validate connectionless PSM length
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (182 preceding siblings ...)
2026-09-30 15:15 ` [PATCH 6.1 183/982] Bluetooth: btusb: Add support for TP-Link TL-UB250 Greg Kroah-Hartman
@ 2026-09-30 15:15 ` Greg Kroah-Hartman
2026-09-30 15:15 ` [PATCH 6.1 185/982] ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt Greg Kroah-Hartman
` (804 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Samuel Moelius,
Luiz Augusto von Dentz, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Moelius <sam.moelius@trailofbits.com>
[ Upstream commit a40a5f922546b3bd7c094d882b29177db4f2abe0 ]
Connectionless L2CAP frames carry a two-byte PSM at the start of the
payload. l2cap_recv_frame() currently reads that PSM unconditionally
after validating only the outer L2CAP length.
A malformed connectionless frame with a zero- or one-byte payload can
therefore make the parser read beyond the advertised skb payload and use
tailroom bytes as part of the PSM. A VHCI-backed QEMU reproducer
injected a one-byte connectionless payload and reached the unchecked
read.
Reject connectionless frames that cannot contain the PSM before reading
or pulling it. This preserves all valid connectionless frames while
dropping only structurally incomplete packets.
Assisted-by: Codex:gpt-5.5-cyber-preview
Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/l2cap_core.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 836db84816d67..3097ffd654c1e 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -7137,6 +7137,11 @@ static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
break;
case L2CAP_CID_CONN_LESS:
+ if (skb->len < L2CAP_PSMLEN_SIZE) {
+ kfree_skb(skb);
+ break;
+ }
+
psm = get_unaligned((__le16 *) skb->data);
skb_pull(skb, L2CAP_PSMLEN_SIZE);
l2cap_conless_channel(conn, psm, skb);
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 185/982] ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (183 preceding siblings ...)
2026-09-30 15:15 ` [PATCH 6.1 184/982] Bluetooth: L2CAP: validate connectionless PSM length Greg Kroah-Hartman
@ 2026-09-30 15:15 ` Greg Kroah-Hartman
2026-09-30 15:15 ` [PATCH 6.1 186/982] ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence Greg Kroah-Hartman
` (803 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko AI Review, bui duc phuc,
Mark Brown, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: bui duc phuc <phucduc.bui@gmail.com>
[ Upstream commit ee7b5f7b39332febf917f9ebf212842cc9379815 ]
rockchip_pdm_set_fmt() calls pm_runtime_get_sync() before accessing
hardware registers, but ignores its return value.
If the runtime resume fails, the function continues to perform register
accesses while the device state is undefined.
Replace pm_runtime_get_sync() with pm_runtime_resume_and_get() and
return early on failure to avoid unpowered register accesses.
Reported-by: Sashiko AI Review <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260522110302.349421F000E9@smtp.kernel.org/
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Link: https://patch.msgid.link/20260602101608.45137-6-phucduc.bui@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/rockchip/rockchip_pdm.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/sound/soc/rockchip/rockchip_pdm.c b/sound/soc/rockchip/rockchip_pdm.c
index 5b1e47bdc376b..336d0eb0e8b47 100644
--- a/sound/soc/rockchip/rockchip_pdm.c
+++ b/sound/soc/rockchip/rockchip_pdm.c
@@ -322,6 +322,7 @@ static int rockchip_pdm_set_fmt(struct snd_soc_dai *cpu_dai,
{
struct rk_pdm_dev *pdm = to_info(cpu_dai);
unsigned int mask = 0, val = 0;
+ int ret;
mask = PDM_CKP_MSK;
switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
@@ -335,7 +336,10 @@ static int rockchip_pdm_set_fmt(struct snd_soc_dai *cpu_dai,
return -EINVAL;
}
- pm_runtime_get_sync(cpu_dai->dev);
+ ret = pm_runtime_resume_and_get(cpu_dai->dev);
+ if (ret)
+ return ret;
+
regmap_update_bits(pdm->regmap, PDM_CLK_CTRL, mask, val);
pm_runtime_put(cpu_dai->dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 186/982] ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (184 preceding siblings ...)
2026-09-30 15:15 ` [PATCH 6.1 185/982] ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt Greg Kroah-Hartman
@ 2026-09-30 15:15 ` Greg Kroah-Hartman
2026-09-30 15:15 ` [PATCH 6.1 187/982] ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure Greg Kroah-Hartman
` (802 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, bui duc phuc, Mark Brown,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: bui duc phuc <phucduc.bui@gmail.com>
[ Upstream commit 3168721d6ec3b610edf6a3c22ad190722a27d276 ]
Enable the 'hclk' bus clock before the 'clk' controller clock during
runtime resume.
The bus clock provides the register access interface, so enable it before
the controller clock. This also makes the resume sequence the reverse of
the suspend sequence, which keeps the clock ordering consistent.
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Link: https://patch.msgid.link/20260602101608.45137-4-phucduc.bui@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/rockchip/rockchip_pdm.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/sound/soc/rockchip/rockchip_pdm.c b/sound/soc/rockchip/rockchip_pdm.c
index 336d0eb0e8b47..6a412b834b76e 100644
--- a/sound/soc/rockchip/rockchip_pdm.c
+++ b/sound/soc/rockchip/rockchip_pdm.c
@@ -427,16 +427,16 @@ static int rockchip_pdm_runtime_resume(struct device *dev)
struct rk_pdm_dev *pdm = dev_get_drvdata(dev);
int ret;
- ret = clk_prepare_enable(pdm->clk);
+ ret = clk_prepare_enable(pdm->hclk);
if (ret) {
- dev_err(pdm->dev, "clock enable failed %d\n", ret);
+ dev_err(pdm->dev, "hclock enable failed %d\n", ret);
return ret;
}
- ret = clk_prepare_enable(pdm->hclk);
+ ret = clk_prepare_enable(pdm->clk);
if (ret) {
- clk_disable_unprepare(pdm->clk);
- dev_err(pdm->dev, "hclock enable failed %d\n", ret);
+ clk_disable_unprepare(pdm->hclk);
+ dev_err(pdm->dev, "clock enable failed %d\n", ret);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 187/982] ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (185 preceding siblings ...)
2026-09-30 15:15 ` [PATCH 6.1 186/982] ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence Greg Kroah-Hartman
@ 2026-09-30 15:15 ` Greg Kroah-Hartman
2026-09-30 15:15 ` [PATCH 6.1 188/982] sparc64: uprobes: add missing break Greg Kroah-Hartman
` (801 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko AI Review, bui duc phuc,
Mark Brown, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: bui duc phuc <phucduc.bui@gmail.com>
[ Upstream commit 3546e9aa691ac981e4734fedd1646d0180784893 ]
If regcache_sync() fails during runtime resume, the driver disables the
clocks and returns an error. However, the regmap cache-only mode is left
disabled.
Restore cache-only mode in the error path so subsequent register accesses
continue to use the cache while the device is inactive.
Reported-by: Sashiko AI Review <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260522103713.6C09D1F000E9@smtp.kernel.org/
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Link: https://patch.msgid.link/20260602101608.45137-5-phucduc.bui@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/rockchip/rockchip_spdif.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/soc/rockchip/rockchip_spdif.c b/sound/soc/rockchip/rockchip_spdif.c
index 5b4f004575879..d10fbae8d473c 100644
--- a/sound/soc/rockchip/rockchip_spdif.c
+++ b/sound/soc/rockchip/rockchip_spdif.c
@@ -98,6 +98,7 @@ static int __maybe_unused rk_spdif_runtime_resume(struct device *dev)
ret = regcache_sync(spdif->regmap);
if (ret) {
+ regcache_cache_only(spdif->regmap, true);
clk_disable_unprepare(spdif->mclk);
clk_disable_unprepare(spdif->hclk);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 188/982] sparc64: uprobes: add missing break
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (186 preceding siblings ...)
2026-09-30 15:15 ` [PATCH 6.1 187/982] ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure Greg Kroah-Hartman
@ 2026-09-30 15:15 ` Greg Kroah-Hartman
2026-09-30 15:15 ` [PATCH 6.1 189/982] net: stmmac: xgmac2: disable RBUE in default RX interrupt mask Greg Kroah-Hartman
` (800 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rosen Penev,
Masami Hiramatsu (Google), Andreas Larsson, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <rosenp@gmail.com>
[ Upstream commit 5b0eee4cd812bd6547eea393cb9b5c0322f26c88 ]
Missing fallthrough causes failure with newer compilers:
arch/sparc/kernel/uprobes.c:284:2: error: unannotated fall-through between switch labels [-Werror,-Wimplicit-fallthrough]
284 | default:
| ^
arch/sparc/kernel/uprobes.c:284:2: note: insert 'break;' to avoid fall-through
284 | default:
| ^
| break;
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Reviewed-by: Andreas Larsson <andreas@gaisler.com>
Signed-off-by: Andreas Larsson <andreas@gaisler.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/sparc/kernel/uprobes.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/sparc/kernel/uprobes.c b/arch/sparc/kernel/uprobes.c
index 1a0600206bf5c..dbc51dc2bb4f4 100644
--- a/arch/sparc/kernel/uprobes.c
+++ b/arch/sparc/kernel/uprobes.c
@@ -278,6 +278,7 @@ int arch_uprobe_exception_notify(struct notifier_block *self,
case DIE_SSTEP:
if (uprobe_post_sstep_notifier(args->regs))
ret = NOTIFY_STOP;
+ break;
default:
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 189/982] net: stmmac: xgmac2: disable RBUE in default RX interrupt mask
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (187 preceding siblings ...)
2026-09-30 15:15 ` [PATCH 6.1 188/982] sparc64: uprobes: add missing break Greg Kroah-Hartman
@ 2026-09-30 15:15 ` Greg Kroah-Hartman
2026-09-30 15:15 ` [PATCH 6.1 190/982] ptp: ocp: add shutdown callback Greg Kroah-Hartman
` (799 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maxime Chevallier, Nazim Amirul,
Simon Horman, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nazim Amirul <muhammad.nazim.amirul.nazle.asmade@altera.com>
[ Upstream commit d3265c19b35d036bba327b36b5366bee76b0157c ]
Enabling the RX Buffer Unavailable (RBUE) interrupt is counterproductive
and can trigger a MAC interrupt storm under heavy RX pressure. When the
DMA runs out of RX descriptors it fires RBUE continuously until software
refills the ring.
However, RBUE is redundant: the normal RX completion interrupt (RIE)
already triggers NAPI, which processes completed descriptors and refills
the ring, causing the DMA to resume. The RBUE handler itself only sets
handle_rx - the same outcome as RIE.
On Agilex5 under heavy RX pressure, the MAC interrupt (which includes
RBUE) was observed firing 1,821,811,555 times against only 2,618,627
actual RX completions - a ~695x ratio - confirming the severity of the
storm.
RBUE does not provide OOM recovery. If page_pool is exhausted,
stmmac_rx_refill() cannot advance the DMA tail pointer, the DMA stays
suspended, and RBUE fires again on the next NAPI completion - a storm
with no forward progress. This patch trades that storm for a clean
stall with the same RX outcome. Proper OOM recovery is a pre-existing
gap outside the scope of this fix.
Note: as a consequence of disabling RBUE, the rx_buf_unav_irq ethtool
counter will always read 0 on XGMAC2 devices. This behaviour is already
inconsistent across DWMAC core versions.
Remove RBUE from XGMAC_DMA_INT_DEFAULT_EN and XGMAC_DMA_INT_DEFAULT_RX
to prevent the interrupt storm while keeping normal RX handling intact.
Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Signed-off-by: Nazim Amirul <muhammad.nazim.amirul.nazle.asmade@altera.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260609121703.9736-1-muhammad.nazim.amirul.nazle.asmade@altera.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
index 8748c37e9dac9..f9110e6164843 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
@@ -398,9 +398,9 @@
#define XGMAC_RIE BIT(6)
#define XGMAC_TBUE BIT(2)
#define XGMAC_TIE BIT(0)
-#define XGMAC_DMA_INT_DEFAULT_EN (XGMAC_NIE | XGMAC_AIE | XGMAC_RBUE | \
+#define XGMAC_DMA_INT_DEFAULT_EN (XGMAC_NIE | XGMAC_AIE | \
XGMAC_RIE | XGMAC_TIE)
-#define XGMAC_DMA_INT_DEFAULT_RX (XGMAC_RBUE | XGMAC_RIE)
+#define XGMAC_DMA_INT_DEFAULT_RX (XGMAC_RIE)
#define XGMAC_DMA_INT_DEFAULT_TX (XGMAC_TIE)
#define XGMAC_DMA_CH_Rx_WATCHDOG(x) (0x0000313c + (0x80 * (x)))
#define XGMAC_RWT GENMASK(7, 0)
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 190/982] ptp: ocp: add shutdown callback
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (188 preceding siblings ...)
2026-09-30 15:15 ` [PATCH 6.1 189/982] net: stmmac: xgmac2: disable RBUE in default RX interrupt mask Greg Kroah-Hartman
@ 2026-09-30 15:15 ` Greg Kroah-Hartman
2026-09-30 15:15 ` [PATCH 6.1 191/982] vsock: use sk_acceptq_is_full() helper in all transports Greg Kroah-Hartman
` (798 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vadim Fedorenko, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vadim Fedorenko <vadim.fedorenko@linux.dev>
[ Upstream commit f6f955cbf9d4e02deebe54ca91c118b53be9ffe6 ]
The shutdown callback was never implemented for this driver, but it's
needed because .remove() callback is never called during kexec/reboot
process. That leaves HW with some interrupts enabled and may cause
spurious interrupt while booting into a new kernel during with kexec.
If it happens that I2C interrupt fires during kexec, the whole I2C bus
is disabled leaving TimeCard with no devlink communication. The same
happens if timestampers were enabled, leaving the card without
timestamper interrupts until full reboot cycle.
Implement .shutdown() callback with the same function as remove
callback.
Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Link: https://patch.msgid.link/20260611190333.787132-1-vadim.fedorenko@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ptp/ptp_ocp.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/ptp/ptp_ocp.c b/drivers/ptp/ptp_ocp.c
index c4793bb13e3cb..f2332b954bcf0 100644
--- a/drivers/ptp/ptp_ocp.c
+++ b/drivers/ptp/ptp_ocp.c
@@ -3794,6 +3794,7 @@ static struct pci_driver ptp_ocp_driver = {
.id_table = ptp_ocp_pcidev_id,
.probe = ptp_ocp_probe,
.remove = ptp_ocp_remove,
+ .shutdown = ptp_ocp_remove,
};
static int
--
2.53.0
^ permalink raw reply related [flat|nested] 990+ messages in thread
* [PATCH 6.1 191/982] vsock: use sk_acceptq_is_full() helper in all transports
2026-09-30 15:12 [PATCH 6.1 000/982] 6.1.189-rc1 review Greg Kroah-Hartman
` (189 preceding siblings ...)
2026-09-30 15:15 ` [PATCH 6.1 190/982] ptp: ocp: add shutdown callback Greg Kroah-Hartman
@ 2026-09-30 15:15 ` Greg Kroah-Hartman
2026-09-30 15:15 ` [PATCH 6.1 192/982] e1000e: limit endianness conversion to boundary words Greg Kroah-Hartman
` (797 subsequent siblings)
988 siblings, 0 replies; 990+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-30 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stefano Garzarella, Raf Dickson,
Luigi Leonardi, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raf Dickson <rafdog35@gmail.com>
[ Upstream commit 4ff2e84ff1b33d79fa0e3ae355ce4a334908ef9a ]
Replace the open-coded backlog check with sk_acceptq_is_full().
The helper uses > instead of >=, which is the c